On Tue, Dec 21, 2021 at 10:24:27AM -0800, Yang Shi wrote: > It seems the THP is split during smaps walk. The reproducer does call > MADV_FREE on partial THP which may split the huge page. > > The below fix (untested) should be able to fix it. Did you read the rest of the thread on this? If the page is being migrated, we should still account it ... also, you've changed the refcount, so this: if (page_count(page) == 1) { smaps_page_accumulate(mss, page, size, size << PSS_SHIFT, dirty, locked, true); return; } will never trigger.