From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.218.175.137 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793904064; b=OGkiYk0Kh6UGgGzGJtTKSoyQ3aANFT5BOuAtSRIS5KQlHxlxG6AGe02zoA1JAdP/syye PF2pyRlbWzvW0PY8Q5PA4ZCwPwSbbUEjkxpjIoYy36nkr+NG67umLZEqzfMGlov18LNPz zMrujWz7c71J3DelBeG+5PhYiphpGzbcbbiAIqdHQvU6/2D17sExHKHGJK22Y8LAR0sQ/ IY4yyXCWG7Css7wNkdygGYMoLTrez5ferMZXvBV5RROUIglAoiwVT14HhVCJdheiD2TI5 O5Zshb9j1CwxT6wNXsIn+nfwEbm6eYMRq0DNRVWKJytlm/pOmhOPbaTBseSGoG7QH9g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793904064; h=DMARC-Filter:X-Envelope-To:DKIM-Signature:X-Envelope-To:Received: X-Mizu-Trace-ID:X-Migadu-Flow:From:To:Cc:Subject:Date:Message-ID: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=/8bJMm/sgf29qfCgUJsD1PwhcylKtHc9E7GXw05kMnY=; b=Z2ymBagcLJIoiuEb1HqetxU6qIzHHus5WnMNYdnvoFsq3YscbtAfqlKC4dM8YoNdILMz g4rtKkxxXPdIet9hXvfCw/hL/pzPeS2ApfjneaEXxuieGhw62vLKE5UJvQBB3N0Phmz9L z1kCZzDKzhM0+vyU3r+m67jOTnaMVyvKAFGs2DPp223gK3LPmAGoyWTatxLSEVZUXYQCU AWIpB+KrwXZnmpOJTU5ZxF0iOenv3EMgleqssUFlKuac19Odf1J/hASfaf46iDMKmL3iT fiAYVBCuhYqSs/Sp5dYrcU0GEVkcUUnNO8huoTCHvEpveR+OA6P+bxBb2E8LuvdrABA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=fcUh3zPF; arc=none smtp.remote-ip=91.218.175.137 Received: from mta0.migadu.com (out-137.mta0.migadu.com [91.218.175.137]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B550C606A32D for ; Thu, 5 Nov 2026 18:41:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org B550C606A32D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux.dev header.i=@linux.dev header.a=rsa-sha256 header.s=key1 header.b=fcUh3zPF X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=ESJRx81IWR2zPX4rBwYm4630w/5tlX0IX9UcfPNoYB4=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1793904062; v=1; x=1794508862; b=fcUh3zPFAUHMX9gyVjNaHYheubTR0rm8S/XTgm23JM5hjsp5pPB/Y0q6k3akWJdvVfuOgxhj wiigDzyWyt5MiR8OGRU+NhdjUouqLXiY4rNfsKYV5dDbOmGQU/5qzJ7WzRCRtTBiHRvvGoCpbWw KIFKHu4G/AZKstVh3OhaE9vU= X-Envelope-To: linux-kernel@vger.kernel.org Received: by mta12.migadu.com with ESMTPS id 59e87fb4a13f42e8; Thu, 05 Nov 2026 18:41:01 +0000 X-Mizu-Trace-ID: 59e87fb4a13f42e8 X-Migadu-Flow: FLOW_OUT From: Usama Arif To: Andrew Morton , david@kernel.org, chrisl@kernel.org, kasong@tencent.com, ljs@kernel.org, ziy@nvidia.com, linux-mm@kvack.org Cc: chenhuacai@kernel.org, ying.huang@linux.alibaba.com, Baoquan He , willy@infradead.org, youngjun.park@lge.com, hannes@cmpxchg.org, riel@surriel.com, shakeel.butt@linux.dev, alex@ghiti.fr, kas@kernel.org, baohua@kernel.org, dev.jain@arm.com, baolin.wang@linux.alibaba.com, Nico Pache , Liam R. Howlett , ryan.roberts@arm.com, Vlastimil Babka , lance.yang@linux.dev, linux-kernel@vger.kernel.org, nphamcs@gmail.com, shikemeng@huaweicloud.com, yosry@kernel.org, qi.zheng@linux.dev, luizcap@redhat.com, kernel-team@meta.com, Usama Arif , stable@vger.kernel.org Subject: [PATCH v9 10/32] mm/migrate_device: avoid leaking folio references during THP splitting Date: Thu, 5 Nov 2026 10:38:54 -0800 Message-ID: <20261105183940.2236717-11-usama.arif@linux.dev> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261105183940.2236717-1-usama.arif@linux.dev> References: <20261105183940.2236717-1-usama.arif@linux.dev> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit migrate_vma_split_unmapped_folio() takes an extra folio reference because split_huge_pmd_address(..., true) drops one when it splits a PMD. However, migrate_vma only holds mmap_lock for reading. A concurrent MADV_DONTNEED can clear the migration PMD, or split it into PTE migration entries, before the split helper takes the PMD lock. The helper then does nothing and leaves the extra reference behind. folio_split_unmapped() fails with -EAGAIN due to the unexpected reference, and the reference is never dropped. An existing migration PMD is expanded into PTE migration entries even with freeze=false. Use that mode and remove the extra folio_get(). The reference already held by migration keeps the source folio alive whether or not its PMD migration entry still exists. Reported-by: Zi Yan Fixes: 4265d67e405a ("mm/migrate_device: add THP splitting during migration") Cc: stable@vger.kernel.org Signed-off-by: Usama Arif --- mm/migrate_device.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/mm/migrate_device.c b/mm/migrate_device.c index 9e19fadfa65c6..3286bb8a4b73e 100644 --- a/mm/migrate_device.c +++ b/mm/migrate_device.c @@ -920,12 +920,7 @@ static int migrate_vma_split_unmapped_folio(struct migrate_vma *migrate, unsigned long flags; int ret = 0; - /* - * take a reference, since split_huge_pmd_address() with freeze = true - * drops a reference at the end. - */ - folio_get(folio); - split_huge_pmd_address(migrate->vma, addr, true); + split_huge_pmd_address(migrate->vma, addr, false); ret = folio_split_unmapped(folio, 0); if (ret) return ret; -- 2.53.0-Meta