page_idle_get_folio() speculatively calls folio_test_lru() before folio_try_get(). The folio can get freed and reallocated to a tail page in the meantime. In that case, VM_BUG_ON_PGFLAGS() in const_folio_flags() can be triggered. Remove the speculative call. Also mark the folio_test_lru() check right after folio_try_get() success as no more unlikely. This is a sibling-path bug: damon_get_folio() was copied from this function with the same flawed pattern. Commit d6b8b02a27b3 ("mm/damon/ops-common: call folio_test_lru() after folio_get()") fixed damon_get_folio(), but page_idle_get_folio() was left unfixed. KCSAN (strict mode) confirms the data race on the folio flags: BUG: KCSAN: data-race in ... / percpu_counter_add_batch page_idle_get_folio+0x7a/0x2d0 page_idle_bitmap_read+0xc9/0x220 Signed-off-by: Jiale Yao --- mm/page_idle.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/page_idle.c b/mm/page_idle.c index 9c67cbac2965..29ee18f0e8ce 100644 --- a/mm/page_idle.c +++ b/mm/page_idle.c @@ -40,9 +40,9 @@ static struct folio *page_idle_get_folio(unsigned long pfn) return NULL; folio = page_folio(page); - if (!folio_test_lru(folio) || !folio_try_get(folio)) + if (!folio_try_get(folio)) return NULL; - if (unlikely(page_folio(page) != folio || !folio_test_lru(folio))) { + if (unlikely(page_folio(page) != folio) || !folio_test_lru(folio)) { folio_put(folio); folio = NULL; } -- 2.34.1