Re: + lib-test_hmm-evict-device-pages-on-file-close-to-avoid-use-after-free.patch added to mm-new branch

[Zenghui Yu <zenghui.yu@linux.dev>]

On 4/1/26 8:33 AM, Andrew Morton wrote:
> The patch titled
>      Subject: lib: test_hmm: evict device pages on file close to avoid use-after-free
> has been added to the -mm mm-new branch.  Its filename is
>      lib-test_hmm-evict-device-pages-on-file-close-to-avoid-use-after-free.patch
> 
> This patch will shortly appear at
>      https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/lib-test_hmm-evict-device-pages-on-file-close-to-avoid-use-after-free.patch
> 
> This patch will later appear in the mm-new branch at
>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Note, mm-new is a provisional staging ground for work-in-progress
> patches, and acceptance into mm-new is a notification for others take
> notice and to finish up reviews.  Please do not hesitate to respond to
> review feedback and post updated versions to replace or incrementally
> fixup patches in mm-new.
> 
> The mm-new branch of mm.git is not included in linux-next
> 
> If a few days of testing in mm-new is successful, the patch will me moved
> into mm.git's mm-unstable branch, which is included in linux-next
> 
> Before you just go and hit "reply", please:
>    a) Consider who else should be cc'ed
>    b) Prefer to cc a suitable mailing list as well
>    c) Ideally: find the original patch on the mailing list and do a
>       reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
> 
> The -mm tree is included into linux-next via various
> branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there most days
> 
> ------------------------------------------------------
> From: Alistair Popple <apopple@nvidia.com>
> Subject: lib: test_hmm: evict device pages on file close to avoid use-after-free
> Date: Tue, 31 Mar 2026 17:34:43 +1100
> 
> Patch series "Minor hmm_test fixes and cleanups".
> 
> Two bugfixes a cleanup for the HMM kernel selftests.  These were mostly
> reported by Zenghui Yu with special thanks to Lorenzo for analysing and
> pointing out the problems.
> 
> 
> This patch (of 3):
> 
> When dmirror_fops_release() is called it frees the dmirror struct but
> doesn't migrate device private pages back to system memory first.  This
> leaves those pages with a dangling zone_device_data pointer to the freed
> dmirror.
> 
> If a subsequent fault occurs on those pages (eg.  during coredump) the
> dmirror_devmem_fault() callback dereferences the stale pointer causing a
> kernel panic.  This was reported [1] when running mm/ksft_hmm.sh on arm64,
> where a test failure triggered SIGABRT and the resulting coredump walked
> the VMAs faulting in the stale device private pages.
> 
> Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in
> dmirror_fops_release() to migrate all device private pages back to system
> memory before freeing the dmirror struct.  The function is moved earlier
> in the file to avoid a forward declaration.
> 
> Link: https://lkml.kernel.org/r/20260331063445.3551404-1-apopple@nvidia.com
> Link: https://lkml.kernel.org/r/20260331063445.3551404-2-apopple@nvidia.com
> Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
> Signed-off-by: Alistair Popple <apopple@nvidia.com>
> Reported-by: Zenghui Yu <zenghui.yu@linux.dev>
> Closes: https://lore.kernel.org/linux-mm/8bd0396a-8997-4d2e-a13f-5aac033083d7@linux.dev/
> Reviewed-by: Balbir Singh <balbirs@nvidia.com>
> Cc: David Hildenbrand <david@kernel.org>
> Cc: Jason Gunthorpe <jgg@ziepe.ca>
> Cc: Leon Romanovsky <leon@kernel.org>
> Cc: Liam Howlett <liam.howlett@oracle.com>
> Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Mike Rapoport <rppt@kernel.org>
> Cc: Suren Baghdasaryan <surenb@google.com>
> Cc: Zenghui Yu <zenghui.yu@linux.dev>
> Cc: <stable@vger,kernel.org>

Cc: <stable@vger.kernel.org>

?

Thanks,
Zenghui