[PATCH 14/46] mm/huge_memory: fix zapping migration entries for device-private THPs

[Dev Jain]

On 27/10/26 4:47 am, David Hildenbrand (Arm) wrote:
> From: Chris Mason <mason at kernel.org>
> 
> A PMD migration entry can refer to a device-private folio.
> zap_huge_pmd_folio() checks the folio type instead of the entry type,
> so it treats such a migration entry as a device-private entry.
> 
> Installing the migration entry already removed the reverse mapping and
> dropped the mapping reference. Zapping it must not repeat those
> operations. Concurrent MADV_DONTNEED during migration back to system
> memory can trigger this.
> 
> Check the PMD entry type using pmd_is_device_private_entry().
> 
> Fix generated by an LLM and sent by Chris Mason in private.
> 
> Fixes: 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations")
> Cc: stable at vger.kernel.org
> Signed-off-by: Chris Mason <mason at kernel.org>
> [ david: simplify description ]
> Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>
> ---

Matches zap_nonpresent_ptes.

Reviewed-by: Dev Jain <dev.jain at arm.com>


>  mm/huge_memory.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index eda020dd6e33f..1b50cc2b35351 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -2493,7 +2493,7 @@ static inline void zap_deposited_table(struct mm_struct *mm, pmd_t *pmd)
>  static void zap_huge_pmd_folio(struct mm_struct *mm, struct vm_area_struct *vma,
>  		pmd_t pmdval, struct folio *folio, bool is_present)
>  {
> -	const bool is_device_private = folio_is_device_private(folio);
> +	const bool is_device_private = !is_present && pmd_is_device_private_entry(pmdval);
>  
>  	/* Transfer young+dirty while the folio is still mapped. */
>  	if (is_present && !folio_test_anon(folio)) {
>