Re: [PATCH 09/13] mm/migrate_device: fix use-after-free of the anon rmap

[Alistair Popple <apopple@nvidia.com>]

On 2026-11-12 at 05:13 +1100, "Lorenzo Stoakes (ARM)" <ljs@kernel.org> wrote...
> A munmap() of anonymous memory can result in a use-after-free of the
> anonymous rmap if a concurrent device memory migration occurs and the
> migration runs without the mmap_lock held.
> 
> This can occur for a long-term pin of device-coherent memory, or a driver
> evicting its device memory by PFN.
> 
> Consider:
> 
>     eviction                        munmap()
>     ========                        ========
>     migrate_device_range()
>       migrate_device_unmap()
>         try_to_migrate()
>                                     zap the migration entry
>                                     unlink_anon_vmas()
>                                       last VMA: free the anon_vma
>     migrate_device_finalize()
>       remove_migration_ptes()
>         /* locks and walks the freed anon_vma */
> 
> If munmap() runs before try_to_migrate() instead, the folio is no longer
> mapped and gets no migration entry. The walk still runs, and follows the
> stale folio->mapping to the freed anon_vma.
> 
> Resolve this by pinning the anon rmap of each folio which possesses one in
> migrate_device_range(), migrate_device_pfns() and
> migrate_device_coherent_folio() before its PTEs are replaced, and
> unpinning it once the walk is done.

I was going to ask why this wouldn't also be an issue for migrate_vma_setup()
which does something similar. But in that case mmap_lock is held across setup
and finalize which I guess is what saves us there?

> A folio which is no longer mapped cannot be pinned and has no migration
> entries to remove, so skip it rather than migrating it.
> 
> Reported-by: Chris Mason <mason@kernel.org>
> Fixes: e778406b40db ("mm/migrate_device.c: add migrate_device_range()")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> ---
>  include/linux/migrate.h |  1 +
>  mm/migrate_device.c     | 39 ++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 39 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/migrate.h b/include/linux/migrate.h
> index 78424b3824c2..c6cce7925b9b 100644
> --- a/include/linux/migrate.h
> +++ b/include/linux/migrate.h
> @@ -136,6 +136,7 @@ static inline int migrate_misplaced_folio(struct folio *folio, int node)
>  #define MIGRATE_PFN_MIGRATE	(1UL << 1)
>  #define MIGRATE_PFN_WRITE	(1UL << 3)
>  #define MIGRATE_PFN_COMPOUND	(1UL << 4)
> +#define MIGRATE_PFN_ANON_RMAP	(1UL << 5)	/* mm internal */
>  #define MIGRATE_PFN_SHIFT	6
>  
>  static inline struct page *migrate_pfn_to_page(unsigned long mpfn)
> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index 7ebd02ec303b..5fe11dd01291 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -552,6 +552,27 @@ static bool migrate_vma_check_page(struct page *page, struct page *fault_page)
>  	return true;
>  }
>  
> +/*
> + * Pin the anonymous rmap if present to allow migration entries to be safely
> + * removed. Returns true if the pin succeeded or no pin is required, and false
> + * if the folio is no longer mapped.
> + */
> +static bool pin_anon_rmap(struct folio *folio, unsigned long *src_pfn)
> +{
> +	if (!folio_test_anon(folio) || folio_test_ksm(folio))
> +		return true;
> +	if (!folio_get_anon_vma(folio)) /* Pin the anon rmap. */
> +		return false;
> +	*src_pfn |= MIGRATE_PFN_ANON_RMAP;
> +	return true;
> +}
> +
> +static void unpin_anon_rmap(struct folio *folio, unsigned long src_pfn)
> +{
> +	if (src_pfn & MIGRATE_PFN_ANON_RMAP)
> +		put_anon_vma(folio_anon_vma(folio)); /* Unpin the anon rmap. */
> +}
> +
>  /*
>   * Unmaps pages for migration. Returns number of source pfns marked as
>   * migrating.
> @@ -633,6 +654,7 @@ static unsigned long migrate_device_unmap(unsigned long *src_pfns,
>  
>  		folio = page_folio(page);
>  		remove_migration_ptes(folio, folio, 0);
> +		unpin_anon_rmap(folio, src_pfns[i]);
>  
>  		src_pfns[i] = 0;
>  		if (fault_folio != folio)
> @@ -1335,6 +1357,7 @@ static void __migrate_device_finalize(unsigned long *src_pfns,
>  		if (!folio_is_zone_device(dst))
>  			folio_add_lru(dst);
>  		remove_migration_ptes(src, dst, 0);
> +		unpin_anon_rmap(src, src_pfns[i]);
>  		if (fault_folio != src)
>  			folio_unlock(src);
>  		folio_put(src);
> @@ -1384,6 +1407,7 @@ EXPORT_SYMBOL(migrate_vma_finalize);
>  
>  static unsigned long migrate_device_pfn_lock(unsigned long pfn)
>  {
> +	unsigned long src_pfn = migrate_pfn(pfn) | MIGRATE_PFN_MIGRATE;
>  	struct folio *folio;
>  
>  	folio = folio_get_nontail_page(pfn_to_page(pfn));
> @@ -1395,7 +1419,13 @@ static unsigned long migrate_device_pfn_lock(unsigned long pfn)
>  		return 0;
>  	}
>  
> -	return migrate_pfn(pfn) | MIGRATE_PFN_MIGRATE;
> +	if (!pin_anon_rmap(folio, &src_pfn)) {
> +		folio_unlock(folio);
> +		folio_put(folio);
> +		return 0;
> +	}
> +
> +	return src_pfn;
>  }
>  
>  /**
> @@ -1431,6 +1461,7 @@ int migrate_device_range(unsigned long *src_pfns, unsigned long start,
>  		nr = folio_nr_pages(folio);
>  		if (nr > npages - i) {
>  			if (src_pfns[i] & MIGRATE_PFN_MIGRATE) {
> +				unpin_anon_rmap(folio, src_pfns[i]);
>  				folio_unlock(folio);
>  				folio_put(folio);
>  			}
> @@ -1474,6 +1505,7 @@ int migrate_device_pfns(unsigned long *src_pfns, unsigned long npages)
>  		nr = folio_nr_pages(folio);
>  		if (nr > npages - i) {
>  			if (src_pfns[i] & MIGRATE_PFN_MIGRATE) {
> +				unpin_anon_rmap(folio, src_pfns[i]);
>  				folio_unlock(folio);
>  				folio_put(folio);
>  			}
> @@ -1509,6 +1541,11 @@ int migrate_device_coherent_folio(struct folio *folio)
>  
>  	folio_lock(folio);
>  	src_pfn = migrate_pfn(folio_pfn(folio)) | MIGRATE_PFN_MIGRATE;
> +	if (!pin_anon_rmap(folio, &src_pfn)) {
> +		folio_unlock(folio);
> +		folio_put(folio);
> +		return -EBUSY;
> +	}
>  
>  	/*
>  	 * We don't have a VMA and don't need to walk the page tables to find
> 
> -- 
> 2.56.0
>