Re: [PATCH v3 1/6] mm/migrate_device: Clear stale mapping after freeing swapcache

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `goto next;` causes aborted migration to corrupt page cache and page tables.
--

--- Patch [1]: [PATCH v3 1/6] mm/migrate_device: Clear stale mapping after freeing swapcache ---
commit 36bc19904d5fb8100fc812248c9247ad225d6ebe
Author: Arvind Yadav <[email protected]>

mm/migrate_device: Clear stale mapping after freeing swapcache

This commit fixes a bug in __migrate_device_pages() where a stale mapping
is used after a folio is removed from the swap cache. It refreshes the
mapping via folio_mapping() and resets 'nr' to 1 after a successful folio
split to process the resulting order-0 folios independently.

> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -1193,6 +1193,13 @@ static void __migrate_device_pages(unsigned long *src_pfns,
>  							 MIGRATE_PFN_COMPOUND);
>  					goto next;
>  				}
> +
> +				/*
> +				 * reset nr so that only first after-split folio
> +				 * is processed below
> +				 */
> +				VM_WARN_ON_ONCE(folio_test_large(folio));
> +				nr = 1;
>  			} else if ((src_pfns[i] & MIGRATE_PFN_MIGRATE) &&
>  				(dst_pfns[i] & MIGRATE_PFN_COMPOUND) &&
>  				!(src_pfns[i] & MIGRATE_PFN_COMPOUND)) {
>  				src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;

[Severity: High]
This is a pre-existing issue, but does this error path in
__migrate_device_pages() miss a goto next statement?

When a non-compound source page is paired with a compound destination page,
the code correctly clears the MIGRATE_PFN_MIGRATE flag to abort the
migration, but it falls through instead of skipping to the next iteration.

Without a goto next, execution continues to the unconditional page cache
migration loop at the bottom of the function. This calls
folio_migrate_mapping(), which moves the page cache state to the new folio.

Later, because MIGRATE_PFN_MIGRATE was cleared, migrate_vma_finalize() will
restore the CPU page tables to map the old source page. Will this cause data
corruption by desynchronizing the CPU page tables from the page cache?

>  			}
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1