From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 875ECC61DB9 for ; Fri, 28 Aug 2026 04:44:53 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3D0246B0088; Fri, 28 Aug 2026 00:44:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3816A6B008A; Fri, 28 Aug 2026 00:44:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 24B686B008C; Fri, 28 Aug 2026 00:44:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id EF1F16B0088 for ; Fri, 28 Aug 2026 00:44:51 -0400 (EDT) Received: from smtpin07.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 6595D80355 for ; Fri, 28 Aug 2026 04:44:51 +0000 (UTC) X-FDA: 85149437982.07.3912127 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) by imf25.hostedemail.com (Postfix) with ESMTP id 2F6FDA0003 for ; Fri, 28 Aug 2026 04:44:46 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=I67BYX2L; spf=pass (imf25.hostedemail.com: domain of matthew.brost@intel.com designates 198.175.65.17 as permitted sender) smtp.mailfrom=matthew.brost@intel.com; dmarc=pass (policy=none) header.from=intel.com; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1787892288; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=kOeBQGZ2GY/BcJazP3JpVZ6EnBFLLM/p6uQi2qrgo3U=; b=2kv9LtMEKc/itN8wRYDhL5SkJ0kOuNA9KKrWKmkcXT3asC6xFy6cqzrYUku/qAZ4AO1krh LxTy0zQD7kb0EgWYon4oCLUXptKf7N3k0cQ7c0j1ujptY5baup9irQisv95g/n65Y80Oef rK0fG8IVYBr3H9vbGB7OmuFK+Mif0Lo= ARC-Seal: i=2; a=rsa-sha256; d=hostedemail.com; s=arc-20220608; cv=fail; t=1787892288; b=7OXh7pX+0Z4QEGoS/kimXoFdJxjjL1meKT08iCKC6IWCB/L/4MDFQzNwhwoz9t7FS/OnK+ 9aarnNaztWKDp2e6W1FoJBOKM0fLSuZ8tWVVggT5JNbbEA7kTOzGMioVlpdoC75ctvKJO6 FXxqughS8xDmXi7K/OjkflQz8dnoc+Y= ARC-Authentication-Results: i=2; imf25.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=I67BYX2L; spf=pass (imf25.hostedemail.com: domain of matthew.brost@intel.com designates 198.175.65.17 as permitted sender) smtp.mailfrom=matthew.brost@intel.com; dmarc=pass (policy=none) header.from=intel.com; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1787892287; x=1819428287; h=date:from:to:cc:subject:message-id:references: in-reply-to:mime-version; bh=LxFzjPAWZOWZ6oTzOAJqkAI5PWq3UG1EvvJtFcmB5s4=; b=I67BYX2LlMask63sP5kye9sYiiUO/QHplM7JrWi4EebYvKzlVpif0BFq QF8kG87ekyg6nDPzAUR+fgUPiy2x+xu7xD7SZ5y0Nycxl0o47lST6XiAh YOLjbf2p80aYTn6iUEDIRuu8yj/x7ABrtNRbtXPbjin3f3OP2N/TBVvMi btpmoVw5CvL5hmiP5u7WzZOx+NqoobutKYQo9w3yAEO1w2+gEstPqAjEz IywunDiVrmNowRcKjs3C4CFZRLY9EUg8eJbjoEZDtTPV/tl7whXrYradm UH0SjmWYVrYkTPdiRKzWVaeGniSZPXytjLQ/2KK3V7p7JJA3qIpGOPovm g==; X-CSE-ConnectionGUID: qzse01szSRK1PApx/wJGlw== X-CSE-MsgGUID: xh4MEY1WRS26Qf6d/8rL1w== X-IronPort-AV: E=McAfee;i="6800,10657,11888"; a="88422383" X-IronPort-AV: E=Sophos;i="6.25,248,1779174000"; d="scan'208";a="88422383" Received: from fmviesa004.fm.intel.com ([10.60.135.144]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Aug 2026 21:44:46 -0700 X-CSE-ConnectionGUID: jLqRRIEUS0urh1cU7VINRQ== X-CSE-MsgGUID: 7FUL7C6tT6SGJMrRzKma9g== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,248,1779174000"; d="scan'208";a="270019534" Received: from fmsmsx903.amr.corp.intel.com ([10.18.126.92]) by fmviesa004.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Aug 2026 21:44:45 -0700 Received: from FMSMSX902.amr.corp.intel.com (10.18.126.91) by fmsmsx903.amr.corp.intel.com (10.18.126.92) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Thu, 27 Aug 2026 21:44:45 -0700 Received: from fmsedg903.ED.cps.intel.com (10.1.192.145) by FMSMSX902.amr.corp.intel.com (10.18.126.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46 via Frontend Transport; Thu, 27 Aug 2026 21:44:45 -0700 Received: from BL0PR03CU003.outbound.protection.outlook.com (52.101.53.63) by edgegateway.intel.com (192.55.55.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Thu, 27 Aug 2026 21:44:44 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=RMgKO6ondq7XF7rMW4IrYyXdRaWopLzdUkg5/yqFnSq5knOBATiwNNdky4xu6ZTjVn85+qKaCohL+dH9032BHeqP8Nkm9RYqm17tGJKnwBDjevpQJLcw66lkcOYNoGRuZHiCqd+Hq4oCuSJsISvDXaAGkr4U0pJ+tpvTFzp7uWcIVk6pyHgWx9B0pgCMuqMXzAtEkjmsIbq7Gx7YCR1OuWFMJ3NCipfhrhf7g+nN9TJ8pEO9gwQymkfp+k4oB90dqAmDqCr2hmA/xNasU7N/fRs8fSMFX/R3B8NrL7qJhvWpt15QzU6bTQtP01nJNIEzpPRHLKkPBtlrBS8dKO9cjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kOeBQGZ2GY/BcJazP3JpVZ6EnBFLLM/p6uQi2qrgo3U=; b=qnT30cfxRtCOz4Y8EUmGqXFCs1YQp08iIfMCHgsqRbazMSGlnJzVrRDpChyaI+544kxzmFBctYyS0/HDQB8A388QTuqG/H2tT3ttDgOucC0IIVfE+DjqMk9dp1WJs7x8EnnpcDGQH2LwRsd4xaMbWg76xaxw/NmTmdJ6pNDBeqhukaq3zh7399k7J1znnT/i9coCo+6MSOZUl3HboL9buPrbkybvJM4Z7ZmyfaiL2bBgm9SotgGbzAb2QcHROsk4mx4c7Gr7iVAA8qJ6gzdhHkNITJgjBSXYQuAnQ2uzn+asQMEqhqGt1lf+7sGduMoNZ+VGasp9UuGff1xIUxof1Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Received: from PH7PR11MB6522.namprd11.prod.outlook.com (2603:10b6:510:212::12) by IA3PPF1805EFE45.namprd11.prod.outlook.com (2603:10b6:20f:fc04::ce) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.10; Fri, 28 Aug 2026 04:44:43 +0000 Received: from PH7PR11MB6522.namprd11.prod.outlook.com ([fe80::e0c5:6cd8:6e67:dc0c]) by PH7PR11MB6522.namprd11.prod.outlook.com ([fe80::e0c5:6cd8:6e67:dc0c%4]) with mapi id 15.21.0360.008; Fri, 28 Aug 2026 04:44:43 +0000 Date: Thu, 27 Aug 2026 21:44:40 -0700 From: Matthew Brost To: "David Hildenbrand (Arm)" CC: Hui Su , , , , , , , , , , , , Subject: Re: [PATCH v2] mm/migrate_device: avoid out-of-bounds writes for compound folios Message-ID: References: <20260817120758.669807-3-sh_def@163.com> <4ead5df7-f000-4087-83e4-13aae036e0b7@kernel.org> Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: <4ead5df7-f000-4087-83e4-13aae036e0b7@kernel.org> X-ClientProxiedBy: SJ0PR05CA0020.namprd05.prod.outlook.com (2603:10b6:a03:33b::25) To PH7PR11MB6522.namprd11.prod.outlook.com (2603:10b6:510:212::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PH7PR11MB6522:EE_|IA3PPF1805EFE45:EE_ X-MS-Office365-Filtering-Correlation-Id: 645b62b1-14c0-4243-f4fd-08df04bf13f8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|7416014|10067099003|6133799003|18002099003|22082099003|4143699003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: tvKIfNBETvlSVAFAxO/zLXePLXgtFeG3MfQJdw7h0R7YVHhupQ15APQw/Zshy0ai2bl/f/uIsTLVYWSQXw7O4/LpQPSsn5JfAFfo7wA8j3DWbmqx77/FUJEoboZEAhMKOCaSIXREnNuArO64/1oEPpQLGGEBGBMyZDnUVGbAPsapB05rKHGKjh9JRE+/hpGs5gG9xiHHsVoIvRPHu9wfCdlzlEHjt6H+205zHiwwX9gIbbsfe15EKi05In+c+LxGaTixEn5fyBAIFFLOhXCkGEtlVkBSBpoj4IV0p3Yqb5SjTbZOEGJHJEIi8/pib4m9pSnMWtmPs5gDQgCr2/PDHe9E+EB8LkUYzlM6aTg7X96NaMr2ksgOJZe1s8znfihyGRfaH6Me93EYWpOU+cU1L19znc2g7dluG5cq3N49+f5I+jUjw29JKpGom7ag6h3uBxiUUS0XohBoMY2hzJZSTzJF4J7lwSRrjgx/b7rFzANeEGcZKB+W16ceLNAShiS5ZqoWrmY7j830e6aThKdXWkw6ZHFiY3fNWWzOrEdMzCCC8Gb4y7kGUZjK2t8FPbZ+IU4OG9Jmjb9I4YnBMtjd0Na8FgDOrZiP8bY4jtpOa9KyWxmjM74gompuXKuHT8X+7Dgv0nHS4Mg76Oe2PvCk1VmX1MJqbKJFbanHN9el3VI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH7PR11MB6522.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(7416014)(10067099003)(6133799003)(18002099003)(22082099003)(4143699003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?M7jIhjkHiiwJ1xMnnQ5CGGwXuxpe4dIINhSHOZVIZWAtEsNt1wFIM3Kx5hXU?= =?us-ascii?Q?kijo1zSyFY50PVxmBiJW0Y5mxau3QbC2PSVX6KMbmxiruUtRP4MvmE8m3o91?= =?us-ascii?Q?1n8BLxGmuevvRv2BPyJuNg8+mvGBy4Xb/pPztPz9JU23xXRoTrWTIsNBXYWX?= =?us-ascii?Q?ICfRsfDQ1C6xW9N0TFID5qjwyRbvTQxks8xhem16Py3EovQM1uUA4QSp/N8I?= =?us-ascii?Q?Y1n4zG69TpUlN2FxxO3+4MDr7FdVAijlo0C70daEtfFxZnR7r1+56NnfCe2+?= =?us-ascii?Q?+UiRS42H13vWZFjwGV9euns4iLXcoeDWagjtli0B0muTiNxnslA4ud9QonX1?= =?us-ascii?Q?C4yP1ba2/UOUwCT7R8ON8k0nh7bFbkojWQkE6NwXbeprkyZkzW8k/HcAl0GR?= =?us-ascii?Q?pEGJbEuvaahZbMv1KNX4EnL8BuomVcNNXJyb/Cpcn7GjKUkyXaSclhD+vh2j?= =?us-ascii?Q?s9j0Wa+V5Q3PYz8D+LMRtN5SbYVz2sSS4VXKkbzyNiLDPuJTcgtmJjRcnz3c?= =?us-ascii?Q?9XaROcmqf4pIx3ais0B5ZaEYK3hSSMvcOdjT9EcbIGEP5dI+50G/yOU+zM0k?= =?us-ascii?Q?m64H7YCm4cGrNAfwA82Y0raOlYrnx1lOyoITfto0u3AINGkXOxaGMlYa9AtX?= =?us-ascii?Q?qCmncii5edo3PX5znGG3pGH2sRWWjccT7xmkEbpKlhGCOTqwMavZSJ0zFYyK?= =?us-ascii?Q?yEF5yKhb76alPbLWpSH7wSFT+9EeA1aXHPdMsB+3BsRxFOdXGTetWz5rQMjZ?= =?us-ascii?Q?6cg4bbjzQlkpFKVVQ4vNg3etR80c7gP4xBHmiekwAYgxbICrn6eCRlifnA5I?= =?us-ascii?Q?DSbJYPO69Py7U0M9Wj7wcBPMrzxSIRo4HsbjmjjFLCBTciPk30zzWdzGd4+q?= =?us-ascii?Q?HD8j6X71+Endic/g7TsB6akbtj/wqZkY8JNlncZ+KJEVMf2DZ9kJev0Bw+y+?= =?us-ascii?Q?6B5/lpcvhZslTdUADZpvypd1LjG3i9jUAbpU/DAM96OGbQkI4L4kcBGkdugc?= =?us-ascii?Q?sBFVx9aNJ9uxzdYfw9J0qO/PPwSQzbIDhpgA57y3ZePSzcVkjk2bVp49JdwK?= =?us-ascii?Q?aTiUq1GGVUqMHz565SS52nhTLkVOacPUxBZvaUQvg6qODmIprFfqw/IRY+UE?= =?us-ascii?Q?RZ2+HPe/6fjtajbLoxr1JpwQC7IgMBHflR8X0aK2/PwwwBE0IxMPfw1vXoWn?= =?us-ascii?Q?bfG8cnW0oopSq1ri0A+C2rEQKDA8jxwdyLZO30O+aKxJTT3/kusPHSijBR8p?= =?us-ascii?Q?oUMhMwnB8nG0tHm7sOueInajEKyF4DSn24xmMKTbHud6Bb1/VIU0uYGyd8B7?= =?us-ascii?Q?G+7BEfOdusu4AXXAQJ7rJokC/q7CGcDwtDSBUIB+T33IkdhpvauMxKkDNv31?= =?us-ascii?Q?znVpmGbKSZIVibNMMqPItIsxWCy6e56fGIRBGud9B/f+e79R0pvFn+V2jol8?= =?us-ascii?Q?Fy5N2VoVBUzK0JYxHTCf4S4I/eq30veq6dw2lDw/TdXD6Y5s5ci1YdjPzzze?= =?us-ascii?Q?Wfo2E4OKRdGhFKeoQjoIRAnfwaf0c1Av5DtgXLDz+ujARY5/DseHya9Smale?= =?us-ascii?Q?mEqjT1K0Fqm02djA6N4GNnPQvRYQ51kuoa37c8p/l9j7UcckAcVI5ZSV3O8w?= =?us-ascii?Q?bH58P2A0E3rTQANgYYhxUcBT81JJFVJQlYcepjoV/gACgYX1uK97iuwEebov?= =?us-ascii?Q?aZPWCRX0EIT+LhZ80bFtapf/NyMOV5wJn169ZpV/MXSEH72ScUQUuEigqCAT?= =?us-ascii?Q?sEI/IEubvw=3D=3D?= X-Exchange-RoutingPolicyChecked: NqE2IzeuYAbuxThHEwi0mRkew5YuQBNZ2zH1vZa6qr0cA06tYvgiinh20zwsezzkLqKrH9eWQwWVpUtpTHSit3y71QLXaHciuJAevOnGOFzZLI/LfcQxqsWjDzbT834X34a4BZF6KsuJR5Ato/EzV7z2tvlSAlNP56+1yrOYy1K6tPya3HnWFfsaSme4PcTw7ljQqQNxTFAJispgyXBi0/GqPaObW0iR2fI4xyUKbo+iR81jCkG0q8UEQec9HiGELIm3saR83DZlFmI/YO1XAZiNVQDcq+ohsLu3R4TbkxXZK39rY3Q3AFpFc53IZ7B36NYg58oWbImiE0B84CcqbQ== X-MS-Exchange-CrossTenant-Network-Message-Id: 645b62b1-14c0-4243-f4fd-08df04bf13f8 X-MS-Exchange-CrossTenant-AuthSource: PH7PR11MB6522.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Aug 2026 04:44:43.2805 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8u8nmbD/lea+26iHzUyMqFZs2E8gYjjcgdLUeKM2tPTyuIoPH4T6yzOsGFNxSv1ePkg6qB/NkuET8IdVtllf+g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA3PPF1805EFE45 X-OriginatorOrg: intel.com X-Stat-Signature: 4ag1z9qs55psxb7dersforiyneekmnbx X-Rspamd-Queue-Id: 2F6FDA0003 X-Rspamd-Server: rspam02 X-Rspam-User: X-HE-Tag: 1787892286-915498 X-HE-Meta: U2FsdGVkX19vPSsbZ3QdR1hIWzhH2AQ0Gf0Ju09XlkX1SJ+5/yPJ9xaBjo+wLe2yP7aMftZe51mZtmWjP5AslA/L9iLHA9lWinmk++P2G5zUHpELwTGf6Lo3Brho5zQDIvU96rTiytMMnWS2PWkNsP0g5WpK2UdFl2wPslTmxfKshZD5XbLzq5XKkQGKN7Y/t8/FCpEFFUa1Xlc5MpfePRzanONNL4DpoefTUxC+E9XX34asBaZBaZC2sH+UQ8hO2hj4/SHzfriVv6HNT0EmnruTfzw5uR64ovs5WSIjyYbI5H7ct3rQ26ZrbNITmNCf6y7kuUHcASRN5OnQCdizcudnAPFIsKWM2FIUD+0fnphRZBRnAqEqjEatqQb0cIvWHCe3G3KHyvip4rjcsl5szRN1G0B5uLSWeZ4Sm/DGtkg5a00NUZHWlE9ZJWA1zluYO+d2CAyk0Gjh1umj+pzNNgrRcRSH1WA2UahtJd+FGFacc96jcOwpu5DEN//52merAiHKs16ymZypiboTSclSaGZrFETPXtgjhDzLJ+CpvLOMrDI7MpqdYbybvmHROPFm+cC+AQOptw673Gx5ll4pznpPaaR9a5lEDfla8riXBvVSC4avFQrNep+y8GwyP57MWwwVITJ84RFLq1h1jCoyywr1mJ6ejD7QyrC6nZ1NRr/C5L+dqHMp4Xc6UuKes3/h+7iOnHelLH3QHNnFn0b07Ium4cTJ8HV6yt7IrHtcXReSRnRT81Kt20qgud1BzEYb/8DckfPoV2zW7hERTvbUoZZeDWgIUXJ7ul5q+ZRskSyHXBmsxOZxKWgN1/LAWOA3eXMppAW6a1WWePmD152FEbyPSGL0JAsjMSvhtFDjWU+/jz0mWWijQrTZYQuT0DvD4zN5t9lPxxhNh4UO+2s2vpjBj/wxc1yW2R/HJXIvkKjTP0lz+9WKE1hF/HzRagFqsWDkThwHYRQ2TT5Ec0f LSopUkH3 E36i2v43l1IzcMX1tjgtC12C2L8N6iaIdLAfTst0UhVcRh949p0CK3VtnXpSp9hkBSdifx8UuYe72L0KiP577A77L2YOg1o17eA/ZsI4T7sLGeT88BxBBUAzRiqIX31rbCwZ8GZSi2QWktwu3+OkcO61stG4cDhsrmvV2nLKuxCOrwFEONIqHy6PIEoHPxSmZovUXGv5RRYdb/tmjwX2+LR0Z7VfypCRrNdSW09lTPwE6T/S7DOmomKQyWXZJX4KXMKtML27dfsGVfDt61MaWqH478tgh1vJbxBxTKyYUx24iMmi8F3JadXl5wmPPD0iJzBdDbpxQvfMR39SuNWp7vQ6TJSt+wqSkunoRaKvDXohGW2+K2wPGAV/DDmY3fmmKjGWUI65FvwOdjBGrAvu4FZtfzsCUx5tyBPo50Pz9rHtevnCPs4kEUzbJ9oJUOQqtd9xb3IihPrZXKj690iUbnGHIqL07UGMTiK2wAp3KhwulaHz9WC8N1cImQv+Hm4KuPrwmiGwO4N7AkLXKUrMUoHqvn5LftuW+fpVpOigiUiBbNX4/uClG3UyfeSApgJa7ny03Kwh7P6uy9PPEj1BEwOIcCqIF/KSYi/J4QucSaDbu5inbqdD1+Kq6xVFW9GS3JrB9cfcdkWq9C4+S0g/Dgw9Y2F93hhEW/aOySAGg9iuDuWE= Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Aug 27, 2026 at 05:14:40PM +0200, David Hildenbrand (Arm) wrote: > On 8/17/26 14:08, Hui Su wrote: > > migrate_device_range() and migrate_device_pfns() clear the entries > > following a compound folio so that the PFN arrays retain their > > page-granular representation. > > > > If a compound folio extends beyond the end of the caller-provided range, > > the loops clear all following folio entries without limiting them to the > > number of slots remaining in the npages-sized array, causing an > > out-of-bounds write. > > > > Do not proceed with a compound folio if its page-granular representation > > does not fit entirely in the remaining PFN array. If this happens, drop > > any reference and lock acquired for the folio, clear the remaining > > entries, and stop collecting. > > > > Observed with a KASAN x86 QEMU kernel using the HMM > > migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after > > migrating an anonymous huge page to device memory exercises: > > > > dmirror_fops_release() > > -> dmirror_device_evict_chunk() > > -> migrate_device_range() > > > > Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages") > > Cc: stable@vger.kernel.org > > Signed-off-by: Hui Su > > --- > > Changes in v2: > > - Do not partially represent a compound folio when it does not fit in > > the remaining PFN array. > > - Drop any reference and lock acquired for that folio, clear the > > remaining entries, and stop collecting, as suggested by Balbir Singh. > > > > v1: https://lore.kernel.org/lkml/20260817074350.442493-2-sh_def@163.com/ > > > > mm/migrate_device.c | 18 ++++++++++++++++++ > > 1 file changed, 18 insertions(+) > > > > diff --git a/mm/migrate_device.c b/mm/migrate_device.c > > index 908d2d4ec43a..69b8d0660bab 100644 > > --- a/mm/migrate_device.c > > +++ b/mm/migrate_device.c > > @@ -1400,6 +1400,15 @@ int migrate_device_range(unsigned long *src_pfns, unsigned long start, > > > > src_pfns[i] = migrate_device_pfn_lock(pfn); > > nr = folio_nr_pages(folio); > > + if (nr > npages - i) { > > + if (src_pfns[i] & MIGRATE_PFN_MIGRATE) { > > + folio_unlock(folio); > > + folio_put(folio); > > + } > > + memset(&src_pfns[i], 0, > > + (npages - i) * sizeof(*src_pfns)); > > + break; > > + } > > if (nr > 1) { > > src_pfns[i] |= MIGRATE_PFN_COMPOUND; > > for (j = 1; j < nr; j++) > > @@ -1434,6 +1443,15 @@ int migrate_device_pfns(unsigned long *src_pfns, unsigned long npages) > > > > src_pfns[i] = migrate_device_pfn_lock(src_pfns[i]); > > nr = folio_nr_pages(folio); > > + if (nr > npages - i) { > > + if (src_pfns[i] & MIGRATE_PFN_MIGRATE) { > > + folio_unlock(folio); > > + folio_put(folio); > > + } > > + memset(&src_pfns[i], 0, > > + (npages - i) * sizeof(*src_pfns)); > > + break; > > + } > > if (nr > 1) { > > src_pfns[i] |= MIGRATE_PFN_COMPOUND; > > for (j = 1; j < nr; j++) > > The code duplication here makes me angry. :) And using a memset on one branch but > not on the other is weird. > > But is this the right fix or rather what > > https://lore.kernel.org/r/20260805231041.3791771-3-matthew.brost@intel.com > I'm not sure my patch is right now that I think about, or if this patch is right, or your suggestion either :). > tried? That fix would also need a cleanup but seems code-wise simpler. A cleanup could look like: > > diff --git a/mm/migrate_device.c b/mm/migrate_device.c > index 762c5cee8fecc..480bf59bc2425 100644 > --- a/mm/migrate_device.c > +++ b/mm/migrate_device.c > @@ -1419,10 +1419,9 @@ int migrate_device_range(unsigned long *src_pfns, unsigned long start, > for (pfn = start, i = 0; i < npages; pfn++, i++) { > struct page *page = pfn_to_page(pfn); > struct folio *folio = page_folio(page); > - unsigned int nr = 1; > + unsigned int nr = min(folio_nr_pages(folio), npages - i); > > src_pfns[i] = migrate_device_pfn_lock(pfn); > - nr = folio_nr_pages(folio); > if (nr > 1) { > src_pfns[i] |= MIGRATE_PFN_COMPOUND; > for (j = 1; j < nr; j++) > @@ -1453,10 +1452,9 @@ int migrate_device_pfns(unsigned long *src_pfns, unsigned long npages) > for (i = 0; i < npages; i++) { > struct page *page = pfn_to_page(src_pfns[i]); > struct folio *folio = page_folio(page); > - unsigned int nr = 1; > + unsigned int nr = min(folio_nr_pages(folio), npages - i); I think the semantics of both these function should be that if a user passes in a PFN array and one of the PFNs exceeds the `npages` limit, that is a misuse of this function and we should unwind and return an error. The caller is providing the PFNs and should therefore know the backing page alignment, so `npages` should always end exactly on a page boundary. The sole caller of migrate_device_pfns function is `drm_gpusvm/pagemap`, which certainly adheres to this requirement. The two callers of migrate_device_range, also seemly adheres to this requirement. Matt > > src_pfns[i] = migrate_device_pfn_lock(src_pfns[i]); > - nr = folio_nr_pages(folio); > if (nr > 1) { > src_pfns[i] |= MIGRATE_PFN_COMPOUND; > for (j = 1; j < nr; j++) > > > And as a further cleanup, we'd better de-duplicate that code and possibly use a > memset for clearing, getting rid of j entirely. > > > > -- > Cheers, > > David