Re: [PATCH] mm/migrate_device: pin large folios before splitting

[Lance Yang]

On Wed, Jul 01, 2026 at 07:06:38AM -0700, Usama Arif wrote:
>migrate_vma_collect_pmd() can detect a large folio while holding the PTE
>lock, then drop the PTE lock before calling migrate_vma_split_folio(). The
>split helper took its own reference, but only after the lock had already
>been dropped.
>
>One way to hit this is device migration over a range that contains a large
>folio. The walker reads the PTE while holding the PTE lock and derives the
>folio either from a present PTE via vm_normal_page(), or from a non-present
>PTE that encodes a device-private softleaf entry. It then has to drop the
>PTE lock because split_folio() can block. Before migrate_vma_split_folio()
>gets a folio reference, concurrent reclaim, migration, or truncation can
>replace or clear the entry and drop the last reference to the folio. The
>split helper would then take a reference and lock on a stale folio pointer.
>
>Take a temporary reference before dropping the PTE lock and pass that
>reference into migrate_vma_split_folio(). The helper consumes the
>reference, so split_folio() still sees only the expected caller pin instead
>of an extra pin that could make the split fail.

Yeah, that's how it should have been:

lookup under PTL -> get folio ref -> drop PTL.

Getting a ref after dropping PTL feels a bit too optimistic ...

>Reported-by: sashiko-bot <sashiko-bot@xxxxxxxxxx>
>Link: https://sashiko.dev/#/patchset/20260630164143.1595669-1-usama.arif%40linux.dev
>Fixes: 022a12deda53 ("mm/migrate_device: handle partially mapped folios during collection")
>Signed-off-by: Usama Arif <usama.arif@xxxxxxxxx>
>---

Thanks for fixing it! Feel free to add:

Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>