Gavin Guo 22f6368768 mm/huge_memory: fix dereferencing invalid pmd migration entry ... commit be6e843fc5 upstream. When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrated below. To prevent this invalid access, it is necessary to check the PMD migration entry and return early. In this context, there is no need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the equality of the target folio. Since the PMD migration entry is locked, it cannot be served as the target. Mailing list discussion and explanation from Hugh Dickins: "An anon_vma lookup points to a location which may contain the folio of interest, but might instead contain another folio: and weeding out those other folios is precisely what the "folio != pmd_folio((*pmd)" check (and the "risk of replacing the wrong folio" comment a few lines above it) is for." BUG: unable to handle page fault for address: ffffea60001db008 CPU: 0 UID: 0 PID: 2199114 Comm: tee Not tainted 6.14.0+ #4 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:split_huge_pmd_locked+0x3b5/0x2b60 Call Trace: <TASK> try_to_migrate_one+0x28c/0x3730 rmap_walk_anon+0x4f6/0x770 unmap_folio+0x196/0x1f0 split_huge_page_to_list_to_order+0x9f6/0x1560 deferred_split_scan+0xac5/0x12a0 shrinker_debugfs_scan_write+0x376/0x470 full_proxy_write+0x15c/0x220 vfs_write+0x2fc/0xcb0 ksys_write+0x146/0x250 do_syscall_64+0x6a/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e The bug is found by syzkaller on an internal kernel, then confirmed on upstream. Link: https://lkml.kernel.org/r/20250421113536.3682201-1-gavinguo@igalia.com Link: https://lore.kernel.org/all/20250414072737.1698513-1-gavinguo@igalia.com/ Link: https://lore.kernel.org/all/20250418085802.2973519-1-gavinguo@igalia.com/ Fixes: 84c3fc4e9c ("mm: thp: check pmd migration entry in common path") Signed-off-by: Gavin Guo <gavinguo@igalia.com> Acked-by: David Hildenbrand <david@redhat.com> Acked-by: Hugh Dickins <hughd@google.com> Acked-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Gavin Shan <gshan@redhat.com> Cc: Florent Revest <revest@google.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Miaohe Lin <linmiaohe@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> [gavin: backport the migration checking logic to __split_huge_pmd] Signed-off-by: Gavin Guo <gavinguo@igalia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-06-27 11:07:38 +01:00
..
damon	mm/damon/vaddr: fix issue in damon_va_evenly_split_region()	2024-12-14 19:54:52 +01:00
kasan	kasan: make report_lock a raw spinlock	2024-12-14 19:54:50 +01:00
kfence	kfence: skip __GFP_THISNODE allocations on NUMA systems	2025-02-21 13:49:48 +01:00
kmsan	dma: kmsan: export kmsan_handle_dma() for modules	2025-03-13 12:53:15 +01:00
backing-dev.c	writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs	2023-04-26 14:28:39 +02:00
balloon_compaction.c	mm: Convert all PageMovable users to movable_operations	2022-08-02 12:34:03 -04:00
bootmem_info.c	bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem	2022-08-28 14:02:45 -07:00
cma_debug.c	mm/cma_debug: show complete cma name in debugfs directories	2022-09-11 20:25:50 -07:00
cma_sysfs.c
cma.c	mm/cma: drop incorrect alignment check in cma_init_reserved_mem	2024-06-16 13:41:39 +02:00
cma.h	mm/cma: provide option to opt out from exposing pages on activation failure	2022-03-22 15:57:09 -07:00
compaction.c	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations	2024-04-03 15:19:42 +02:00
debug_page_ref.c
debug_vm_pgtable.c	docs: rename Documentation/vm to Documentation/mm	2022-06-27 12:52:53 -07:00
debug.c	mm: remove the vma linked list	2022-09-26 19:46:26 -07:00
dmapool.c	mm/dmapool.c: revert "make dma pool to use kmalloc_node"	2022-01-15 16:30:28 +02:00
early_ioremap.c	mm/early_ioremap: declare early_memremap_pgprot_adjust()	2022-03-22 15:57:11 -07:00
fadvise.c	riscv: compat: syscall: Add compat_sys_call_table implementation	2022-04-26 13:36:25 -07:00
failslab.c	mm: fix unexpected changes to {failslab|fail_page_alloc}.attr	2022-11-22 18:50:44 -08:00
filemap.c	mm: fix filemap_get_folios_contig returning batches of identical folios	2025-04-25 10:43:54 +02:00
folio-compat.c	mm: remove try_to_free_swap()	2022-10-03 14:02:53 -07:00
frontswap.c	frontswap: don't call ->init if no ops are registered	2022-09-26 12:14:34 -07:00
gup_test.c	mm: rename is_pinnable_page() to is_longterm_pinnable_page()	2022-07-17 17:14:27 -07:00
gup_test.h
gup.c	mm: Fix is_zero_page() usage in try_grab_page()	2025-04-25 10:44:01 +02:00
highmem.c	highmem: fix kmap_to_page() for kmap_local_page() addresses	2022-10-12 18:51:51 -07:00
hmm.c	mm/swap: add swp_offset_pfn() to fetch PFN from swap entry	2022-09-26 19:46:05 -07:00
huge_memory.c	mm/huge_memory: fix dereferencing invalid pmd migration entry	2025-06-27 11:07:38 +01:00
hugetlb_cgroup.c	mm/hugetlb_cgroup: convert hugetlb_cgroup_uncharge_page() to folios	2024-05-17 11:55:52 +02:00
hugetlb_vmemmap.c	mm: hugetlb_vmemmap: fix a race between vmemmap pmd split	2023-09-19 12:27:56 +02:00
hugetlb_vmemmap.h	mm: hugetlb_vmemmap: improve hugetlb_vmemmap code readability	2022-08-08 18:06:43 -07:00
hugetlb.c	mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race	2025-06-27 11:07:38 +01:00
hwpoison-inject.c	mm/hwpoison: add __init/__exit annotations to module init/exit funcs	2022-10-03 14:03:05 -07:00
init-mm.c	mm: remove rb tree.	2022-09-26 19:46:16 -07:00
internal.h	mm: unconditionally close VMAs on error	2024-11-22 15:37:34 +01:00
interval_tree.c
io-mapping.c
ioremap.c	mm: ioremap: Add ioremap/iounmap_allowed()	2022-06-27 12:22:31 +01:00
Kconfig	mm: z3fold: deprecate CONFIG_Z3FOLD	2024-10-17 15:22:05 +02:00
Kconfig.debug	mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM	2023-06-14 11:15:29 +02:00
khugepaged.c	mm: khugepaged: fix kernel BUG in hpage_collapse_scan_file()	2024-08-29 17:30:17 +02:00
kmemleak.c	mm: kmemleak: fix upper boundary check for physical address objects	2025-02-21 13:49:49 +01:00
ksm.c	mm/ksm: fix race with VMA iteration and mm_struct teardown	2023-03-30 12:49:29 +02:00
list_lru.c	mm: kmem: make mem_cgroup_from_obj() vmalloc()-safe	2022-06-16 19:48:31 -07:00
maccess.c	mm: Fix copy_from_user_nofault().	2023-06-28 11:12:17 +02:00
madvise.c	mm,madvise,hugetlb: check for 0-length range after end address adjustment	2025-03-07 16:56:39 +01:00
Makefile	mm: memcontrol: drop dead CONFIG_MEMCG_SWAP config symbol	2022-10-03 14:03:36 -07:00
mapping_dirty_helpers.c	mm: move tlb_flush_pending inline helpers to mm_inline.h	2022-01-15 16:30:27 +02:00
memblock.c	x86/numa: Fix the address overlap check in numa_fill_memblks()	2024-03-01 13:26:36 +01:00
memcontrol.c	memcg: always call cond_resched() after fn()	2025-06-04 14:40:21 +02:00
memfd.c	memfd: check for non-NULL file_seals in memfd_create() syscall	2023-06-28 11:12:27 +02:00
memory_hotplug.c	hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio	2025-05-22 14:10:09 +02:00
memory-failure.c	mm/hwpoison: do not send SIGBUS to processes with recovered clean pages	2025-04-25 10:43:42 +02:00
memory-tiers.c	memory tier: release the new_memtier in find_create_memory_tier()	2023-03-10 09:34:27 +01:00
memory.c	mm: fix apply_to_existing_page_range()	2025-04-25 10:44:04 +02:00
mempolicy.c	mm/numa_balancing: teach mpol_to_str about the balancing mode	2024-08-03 08:49:40 +02:00
mempool.c	mm/mempool: use might_alloc()	2022-06-16 19:48:30 -07:00
memremap.c	mm/memremap.c: map FS_DAX device memory as decrypted	2022-11-08 15:57:23 -08:00
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-04-03 15:19:36 +02:00
migrate_device.c	mm/migrate_device: return number of migrating pages in args->cpages	2022-11-22 18:50:43 -08:00
migrate.c	mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index	2025-05-22 14:10:08 +02:00
mincore.c	mm: teach mincore_hugetlb about pte markers	2023-03-22 13:34:03 +01:00
mlock.c	mm/mlock: drop dead code in count_mm_mlocked_page_nr()	2022-09-26 19:46:27 -07:00
mm_init.c	mm: multi-gen LRU: groundwork	2022-09-26 19:46:09 -07:00
mm_slot.h	mm: introduce common struct mm_slot	2022-10-03 14:02:43 -07:00
mmap_lock.c	mm: mmap_lock: replace get_memcg_path_buf() with on-stack buffer	2024-08-03 08:49:30 +02:00
mmap.c	mm/hugetlb: unshare page tables during VMA split, not before	2025-06-27 11:07:38 +01:00
mmu_gather.c	mm/khugepaged: fix GUP-fast interaction by sending IPI	2022-11-30 14:49:42 -08:00
mmu_notifier.c	mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()	2022-04-21 20:01:10 -07:00
mmzone.c	mm: multi-gen LRU: groundwork	2022-09-26 19:46:09 -07:00
mprotect.c	mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled in	2022-10-12 15:56:46 -07:00
mremap.c	mm, mremap: fix mremap() expanding for vma's with vm_ops->close()	2023-02-09 11:28:22 +01:00
msync.c	mm/msync: use vma_find() instead of vma linked list	2022-09-26 19:46:25 -07:00
nommu.c	mm: add nommu variant of vm_insert_pages()	2025-03-28 21:58:53 +01:00
oom_kill.c	memcg: fix soft lockup in the OOM process	2025-03-07 16:56:29 +01:00
page_alloc.c	mm/page_alloc.c: avoid infinite retries caused by cpuset race	2025-06-04 14:40:21 +02:00
page_counter.c	mm: page_counter: remove unneeded atomic ops for low/min	2022-09-11 20:26:01 -07:00
page_ext.c	mm/page_exit: fix kernel doc warning in page_ext_put()	2022-11-22 18:50:41 -08:00
page_idle.c	mm: don't be stuck to rmap lock on reclaim path	2022-05-19 14:08:54 -07:00
page_io.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
page_isolation.c	mm/page_isolation: fix clang deadcode warning	2022-10-28 13:37:22 -07:00
page_owner.c	mm: reuse pageblock_start/end_pfn() macro	2022-10-03 14:03:03 -07:00
page_poison.c
page_reporting.c
page_reporting.h
page_table_check.c	mm/page_table_check: fix crash on ZONE_DEVICE	2024-06-27 13:46:22 +02:00
page_vma_mapped.c	mm/swap: add swp_offset_pfn() to fetch PFN from swap entry	2022-09-26 19:46:05 -07:00
page-writeback.c	mm: fix ratelimit_pages update error in dirty_ratio_handler()	2025-06-27 11:07:30 +01:00
pagewalk.c	- Yu Zhao's Multi-Gen LRU patches are here. They've been under test in	2022-10-10 17:53:04 -07:00
percpu-internal.h	percpu: improve percpu_alloc_percpu event trace	2022-05-13 07:20:18 -07:00
percpu-km.c
percpu-stats.c	mm: use vmalloc_array and vcalloc for array allocations	2022-03-08 09:30:46 -05:00
percpu-vm.c
percpu.c	mm: percpu: use kmemleak_ignore_phys() instead of kmemleak_free()	2022-07-17 17:14:47 -07:00
pgalloc-track.h
pgtable-generic.c	mm: fix race between __split_huge_pmd_locked() and GUP-fast	2024-06-16 13:41:38 +02:00
process_vm_access.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
ptdump.c	mm: pagewalk: Fix race between unmap and page walker	2022-09-03 10:13:13 -07:00
readahead.c	mm/readahead: fix large folio support in async readahead	2025-01-09 13:30:06 +01:00
rmap.c	mm/rmap: reject hugetlb folios in folio_make_device_exclusive()	2025-04-25 10:43:42 +02:00
rodata_test.c	mm/rodata_test: use PAGE_ALIGNED() helper	2022-10-03 14:03:05 -07:00
secretmem.c	secretmem: disable memfd_secret() if arch cannot set direct map	2024-10-17 15:22:28 +02:00
shmem.c	mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling	2024-11-22 15:37:34 +01:00
shrinker_debug.c	mm: shrinkers: fix deadlock in shrinker debugfs	2023-02-22 12:59:46 +01:00
shuffle.c	mm/shuffle: convert module_param_call to module_param_cb	2022-10-03 14:03:07 -07:00
shuffle.h
slab_common.c	mm: krealloc: Fix MTE false alarm in __do_krealloc	2024-11-17 15:07:22 +01:00
slab.c	mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP	2023-03-30 12:49:23 +02:00
slab.h	- Yu Zhao's Multi-Gen LRU patches are here. They've been under test in	2022-10-10 17:53:04 -07:00
slob.c	Merge branch 'slab/for-6.1/kmalloc_size_roundup' into slab/for-next	2022-09-29 11:30:55 +02:00
slub.c	treewide: use prandom_u32_max() when possible, part 1	2022-10-11 17:42:55 -06:00
sparse-vmemmap.c	mm: hugetlb_vmemmap: move vmemmap code related to HugeTLB to hugetlb_vmemmap.c	2022-08-08 18:06:42 -07:00
sparse.c	x86/kaslr: Expose and use the end of the physical memory address space	2024-09-12 11:10:17 +02:00
swap_cgroup.c	mm: memcontrol: don't allocate cgroup swap arrays when memcg is disabled	2022-10-03 14:03:36 -07:00
swap_slots.c	mm/swap: convert put_swap_page() to put_swap_folio()	2022-10-03 14:02:46 -07:00
swap_state.c	swap_state: convert free_swap_cache() to use a folio	2022-10-03 14:02:51 -07:00
swap.c	mm: page_alloc: move mlocked flag clearance into free_pages_prepare()	2024-12-14 19:54:31 +01:00
swap.h	mm/swap: fix race when skipping swapcache	2024-03-01 13:26:32 +01:00
swapfile.c	mm/swapfile: skip HugeTLB pages for unuse_vma	2024-10-22 15:56:43 +02:00
truncate.c	mm: Fix missing folio invalidation calls during truncation	2024-09-04 13:25:00 +02:00
usercopy.c	mm: Fix copy_from_user_nofault().	2023-06-28 11:12:17 +02:00
userfaultfd.c	userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb	2024-02-23 09:12:51 +01:00
util.c	mm: unconditionally close VMAs on error	2024-11-22 15:37:34 +01:00
vmalloc.c	mm: don't skip arch_sync_kernel_mappings() in error paths	2025-03-13 12:53:15 +01:00
vmpressure.c	net-memcg: Fix scope of sockmem pressure indicators	2023-09-13 09:42:33 +02:00
vmscan.c	mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock	2025-04-25 10:43:42 +02:00
vmstat.c	vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event	2024-12-14 19:54:13 +01:00
workingset.c	mm/mglru: fix underprotected page cache	2023-12-20 17:00:26 +01:00
z3fold.c	mm: Convert all PageMovable users to movable_operations	2022-08-02 12:34:03 -04:00
zbud.c
zpool.c	zpool: remove the list of pools_head	2022-01-15 16:30:31 +02:00
zsmalloc.c	zsmalloc: allow only one active pool compaction context	2023-08-23 17:52:40 +02:00
zswap.c	mm: zswap: fix missing folio cleanup in writeback race path	2024-03-01 13:26:39 +01:00