From nobody Mon Jun 8 22:00:33 2026 Received: from canpmsgout06.his.huawei.com (canpmsgout06.his.huawei.com [113.46.200.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 770EB3DCDBE; Tue, 26 May 2026 10:19:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.221 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779790795; cv=none; b=C8I2mv/fesaMhuJGuKs1UMyslXllwvf7VHsjCQq4vaciuJpjWELJVAx9ogDUErq2KFGEzCYoPuGrD02ThuRgX+so0Q0utkHlI/Y/cQ7b/wOMufIF9V7ED+GyaXKcEBYMTzPlxyvhoV0KziSUBssSQ0uonLZJnbpIsgXAAuHj7xY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779790795; c=relaxed/simple; bh=3U+q5ULrJTi2zdG1RyDpON1+p6CeGUGXlRzS0kesnxQ=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=o/H4JaQ/MXKkEjL9SWyGPvYUg/UwVqgWfFQYDze8l1BANzurx/9HX9blvUn3q4q6RNWwrJSRU+oOp4MwAj9NRkr+Uw/w8x9mgG70qKlbYnXM1ZHFuX0if7XAyDkJirIhfNmkmMg0sYUCtVuhVu7hDOtrcAx8TtjN72IWXZjJVKc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=yHCTzsco; arc=none smtp.client-ip=113.46.200.221 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="yHCTzsco" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=bop9Gyi7xKPEmIomQDcHYip9MHt4Iri7bj2ujyH/GCk=; b=yHCTzsco6m11SyH4lFMFWyK8v64ozU7zDxY/I5vXuZOijBDSe/IdQ5JdUorgBXwYuoz/DtvH7 xEVojwBKXuv8ekyYtHE2VDjO7oSdPsHWPye/j1K2toKNZKhzIpDGytk7BKTDb4EbQEDAXaopTir UmetOsq7RlIRvrHtJ8PljsY= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout06.his.huawei.com (SkyGuard) with ESMTPS id 4gPpSt1XSrzRhrc; Tue, 26 May 2026 18:11:58 +0800 (CST) Received: from kwepemr500001.china.huawei.com (unknown [7.202.194.229]) by mail.maildlp.com (Postfix) with ESMTPS id DEC5640569; Tue, 26 May 2026 18:19:42 +0800 (CST) Received: from huawei.com (10.50.87.63) by kwepemr500001.china.huawei.com (7.202.194.229) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 26 May 2026 18:19:42 +0800 From: Yin Tirui To: Andrew Morton CC: David Hildenbrand , Lorenzo Stoakes , Zi Yan , Baolin Wang , "Liam R . Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Vlastimil Babka , Yang Shi , , , , , , Subject: [PATCH] mm/huge_memory: update file PMD counter before folio_put() Date: Tue, 26 May 2026 18:13:37 +0800 Message-ID: <20260526101337.1984081-1-yintirui@huawei.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemr500001.china.huawei.com (7.202.194.229) Content-Type: text/plain; charset="utf-8" __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put(). Fixes: fadae2953072 ("thp: use mm_file_counter to determine update which rs= s counter") Cc: Signed-off-by: Yin Tirui Acked-by: David Hildenbrand (arm) Reviewed-by: Dev Jain Reviewed-by: Lance Yang Reviewed-by: Lorenzo Stoakes --- mm/huge_memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 0135c29a4372..a5f4a48b7b77 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3145,7 +3145,9 @@ static void __split_huge_pmd_locked(struct vm_area_st= ruct *vma, pmd_t *pmd, if (!folio_test_referenced(folio) && pmd_young(old_pmd)) folio_set_referenced(folio); folio_remove_rmap_pmd(folio, page, vma); + add_mm_counter(mm, mm_counter_file(folio), -HPAGE_PMD_NR); folio_put(folio); + return; } add_mm_counter(mm, mm_counter_file(folio), -HPAGE_PMD_NR); return; --=20 2.43.0