[PATCH v2] mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

[PATCH v2] mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

[Kefeng Wang]

pte_pfn() and pte_dirty() have undefined behaviour when called on a
non-present PTE. In migrate_vma_collect_pmd(), these functions may be
invoked on non-present entries (e.g., device-private entries), leading
to potential crashes from pte_pfn() or incorrect dirty folio accounting
from pte_dirty(). Fix both by guarding with pte_present() checks.

Fixes: fd35ca3d12cc ("mm/migrate_device.c: copy pte dirty bit to page")
Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive")
Cc: <stable@vger.kernel.org>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
v2:
- correct changelog and Fixes tags, suggested by David.
- cc stable, suggested by Andrew.

 mm/migrate_device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index 052167f9ad54..6e711381f092 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -411,7 +411,8 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
 			bool anon_exclusive;
 			pte_t swp_pte;
 
-			flush_cache_page(vma, addr, pte_pfn(pte));
+			if (pte_present(pte))
+				flush_cache_page(vma, addr, pte_pfn(pte));
 			anon_exclusive = folio_test_anon(folio) &&
 					  PageAnonExclusive(page);
 			if (anon_exclusive) {
@@ -432,7 +433,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
 			migrate->cpages++;
 
 			/* Set the dirty flag on the folio now the pte is gone. */
-			if (pte_dirty(pte))
+			if (pte_present(pte) && pte_dirty(pte))
 				folio_mark_dirty(folio);
 
 			/* Setup special migration page table entry */
-- 
2.27.0

Re: [PATCH v2] mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

[Balbir Singh]

On Wed, Jul 08, 2026 at 08:39:55AM +0800, Kefeng Wang wrote:
> pte_pfn() and pte_dirty() have undefined behaviour when called on a
> non-present PTE. In migrate_vma_collect_pmd(), these functions may be
> invoked on non-present entries (e.g., device-private entries), leading
> to potential crashes from pte_pfn() or incorrect dirty folio accounting
> from pte_dirty(). Fix both by guarding with pte_present() checks.
> 
> Fixes: fd35ca3d12cc ("mm/migrate_device.c: copy pte dirty bit to page")
> Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
> v2:
> - correct changelog and Fixes tags, suggested by David.
> - cc stable, suggested by Andrew.
> 
>  mm/migrate_device.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index 052167f9ad54..6e711381f092 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -411,7 +411,8 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
>  			bool anon_exclusive;
>  			pte_t swp_pte;
>  
> -			flush_cache_page(vma, addr, pte_pfn(pte));
> +			if (pte_present(pte))
> +				flush_cache_page(vma, addr, pte_pfn(pte));
>  			anon_exclusive = folio_test_anon(folio) &&
>  					  PageAnonExclusive(page);
>  			if (anon_exclusive) {
> @@ -432,7 +433,7 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
>  			migrate->cpages++;
>  
>  			/* Set the dirty flag on the folio now the pte is gone. */
> -			if (pte_dirty(pte))
> +			if (pte_present(pte) && pte_dirty(pte))
>  				folio_mark_dirty(folio);
>  
>  			/* Setup special migration page table entry */
> -- 

Makes sense, thanks!

Reviewed-by: Balbir Singh <balbirs@nvidia.com>

Re: [PATCH v2] mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

[Zi Yan]

On Tue Jul 7, 2026 at 8:39 PM EDT, Kefeng Wang wrote:
> pte_pfn() and pte_dirty() have undefined behaviour when called on a
> non-present PTE. In migrate_vma_collect_pmd(), these functions may be
> invoked on non-present entries (e.g., device-private entries), leading
> to potential crashes from pte_pfn() or incorrect dirty folio accounting
> from pte_dirty(). Fix both by guarding with pte_present() checks.
>
> Fixes: fd35ca3d12cc ("mm/migrate_device.c: copy pte dirty bit to page")
> Fixes: 6c287605fd56 ("mm: remember exclusively mapped anonymous pages with PG_anon_exclusive")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> ---
> v2:
> - correct changelog and Fixes tags, suggested by David.
> - cc stable, suggested by Andrew.
>
>  mm/migrate_device.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
Acked-by: Zi Yan <ziy@nvidia.com>

-- 
Best Regards,
Yan, Zi