Oscar, you might want to double check but AFAICS this is VM_BUG_ON only so in none of our kernels this should blow up. I do not see any other potential security implications.

Yes, we can only blow up on DEBUG_VM, because:

>static inline bool folio_test_hugetlb(struct folio *folio)
>{
>        return folio_test_large(folio) &&
>                test_bit(PG_hugetlb, folio_flags(folio, 1));
>}

>static unsigned long *folio_flags(struct folio *folio, unsigned n)
>{
>        struct page *page = &folio->page;
>
>        VM_BUG_ON_PGFLAGS(PageTail(page), page);
>        VM_BUG_ON_PGFLAGS(n > 0 && !test_bit(PG_head, &page->flags), page);
>        return &page[n].flags;
>}

Basically what happens is that folio_test_large, which checks PG_head returned true, but folio_flags() blows up because by the time we call in, PG_head has vanished, which means that the page has changed throughout the check.

While it is true that we only crash onDEBUG_VM, this fixes a more fundamental issue which is having the check for PageHuge in a deterministic way, so I am leaning towards backporting this anyway, not as a security fix, but as a fix in general.

Unless there are objections.