From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 512B23382CD for ; Wed, 1 Apr 2026 03:01:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775012510; cv=none; b=ZSHzpbzN9uNi7CZGPfawW4qf4wfGGH2zBWptfjyDerHL8iT6reAMvfHh8k5PEPSIiV9AWI/yFOf+78flw6718BjUIP5VVh0z34kenkL7b1C3XRyOYPdh2ESm+jx8yQX1jGbu4EcVTBIhk2KgkM/m3PeuhV6eGdHEwHvW7Q5hRIA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775012510; c=relaxed/simple; bh=ZVTmb5OLDlIKZZKOSd5dxlLCVxnnVXo3iP8zcwo5QKE=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=P+Z/60MaKCnVqdwsJUXTptBDvxH1T6ZVNALNWVBIAKluFi8osfCHp7MU6M7fDqiFSojcXE7CkKiTl4uEk7IMNcQJ6rhEbYvIUmoc/y5yy8WzhtCymPs8eKxicBUfj5NeZSiuzJV083THKwmnMUMDgD4jRCIG26blVl8ouq9XE+I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=lS5D11xR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="lS5D11xR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D0B9C19423; Wed, 1 Apr 2026 03:01:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1775012509; bh=ZVTmb5OLDlIKZZKOSd5dxlLCVxnnVXo3iP8zcwo5QKE=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=lS5D11xR9HeBMut1uKPuy64GlGGY9xrdhDDL7Ny5n7GBAM4eBRYTu+rRgRlUxkcFU zMpYZ+n9K97xXeniop8EGgYwaBjIHhgc6ko06AGvS+uQFkg6KbP8vchpD6vFH/Arl/ yZ4/gUv64ZK2t25GCTBTatjCh4yP2SvqRqanef/Q= Date: Tue, 31 Mar 2026 20:01:48 -0700 From: Andrew Morton To: David Carlier Cc: Peter Xu , Mike Rapoport , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v4] mm/userfaultfd: detect VMA replacement after copy retry in mfill_copy_folio_retry() Message-Id: <20260331200148.cc0c95deaf070579a68af041@linux-foundation.org> In-Reply-To: <20260331134158.622084-1-devnexen@gmail.com> References: <20260331134158.622084-1-devnexen@gmail.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Tue, 31 Mar 2026 14:41:58 +0100 David Carlier wrote: > In mfill_copy_folio_retry(), all locks are dropped to retry > copy_from_user() with page faults enabled. During this window, the VMA > can be replaced entirely (e.g. munmap + mmap + UFFDIO_REGISTER by > another thread), but the caller proceeds with a folio allocated from the > original VMA's backing store. > > Checking ops alone is insufficient: the replacement VMA could be the > same type (e.g. shmem -> shmem) with identical flags but a different > backing inode. Take a snapshot of the VMA's file and flags before > dropping locks, and compare after re-acquiring them. If anything > changed, bail out with -EINVAL. > > Use get_file()/fput() rather than ihold()/iput() to hold the file > reference across the lock-dropped window, avoiding potential deadlocks > from filesystem eviction under mmap_lock. Thanks, I've queued this as a squashable fix against mm-unstable's "shmem, userfaultfd: implement shmem uffd operations using vm_uffd_ops ongoing". I've fumbled the ball on your [2/2] unlikely() fix ;). Please resend that after -rc1.