Re: [PATCH v2] mm/migrate_device: avoid out-of-bounds writes for compound folios

[David Hildenbrand (Arm)]

On 9/9/26 13:20, Hui Su wrote:
> On Mon, Sep 07, 2026 at 02:23:33PM +0200, David Hildenbrand (Arm) wrote:
>> That's what I was thinking: because how should we partially migrate folios?
>> Doesn't make sense :)
>>
>> If this cannot be triggered today, neither Fixes: nor CC: stable is appropriate.
>>
>> Agreed that we should just warn.
> 
> Hi David, Matthew,
> 
> Sorry, I missed this earlier.
> 
> This fix has already landed in mainline, but I agree that the API semantics
> should be clarified. Partially migrating a compound folio does not make
> sense. If the intended contract is that callers must not provide a range
> that cuts through a compound folio, then treating such input as caller
> misuse with an explicit WARN/error path sounds reasonable.
> 
> The reason I added the Fixes tag and Cc'd stable was that I observed an
> actual KASAN out-of-bounds write with the HMM migrate_anon_huge_zero
> selftest. The path was:
> 
>   dmirror_fops_release()
>     -> dmirror_device_evict_chunk()
>       -> migrate_device_range()
> 
> My intent was to prevent migrate_device_range() from writing past the
> caller-provided src_pfns array when such an input is observed. That said,
> silently stopping the collection is not necessarily the best API semantics
> if this should be treated as caller misuse.
> 
> I will rerun the reproducer on current mainline and report back with the
> result. If the preferred direction is to make this an explicit WARN/error
> path instead, I can send a follow-up patch on top of mainline.

Yes, and please clean up the code in any case; the duplication should be avoided.

-- 
Cheers,

David