[PATCH 0/2] mm/huge_memory: fix move_pages_huge_pmd() for huge zero pages

[Chris Down]

Two fixes for the huge zero page path in move_pages_huge_pmd()
(UFFDIO_MOVE).

Patch 1 fixes a use of NULL folio introduced by the folio_mk_pmd()
conversion in commit e3981db444a0 ("mm: add folio_mk_pmd()").
mk_huge_pmd(src_page, ...) with folio_mk_pmd(src_folio, ...) in the huge
zero page branch where src_folio is explicitly NULL. With
SPARSEMEM_VMEMMAP this silently produces a PMD with a bogus PFN, on
other memory models it is a NULL deref.

Patch 2 adds the missing pmd_mkspecial() call that was omitted when
commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero
folio special") marked huge zero folio PMD mappings as special. Without
it, vm_normal_page_pmd() on CONFIG_ARCH_HAS_PTE_SPECIAL architectures
does not recognise the moved huge zero page as special, incorrectly
treating it as a normal page and corrupting its refcount.

Chris Down (2):
  mm/huge_memory: Fix use of NULL folio in move_pages_huge_pmd()
  mm/huge_memory: Mark moved huge zero page PMD as special

 mm/huge_memory.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

-- 
2.51.2