drm/pagemap: Clear driver-provided PFNs from migration PFN array

DRM pagemap overloads the migration PFN array to store driver-provided
PFNs before calling migrate_vma_*() to finalize the migration. If an
error occurs during the incremental copy phase, the migration PFN
entries are reverted to their original state. After reverting the
device-folio mutations, clear any remaining driver-provided PFNs to
avoid confusing the migrate_vma_*() helpers.

Also clear any driver-provided PFNs if populate_devmem_pfn() fails, as
a precaution against stale entries being interpreted as migration PFNs.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 3902846af36b ("drm/pagemap Fix error paths in drm_pagemap_migrate_to_devmem")
Fixes: ec265e1f1cfc ("drm/pagemap: Support source migration over interconnect")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Link: https://patch.msgid.link/20260721204353.1082632-1-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/drm_pagemap.c b/drivers/gpu/drm/drm_pagemap.c
index 15c78eca180b7b744051115d1d307818dd8b150e..892b325fa99b8f64f723059cd4defa1af59128d6 100644 (file)
--- a/drivers/gpu/drm/drm_pagemap.c
+++ b/drivers/gpu/drm/drm_pagemap.c
@@ -727,8 +727,10 @@ int drm_pagemap_migrate_to_devmem(struct drm_pagemap_devmem *devmem_allocation,
        }
 
        err = ops->populate_devmem_pfn(devmem_allocation, npages, migrate.dst);
-       if (err)
-               goto err_aborted_migration;
+       if (err) {
+               npages = 0;
+               goto err_finalize;
+       }
 
        own_pages = 0;
 
@@ -807,8 +809,11 @@ next:
                msecs_to_jiffies(mdetails->timeslice_ms);
 
 err_finalize:
-       if (err)
+       if (err) {
                drm_pagemap_migration_unlock_put_pages(npages, migrate.dst);
+               for (i = npages; i < npages_in_range(start, end); ++i)
+                       migrate.dst[i] = 0;
+       }
 err_aborted_migration:
        migrate_vma_pages(&migrate);