Miaohe Lin <linmiaohe@xxxxxxxxxx> writes:
> When follow_page peeks a page, the page could be migrated and then be
> offlined while it's still being used by the do_pages_stat_array().
> Use FOLL_GET to hold the page refcnt to fix this potential race.
>
> Signed-off-by: Miaohe Lin <linmiaohe@xxxxxxxxxx>
Acked-by: "Huang, Ying" <ying.huang@xxxxxxxxx>
> ---
> mm/migrate.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/mm/migrate.c b/mm/migrate.c
> index dbd91fbdb127..cd85ba0ab592 100644
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -1807,13 +1807,18 @@ static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
> goto set_status;
>
> /* FOLL_DUMP to ignore special (like zero) pages */
> - page = follow_page(vma, addr, FOLL_DUMP);
> + page = follow_page(vma, addr, FOLL_GET | FOLL_DUMP);
>
> err = PTR_ERR(page);
> if (IS_ERR(page))
> goto set_status;
>
> - err = page ? page_to_nid(page) : -ENOENT;
> + if (page) {
> + err = page_to_nid(page);
> + put_page(page);
> + } else {
> + err = -ENOENT;
> + }
> set_status:
> *status = err;
