From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azon11010056.outbound.protection.outlook.com [52.101.201.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACD662AD10 for ; Mon, 27 Jul 2026 00:38:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.201.56 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785112718; cv=fail; b=c45v8GhLldASZ63REl/oJPZHzbXNZw9v8TPtJigA4DNstFj1lGui9ylvwb/hS3fhDXQbjLmjGP+9nLiTYf8t6kgxp4uuIgJz9Lvy/2UCkRN7X2gdyf1ZdayFB5kOkR7SVkjtMX1u4J+1/XhPI8/xVqV/gxd+xioj0TgHfSo27vc= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785112718; c=relaxed/simple; bh=CQnvnV88nPCg9P9YCbo0A5xbre3FcTfHpPTEFPvay+M=; h=Message-ID:Date:Subject:To:Cc:References:From:In-Reply-To: Content-Type:MIME-Version; b=tNs/V3C/IQFB+KPIbYidea8Gt/q7DLnlY5JGYw4R5zUW+ys9QC9OH6l0TRlafssqbPpTcC2/WlzwS7h+RARVPMpMmB/frKN4K44W27+h3jE4GLkv6BspXkUmuh+Qhw5e+ixh094Vh7xdN53kCIE31AVl+drMcupLfR8AJ6bwQTQ= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=ulCL0uKP; arc=fail smtp.client-ip=52.101.201.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="ulCL0uKP" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ADNLeR6Co7ym0B8q1egTDsXtr+X6hF76DM3AKuabciJl0Wgswd7Ecq2rcX31RMOY/IZjFpXhveF+Dr+K/pvlUk63DIofpjj3NkizOhmD2GO1Sb00sTFZdiFQKdm1BgWLTyi5BPGkKUJzyUDIn64vkdNAfgAviIzG3rJxjGx/SSmZ0+DTaGFzcxODTqr/q17931OrK4TXcHHUm2C9UyF68hei5unShLoJI7PwDe64gvPC4G5YkWr2U8G1qY9IbAa2iuZzzXxZZRBHONOMLU0EyUXsCW/W6Clvdcxy+8AGl6KAcTKMMyogRvRJ8cfmjQ0K17nJQ3xYK4++5V+MMJXYaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5CIQm41qBdC2/vjFOuEpu1Kt9/FVv1US0cky8Lv7b7A=; b=PZnzclF1MajIQSNx+S69IMjQmk9eEFHSH6dGmp+fm7yFpWbg1lXPqNjFWBdbeQVwSu8ysOUoibSA3wRz28FxhI1FBwZE0F34EgjfjbpCT3uIx1FoA51j7DufBFFCslFjUZNyZd7dB64HVCTMvnnX5LvFLvL9xm5y64AucOu/J9fOvZULeHcPAqmZT+b8J1tUafbG5BSUi8JWKNPBdiVwhODaBpniCrbW1C5G1B1ujydNpCOdopK+JNqLKD5Z/YtRHEjwfUHvVOAIaeKqwToCJRPZT5c5UuuFj62tIA+RsDyKvLKPD/aaJ/Gvq9zx4Z9tUce3pf5KpiNKpZRoooMgHQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5CIQm41qBdC2/vjFOuEpu1Kt9/FVv1US0cky8Lv7b7A=; b=ulCL0uKP6/R5u9ksHnchuEgHfGi145xshzt3Q+Up5zPZsaX45Yp3rqB2ZCjHcElfKwbHkYPnGddTpXClILhOkGlKNmO39Aomw5pRKfguj6T9DnojIWGbOYN1yUPugs7YXWODlGeXOgUN8Pp4Q4UPlLuaexk3yWk0dLkUZQVsXgKFSdIoWVlGbiC5jToFhEtPJpCuMVIHPxvob/kL2hS9d3rIVNFjujqQSjQjA0uHvuTbTJYwwq/8mx5q5+a3oZue136iuHK/9Yva7gz2WcnQ4xdrkb2UQshT8nzhH9McbHQH8jHsSbJhSQTm5/y8+VFd5Cpnh8ulesgjqebrL5t2eg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from CH2PR12MB5001.namprd12.prod.outlook.com (2603:10b6:610:61::18) by DM4PR12MB6279.namprd12.prod.outlook.com (2603:10b6:8:a3::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.13; Mon, 27 Jul 2026 00:38:29 +0000 Received: from CH2PR12MB5001.namprd12.prod.outlook.com ([fe80::89e3:6df0:de90:8dfe]) by CH2PR12MB5001.namprd12.prod.outlook.com ([fe80::89e3:6df0:de90:8dfe%3]) with mapi id 15.21.0245.012; Mon, 27 Jul 2026 00:38:29 +0000 Message-ID: Date: Mon, 27 Jul 2026 10:38:21 +1000 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] mm/migrate_device: Clear stale mapping after freeing swapcache To: Zi Yan , "David Hildenbrand (Arm)" , Andrew Morton , Arvind Yadav Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, matthew.brost@intel.com, joshua.hahnjy@gmail.com, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com References: <20260724082702.2531024-1-arvind.yadav@intel.com> <20260724214307.a50ed52cf78fdc73bc42f9bf@linux-foundation.org> <2b2fe98d-1a7b-4aef-a1ff-0fbe43339180@kernel.org> Content-Language: en-US From: Balbir Singh In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: MEWPR01CA0310.ausprd01.prod.outlook.com (2603:10c6:220:1d8::16) To CH2PR12MB5001.namprd12.prod.outlook.com (2603:10b6:610:61::18) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH2PR12MB5001:EE_|DM4PR12MB6279:EE_ X-MS-Office365-Filtering-Correlation-Id: ec31bdd9-2af0-4cd9-172e-08deeb7760a6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|7416014|366016|1800799024|10067099003|22082099003|18002099003|4143699003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: wR98c1xLGyMdPja3nXG1jxeOQc68m68M85RamTviOAvE2et+uT0ZEvs7KY2a1gceaLK/kSqpfM5pVijXF7TUEHJNn5KhEz1ggobuCUPy8B0cTwuV5Ql0wL/y76NYRVSl6iDrvhSzzhdaOaPzIF6D3bE/tfkq/+xfVu1NqqS49xKQPQSLzw2c+Sju4Eoc4HaHAL6DcmiJv4eAXTI6Q0eTMkVvDEimIZkE6U5AqazYH/SVp5JHi0TUf65dvN9SEg7eLAEEoftNtSI3MjTdcBd9pl4hEu0WlL020CffSnX8PlGX6HrWpD2XqviWKMA7cIUb2g/T9oM2PMS994WrGNx+xtT9ipBAv8hfkZhvqHwiugNOpPJ+SvxsULESHL5L0P2BkSFxJJO0Mb0JtXF04hOPNtcbXlMeMNi5RF1d+Y1OyL5MwY+8BRS7XgiKhIBGXAG/db1a4p8Mx/szO3zWURhmHeT46CYW98F883mSwkPuvo+fQEnVBRAy5AXYWxfk4N1XbGrrN0BBRvZmDSID2Z2UMlh02ALAVRh5J5UijLK/imlgfzUshsKfZkYp5EGp5SxGbObYg5q7Xeze69roohxD7aopbeMQES+as012cKMBXCY1b9wLx2ZVfnkz9pKN1RjwDSyy4rH5G+k6q00PEVOVto5A4h7LWk+trw7rDntS1Ck= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR12MB5001.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(7416014)(366016)(1800799024)(10067099003)(22082099003)(18002099003)(4143699003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?OUYycVlURlNoQmh2VHlBTG5ncG5oS2VacTAyTjhtU1JvZHFCaG5od001b1Rv?= =?utf-8?B?d2FvaWNIZGRIeDYvV3hiUXJLZ2FSbmhlWnkrN1JBMVZVNm1TcEUwTTJvc29m?= =?utf-8?B?UG5YdGs0MlV6TFcrOWRSeTVpN051TWEwSk5IY2hjM2lENGVVWDkvcGp3OGtT?= =?utf-8?B?SFFqU0RJYTY5ZkhpQmRxYk1JSGJhWjBwb3lXU2ZGZVhVOHdpaS9KTEoybU0v?= =?utf-8?B?Y1lGS1lUT3Y4UHQ0ZmU2TzJ4aXpXVEs1VFc5aEZTUS8xNkI4ajF2VTFEUGg4?= =?utf-8?B?VC9pUkR0bmpDYWJKNFZKSjVtYlRQR2VJazhWc3R6RFhCME5Sa3ErcmJqVUc3?= =?utf-8?B?R1JGVU1iN2QwK1pvaXc1RW9iWWI3ZlVHUnM2cUxLdmkxeGh4TXNqMmVFam0x?= =?utf-8?B?c3RrZVZVY3FlOWw3ZTlFaXMySUV2ZzVLQzkzaktIazZORm9lb3lTb3dGZjEy?= =?utf-8?B?UWlVSi9XZ1JJYXZHN0Z4TnFKWHRvRDNMdksxNTR3OWlGZGdFaFdtQVJoN25V?= =?utf-8?B?MXI3cHRSRWxQUzVEdjJuRitlM0lrUzBHTlhSUmJOK1dFY0VNS3NxUjN0NUZI?= =?utf-8?B?Ymg4emIvRzR4bGRCbGsreEdPODFmMXRLMFJIeDN0YjJYRW9FcFF0KzRvdVAw?= =?utf-8?B?V2NBQlhHWU5Da0xxV0JFNlM1Z0ZxMCt6NXc4bVltZEEzNFM5WW9CYzRmYmpY?= =?utf-8?B?TnVvZXFNY0hQN1VWL3BuQVZvbXZLK3N2MW96VGw5ZWs5STlNdTN2TDZwUG5J?= =?utf-8?B?Ukl6M2xiMGxkSWdVV2NESFJwWWZVUU1XS25rUUM0dkkvN0E5eWR4MjZoNWQz?= =?utf-8?B?ZWZFTDdDUFYwRSt1RkhJUEgwYmJwWG1FS05KUER5WDlTVy9rV3gyM2RqbEw3?= =?utf-8?B?Y21Wanh0YjlQenQ5OG5zVGlGVDRGUmhJTFp6QTRZV2tJRUJ5WXlvOFlGQy9Y?= =?utf-8?B?alpHbWk1ZzdCQ0hRbHVXV1YzMGRnVlRxNnlOWXZUWW5saGwzbHY3N1lQOTdo?= =?utf-8?B?eWdRTnhoUGtLeitwNmNaaDUxK2dwcHNOQ1U4eW5VdEtNR1FtMjRVSCswdmdT?= =?utf-8?B?NHFnZDJPZVREUXl5K0tKS1BOU0tlSW01NFgxMGdZV3dTak8xRlh3VlpOVUx4?= =?utf-8?B?WVRsZ1ZOWlk0ZFJKc0JCYmVoaUdpczlVSFBKSnJNV1VSZG1QWWtqUElIZlNs?= =?utf-8?B?Tm01ZHR2TmtFN1NpSVV5NXVBMEorZVYrR3E0bzY0T05JYlNXRG13aHVkM1JY?= =?utf-8?B?SjJ0RFc4RnJtbkdQNk1TVmtXTmIwUGM1ZE4rSWdJSmk1RmYzRTA4ME4wR3lG?= =?utf-8?B?cFQ2RzE3Um9ubHhDM2p2dlN4VlVUbHIrT3ZjLzF5dzBySHlBRnBiZWdhNU90?= =?utf-8?B?azNTVDF5dTVPQ05iYm80ZUIwZ25zNEhyVmVXWWxRcFVRaS9QV3pjNlZINnVI?= =?utf-8?B?bjNwMnhtMUZyd0dYYm9QTW9lMERIM0JyZHFiajZpaHhqWlRQMjRGV0d2QnhY?= =?utf-8?B?L1o4NmFDdnBXL29XcjZXQVNlS21FRyt6RmN6Wk9aMW14blBieUVjWGlrSzZz?= =?utf-8?B?V1AxQzc0V3k2QVBmL3JBRmx4LzZVT3kvS1VKdzJ2TlFmNVM2KzVhbnQvWUl1?= =?utf-8?B?ejNtMWV2bWtUUWovd0hvc2xvc1d3aU92cjBBK29nYk4ra29Gcy9QSklEMTgr?= =?utf-8?B?NG5ZZTIvSy9aYk1CVld1YXlIQTF3ZUdRY0RNS0RpNE40RVErRzdXK2RmRWRG?= =?utf-8?B?czI4UkVQRDdKZkpVcUg2OXdVSXY3aUVkWTVZMzExZVlZSHVldmMrL0ZSZ0Ns?= =?utf-8?B?TVdaTjhPQno2NHppNU02WWplbmFINGp0WkdNUXh0NWl6WXZodkUvZFk4aHZy?= =?utf-8?B?bDY5N21MUUx3N0oyckkyY0F0NUpFeFVGVERzVkRkMmxYeng4Y1JOeWZSZVZP?= =?utf-8?B?TGZ4d3ZnUUErK21CVXR1ZXpBRGZQUVJaUG9HbE1WV2szbjNJLzJGdE5BLzU5?= =?utf-8?B?V2w2TjhYdURoaVZuSHJyTGVHOHN3RGM0WFhFREsrQ0h5bk45cHNEVHVoTUcv?= =?utf-8?B?dnZIejg0YjU5Yk13ZHdQdEszU0kyZXBXblJlYUNJMTFUV1RUdUJ1eGxQaUZ1?= =?utf-8?B?ZlgyS3NjOGJzQ3U0R3kxRFdPQ1M0dEhtTUJGZkFQYTJJSEtIbWF2ZGNtNGFR?= =?utf-8?B?djByZjdpMUVOQnJ4QkNFQ3kySWpGWVN6bGJGNzJmVmZxakwzNURiTmJPbGpV?= =?utf-8?B?RWpNck55bVh1K1N1SGhJdlBvRmNGdVJSYjRDR2NSR2xjWXkwUFZBdlF3Yk4y?= =?utf-8?B?UzROU05HNDZIaXhudXY5K3lSSytkVjdMa1NpN3MzWGhYbyszR3ZsZz09?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: ec31bdd9-2af0-4cd9-172e-08deeb7760a6 X-MS-Exchange-CrossTenant-AuthSource: CH2PR12MB5001.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2026 00:38:29.1924 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: h//GEZ+/Fz0vGx6yWQboBxGu6nTD0OkKZCPb7Q6/mQN6I02zHr9yP85G8zfkYf99OQKt03u3fFpMvbEA/0W83w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB6279 On 7/26/26 7:05 AM, Zi Yan wrote: > On Sat Jul 25, 2026 at 3:36 PM EDT, David Hildenbrand (Arm) wrote: >> On 7/25/26 06:43, Andrew Morton wrote: >>> On Fri, 24 Jul 2026 13:57:02 +0530 Arvind Yadav wrote: >>> >>>> __migrate_device_pages() reads the folio mapping before calling >>>> folio_free_swap(). When folio_free_swap() succeeds, the folio is removed >>>> from the swap cache, but the saved mapping still points to swap_space. >>>> >>>> Passing the stale mapping to folio_migrate_mapping() makes it take the >>>> mapped-folio path after the swapcache reference has been dropped. This can >>>> cause an invalid swap_space lock access followed by a folio reference >>>> count BUG. >>>> >>>> Refresh the saved mapping after folio_free_swap() so the current folio >>>> state is used during migration. >>>> >>> >>> Thanks. AI review might have found an issue with this. And one >>> possible pre-existing issue in the code which Alistair and Balbir >>> worked on. >>> >>> https://sashiko.dev/#/patchset/20260724082702.2531024-1-arvind.yadav@intel.com >> >> Yeah, this might need another careful look. > > It seems that the pre-existing issue can be fixed by resetting nr to 1 > after split is successful. It should also complete this patch. Something > like this: > > > diff --git a/mm/migrate_device.c b/mm/migrate_device.c > index 18d097c388530..4a77b6c86ae4f 100644 > --- a/mm/migrate_device.c > +++ b/mm/migrate_device.c > @@ -1193,6 +1193,11 @@ static void __migrate_device_pages(unsigned long *src_pfns, > MIGRATE_PFN_COMPOUND); > goto next; > } > + /* > + * reset nr so that only first after-split folio > + * is processed below > + */ > + nr = 1; > } else if ((src_pfns[i] & MIGRATE_PFN_MIGRATE) && > (dst_pfns[i] & MIGRATE_PFN_COMPOUND) && > !(src_pfns[i] & MIGRATE_PFN_COMPOUND)) { > > Hmm.. I don't this error condition possible, migrate_vma_split_unmapped_folio() will VM_WARN_ON non anonymous folios, but the design contract is for anonymous folios only. The enforcement comes from the callers of migrate_vma_pages() and migrate_device_pages(). Also __folio_freeze_and_split_unmapped() checks if the folio has a swapcache and mapping associated with it, prior to split. I think this is a false positive Balbir