From: sashiko-bot@kernel.org
To: "Kyle Zeng" <kylebot@openai.com>
Cc: linux-rdma@vger.kernel.org
Subject: Re: [PATCH] net/rds: Do not unpin a page after a failed atomic pin
Date: Fri, 30 Oct 2026 04:26:11 +0000 [thread overview]
Message-ID: <sashiko-outbox-190295@kernel.org> (raw)
In-Reply-To: <20261030042110.73571-1-kylebot@openai.com>
> rds_cmsg_atomic() assumes that a non-NULL output from rds_pin_pages()
> represents a pin that it owns. However, pin_user_pages_fast() can roll
> back a fast-GUP pin after racing fork() and then fail in the slow path,
> for example after a concurrent mprotect(PROT_NONE). The output slot can
> still contain the already-unpinned page.
>
> The common error path calls unpin_user_page() on that stale pointer.
> This can consume another subsystem's pin and allow the page to be
> freed while it is still in use.
>
> Clear page when rds_pin_pages() does not return one. The error path
> continues to release the page on errors after a successful pin, and
> successful requests retain their existing ownership and behavior. All
> four RDS atomic ancillary operations share this path.
>
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261030042110.73571-1-kylebot@openai.com?part=1
prev parent reply other threads:[~2026-10-30 4:26 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-30 4:21 [PATCH] net/rds: Do not unpin a page after a failed atomic pin Kyle Zeng
2026-10-30 4:23 ` netdev-bot+sinfo
2026-10-30 4:26 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-190295@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=kylebot@openai.com \
--cc=linux-rdma@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.