Re: [PATCH] mm/migrate_device: pin large folios before splitting

[Zi Yan]

On 1 Jul 2026, at 10:06, Usama Arif wrote:

> migrate_vma_collect_pmd() can detect a large folio while holding the PTE
> lock, then drop the PTE lock before calling migrate_vma_split_folio(). The
> split helper took its own reference, but only after the lock had already
> been dropped.
>
> One way to hit this is device migration over a range that contains a large
> folio. The walker reads the PTE while holding the PTE lock and derives the
> folio either from a present PTE via vm_normal_page(), or from a non-present
> PTE that encodes a device-private softleaf entry. It then has to drop the
> PTE lock because split_folio() can block. Before migrate_vma_split_folio()
> gets a folio reference, concurrent reclaim, migration, or truncation can
> replace or clear the entry and drop the last reference to the folio. The
> split helper would then take a reference and lock on a stale folio pointer.
>
> Take a temporary reference before dropping the PTE lock and pass that
> reference into migrate_vma_split_folio(). The helper consumes the
> reference, so split_folio() still sees only the expected caller pin instead
> of an extra pin that could make the split fail.
>
> Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
> Link: https://sashiko.dev/#/patchset/20260630164143.1595669-1-usama.arif%40linux.dev
> Fixes: 022a12deda53 ("mm/migrate_device: handle partially mapped folios during collection")
> Signed-off-by: Usama Arif <usama.arif@xxxxxxxxx>
> ---
>  mm/migrate_device.c | 21 ++++++++++++++++++---
>  1 file changed, 18 insertions(+), 3 deletions(-)
>

LGTM. Like David said, the comments might not be needed. Thanks.

Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>

Best Regards,
Yan, Zi