Re: [PATCH v2] mm/gup: honour FOLL_PIN in NOMMU __get_user_pages_locked()

["David Hildenbrand (Arm)" <david@kernel.org>]

On 4/24/26 15:38, Andrew Morton wrote:
> On Thu, 23 Apr 2026 16:28:04 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
>> The !CONFIG_MMU implementation of __get_user_pages_locked() takes a bare
>> get_page() reference for each page regardless of foll_flags:
>> 	if (pages[i])
>> 		get_page(pages[i]);
>>
>> This is reached from pin_user_pages*() with FOLL_PIN set.
>> unpin_user_page() is shared between MMU and NOMMU configurations and
>> unconditionally calls gup_put_folio(..., FOLL_PIN), which subtracts
>> GUP_PIN_COUNTING_BIAS (1024) from the folio refcount.
>>
>> This means that pin adds 1, and then unpin will subtract 1024.
>>
>> If a user maps a page (refcount 1), registers it 1023 times as an
>> io_uring fixed buffer (1023 pin_user_pages calls -> refcount 1024), then
>> unregisters: the first unpin_user_page subtracts 1024, refcount hits 0,
>> the page is freed and returned to the buddy allocator.  The remaining
>> 1022 unpins write into whatever was reallocated, and the user's VMA
>> still maps the freed page (NOMMU has no MMU to invalidate it).
>> Reallocating the page for an io_uring pbuf_ring then lets userspace
>> corrupt the new owner's data through the stale mapping.
>>
>> Use try_grab_folio() which adds GUP_PIN_COUNTING_BIAS for FOLL_PIN and 1
>> for FOLL_GET, mirroring the CONFIG_MMU path so pin and unpin are
>> symmetric.
> 
> Battle of the bots?
> 	https://sashiko.dev/#/patchset/2026042303-vendor-outright-b9d2@gregkh

It references the

	if (pages && !(flags & FOLL_PIN))
		flags |= FOLL_GET;

I'm not sure if there is actual NOMMU code that triggers it. For example,
uprobes uses that pattern, but I suspect that that's not a thing on NOMMU.


Probably best to just squash:

diff --git a/mm/gup.c b/mm/gup.c
index ad9ded39609c..44bd28cf6e00 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1988,6 +1988,9 @@ static long __get_user_pages_locked(struct mm_struct *mm,
unsigned long start,
        if (!nr_pages)
                return 0;

+       if (pages && !(foll_flags & FOLL_PIN))
+               foll_flags |= FOLL_GET;
+
        /*
         * The internal caller expects GUP to manage the lock internally and the
         * lock must be released when this returns.


-- 
Cheers,

David