Re: [PATCH 4/4] mm/mempolicy: skip zone device folios when queueing folios

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] queue_folios_pmd() blindly calls pmd_folio() on raw PFN PMDs, causing a kernel panic during mbind(MPOL_MF_STRICT) on VM_PFNMAP mappings.
--

--- Patch [4]: [PATCH 4/4] mm/mempolicy: skip zone device folios when queueing folios ---
commit 638b94b8502c12252205f411cec0cf58a9fd9ce2
Author: Gregory Price <[email protected]>

mm/mempolicy: skip zone device folios when queueing folios

This commit adds explicit zone device checks to queue_folios_pmd() and
queue_folios_hugetlb() to mirror the behavior in queue_folios_pte_range().

> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 5720f7f54d942..bd79e61a40d1a 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -668,6 +668,8 @@ static void queue_folios_pmd(pmd_t *pmd, struct mm_walk *walk)
>  	}
>  	if (!queue_folio_required(folio, qp))
>  		return;
> +	if (folio_is_zone_device(folio))
> +		return;

[Severity: High]
This is a pre-existing issue, but can this code path trigger a kernel panic
if it encounters a raw PFN PMD from a VM_PFNMAP mapping?

Looking at queue_pages_test_walk() in mm/mempolicy.c, it allows unmigratable
VMAs (like VM_PFNMAP) to be walked if MPOL_MF_STRICT is specified:

	if (!vma_migratable(vma) &&
	    !(flags & MPOL_MF_STRICT))
		return 1;

	if (flags & (MPOL_MF_STRICT | MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
		return 0;

During the walk, queue_folios_pmd() unconditionally calls pmd_folio(pmdval)
on present PMDs. Since VM_PFNMAP raw PFNs lack a valid struct page,
pmd_folio() would return a garbage pointer, leading to a crash when
queue_folio_required() or the newly added folio_is_zone_device() dereferences
it.

Should queue_folios_pmd() be using vm_normal_folio_pmd() or similar to filter
out raw PFN mappings before attempting to extract the folio?

>  	if (!(qp->flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) ||
>  	    !vma_migratable(walk->vma) ||
>  	    !migrate_folio_add(folio, qp->pagelist, qp->flags))

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4