Re: [PATCH 1/5] mm: do not call vm_ops->access with FOLL_ANON

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Thu, Nov 12, 2026 at 11:08:57PM +0100, David Hildenbrand (Arm) wrote:
> From: Chris Mason <mason@kernel.org>
>
> Reading /proc/<pid>/cmdline or /proc/<pid>/environ can block in a device
> driver, or read device memory, if the virtual addresses point at a device
> mapping.
>
> Ever since commit 7f7ccc2ccc2e ("proc: do not access cmdline nor environ
> from file-backed areas") we use FOLL_ANON to only read from anonymous
> memory. While GUP properly handles FOLL_ANON, __access_remote_vm()
> will fall back on GUP errors to vma->vm_ops->access() without similarly
> considering the flag.
>
> Fix it by not calling vm_ops->access if FOLL_ANON was specified, to
> truly limit it to anonymous memory only.
>
> Fixes: 7f7ccc2ccc2e ("proc: do not access cmdline nor environ from file-backed areas")
> Signed-off-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> [ david: simplify description; slightly rework implementation ]
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

LGTM so:

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
>  mm/memory.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/mm/memory.c b/mm/memory.c
> index 1a0ec09c56fd7..d4370c1b331c9 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -7398,6 +7398,9 @@ static int __access_remote_vm(struct mm_struct *mm, unsigned long addr,
>  				continue;
>  			}
>
> +			if (gup_flags & FOLL_ANON)
> +				break;
> +
>  			/*
>  			 * Check if this is a VM_IO | VM_PFNMAP VMA, which
>  			 * we can access using slightly different code.
>
> --
> 2.43.0
>

--
Cheers, Lorenzo