mm-migrate_device-move-softleaf_to_folio-inside-device-private-branch.patch removed from -mm tree

The quilt patch titled
Subject: mm/migrate_device: move softleaf_to_folio() inside device-private branch
has been removed from the -mm tree. Its filename was
mm-migrate_device-move-softleaf_to_folio-inside-device-private-branch.patch

This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Usama Arif <[email protected]>
Subject: mm/migrate_device: move softleaf_to_folio() inside device-private branch
Date: Mon, 6 Jul 2026 04:42:07 -0700

migrate_vma_collect_pmd() calls softleaf_to_folio() on a non-present PMD before checking the entry's type. softleaf_to_folio() converts the entry's offset to a PFN, which is only meaningful for migration or device-private entries.

A PMD swap entry's offset is a swap offset, not a PFN, so the lookup would either return a bogus folio pointer or trip pfn_to_page validation on a debug kernel. In the non-device-private path the returned folio is then unused (the OR short-circuits to migrate_vma_collect_skip()), but the lookup itself is already unsafe.

Move the softleaf_to_folio() call inside the device-private branch where the folio is actually needed, mirroring the equivalent change_non_present_huge_pmd() fix.

---

 mm/migrate_device.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

@@ -166,11 +166,14 @@ static int migrate_vma_collect_huge_pmd(
 	} else if (!pmd_present(*pmdp)) {
 		const softleaf_t entry = softleaf_from_pmd(*pmdp);
 
-		folio = softleaf_to_folio(entry);
-
 		if (!softleaf_is_device_private(entry) ||
-			!(migrate->flags & MIGRATE_VMA_SELECT_DEVICE_PRIVATE) ||
-			(folio->pgmap->owner != migrate->pgmap_owner)) {
+		    !(migrate->flags & MIGRATE_VMA_SELECT_DEVICE_PRIVATE)) {
+			spin_unlock(ptl);
+			return migrate_vma_collect_skip(start, end, walk);
+		}
+
+		folio = softleaf_to_folio(entry);
+		if (folio->pgmap->owner != migrate->pgmap_owner) {
 			spin_unlock(ptl);
 			return migrate_vma_collect_skip(start, end, walk);
 		}

_

Patches currently in -mm which might be from [email protected] are

mm-mempolicy-skip-non-present-pmds-when-queueing-folios.patch mm-madvise-skip-device-private-pmds-in-cold-and-pageout-walks.patch mm-huge_memory-skip-device-private-pmds-in-madvise_free_huge_pmd.patch mm-vmstat-mm-memcontrol-add-_monotonic-vmstat-readers.patch mm-vmscan-reduce-lru_lock-contention-via-vmstat-derived-scan-balance-cost.patch