mm/huge_memory: fix move_pages_huge_pmd() for huge zero pages

Two fixes for the huge zero page path in move_pages_huge_pmd() (UFFDIO_MOVE).

Patch 1 fixes a use of NULL folio introduced by the folio_mk_pmd() conversion in commit e3981db444a0 ("mm: add folio_mk_pmd()"). mk_huge_pmd(src_page, ...) with folio_mk_pmd(src_folio, ...) in the huge zero page branch where src_folio is explicitly NULL. With SPARSEMEM_VMEMMAP this silently produces a PMD with a bogus PFN, on other memory models it is a NULL deref.

Patch 2 adds the missing pmd_mkspecial() call that was omitted when commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero folio special") marked huge zero folio PMD mappings as special. Without it, vm_normal_page_pmd() on CONFIG_ARCH_HAS_PTE_SPECIAL architectures does not recognise the moved huge zero page as special, incorrectly treating it as a normal page and corrupting its refcount.

Chris Down (2):
mm/huge_memory: Fix use of NULL folio in move_pages_huge_pmd() mm/huge_memory: Mark moved huge zero page PMD as special

 mm/huge_memory.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

2.51.2

Thanks for the report and fixes. This sounds like something selftests should have detected.

Can we teach tools/testing/selftests/mm/uffd-unit-tests.c to trigger that behavior on the huge zero folio?

We have uffd_move_pmd_test(), but it seems to focus on moving non-zero folios I suppose.

Cheers,

David