Re: [PATCH v2] mm/migrate_device: avoid out-of-bounds writes for compound folios

[Andrew Morton]

On Mon, 17 Aug 2026 20:08:00 +0800 Hui Su <sh_def@xxxxxxx> wrote:

> migrate_device_range() and migrate_device_pfns() clear the entries
> following a compound folio so that the PFN arrays retain their
> page-granular representation.
> 
> If a compound folio extends beyond the end of the caller-provided range,
> the loops clear all following folio entries without limiting them to the
> number of slots remaining in the npages-sized array, causing an
> out-of-bounds write.
> 
> Do not proceed with a compound folio if its page-granular representation
> does not fit entirely in the remaining PFN array. If this happens, drop
> any reference and lock acquired for the folio, clear the remaining
> entries, and stop collecting.
> 
> Observed with a KASAN x86 QEMU kernel using the HMM
> migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after
> migrating an anonymous huge page to device memory exercises:
> 
>   dmirror_fops_release()
>     -> dmirror_device_evict_chunk()
>       -> migrate_device_range()

It isn't clear (to me, at least) what "exercises:" means.  Was there a
WARN?  Did the kernel crash?  Did it erase all my cat videos?

IOW, in detail, what are the userspace-visible effects of the bug? 
Please add this info to the changelog and maintain it.

Sashiko might have found some things.  Some pre-existing, some newly added:
	https://sashiko.dev/#/patchset/20260817120758.669807-3-sh_def@xxxxxxx