Re: [PATCH 08/13] mm/migrate_device: fix ksmd oops on a migrated KSM page

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] mm/migrate_device: disallow migrating KSM folios to coherent
  device memory
--

commit 3977d2303c0d4387359f5f7af29357634f5745a7
Author: Chris Mason <mason@kernel.org>

mm/migrate_device: fix ksmd oops on a migrated KSM page

This commit disallows migrating KSM folios to device private memory in
__migrate_device_pages() so that ksmd does not access non-direct-mapped
device private pages.

> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index 1784765188394..f5fb7f2d616a1 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -1212,6 +1212,15 @@ static void __migrate_device_pages(unsigned long *src_pfns,
>  		}
>  
>  
> +		/*
> +		 * KSM doesn't know not to try to read device private pages, so
> +		 * disallow the combination.
> +		 */
> +		if (folio_is_device_private(newfolio) && folio_test_ksm(folio)) {
> +			src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
> +			goto next;
> +		}
> +
>  		if (folio_is_device_private(newfolio) ||
>  		    folio_is_device_coherent(newfolio)) {
>  			if (mapping) {

[Severity: High]
Should this check also disallow migrating KSM folios when
folio_is_device_coherent(newfolio) is true?

ksm_next_page_pmd_entry() skips all zone device folios:

mm/ksm.c:ksm_next_page_pmd_entry() {
    ...
		if (folio_is_zone_device(folio) || !folio_test_anon(folio))
			continue;
    ...
}

When a KSM folio is migrated to coherent device memory, the next ksmd
scan skips its virtual address and unlinks its rmap_item from
stable_node->hlist while newfolio remains mapped as a KSM folio.  Later
migration back to system RAM replaces the PTE with a migration entry,
but remove_migration_ptes() -> rmap_walk_ksm() can no longer find the
VMA to restore the PTE, leaving a dangling migration entry that causes
the process to loop in page faults.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-mason-migrate-et-al-fixes-v1-0-3d2454362e8d@kernel.org?part=8