Re: [PATCH 09/13] mm/migrate_device: fix use-after-free of the anon rmap

[Lorenzo Stoakes (ARM)]

On Thu, Nov 12, 2026 at 01:11:36PM -0500, Gregory Price (Meta) wrote:
> On 2026-11-11 18:13 +0000, Lorenzo Stoakes (ARM) wrote:
> > A munmap() of anonymous memory can result in a use-after-free of the
> > anonymous rmap if a concurrent device memory migration occurs and the
> > migration runs without the mmap_lock held.
> >
> > This can occur for a long-term pin of device-coherent memory, or a driver
> > evicting its device memory by PFN.
> >
> > Consider:
> >
> >     eviction                        munmap()
> >     ========                        ========
> >     migrate_device_range()
> >       migrate_device_unmap()
> >         try_to_migrate()
> >                                     zap the migration entry
> >                                     unlink_anon_vmas()
> >                                       last VMA: free the anon_vma
> >     migrate_device_finalize()
> >       remove_migration_ptes()
> >         /* locks and walks the freed anon_vma */
> >
> > If munmap() runs before try_to_migrate() instead, the folio is no longer
> > mapped and gets no migration entry. The walk still runs, and follows the
> > stale folio->mapping to the freed anon_vma.
> >
> > Resolve this by pinning the anon rmap of each folio which possesses one in
> > migrate_device_range(), migrate_device_pfns() and
> > migrate_device_coherent_folio() before its PTEs are replaced, and
> > unpinning it once the walk is done.
> >
> > A folio which is no longer mapped cannot be pinned and has no migration
> > entries to remove, so skip it rather than migrating it.
> >
> > Reported-by: Chris Mason <mason@xxxxxxxxxx>
> > Fixes: e778406b40db ("mm/migrate_device.c: add migrate_device_range()")
> > Cc: <stable@xxxxxxxxxxxxxxx>
> > Signed-off-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
>
> Was able to reproduce/observe a slab-UAF in rmap_walk_anon with KASAN
> enabled, and that this patch resolves it.

Great thanks! I guess you have some mega-schlopped setup for triggering testing
like this? (Meant in a complimentary way in this case :P)

>
> Can't say i understand the change well enough to R-by, but I can say
> this resolves a clear bug.

A-b is often the way for that ;) but I don't want to be greedy here :P

>
> Tested-by: Gregory Price (Meta) <gourry@xxxxxxxxxx>

Thanks! :)

--
Cheers, Lorenzo