z3fold_page_migration() calls memcpy(new_zhdr, zhdr, PAGE_SIZE). However, zhdr contains fields that can't be directly coppied over (ex: list_head, a circular linked list). We only need to initialize the linked lists in new_zhdr, as z3fold_isolate_page() already ensures that these lists are empty Additionally it is possible that zhdr->work has been placed in a workqueue. In this case we shouldn't migrate the page, as zhdr->work references zhdr as opposed to new_zhdr. Fixes: bba4c5f96ce4 ("mm/z3fold.c: support page migration") Signed-off-by: Henry Burns <henryburns@xxxxxxxxxx> --- Changelog since v1: - Made comments explicityly refer to new_zhdr->buddy. mm/z3fold.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/mm/z3fold.c b/mm/z3fold.c index 42ef9955117c..f4b2283b19a3 100644 --- a/mm/z3fold.c +++ b/mm/z3fold.c @@ -1352,12 +1352,22 @@ static int z3fold_page_migrate(struct address_space *mapping, struct page *newpa z3fold_page_unlock(zhdr); return -EBUSY; } + if (work_pending(&zhdr->work)) { + z3fold_page_unlock(zhdr); + return -EAGAIN; + } new_zhdr = page_address(newpage); memcpy(new_zhdr, zhdr, PAGE_SIZE); newpage->private = page->private; page->private = 0; z3fold_page_unlock(zhdr); spin_lock_init(&new_zhdr->page_lock); + INIT_WORK(&new_zhdr->work, compact_page_work); + /* + * z3fold_page_isolate() ensures that new_zhdr->buddy is empty, + * so we only have to reinitialize it. + */ + INIT_LIST_HEAD(&new_zhdr->buddy); new_mapping = page_mapping(page); __ClearPageMovable(page); ClearPagePrivate(page); -- 2.22.0.510.g264f2c817a-goog