mm/huge_memory: fix move_pages_huge_pmd() for huge zero pages

[PATCH 0/2] mm/huge_memory: fix move_pages_huge_pmd() for huge zero pages

Posted by Chris Down 1 month, 1 week ago

Two fixes for the huge zero page path in move_pages_huge_pmd()
(UFFDIO_MOVE).

Patch 1 fixes a use of NULL folio introduced by the folio_mk_pmd()
conversion in commit e3981db444a0 ("mm: add folio_mk_pmd()").
mk_huge_pmd(src_page, ...) with folio_mk_pmd(src_folio, ...) in the huge
zero page branch where src_folio is explicitly NULL. With
SPARSEMEM_VMEMMAP this silently produces a PMD with a bogus PFN, on
other memory models it is a NULL deref.

Patch 2 adds the missing pmd_mkspecial() call that was omitted when
commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero
folio special") marked huge zero folio PMD mappings as special. Without
it, vm_normal_page_pmd() on CONFIG_ARCH_HAS_PTE_SPECIAL architectures
does not recognise the moved huge zero page as special, incorrectly
treating it as a normal page and corrupting its refcount.

Chris Down (2):
  mm/huge_memory: Fix use of NULL folio in move_pages_huge_pmd()
  mm/huge_memory: Mark moved huge zero page PMD as special

 mm/huge_memory.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

-- 
2.51.2

Re: [PATCH 0/2] mm/huge_memory: fix move_pages_huge_pmd() for huge zero pages

Posted by David Hildenbrand (Arm) 1 month, 1 week ago

On 2/18/26 04:44, Chris Down wrote:
> Two fixes for the huge zero page path in move_pages_huge_pmd()
> (UFFDIO_MOVE).
> 
> Patch 1 fixes a use of NULL folio introduced by the folio_mk_pmd()
> conversion in commit e3981db444a0 ("mm: add folio_mk_pmd()").
> mk_huge_pmd(src_page, ...) with folio_mk_pmd(src_folio, ...) in the huge
> zero page branch where src_folio is explicitly NULL. With
> SPARSEMEM_VMEMMAP this silently produces a PMD with a bogus PFN, on
> other memory models it is a NULL deref.
> 
> Patch 2 adds the missing pmd_mkspecial() call that was omitted when
> commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero
> folio special") marked huge zero folio PMD mappings as special. Without
> it, vm_normal_page_pmd() on CONFIG_ARCH_HAS_PTE_SPECIAL architectures
> does not recognise the moved huge zero page as special, incorrectly
> treating it as a normal page and corrupting its refcount.

Thanks for the report and fixes. This sounds like something selftests 
should have detected.

Can we teach  tools/testing/selftests/mm/uffd-unit-tests.c to trigger 
that behavior on the huge zero folio?

We have uffd_move_pmd_test(), but it seems to focus on moving non-zero 
folios I suppose.

-- 
Cheers,

David