On Tue 21 Nov 2017, 17:35, Zi Yan wrote:

On 21 Nov 2017, at 17:12, Andrew Morton wrote:

...

On Mon, 20 Nov 2017 21:18:55 -0500 Zi Yan zi.yan@sent.com wrote:

...

This patch fixes it by only calling prep_transhuge_page() when we are certain that the target page is THP.

What are the user-visible effects of the bug?

By inspecting the code, if called on a non-THP, prep_transhuge_page() will

1. change the value of the mapping of (page + 2), since it is used for THP deferred list;
2. change the lru value of (page + 1), since it is used for THP’s dtor.

Both can lead to data corruption of these two pages.

Pragmatically and from the point of view of the memory_hotplug subsys, the effect is a kernel crash when pages are being migrated during a memory hot remove offline and migration target pages are found in a bad state.

Best, Andrea