From 7d8746d7dc9cc4003661011424e5880ea7ae364b Mon Sep 17 00:00:00 2001 From: Hungyu Lin Date: Mon, 26 Oct 2026 19:53:29 +0000 Subject: [PATCH] mm/migrate: untag addresses when querying page nodes When move_pages() is used with nodes == NULL, do_pages_stat_array() passes each page address directly to vma_lookup(). A valid tagged address therefore fails the VMA lookup and gets -EFAULT in its status entry, instead of the node reported for the corresponding untagged address. The tagged address ABI permits these pointers, and the migration path already removes their tags. Apply the target mm's untagging rules to the query path as well, while holding its mmap read lock. Link: https://lore.kernel.org/20261026195330.46757-1-dennylin0707@gmail.com Fixes: 057d3389108e ("mm: untag user pointers passed to memory syscalls") Signed-off-by: Hungyu Lin Signed-off-by: Andrew Morton Reported-by: Sashiko Closes: https://lore.kernel.org/r/20260721183257.706661F000E9@smtp.kernel.org Acked-by: Zi Yan Acked-by: David Hildenbrand (Arm) Reviewed-by: Catalin Marinas Cc: Matthew Brost Cc: Joshua Hahn Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Cc: Andrey Konovalov Cc: Vincenzo Frascino Cc: Cc: --- mm/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/migrate.c b/mm/migrate.c index 7bdcdb57652f..d649a6cfce6c 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -2461,7 +2461,7 @@ static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages, mmap_read_lock(mm); for (i = 0; i < nr_pages; i++) { - unsigned long addr = (unsigned long)(*pages); + unsigned long addr = (unsigned long)untagged_addr_remote(mm, *pages); struct vm_area_struct *vma; struct folio_walk fw; struct folio *folio;