[to-be-updated] mm-filemap-convert-fault-and-readahead-logic-to-use-vma_flags_t-fix.patch removed from -mm tree

[to-be-updated] mm-filemap-convert-fault-and-readahead-logic-to-use-vma_flags_t-fix.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: mm/filemap: cache random-read flag before dropping fault lock
has been removed from the -mm tree.  Its filename was
     mm-filemap-convert-fault-and-readahead-logic-to-use-vma_flags_t-fix.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Andrew Morton <akpm@linux-foundation.org>
Subject: mm/filemap: cache random-read flag before dropping fault lock
Date: Thu, 05 Nov 2026 14:52:01 -0800

An unprivileged process racing a file-backed fault against munmap()
can potentially trigger a kernel oops in the forced-THP readahead path.

The conversion of do_sync_mmap_readahead() to vma_flags_t replaced its
saved vm_flags value with accesses through a VMA pointer. The random-read
flag is now tested after maybe_unlock_mmap_for_io() can release the
fault lock. That helper pins the file, not the VMA, so a concurrent
munmap() can free the VMA before the flag test.

Save the random-read flag before releasing the lock. Also remove the
redundant inner VMA declaration in the executable-mapping block.

Link: https://lore.kernel.org/au2_PPpdAMgRJZtX@gremlin
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/sashiko-outbox-200257@kernel.org
Cc: Lorenzo Stoakes (ARM) <ljs@kernel.org>
---

 mm/filemap.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/filemap.c~mm-filemap-convert-fault-and-readahead-logic-to-use-vma_flags_t-fix
+++ a/mm/filemap.c
@@ -3409,6 +3409,7 @@ static struct file *do_sync_mmap_readahe
 
 	if (force_thp_readahead) {
 		unsigned long folio_nr_pages = 1UL << thp_order;
+		bool random_read = vma_test(vma, VMA_RAND_READ_BIT);
 
 		fpin = maybe_unlock_mmap_for_io(vmf, fpin);
 		ractl._index &= ~(folio_nr_pages - 1);
@@ -3417,7 +3418,7 @@ static struct file *do_sync_mmap_readahe
 		 * Fetch two folios so we get the chance to actually
 		 * readahead, unless we've been told not to.
 		 */
-		if (!vma_test(vma, VMA_RAND_READ_BIT))
+		if (!random_read)
 			ra->size *= 2;
 		ra->async_size = folio_nr_pages;
 		ra->order = thp_order;
@@ -3437,7 +3438,6 @@ static struct file *do_sync_mmap_readahe
 		 * pad that might exist between sections, which would be a waste
 		 * of memory.
 		 */
-		struct vm_area_struct *vma = vmf->vma;
 		const unsigned long start = vma_start_pgoff(vma);
 		const unsigned long end = vma_end_pgoff(vma);
 		unsigned long ra_end;
_

Patches currently in -mm which might be from akpm@linux-foundation.org are

mm-mempolicy-use-one-node-set-for-interleave-weights.patch
maple_tree-fix-reverse-iterator-state-when-the-root-disappears.patch
shmem-consume-the-reserved-xattr-space-despite-remount.patch
selftests-mm-check-madv_cold-and-madv_pageout-on-partly-advised-thps-fix.patch
alloc_tag-introduce-ioctls-to-toggle-allocation-tracepoints-fix-fix.patch
alloc_tag-introduce-ioctls-to-toggle-allocation-tracepoints-fix.patch
mm-filemap-convert-fault-and-readahead-logic-to-use-vma_flags_t-fix-fix.patch
profile-account-for-partial-proc-profile-reads.patch
profile-simplify-proc-profile-read-layout.patch
ipc-msg-clamp-negative-msg_info-usage-counts.patch
squashfs-fix-leaked-page-locks-when-page-actor-allocation-fails-fix.patch
drivers-media-v4l2-core-v4l2-vp9c-reduce-inlining.patch