From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA4E12E7648 for ; Wed, 18 Feb 2026 03:45:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771386303; cv=none; b=WMGXl73lXp35J0ph8HW/i1UooUIcpScPMsc6ehIwZ+6/HM+S5gfQpr8Bce7N2BovA5ru5GdO/p0hS2AsuubIk2cWmv+h4zN8RhCjjxCsC060qcxWhwvBWWnDmRmPz15zOgRt5Rk7S8Xi30MhN6SxZMzC8So95oOYMR0jZ6L8H7g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771386303; c=relaxed/simple; bh=rNmCxRaZrL47s2niGfkvdqO2nlBKiWdDYvrmKiWxc2U=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=j9AZeIppdr3rC/CrZ6e+uclq6v1x0BGAZADcPyTLmBv3VxPa2WFKRRfcKGq/FF4LceaMPOikCEFuC0tuhWeyFuP2EO+HTGGSzw0BBP9gGd1ZrctLs5S84T/TeI+fEnivceZM99jzMXlmMYQmLixgtVS+uUDzqOQz7xNb+M3AJSk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=chrisdown.name; spf=pass smtp.mailfrom=chrisdown.name; dkim=pass (1024-bit key) header.d=chrisdown.name header.i=@chrisdown.name header.b=jvTt5FML; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=chrisdown.name Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chrisdown.name Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chrisdown.name header.i=@chrisdown.name header.b="jvTt5FML" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2a95de4b5cbso44633835ad.1 for ; Tue, 17 Feb 2026 19:45:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chrisdown.name; s=google; t=1771386301; x=1771991101; darn=vger.kernel.org; h=user-agent:content-disposition:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=NJWFOiWF36F/VYxYvq9ObLBGauZxL9efpCybptIgmjg=; b=jvTt5FMLDkZanx3CdPU6R57rdBJ6tBfsh53TTRBJ1rwgLlqU2IWmSnRC1Gc+XxNgY+ e1bn8AhO24Zq+yUFh42LJ69ur7ONR5NqrExVDsQd9TrUSlB1ZjGkEeC/YfjTQbdO7c4p gJgiLu5QbHpeAmSxoDBttdP+QVXKcnbxX4xjU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771386301; x=1771991101; h=user-agent:content-disposition:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=NJWFOiWF36F/VYxYvq9ObLBGauZxL9efpCybptIgmjg=; b=l9WefqtvrmtBa5Yh1lUcPqQKgqoYFs5/s4KDspafza8AqjMJmwWeHpQp6tPpMam7XX DVvNNqprOgljCuMKzTEbKjEs3RQX1TzG1umegrhGstyX4r+uvXbfmi2UR+tcl31ZX8og xCKMDlbu4OHX3iZECdKAHSEwSBtsHoXDv0kZ62sljsmuPfIbjqmkWQLAP0gHrNPQYYUd b3KyC886vBc49X5BF9e7WRzHlzTK0tvrLethVCntb5jjx6PIwe0B5piokbBh/cgDA0P6 ZtBjCivoG3Yd9d1tMKkGiu/zDH3gqxutGZ3Heyx5HPE1Ki8On6jovbpDp27a5o9hHy46 yiPw== X-Forwarded-Encrypted: i=1; AJvYcCVsh3flQF5leX0BUa+/v7baqOidyfa1yXP1bQFVqa5nvJ1X3KcU8vzmGPK5tyV/jHc5W7rGJFE8cURrsCE=@vger.kernel.org X-Gm-Message-State: AOJu0YzAzVsqINKUBdPpWeJuktp5uv6dLHnuxoig3hei4l7TR7uxPU8g +55KQy4JJiVS+2zcBGgRRhOrwGmRCj3O1FMZzAdef07mmYfJtiBhqde3XCOjuajz3K4= X-Gm-Gg: AZuq6aLUHkjr7T39YXKMIwEFPtPyT6lWGFoVp46wGu1PBvA7CLGvJk5CBnorIG3OhWY CffvavMxF5O71y3sZwgDDnQuttxDtO1/z1Wt9hETHPMkrrbXrmb2uANNcTxWv/gO1CvzZOCHgJP yZeTtS/AHc2Zgldy1y4ZtkoRVAWEHPPspZlrEponVGzyE2+9zw97hvWFc3Ou4dxFno1ICkXSkTw zwnb9o3Bp0evpVzYFjLAcSrdMB8OtAzB4+aYksUt9e0bC37HV5oELqJYcGrtb03fnF4N1Jjc9en WhjJSv2tg/DJ35G48InNEQiVFuIUDNUcbgCYd7jzUS2agYg460zCxHwVq9tnYoXhTtqrNVOzIp5 rJ+N49J81Nbb1Blf/TSC326UOQ50X3RNxR70CyNvdwHjWmi4hVvgSZP922WSqcRKRVnKVeZD7px 3Ci9BZQpPUbsLTbG8RVOKU X-Received: by 2002:a17:902:f60b:b0:2a0:bb05:df4f with SMTP id d9443c01a7336-2ab4d053111mr152329315ad.44.1771386301369; Tue, 17 Feb 2026 19:45:01 -0800 (PST) Received: from localhost ([175.139.248.66]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ad1a9d58e7sm118526155ad.45.2026.02.17.19.45.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 17 Feb 2026 19:45:00 -0800 (PST) Date: Wed, 18 Feb 2026 11:45:01 +0800 From: Chris Down To: Andrew Morton Cc: David Hildenbrand , Matthew Wilcox , kernel-team@fb.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/2] mm/huge_memory: Fix use of NULL folio in move_pages_huge_pmd() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/2.2.15 (2b349c5e) (2025-10-02) move_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and huge zero pages. For the huge zero page path, src_folio is explicitly set to NULL (used as a sentinel to skip folio operations like lock and rmap). In the huge zero page branch, src_folio is NULL, so folio_mk_pmd(NULL, pgprot) passes NULL through folio_pfn() and page_to_pfn(). With SPARSEMEM_VMEMMAP this silently produces a bogus PFN, installing a PMD pointing to non-existent physical memory. On other memory models it is a NULL dereference. Use page_folio(src_page) to obtain the valid huge zero folio from the page, which was obtained from pmd_page() and remains valid throughout. Fixes: e3981db444a0 ("mm: add folio_mk_pmd()") Cc: stable@vger.kernel.org Signed-off-by: Chris Down --- mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 44ff8a648afd..fed57951a7cd 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2794,7 +2794,7 @@ int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pm _dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma); } else { src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd); - _dst_pmd = folio_mk_pmd(src_folio, dst_vma->vm_page_prot); + _dst_pmd = folio_mk_pmd(page_folio(src_page), dst_vma->vm_page_prot); } set_pmd_at(mm, dst_addr, dst_pmd, _dst_pmd); -- 2.51.2