Re: [PATCH] mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

["David Hildenbrand (Arm)" <david@kernel.org>]

On 7/6/26 13:19, Kefeng Wang wrote:
> pte_pfn() and pte_dirty() have undefined behaviour when called on a
> non-present PTE. In migrate_vma_collect_pmd(), these functions may be
> invoked on non-present entries (e.g., swap PTEs), leading to potential

Certainly not real swap PTEs, as the previous function handling is

	if (!pte_present(pte)) {
		...
		if (!softleaf_is_device_private(entry))
			goto next;

Only device-private entries?


> crashes from pte_pfn() or incorrect dirty folio accounting from
> pte_dirty(). Fix both by guarding with pte_present() checks.
> 
> Fixes: fd35ca3d12cc ("mm/migrate_device.c: copy pte dirty bit to page")
> Fixes: a3589e1d5fe3 ("mm/migrate_device.c: add missing flush_cache_page()")

I suspected device-private code, but indeed, these seem to be added afterwards.

But a3589e1d5fe3 only moved the flush_cache_page()? So that one seems wrong.

> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
>  mm/migrate_device.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index 052167f9ad54..6e711381f092 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -411,7 +411,8 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
>  			bool anon_exclusive;
>  			pte_t swp_pte;
>  
> -			flush_cache_page(vma, addr, pte_pfn(pte));
> +			if (pte_present(pte))
> +				flush_cache_page(vma, addr, pte_pfn(pte));
>  			anon_exclusive = folio_test_anon(folio) &&
>  					  PageAnonExclusive(page);
>  			if (anon_exclusive) {
> @@ -432,7 +433,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
>  			migrate->cpages++;
>  
>  			/* Set the dirty flag on the folio now the pte is gone. */
> -			if (pte_dirty(pte))
> +			if (pte_present(pte) && pte_dirty(pte))
>  				folio_mark_dirty(folio);
>  
>  			/* Setup special migration page table entry */

Changes look good.

-- 
Cheers,

David