Re: [PATCH] mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

["David Hildenbrand (Arm)" <david@kernel.org>]

On 7/7/26 03:28, Kefeng Wang wrote:
> 
> 
> On 7/7/2026 2:30 AM, David Hildenbrand (Arm) wrote:
>> On 7/6/26 13:19, Kefeng Wang wrote:
>>> pte_pfn() and pte_dirty() have undefined behaviour when called on a
>>> non-present PTE. In migrate_vma_collect_pmd(), these functions may be
>>> invoked on non-present entries (e.g., swap PTEs), leading to potential
>>
>> Certainly not real swap PTEs, as the previous function handling is
>>
>>     if (!pte_present(pte)) {
>>         ...
>>         if (!softleaf_is_device_private(entry))
>>             goto next;
>>
>> Only device-private entries?
> 
> Yes，device-private entries.
> 
>>
>>
>>> crashes from pte_pfn() or incorrect dirty folio accounting from
>>> pte_dirty(). Fix both by guarding with pte_present() checks.
>>>
>>> Fixes: fd35ca3d12cc ("mm/migrate_device.c: copy pte dirty bit to page")
>>> Fixes: a3589e1d5fe3 ("mm/migrate_device.c: add missing flush_cache_page()")
>>
>> I suspected device-private code, but indeed, these seem to be added afterwards.
>>
>> But a3589e1d5fe3 only moved the flush_cache_page()? So that one seems wrong.
> 
> I couldn't find a more suitable commit, before a3589e1d5fe3, the
> flush_cache_page() only called under anon_exclusive, not a device
> private entry, so there is no issue. This is the reason why I chose
> this commit.

What makes you believe device-private entries wouldn't have PAE set?

This likely goes back to initial support for device-private.

-- 
Cheers,

David