Re: [PATCH 1/3] mm/mempolicy: skip device-private PMDs when queueing folios

[Usama Arif <usama.arif@linux.dev>]

On 07/07/2026 21:33, Zi Yan wrote:
> On Tue Jul 7, 2026 at 9:45 AM EDT, Usama Arif wrote:
>> queue_folios_pmd() is called under pmd_trans_huge_lock(), whose
>> pmd_is_huge() check returns true for any non-present, non-none huge
>> PMD - including a device-private swap entry. Passing such a PMD to
>> pmd_folio() extracts garbage bits as a PFN and returns a bogus folio
>> pointer.
>>
>> Potential trigger: an HMM-based GPU driver migrates an anonymous THP
>> folio to device memory via migrate_vma_pages(), leaving a device-private
>> PMD. Userspace then calls mbind(), migrate_pages() or
>> set_mempolicy_home_node() on that range.
>>
>> Skip device-private PMDs, matching how queue_folios_pte_range() skips
>> device-private PTE entries by checking !pte_present().
>>
>> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
>> Link: https://sashiko.dev/#/patchset/20260703173903.3789516-1-usama.arif%40linux.dev?part=6
>> Fixes: 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations")
>> Signed-off-by: Usama Arif <usama.arif@linux.dev>
>> ---
>>  mm/mempolicy.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index 914f81863db5..eda817539c77 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -659,6 +659,8 @@ static void queue_folios_pmd(pmd_t *pmd, struct mm_walk *walk)
>>  		qp->nr_failed++;
>>  		return;
>>  	}
>> +	if (unlikely(pmd_is_device_private_entry(*pmd)))
>> +		return;
> 
> Should it also increase qp->nr_failed like pmd migration entry above?
> It also applies to your "if (unlikely(pmd_is_swap_entry(*pmd)))" in the
> PMD-level swap patchset.

The PTE path only increments nr_failed for migration entries, other non-present
entries, including device-private and swap, are skipped. I kept things aligned
with the PTE path.

> In addition, since pmd_is_huge() returns true for all non-present
> non-none pmds, other softleaf entries should also be excluded here? Oh,
> because there is no PMD level hwpoison or pmd marker.
> 

I think what Joshua recommended in [1] makes sense, I will change the PMD code
to gate on !pmd_present() instead. That keeps migration entry accounting, skips
device-private now, and will also avoid calling pmd_folio() on any future non-present
PMD softleaf such as PMD swap.

[1] https://lore.kernel.org/all/20260707191917.3213033-1-joshua.hahnjy@gmail.com/