Skip to contentSkip to conversation

userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry

PATCH Applied Suren Baghdasaryan 2 participants 2 messages Aug 7, 2025 – Aug 8, 2025

Subsystems (3)
Stable branch Memory management userfaultfd
lore
Share & tools
lore

Suren Baghdasaryan

author
#0 lore raw

PATCH v5 1/1 userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry

When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swp_entry_t. Add the missing check and let split_huge_pmd() handle migration entries. While at it also remove unnecessary folio check.

Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Reported-by [email protected]
Closes https://lore.kernel.org/all/[email protected]/ open here
Signed-off-by Suren Baghdasaryan <[email protected]>
Reviewed-by Peter Xu <[email protected]>
Cc [email protected]

---
Applies to mm-unstable after reverting older v4 [1] version.

Changes since v4 [1]
- Removed extra folio check, per David Hildenbrand

[1] https://lore.kernel.org/all/[email protected]/

 mm/userfaultfd.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)
mm/userfaultfd.c +10 -7
index 5431c9dd7fd7..aefdf3a812a1 100644
@@ -1826,13 +1826,16 @@ ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
 			/* Check if we can move the pmd without splitting it. */
 			if (move_splits_huge_pmd(dst_addr, src_addr, src_start + len) ||
 			    !pmd_none(dst_pmdval)) {
-				struct folio *folio = pmd_folio(*src_pmd);
-
-				if (!folio || (!is_huge_zero_folio(folio) &&
-					       !PageAnonExclusive(&folio->page))) {
-					spin_unlock(ptl);
-					err = -EBUSY;
-					break;
+				/* Can be a migration entry */
+				if (pmd_present(*src_pmd)) {
+					struct folio *folio = pmd_folio(*src_pmd);
+
+					if (!is_huge_zero_folio(folio) &&
+					    !PageAnonExclusive(&folio->page)) {
+						spin_unlock(ptl);
+						err = -EBUSY;
+						break;
+					}
 				}
 
 				spin_unlock(ptl);
Signature · 1 line
2.50.1.703.g449372360f-goog
Acked-by on v5 1/1
#1 lore raw
Quoted 37 lines · Suren Baghdasaryan

When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swp_entry_t. Add the missing check and let split_huge_pmd() handle migration entries. While at it also remove unnecessary folio check.

Fixes adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Reported-by [email protected]
Closes https://lore.kernel.org/all/[email protected]/ open here
Signed-off-by Suren Baghdasaryan <[email protected]>
Reviewed-by Peter Xu <[email protected]>
Cc [email protected]

---
Applies to mm-unstable after reverting older v4 [1] version.

Changes since v4 [1]
- Removed extra folio check, per David Hildenbrand

[1] https://lore.kernel.org/all/[email protected]/

  mm/userfaultfd.c | 17 ++++++++++-------
  1 file changed, 10 insertions(+), 7 deletions(-)
mm/userfaultfd.c +0 -7
index 5431c9dd7fd7..aefdf3a812a1 100644
@@ -1826,13 +1826,16 @@ ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
  			/* Check if we can move the pmd without splitting it. */
  			if (move_splits_huge_pmd(dst_addr, src_addr, src_start + len) ||
  			    !pmd_none(dst_pmdval)) {
-				struct folio *folio = pmd_folio(*src_pmd);
-
-				if (!folio || (!is_huge_zero_folio(folio) &&
-					       !PageAnonExclusive(&folio->page))) {
-					spin_unlock(ptl);
-					err = -EBUSY;
-					break;

mm/userfaultfd.c ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start, · line 1838

Quoted 10 lines
mm/userfaultfd.c +10 -0
+				/* Can be a migration entry */
+				if (pmd_present(*src_pmd)) {
+					struct folio *folio = pmd_folio(*src_pmd);
+
+					if (!is_huge_zero_folio(folio) &&
+					    !PageAnonExclusive(&folio->page)) {
+						spin_unlock(ptl);
+						err = -EBUSY;
+						break;
+					}
Acked-by David Hildenbrand <[email protected]>
Signature · 3 lines
Cheers,

David / dhildenb