Re: [PATCH] mm/migrate_device: fix double unlock and remove dead code

Matthew Brost
2026-04-13T23:31:13Z

On Mon, Apr 13, 2026 at 06:39:23PM +0530, Sunny Patel wrote:
> Fix two bugs in device migration paths:
>
> 1) migrate_vma_collect_huge_pmd() calls spin_unlock after
> softleaf_entry_wait_on_locked(), which already releases the ptl.
>
> 2) migrate_vma_insert_huge_pmd_page() has a dead else-if branch and this
> branch is always unreachable.
>
> Signed-off-by: Sunny Patel <nueralspacetech@gmail.com>
> ---
> mm/migrate_device.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index 8079676c8f1f..0e005c26ee88 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -177,7 +177,6 @@ static int migrate_vma_collect_huge_pmd(pmd_t *pmdp, unsigned long start,
>
> if (softleaf_is_migration(entry)) {
> softleaf_entry_wait_on_locked(entry, ptl);
> - spin_unlock(ptl);
> return -EAGAIN;
> }

This entire if statement is dead code, since we bail out and collect a
skip on !softleaf_is_device_private immediately above. I thought we
already had a patch from Davidlohr Bueso 'mm/migrate_device: remove dead
migration entry check in migrate_vma_collect_huge_pmd()' that removed
this whole if statement. I even have an email from Andrew pulling this
patch, but it looks like the code is still present in 7.0.

I found this link via a google search which contains the above patch
too:

https://kernel.googlesource.com/pub/scm/linux/kernel/git/akpm/25-new/+/f405e7bc5d93a541cf11663b2424baf0a03b496f%5E%21/

Look like this change got lost somehow?

Matt

>
> @@ -869,8 +868,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
> if (!is_huge_zero_pmd(*pmdp))
> goto unlock_abort;
> flush = true;
> - } else if (!pmd_none(*pmdp))
> - goto unlock_abort;
> + }
>
> add_mm_counter(vma->vm_mm, MM_ANONPAGES, HPAGE_PMD_NR);
> folio_add_new_anon_rmap(folio, vma, addr, RMAP_EXCLUSIVE);
> --
> 2.43.0
>