Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] Missing `goto next;` causes aborted migration to corrupt page cache 
and page tables.
--

--- Patch [1]: [PATCH v3 1/6] mm/migrate_device: Clear stale mapping after 
freeing swapcache ---
commit 36bc19904d5fb8100fc812248c9247ad225d6ebe
Author: Arvind Yadav <[email protected]>

mm/migrate_device: Clear stale mapping after freeing swapcache

This commit fixes a bug in __migrate_device_pages() where a stale mapping
is used after a folio is removed from the swap cache. It refreshes the
mapping via folio_mapping() and resets 'nr' to 1 after a successful folio
split to process the resulting order-0 folios independently.

> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -1193,6 +1193,13 @@ static void __migrate_device_pages(unsigned long 
> *src_pfns,
>                                                        MIGRATE_PFN_COMPOUND);
>                                       goto next;
>                               }
> +
> +                             /*
> +                              * reset nr so that only first after-split folio
> +                              * is processed below
> +                              */
> +                             VM_WARN_ON_ONCE(folio_test_large(folio));
> +                             nr = 1;
>                       } else if ((src_pfns[i] & MIGRATE_PFN_MIGRATE) &&
>                               (dst_pfns[i] & MIGRATE_PFN_COMPOUND) &&
>                               !(src_pfns[i] & MIGRATE_PFN_COMPOUND)) {
>                               src_pfns[i] &= ~MIGRATE_PFN_MIGRATE;

[Severity: High]
This is a pre-existing issue, but does this error path in
__migrate_device_pages() miss a goto next statement?

When a non-compound source page is paired with a compound destination page,
the code correctly clears the MIGRATE_PFN_MIGRATE flag to abort the
migration, but it falls through instead of skipping to the next iteration.

Without a goto next, execution continues to the unconditional page cache
migration loop at the bottom of the function. This calls
folio_migrate_mapping(), which moves the page cache state to the new folio.

Later, because MIGRATE_PFN_MIGRATE was cleared, migrate_vma_finalize() will
restore the CPU page tables to map the old source page. Will this cause data
corruption by desynchronizing the CPU page tables from the page cache?

>                       }
>               }

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=1

Reply via email to