[PATCH v2 1/5] mm/migrate_device: Clear MIGRATE_PFN_MIGRATE on all sub-folios of a split THP

[Matthew Brost]

migrate_vma_split_unmapped_folio() propagates MIGRATE_PFN_MIGRATE from
the head entry to all HPAGE_PMD_NR entries of src_pfns[]. The two
bailouts below it in __migrate_device_pages() only cleared the head, and
the "next" label then advances by @nr, so the tails keep the flag and a
valid destination without ever going through folio_migrate_mapping().
migrate_vma_finalize() then maps unpopulated destination folios into
userspace.

Clear the flag across the whole @nr range at both bailouts.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Fixes: 4265d67e405a ("mm/migrate_device: add THP splitting during migration")
Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Cc: David Hildenbrand <david@xxxxxxxxxx>
Cc: Lorenzo Stoakes <ljs@xxxxxxxxxx>
Cc: Zi Yan <ziy@xxxxxxxxxx>
Cc: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>
Cc: Liam R. Howlett <liam@xxxxxxxxxxxxx>
Cc: Nico Pache <nico.pache@xxxxxxxxx>
Cc: Ryan Roberts <ryan.roberts@xxxxxxx>
Cc: Dev Jain <dev.jain@xxxxxxx>
Cc: Barry Song <baohua@xxxxxxxxxx>
Cc: Lance Yang <lance.yang@xxxxxxxxx>
Cc: Usama Arif <usama.arif@xxxxxxxxx>
Cc: Joshua Hahn <joshua.hahnjy@xxxxxxxxx>
Cc: Rakie Kim <rakie.kim@xxxxxx>
Cc: Byungchul Park <byungchul@xxxxxx>
Cc: Gregory Price <gourry@xxxxxxxxxx>
Cc: Ying Huang <ying.huang@xxxxxxxxxxxxxxxxx>
Cc: Alistair Popple <apopple@xxxxxxxxxx>
Cc: Balbir Singh <balbirs@xxxxxxxxxx>
Cc: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx>
Cc: Maxime Ripard <mripard@xxxxxxxxxx>
Cc: Thomas Zimmermann <tzimmermann@xxxxxxx>
Cc: David Airlie <airlied@xxxxxxxxx>
Cc: Simona Vetter <simona@xxxxxxxx>
Cc: Thomas Hellström <thomas.hellstrom@xxxxxxxxxxxxxxx>
Cc: Francois Dugast <francois.dugast@xxxxxxxxx>
Cc: dri-devel@xxxxxxxxxxxxxxxxxxxxx
Cc: linux-mm@xxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: GitHub_Copilot:claude-opus-5
Signed-off-by: Matthew Brost <matthew.brost@xxxxxxxxx>
---
 mm/migrate_device.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index 908d2d4ec43a..d37a96cc6335 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -1199,10 +1199,14 @@ static void __migrate_device_pages(unsigned long *src_pfns,
 				 * device private or coherent memory.
 				 *
 				 * Try to get rid of swap cache if possible.
+				 *
+				 * @folio may have been split into @nr folios
+				 * above, so clear all of them.
 				 */
 				if (!folio_test_anon(folio) ||
 				    !folio_free_swap(folio)) {
-					src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
+					for (j = 0; j < nr && i + j < npages; j++)
+						src_pfns[i+j] &= ~MIGRATE_PFN_MIGRATE;
 					goto next;
 				}
 			}
@@ -1210,7 +1214,8 @@ static void __migrate_device_pages(unsigned long *src_pfns,
 			/*
 			 * Other types of ZONE_DEVICE page are not supported.
 			 */
-			src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
+			for (j = 0; j < nr && i + j < npages; j++)
+				src_pfns[i+j] &= ~MIGRATE_PFN_MIGRATE;
 			goto next;
 		}
 
-- 
2.34.1