Re: [PATCH v2] mm/migrate_device: avoid out-of-bounds writes for compound folios

[Hui Su <sh_def@163.com>]

On Mon, Sep 07, 2026 at 02:23:33PM +0200, David Hildenbrand (Arm) wrote:
> That's what I was thinking: because how should we partially migrate folios?
> Doesn't make sense :)
>
> If this cannot be triggered today, neither Fixes: nor CC: stable is appropriate.
>
> Agreed that we should just warn.

Hi David, Matthew,

Sorry, I missed this earlier.

This fix has already landed in mainline, but I agree that the API semantics
should be clarified. Partially migrating a compound folio does not make
sense. If the intended contract is that callers must not provide a range
that cuts through a compound folio, then treating such input as caller
misuse with an explicit WARN/error path sounds reasonable.

The reason I added the Fixes tag and Cc'd stable was that I observed an
actual KASAN out-of-bounds write with the HMM migrate_anon_huge_zero
selftest. The path was:

  dmirror_fops_release()
    -> dmirror_device_evict_chunk()
      -> migrate_device_range()

My intent was to prevent migrate_device_range() from writing past the
caller-provided src_pfns array when such an input is observed. That said,
silently stopping the collection is not necessarily the best API semantics
if this should be treated as caller misuse.

I will rerun the reproducer on current mainline and report back with the
result. If the preferred direction is to make this an explicit WARN/error
path instead, I can send a follow-up patch on top of mainline.

Thanks,
Hui