From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
To: "David Hildenbrand" <david@kernel.org>,
"Liam R. Howlett" <liam@infradead.org>,
"Vlastimil Babka" <vbabka@kernel.org>,
"Mike Rapoport" <rppt@kernel.org>,
"Suren Baghdasaryan" <surenb@google.com>,
"Michal Hocko" <mhocko@suse.com>,
"David Rientjes" <rientjes@google.com>,
"Shakeel Butt" <shakeel.butt@linux.dev>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Jann Horn" <jannh@google.com>,
"Pedro Falcato" <pfalcato@suse.de>,
"Matthew Wilcox (Oracle)" <willy@infradead.org>,
"Jan Kara" <jack@suse.cz>, "Nhat Pham" <nphamcs@gmail.com>,
"Johannes Weiner" <hannes@cmpxchg.org>, "Zi Yan" <ziy@nvidia.com>,
"Matthew Brost" <matthew.brost@intel.com>,
"Joshua Hahn" <joshua.hahnjy@gmail.com>,
"Byungchul Park" <byungchul@sk.com>,
"Gregory Price" <gourry@gourry.net>,
"Ying Huang" <ying.huang@linux.alibaba.com>,
"Alistair Popple" <apopple@nvidia.com>,
"Usama Arif" <usama.arif@linux.dev>,
"Kairui Song" <kasong@tencent.com>,
"Balbir Singh" <balbirs@nvidia.com>,
"Jérôme Glisse" <jglisse@redhat.com>,
"Kiryl Shutsemau" <kas@kernel.org>,
"Yu-cheng Yu" <yu-cheng.yu@intel.com>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
"Dennis Zhou" <dennis@kernel.org>, "Tejun Heo" <tj@kernel.org>,
"Christoph Lameter" <cl@gentwo.org>,
"Peng Fan" <peng.fan@nxp.com>, "Josef Bacik" <jbacik@fb.com>,
"Chris Mason" <mason@kernel.org>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org,
linux-fsdevel@vger.kernel.org,
"Borislav Petkov (AMD)" <bp@alien8.de>,
Mark Brown <broonie@kernel.org>,
"Dennis Zhou (Facebook)" <dennisszhou@gmail.com>,
Rick Edgecombe <rick.p.edgecombe@intel.com>,
"Lorenzo Stoakes (ARM)" <ljs@kernel.org>,
stable@vger.kernel.org
Subject: [PATCH v2 08/13] mm/migrate_device: fix ksmd oops on a migrated KSM page
Date: Fri, 13 Nov 2026 21:45:26 +0000 [thread overview]
Message-ID: <20261113-mason-migrate-et-al-fixes-v2-8-50a2ed382b61@kernel.org> (raw)
In-Reply-To: <20261113-mason-migrate-et-al-fixes-v2-0-50a2ed382b61@kernel.org>
From: Chris Mason <mason@kernel.org>
After a KSM page is migrated to device private memory, ksmd can oops,
and KSM then stops until reboot. A process that maps the page can also
loop in page faults when it next accesses the page.
The problem arises because KSM doesn't know not to try to look at device
private memory that does not exist in the direct map.
In addition, ksmd skips all device pages when it scans, so it drops its
rmap of a KSM page which was migrated to device private or device
coherent memory.
Disallow migrating a KSM page to either by explicitly testing for this
in __migrate_device_pages().
Fixes: a5430dda8a3a ("mm/migrate: support un-addressable ZONE_DEVICE page in migration")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <mason@kernel.org>
[ ljs: tweak commit message, comment, also refuse device coherent ]
Tested-by: Gregory Price (Meta) <gourry@gourry.net>
Acked-by: Balbir Singh <balbirs@nvidia.com>
Reviewed-by: Alistair Popple <apopple@nvidia.com>
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
---
mm/migrate_device.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index 45e571dbfb4c..141d60d27e90 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -1207,6 +1207,11 @@ static void __migrate_device_pages(unsigned long *src_pfns,
if (folio_is_device_private(newfolio) ||
folio_is_device_coherent(newfolio)) {
+ /* KSM does not scan or track device pages. */
+ if (folio_test_ksm(folio)) {
+ src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;
+ goto next;
+ }
if (mapping) {
/*
* For now only support anonymous memory migrating to
--
2.56.0
next prev parent reply other threads:[~2026-11-13 21:46 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 21:45 [PATCH v2 00/13] mm: batch of (urgentish?) fixes in oomk, cachestat, dev-migrate, percpu Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 01/13] mm/mmap: free gathered pages before MMF_OOM_SKIP Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 02/13] mm: cachestat: count each page only once Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 03/13] mm: cachestat: restart the walk after each entry Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 04/13] mm/migrate_device: allocate THP deferred split heads Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 05/13] mm/migrate_device: don't collect a range twice Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 06/13] mm/migrate_device: don't let go of the fault page Lorenzo Stoakes (ARM)
2026-11-13 22:31 ` Balbir Singh
2026-11-13 21:45 ` [PATCH v2 07/13] mm/migrate_device: look up fault folio after a split Lorenzo Stoakes (ARM)
2026-11-13 22:20 ` Balbir Singh
2026-11-13 21:45 ` Lorenzo Stoakes (ARM) [this message]
2026-11-13 21:45 ` [PATCH v2 09/13] mm/migrate_device: fix use-after-free of the anon rmap Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 10/13] mm/migrate_device: refuse to migrate shadow stacks Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 11/13] percpu: fix contig hints that are too low Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 12/13] percpu: search the whole reserved chunk Lorenzo Stoakes (ARM)
2026-11-13 21:45 ` [PATCH v2 13/13] percpu: queue the balance work on an unbound workqueue Lorenzo Stoakes (ARM)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261113-mason-migrate-et-al-fixes-v2-8-50a2ed382b61@kernel.org \
--to=ljs@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=apopple@nvidia.com \
--cc=balbirs@nvidia.com \
--cc=bp@alien8.de \
--cc=broonie@kernel.org \
--cc=byungchul@sk.com \
--cc=cl@gentwo.org \
--cc=dave.hansen@linux.intel.com \
--cc=david@kernel.org \
--cc=dennis@kernel.org \
--cc=dennisszhou@gmail.com \
--cc=gourry@gourry.net \
--cc=hannes@cmpxchg.org \
--cc=jack@suse.cz \
--cc=jannh@google.com \
--cc=jbacik@fb.com \
--cc=jglisse@redhat.com \
--cc=joshua.hahnjy@gmail.com \
--cc=kas@kernel.org \
--cc=kasong@tencent.com \
--cc=liam@infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mason@kernel.org \
--cc=matthew.brost@intel.com \
--cc=mhocko@suse.com \
--cc=nphamcs@gmail.com \
--cc=peng.fan@nxp.com \
--cc=pfalcato@suse.de \
--cc=rick.p.edgecombe@intel.com \
--cc=rientjes@google.com \
--cc=rppt@kernel.org \
--cc=shakeel.butt@linux.dev \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
--cc=tj@kernel.org \
--cc=usama.arif@linux.dev \
--cc=vbabka@kernel.org \
--cc=willy@infradead.org \
--cc=ying.huang@linux.alibaba.com \
--cc=yu-cheng.yu@intel.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®