Re: [PATCH v2] mm/migrate_device: avoid out-of-bounds writes for compound folios

[Balbir Singh]

On 8/18/26 4:21 AM, Andrew Morton wrote:
> On Mon, 17 Aug 2026 20:08:00 +0800 Hui Su <sh_def@xxxxxxx> wrote:
> 
>> migrate_device_range() and migrate_device_pfns() clear the entries
>> following a compound folio so that the PFN arrays retain their
>> page-granular representation.
>>
>> If a compound folio extends beyond the end of the caller-provided range,
>> the loops clear all following folio entries without limiting them to the
>> number of slots remaining in the npages-sized array, causing an
>> out-of-bounds write.
>>
>> Do not proceed with a compound folio if its page-granular representation
>> does not fit entirely in the remaining PFN array. If this happens, drop
>> any reference and lock acquired for the folio, clear the remaining
>> entries, and stop collecting.
>>
>> Observed with a KASAN x86 QEMU kernel using the HMM
>> migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after
>> migrating an anonymous huge page to device memory exercises:
>>
>>   dmirror_fops_release()
>>     -> dmirror_device_evict_chunk()
>>       -> migrate_device_range()
> 
> It isn't clear (to me, at least) what "exercises:" means.  Was there a
> WARN?  Did the kernel crash?  Did it erase all my cat videos?
> 
> IOW, in detail, what are the userspace-visible effects of the bug? 
> Please add this info to the changelog and maintain it.
> 
> Sashiko might have found some things.  Some pre-existing, some newly added:
> 	https://sashiko.dev/#/patchset/20260817120758.669807-3-sh_def@xxxxxxx
> 
> 

userspace-visible effects are a function of the usage of the API by the device
driver. If the device driver passes in npages that don't account for PMD pages,
it would be an issue. In the case above, closing the device will evict pages
from the device back to the CPU, but I am surprised that the size of npages was
not properly split, we should fix that as well.

FYI: I've tried reading through Sashiko's report, but there is too much
pre-existing content that it points to and it can be quite time consuming. I am
working on adding new test cases to try and catch some of the issues found

Balbir