Re: [PATCH v3 2/6] mm/migrate_device: Do not write past the end of the src_pfns array

[Matthew Brost]

On Thu, Aug 27, 2026 at 05:05:09PM +0200, David Hildenbrand (Arm) wrote:
> On 8/6/26 01:10, Matthew Brost wrote:
> > migrate_device_range() and migrate_device_pfns() zero the tail entries
> > of a large folio without checking them against @npages:
> > 
> > 	for (j = 1; j < nr; j++)
> > 		src_pfns[i+j] = 0;
> > 
> > @nr comes from the folio, not from the array, so a folio that extends
> > past the end of the range being migrated writes beyond src_pfns[].
> > Callers size that array for @npages entries, so this corrupts whatever
> > follows it.
> > 
> > Bound the loop by @npages. The subsequent "i += j - 1" still terminates
> > the outer loop correctly: on a bounded exit j is @npages - i, leaving i
> > at @npages after the increment.
> > 
> > Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> > Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages")
> > Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> > Cc: David Hildenbrand <david@xxxxxxxxxx>
> > Cc: Lorenzo Stoakes <ljs@xxxxxxxxxx>
> > Cc: Zi Yan <ziy@xxxxxxxxxx>
> > Cc: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>
> > Cc: Liam R. Howlett <liam@xxxxxxxxxxxxx>
> > Cc: Nico Pache <nico.pache@xxxxxxxxx>
> > Cc: Ryan Roberts <ryan.roberts@xxxxxxx>
> > Cc: Dev Jain <dev.jain@xxxxxxx>
> > Cc: Barry Song <baohua@xxxxxxxxxx>
> > Cc: Lance Yang <lance.yang@xxxxxxxxx>
> > Cc: Usama Arif <usama.arif@xxxxxxxxx>
> > Cc: Joshua Hahn <joshua.hahnjy@xxxxxxxxx>
> > Cc: Rakie Kim <rakie.kim@xxxxxx>
> > Cc: Byungchul Park <byungchul@xxxxxx>
> > Cc: Gregory Price <gourry@xxxxxxxxxx>
> > Cc: Ying Huang <ying.huang@xxxxxxxxxxxxxxxxx>
> > Cc: Alistair Popple <apopple@xxxxxxxxxx>
> > Cc: Balbir Singh <balbirs@xxxxxxxxxx>
> > Cc: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx>
> > Cc: Maxime Ripard <mripard@xxxxxxxxxx>
> > Cc: Thomas Zimmermann <tzimmermann@xxxxxxx>
> > Cc: David Airlie <airlied@xxxxxxxxx>
> > Cc: Simona Vetter <simona@xxxxxxxx>
> > Cc: Thomas Hellström <thomas.hellstrom@xxxxxxxxxxxxxxx>
> > Cc: Francois Dugast <francois.dugast@xxxxxxxxx>
> > Cc: dri-devel@xxxxxxxxxxxxxxxxxxxxx
> > Cc: linux-mm@xxxxxxxxx
> > Cc: linux-kernel@xxxxxxxxxxxxxxx
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: GitHub_Copilot:claude-opus-5
> > Signed-off-by: Matthew Brost <matthew.brost@xxxxxxxxx>
> > ---
> >  mm/migrate_device.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> > index 162d29b2807a..ae9027421b80 100644
> > --- a/mm/migrate_device.c
> > +++ b/mm/migrate_device.c
> > @@ -1415,7 +1415,7 @@ int migrate_device_range(unsigned long *src_pfns, unsigned long start,
> >  		nr = folio_nr_pages(folio);
> >  		if (nr > 1) {
> >  			src_pfns[i] |= MIGRATE_PFN_COMPOUND;
> > -			for (j = 1; j < nr; j++)
> > +			for (j = 1; j < nr && (i + j) < npages; j++)
> >  				src_pfns[i+j] = 0;
> >  			i += j - 1;
> >  			pfn += j - 1;
> > @@ -1449,7 +1449,7 @@ int migrate_device_pfns(unsigned long *src_pfns, unsigned long npages)
> >  		nr = folio_nr_pages(folio);
> >  		if (nr > 1) {
> >  			src_pfns[i] |= MIGRATE_PFN_COMPOUND;
> > -			for (j = 1; j < nr; j++)
> > +			for (j = 1; j < nr && (i + j) < npages; j++)
> >  				src_pfns[i+j] = 0;
> >  			i += j - 1;
> >  		}
> 
> What's the status of this? I assume this is fixed by
> 

I don't think Andrew has pulled either of core MM patches in this
series, so we can discuss a bit more. 

> 	https://lore.kernel.org/20260817120758.669807-3-sh_def@xxxxxxx

I think this version plus your suggestion is probably better here - we
likely shouldn't hand back compound pfns which don't overflow the
requested number of pages. Let' continue the discussion there I guess.

Matt

> 
> instead?
> 
> What is the right direction?
> 
> -- 
> Cheers,
> 
> David