From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CH1PR05CU001.outbound.protection.outlook.com (mail-northcentralusazon11010062.outbound.protection.outlook.com [52.101.193.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 878C9190462 for ; Mon, 17 Aug 2026 08:18:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.193.62 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786954726; cv=fail; b=QRpDHl5iHZPzf0h2xsmWvy9+SAkbDNdic6gChDk8S7eTtxZ+BtFzXyq5PNgSl9frSIyu52PoiqtvIn7ATA6itVkCTZ9mfF+RGYbzTAPbB7x9id5dwMzt/XIUUWcj4HYap/XvDwXrARN6v9QE+Vzv1ai3Y5YsGOIUJePPQXCrPDA= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786954726; c=relaxed/simple; bh=8vx0Jt1NJMg91ekeWx4ldcec4CvTiXWO8CUeTq0YaQo=; h=Date:From:To:Cc:Subject:Message-ID:References:Content-Type: Content-Disposition:In-Reply-To:MIME-Version; b=qrT6z03HLefpJTME+vjxjMmOS2X7aT0CH70O07bGEOhOsB89c9x/GSo5Lk4Z4AHWvd414pg6i9+XXlEcIZft0eftK2G+UntYYTIlbtRjitOQ4xjCqRyMcRQ4oV6ufLg/UsfRz4kytqL4pOHF+MqO2sjAv4MfWMusLW9QrEtllTE= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=VA1svkZo; arc=fail smtp.client-ip=52.101.193.62 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="VA1svkZo" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=T45zjq5F2KH+qwet1iS4TvTrbsEy7gzhAE32B6DWNPlRq3XIxdVDTJcsOpavduO0PKrKvXk7pVSwTB9hOuBo3vpOxZFLsiG2PpjtTRsQPubKWfsYzbgRqXW2H8kiM+DsImz3zOo8FYZeMi51GPDNyRMhFOZhPpajn42WRRnTUVDM/R4X6eNWPAJKytuwy8q2k2LksFoLk7lb2O9nCpBkrQv13kDt4wVZf5p/qMHk/T68CVzMhIbshSy9TpLfOcgutuxSPNk8YzjpYzw7u4vwkQA1PTwjwBjqGgGu7VmLYFwpMzO0Yo+/benVsLx5pu1HKGoGYUfI51xKUc0keWhkwQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5G4f9pYhgY+kQUVWeqMc0DoRNYRWJCVMyFdbLKFqxlo=; b=gV1AJNPDbhqbsucDlcLjEzW4zaLDbSCmtXRURBhY6OaJW1LMFANAqji0Zj2wwhgIbgt8oYnuL8mvkDZQrLsWgHfW30xewz9dZ5+K5Bp/SDg2G740WUPD2ZlpZHWZY0ahjyLHImPBn9p7uu3wFC7oK1qO5s9lVtBPm4UdoNJ1EyoMMVWPta/FXSTsFk5xBCy5OsfDDHW0NVb/P38h0VvjqCenmt0xSdOUEpvBYgkAiKle8RYE6slrFRMTJlP/o3Dh3+3cJL78sLUWAM/3+QbpgdK1ODdnf3NAmUTOBV52aF0q9tMOCUZXOJub71sCMhN9rSoI1O3CI1AMRYYhN0OjIg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5G4f9pYhgY+kQUVWeqMc0DoRNYRWJCVMyFdbLKFqxlo=; b=VA1svkZoEh7WezUAWekDBAEE9ZhJkjb5CX24jlaxfSe+fOElcyOBzwaIekOILsEhFbce+tnRpuDK757Vx12rbO3peDXd9aOntYU6f7EB9tSiu14UtYm5PoH+Cx8CK9M8Bm8O1BnWL2hfRa3Il5euYWuo67t8ESahXvMaPfV9TW9pCpAOyS7KGh+dJ0oVIGrnWrCLrLRO/iTaSG1Wj3DBFgYrBHtjXrWTFwuJfI175IhX1u3b9XTVRBPe0nIiWggmVGW6d/QpZkPLM5WXTC6oo6jwm5MaursBs7e+CkCNFdaxoBH8FeK9sCe2xT9FHAgkpBhC5IkjpWJM7JZAaprpDA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from CH1PR12MB9670.namprd12.prod.outlook.com (2603:10b6:610:2af::6) by CH2PR12MB4311.namprd12.prod.outlook.com (2603:10b6:610:a8::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.17; Mon, 17 Aug 2026 08:18:39 +0000 Received: from CH1PR12MB9670.namprd12.prod.outlook.com ([fe80::416:ea1f:d17b:2811]) by CH1PR12MB9670.namprd12.prod.outlook.com ([fe80::416:ea1f:d17b:2811%6]) with mapi id 15.21.0315.016; Mon, 17 Aug 2026 08:18:39 +0000 Date: Mon, 17 Aug 2026 18:18:34 +1000 From: Balbir Singh To: Hui Su Cc: akpm@linux-foundation.org, david@kernel.org, ziy@nvidia.com, matthew.brost@intel.com, joshua.hahnjy@gmail.com, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm/migrate_device: avoid out-of-bounds writes for compound folios Message-ID: References: <20260817074350.442493-2-sh_def@163.com> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260817074350.442493-2-sh_def@163.com> X-ClientProxiedBy: ME3PR01CA0064.ausprd01.prod.outlook.com (2603:10c6:220:1c2::11) To CH1PR12MB9670.namprd12.prod.outlook.com (2603:10b6:610:2af::6) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH1PR12MB9670:EE_|CH2PR12MB4311:EE_ X-MS-Office365-Filtering-Correlation-Id: fdffbe07-6f1b-4be7-8936-08defc382432 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|366016|1800799024|23010399003|18002099003|22082099003|56012099006|11063799006|10067099003; X-Microsoft-Antispam-Message-Info: lg1paaWcaiRqNlqOOvDWURS1tgmpub3JH/hfD/stKxCo/QQmRwY24Npc0HPElKIdZ4X1sZ56D6EpkZuTEcSSQv0pqWcz9+BUZbXPVfgZoAoqubgNL8YYHw3bTOAh7Ori3Q0uYGGU+tm1t8umjtiNpgjMCeLkK5lgCCeBAI3ULogbT+4QtdC9zobOwdEcWmpVPyKwrcM+xwn6OuLWqOUGZFlQK5+yZyRX2x8llEXTmMmMQyVl5uaHv7igctuG8KF9YhsnZi1VvIP8HprNh4QehQYeCBpjRnnLVuIpLVmOyMY1G0QIi3tZjVikfC8N1OgZZpXkO7BM5eXkZ0+SP6U7R3yzJepTUADjAUn+PSLP3TAAynlBAPw/CW92pKf6JcELYiKq6Bdw5PlYV6cXxTsWe8hlGTvtMEPKb8GT/fOXu0hZpft6EYKfoa6RlrtVV7/UW2+WDyDv58kcZQVbQpvVQcqIGp72xThmKhmYuzKHfjZG//Wa0zKUfJ3u3Vz4ezgk/0N23xi/mOsTxKBGdLOa/YDhHo63s01npQ+zGgHWjGpOmiPhZIyb3U5dT0pel5Vo5wGInNd713lBQlrgTlhwj3kHNOgAIXfjW28gpQeOOvq87qv3qw1pZbyc/uid/mG9QGS9LNGVhC1wy8BY9NIAM0QJffNLWeR64u6EO1yb6CE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH1PR12MB9670.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(366016)(1800799024)(23010399003)(18002099003)(22082099003)(56012099006)(11063799006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?fs5MwAVuxxvaeJHse18Q8A09Y8viWbqicHZeBd93OjUjukp32jD6q3+TVu+5?= =?us-ascii?Q?+BNS8rscF8bzN9PdtX9ySP44ZQRZkaKHexTzk1uSToIyb1oVVDZhEAVKsgOL?= =?us-ascii?Q?aAxlV0Hyf+2OzKEaU9Gd0JpxqPCKUSBL/EE4OrlyOA4cCZ5wFYrudQdTiXX4?= =?us-ascii?Q?hlgHS+hz1HmxVPbPsaTLJW5+LFpbJpXrEyFjP9MF2B+Pxqew061DcpTxArbs?= =?us-ascii?Q?QA8J15ZE01s5oKI/T1s8zzr8crl0BazXH1Rp3K+pMbcpxUe695S9LbM5MchO?= =?us-ascii?Q?x5Vuz0KTiGuxyjP1MCJCWLoi6aqvU/Fx/PULCK/xe5N2xaIyevdNbnAF1KsB?= =?us-ascii?Q?YpLrj2p3POpyks9m07UX3+VmZN7QpokbzS/MvPguP9K6NxbW5soiIOx7eIdR?= =?us-ascii?Q?RW2b9Ryw9XS6ezLxakhErQ+YdtBta2uACx5Ii3ZhGFV9KHQ597XPjcjKPZtt?= =?us-ascii?Q?gMDueKzZY/nNPeD5zlxnogjOYABNa2putSyPf6Fh8PdGu5S7hGhUIMJ4sg5t?= =?us-ascii?Q?YaKGcI7riNJHlJRaPqZOa7MCc4QSJ/QIWy7otnQfUCEor7nVXXsnkrcevGLq?= =?us-ascii?Q?dLo5mxhWdfYvT/KQgtM1AmsdhvZtRUqeiYx4ARArGesGI0DEqSmZIy0idIBU?= =?us-ascii?Q?KM2izLfRAAw0NFINFaf/DpGqyvvO9BLel7CjlSIak88W1TSRxLvgNVXvbBVN?= =?us-ascii?Q?gFwinLmjjiiZYvilotIESWqAMai7JWI7oDQQTkXfOScpWK58UDGY856pxhg1?= =?us-ascii?Q?KmMQV70SyBFvE0bYjJofI/YtdzT1nhHhreV7lvdmf+ypRyHKsR/AEM6loSxh?= =?us-ascii?Q?Etz6juPAhOdfA9dTJtfnFm27aIiuTnvDakuC5hiQTxILqz9iBcoDrhHXK2mc?= =?us-ascii?Q?14BiyI6DXzrS46NfA1TVbsXap0oNEOUqaRIluNILcinF/83p8QTx++Vhc/+G?= =?us-ascii?Q?6FDR64k3ju4KHskpTDZ2b9QyQJ6CXFW2fuBnauf9K8w2WZARzd7fscKR/n5k?= =?us-ascii?Q?rFShYpCx0kIx0wYyDexXw0t52plh1fMgoM5S2au0xatnKUMbIL6hcKc3Yrg0?= =?us-ascii?Q?mpCSUrnytRJTTr5JkyK18UunCfZgqZsGeQdCwMv6kcc05oMLgpcPNziOGSsP?= =?us-ascii?Q?pwjgEQ8IeEHF86EGFXBJfcJep/58c9cAnOtzv0QEnJ08p5Kxk/XO/2i0lL2G?= =?us-ascii?Q?WJgFY4i13cr85fNe8G9Q+vEzTrsGO++LAF3HGrYf0Q3z1JddmrXJIOJDpJ1k?= =?us-ascii?Q?7NUTkZ7ftu8pF7eSDGK2YHq5ZSaz+fnZqLtwkatB36rVGc5Ep5sTSiVteunc?= =?us-ascii?Q?hAepBnmIb0LLlYtkDaPM0eLpxJg1TsIEuWhgQa2uC7dyVDQT3E/3TnoqXkgM?= =?us-ascii?Q?jxUZO/aWhQcCjz0SwlTcliPhkTHBKo9SYB9mrQjYLPgi3JoVTJsfmgvXbLNV?= =?us-ascii?Q?+y35jOspEsazXU7WLHLDpKyNa3UCL4HiJFL7LlrtxqlX6yU/4LWjhvBwCrr4?= =?us-ascii?Q?v0LhGfBSE1QeewGcPIHFIzaq/NbWwy/M6LmD0Y9O3pQCVtMqntYLGwpfaSTV?= =?us-ascii?Q?CXM7wqrKZJhyruhAYtg7M5mRYO1DN9AKABhzygMZX5eJeFRkzNdif5TV0N/V?= =?us-ascii?Q?r+En67JZstfVlsWllmnMSlEgXKp0Z+wGrQFJ8Cegia/HUkS5HGyhhFheUq1C?= =?us-ascii?Q?hp4ojFfuLtaElNOsHZPyuMue5RYwjLZHYOhqVKIUXnm6NwPKysNV/KcZ5KrF?= =?us-ascii?Q?iSLvedHLRw=3D=3D?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: fdffbe07-6f1b-4be7-8936-08defc382432 X-MS-Exchange-CrossTenant-AuthSource: CH1PR12MB9670.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Aug 2026 08:18:39.0400 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 26wmJc0umW1WEXtuYtpjH15CMNdVy3j1/xwP6JCW9xDxk8F2pzLviKKoQUosRpb/PQmbqy0y3YZb705YSf4Qsw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR12MB4311 On Mon, Aug 17, 2026 at 03:43:51PM +0800, Hui Su wrote: > migrate_device_range() and migrate_device_pfns() clear the entries > following a compound folio so that the PFN arrays retain their > page-granular representation. > > If a compound folio extends beyond the end of the caller-provided range, > the loops clear all following folio entries without limiting them to the > number of slots remaining in the npages-sized array, causing an > out-of-bounds write. > > Limit the number of entries updated and consumed to the remaining array > slots while keeping the actual number of pages in the folio unchanged. > > Observed with a KASAN x86 QEMU kernel using the HMM > migrate_anon_huge_zero selftest. Closing /dev/hmm_dmirror0 after > migrating an anonymous huge page to device memory exercises: > > dmirror_fops_release() > -> dmirror_device_evict_chunk() > -> migrate_device_range() > > Fixes: a30b48bf1b24 ("mm/migrate_device: implement THP migration of zone device pages") > Signed-off-by: Hui Su > --- > mm/migrate_device.c | 16 +++++++++------- > 1 file changed, 9 insertions(+), 7 deletions(-) > > diff --git a/mm/migrate_device.c b/mm/migrate_device.c > index 908d2d4ec43a..67bfc1af0b29 100644 > --- a/mm/migrate_device.c > +++ b/mm/migrate_device.c > @@ -1396,16 +1396,17 @@ int migrate_device_range(unsigned long *src_pfns, unsigned long start, > for (pfn = start, i = 0; i < npages; pfn++, i++) { > struct page *page = pfn_to_page(pfn); > struct folio *folio = page_folio(page); > - unsigned int nr = 1; > + unsigned long nr, slots; > > src_pfns[i] = migrate_device_pfn_lock(pfn); > nr = folio_nr_pages(folio); > + slots = min(nr, npages - i); > if (nr > 1) { > src_pfns[i] |= MIGRATE_PFN_COMPOUND; > - for (j = 1; j < nr; j++) > + for (j = 1; j < slots; j++) > src_pfns[i+j] = 0; > - i += j - 1; > - pfn += j - 1; > + i += slots - 1; > + pfn += slots - 1; > } > } > > @@ -1430,15 +1431,16 @@ int migrate_device_pfns(unsigned long *src_pfns, unsigned long npages) > for (i = 0; i < npages; i++) { > struct page *page = pfn_to_page(src_pfns[i]); > struct folio *folio = page_folio(page); > - unsigned int nr = 1; > + unsigned long nr, slots; > > src_pfns[i] = migrate_device_pfn_lock(src_pfns[i]); > nr = folio_nr_pages(folio); > + slots = min(nr, npages - i); > if (nr > 1) { > src_pfns[i] |= MIGRATE_PFN_COMPOUND; > - for (j = 1; j < nr; j++) > + for (j = 1; j < slots; j++) > src_pfns[i+j] = 0; > - i += j - 1; > + i += slots - 1; > } > } > > -- > 2.54.0 > > There is a similar fix sent out by Matthew, The question is, is it OK to send in partial data upto npages (when nr > npages - i)? We should bail early and not proceed if that is the case. Balbir