Re: [PATCH 0/2] mm/huge_memory: fix move_pages_huge_pmd() for huge zero pages

[David Hildenbrand (Arm)]

On 2/18/26 04:44, Chris Down wrote:
> Two fixes for the huge zero page path in move_pages_huge_pmd()
> (UFFDIO_MOVE).
>
> Patch 1 fixes a use of NULL folio introduced by the folio_mk_pmd()
> conversion in commit e3981db444a0 ("mm: add folio_mk_pmd()").
> mk_huge_pmd(src_page, ...) with folio_mk_pmd(src_folio, ...) in the huge
> zero page branch where src_folio is explicitly NULL. With
> SPARSEMEM_VMEMMAP this silently produces a PMD with a bogus PFN, on
> other memory models it is a NULL deref.
>
> Patch 2 adds the missing pmd_mkspecial() call that was omitted when
> commit d82d09e48219 ("mm/huge_memory: mark PMD mappings of the huge zero
> folio special") marked huge zero folio PMD mappings as special. Without
> it, vm_normal_page_pmd() on CONFIG_ARCH_HAS_PTE_SPECIAL architectures
> does not recognise the moved huge zero page as special, incorrectly
> treating it as a normal page and corrupting its refcount.

Thanks for the report and fixes. This sounds like something selftests 
should have detected.

Can we teach  tools/testing/selftests/mm/uffd-unit-tests.c to trigger 
that behavior on the huge zero folio?

We have uffd_move_pmd_test(), but it seems to focus on moving non-zero 
folios I suppose.

--
Cheers,

David