linux-kernel - Re: [PATCH] mm/huge_memory: fix override of entry in remove_migration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <0289aa81-a33b-4945-b3e2-5f61d5227bcc@nvidia.com>
Date: Fri, 14 Nov 2025 22:46:02 +1100
From: Balbir Singh <balbirs@...dia.com>
To: "David Hildenbrand (Red Hat)" <david@...nel.org>,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 dri-devel@...ts.freedesktop.org
Cc: Andrew Morton <akpm@...ux-foundation.org>, Zi Yan <ziy@...dia.com>,
 Joshua Hahn <joshua.hahnjy@...il.com>, Rakie Kim <rakie.kim@...com>,
 Byungchul Park <byungchul@...com>, Gregory Price <gourry@...rry.net>,
 Ying Huang <ying.huang@...ux.alibaba.com>,
 Alistair Popple <apopple@...dia.com>, Oscar Salvador <osalvador@...e.de>,
 Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
 Baolin Wang <baolin.wang@...ux.alibaba.com>,
 "Liam R. Howlett" <Liam.Howlett@...cle.com>, Nico Pache <npache@...hat.com>,
 Ryan Roberts <ryan.roberts@....com>, Dev Jain <dev.jain@....com>,
 Barry Song <baohua@...nel.org>, Lyude Paul <lyude@...hat.com>,
 Danilo Krummrich <dakr@...nel.org>, David Airlie <airlied@...il.com>,
 Simona Vetter <simona@...ll.ch>, Ralph Campbell <rcampbell@...dia.com>,
 Mika Penttilä <mpenttil@...hat.com>,
 Matthew Brost <matthew.brost@...el.com>,
 Francois Dugast <francois.dugast@...el.com>
Subject: Re: [PATCH] mm/huge_memory: fix override of entry in
 remove_migration_pmd

On 11/14/25 20:23, David Hildenbrand (Red Hat) wrote:
> On 14.11.25 02:21, Balbir Singh wrote:
>> Recent changes exposed a BUG in remove_migration_pmd() where the
>> migration entry was being overridden when the folio is device private.
>>
>> Use scope local entry for creating the device private pmde. Make the
>> pmde writable if the migration entry is writable by moving the check
>> is_migration_write() prior to creating the device private entry.
>>
>> Cc: Andrew Morton <akpm@...ux-foundation.org>
>> Cc: David Hildenbrand <david@...hat.com>
>> Cc: Zi Yan <ziy@...dia.com>
>> Cc: Joshua Hahn <joshua.hahnjy@...il.com>
>> Cc: Rakie Kim <rakie.kim@...com>
>> Cc: Byungchul Park <byungchul@...com>
>> Cc: Gregory Price <gourry@...rry.net>
>> Cc: Ying Huang <ying.huang@...ux.alibaba.com>
>> Cc: Alistair Popple <apopple@...dia.com>
>> Cc: Oscar Salvador <osalvador@...e.de>
>> Cc: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
>> Cc: Baolin Wang <baolin.wang@...ux.alibaba.com>
>> Cc: "Liam R. Howlett" <Liam.Howlett@...cle.com>
>> Cc: Nico Pache <npache@...hat.com>
>> Cc: Ryan Roberts <ryan.roberts@....com>
>> Cc: Dev Jain <dev.jain@....com>
>> Cc: Barry Song <baohua@...nel.org>
>> Cc: Lyude Paul <lyude@...hat.com>
>> Cc: Danilo Krummrich <dakr@...nel.org>
>> Cc: David Airlie <airlied@...il.com>
>> Cc: Simona Vetter <simona@...ll.ch>
>> Cc: Ralph Campbell <rcampbell@...dia.com>
>> Cc: Mika Penttilä <mpenttil@...hat.com>
>> Cc: Matthew Brost <matthew.brost@...el.com>
>> Cc: Francois Dugast <francois.dugast@...el.com>
>>
>> Signed-off-by: Balbir Singh <balbirs@...dia.com>
>> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
>> ---
>>   mm/huge_memory.c | 7 +++++--
>>   1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>> index 9dda8c48daca..df93768a6e15 100644
>> --- a/mm/huge_memory.c
>> +++ b/mm/huge_memory.c
>> @@ -4698,7 +4698,12 @@ void remove_migration_pmd(struct page_vma_mapped_walk *pvmw, struct page *new)
>>       folio_get(folio);
>>       pmde = folio_mk_pmd(folio, READ_ONCE(vma->vm_page_prot));
>>   +    if (is_writable_migration_entry(entry))
>> +        pmde = pmd_mkwrite(pmde, vma);
>> +
>>       if (folio_is_device_private(folio)) {
>> +        swp_entry_t entry;
>> +
>>           if (pmd_write(pmde))
>>               entry = make_writable_device_private_entry(
>>                               page_to_pfn(new));
>> @@ -4710,8 +4715,6 @@ void remove_migration_pmd(struct page_vma_mapped_walk *pvmw, struct page *new)
>>         if (pmd_swp_soft_dirty(*pvmw->pmd))
>>           pmde = pmd_mksoft_dirty(pmde);
>> -    if (is_writable_migration_entry(entry))
>> -        pmde = pmd_mkwrite(pmde, vma);
>>       if (pmd_swp_uffd_wp(*pvmw->pmd))
>>           pmde = pmd_mkuffd_wp(pmde);
>>       if (!is_migration_entry_young(entry))
> 
> There are more problems here: you cannot call pmd_mksoft_dirty() etc on something that is not a present pmd! We have pmd_swp_mksoft_dirty() and friends for that.
> 
> So you'll have to completely split both paths.
> 

I'll follow the pattern of remove_migration_pte(), where all the device private handling
and that of pte_swp_soft_dirty and pte_swp_mkuffd_wp is done at the every end after
migration processing.

Thanks for the review! That might also take up any softleaf fix-up's required, I'll check

Balbir

Balbir