Re: [syzbot] kernel BUG in __page_mapcount

[Yang Shi]

On Tue, Dec 21, 2021 at 10:40 AM Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote:
>
> On Tue, Dec 21, 2021 at 10:24:27AM -0800, Yang Shi wrote:
> > It seems the THP is split during smaps walk. The reproducer does call
> > MADV_FREE on partial THP which may split the huge page.
> >
> > The below fix (untested) should be able to fix it.
>
> Did you read the rest of the thread on this?  If the page is being

I just revisited this. Now I see what you mean about "the rest of the
thread". My gmail client doesn't put them in the same thread, sigh...

Yeah, try_get_compound_head() seems like the right way.

Or we just simply treat migration entries as mapcount == 1 as Kirill
suggested or just skip migration entries since they are transient or
show migration entries separately.


> migrated, we should still account it ... also, you've changed the
> refcount, so this:
>
>         if (page_count(page) == 1) {
>                 smaps_page_accumulate(mss, page, size, size << PSS_SHIFT, dirty,
>                         locked, true);
>                 return;
>         }
>
> will never trigger.