Re: [PATCH] mm/migrate_device: pin large folios before splitting

[Usama Arif <usama.arif@linux.dev>]

On 01/07/2026 15:06, Usama Arif wrote:
> migrate_vma_collect_pmd() can detect a large folio while holding the PTE
> lock, then drop the PTE lock before calling migrate_vma_split_folio(). The
> split helper took its own reference, but only after the lock had already
> been dropped.
> 
> One way to hit this is device migration over a range that contains a large
> folio. The walker reads the PTE while holding the PTE lock and derives the
> folio either from a present PTE via vm_normal_page(), or from a non-present
> PTE that encodes a device-private softleaf entry. It then has to drop the
> PTE lock because split_folio() can block. Before migrate_vma_split_folio()
> gets a folio reference, concurrent reclaim, migration, or truncation can
> replace or clear the entry and drop the last reference to the folio. The
> split helper would then take a reference and lock on a stale folio pointer.
> 
> Take a temporary reference before dropping the PTE lock and pass that
> reference into migrate_vma_split_folio(). The helper consumes the
> reference, so split_folio() still sees only the expected caller pin instead
> of an extra pin that could make the split fail.
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20260630164143.1595669-1-usama.arif%40linux.dev
> Fixes: 022a12deda53 ("mm/migrate_device: handle partially mapped folios during collection")
> Signed-off-by: Usama Arif <usama.arif@linux.dev>
> ---
>  mm/migrate_device.c | 21 ++++++++++++++++++---
>  1 file changed, 18 insertions(+), 3 deletions(-)
> 
Hi Andrew!

Could you apply the below fixlet to condense the comment as per Davids', Alistairs' and Zis'
suggestion? I can send a v2 if its easier as well. Thanks!


From 022bfeb9573f745cc1d93468d1cc123cf6507581 Mon Sep 17 00:00:00 2001
From: Usama Arif <usama.arif@linux.dev>
Date: Wed, 1 Jul 2026 11:12:54 -0700
Subject: [fixup] condense comment about folio reference

Signed-off-by: Usama Arif <usama.arif@linux.dev>
---
 mm/migrate_device.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index f5a5f699e98e..052167f9ad54 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -311,11 +311,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
 			if (folio_test_large(folio)) {
 				int ret;
 
-				/*
-				 * Keep the folio stable after dropping the PTE
-				 * lock. migrate_vma_split_folio() consumes this
-				 * reference.
-				 */
+				/* migrate_vma_split_folio() consumes this reference */
 				if (folio != fault_folio)
 					folio_get(folio);
 				lazy_mmu_mode_disable();
@@ -361,11 +357,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
 			if (folio && folio_test_large(folio)) {
 				int ret;
 
-				/*
-				 * Keep the folio stable after dropping the
-				 * PTE lock. migrate_vma_split_folio() consumes
-				 * this reference.
-				 */
+				/* migrate_vma_split_folio() consumes this reference */
 				if (folio != fault_folio)
 					folio_get(folio);
 				lazy_mmu_mode_disable();
-- 
2.53.0-Meta