* + userfaultfd-mfill_atomic-remove-retry-logic-fix.patch added to mm-unstable branch
@ 2026-04-02 18:20 Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-04-02 18:20 UTC (permalink / raw)
To: mm-commits, willy, vbabka, surenb, shuah, seanjc, peterx,
pbonzini, osalvador, muchun.song, mhocko, ljs, liam.howlett,
kalyazin, jthoughton, hughd, harry.yoo, harry, david, baolin.wang,
axelrasmussen, avagin, aarcange, rppt, akpm
The patch titled
Subject: userfaultfd: remove safety measure of not returning ENOENT from _copy
has been added to the -mm mm-unstable branch. Its filename is
userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: : Mike Rapoport (Microsoft) <rppt@kernel.org>
Subject: userfaultfd: remove safety measure of not returning ENOENT from _copy
Date: Thu Apr 2 16:38:39 2026 +0300
Link: https://lkml.kernel.org/r/ac5zcDUY8CFHr6Lw@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrei Vagin <avagin@google.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: Harry Yoo (Oracle) <harry@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nikita Kalyazin <kalyazin@amazon.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/userfaultfd.c | 3 ---
1 file changed, 3 deletions(-)
--- a/mm/userfaultfd.c~userfaultfd-mfill_atomic-remove-retry-logic-fix
+++ a/mm/userfaultfd.c
@@ -530,9 +530,6 @@ err_filemap_remove:
ops->filemap_remove(folio, state->vma);
err_folio_put:
folio_put(folio);
- /* Don't return -ENOENT so that our caller won't retry */
- if (ret == -ENOENT)
- ret = -EFAULT;
return ret;
}
_
Patches currently in -mm which might be from rppt@kernel.org are
userfaultfd-introduce-mfill_copy_folio_locked-helper.patch
userfaultfd-introduce-struct-mfill_state.patch
userfaultfd-introduce-mfill_establish_pmd-helper.patch
userfaultfd-introduce-mfill_get_vma-and-mfill_put_vma.patch
userfaultfd-retry-copying-with-locks-dropped-in-mfill_atomic_pte_copy.patch
userfaultfd-move-vma_can_userfault-out-of-line.patch
userfaultfd-introduce-vm_uffd_ops.patch
shmem-userfaultfd-use-a-vma-callback-to-handle-uffdio_continue.patch
userfaultfd-introduce-vm_uffd_ops-alloc_folio.patch
shmem-userfaultfd-implement-shmem-uffd-operations-using-vm_uffd_ops.patch
userfaultfd-mfill_atomic-remove-retry-logic.patch
userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
* + userfaultfd-mfill_atomic-remove-retry-logic-fix.patch added to mm-unstable branch
@ 2026-04-02 18:21 Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-04-02 18:21 UTC (permalink / raw)
To: mm-commits, willy, vbabka, surenb, shuah, seanjc, peterx,
pbonzini, osalvador, muchun.song, mhocko, ljs, liam.howlett,
kalyazin, jthoughton, hughd, harry.yoo, harry, david, baolin.wang,
axelrasmussen, avagin, aarcange, rppt, akpm
The patch titled
Subject: userfaultfd: remove safety measure of not returning ENOENT from _copy
has been added to the -mm mm-unstable branch. Its filename is
userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: Mike Rapoport (Microsoft) <rppt@kernel.org>
Subject: userfaultfd: remove safety measure of not returning ENOENT from _copy
Date: Thu Apr 2 16:38:39 2026 +0300
Link: https://lkml.kernel.org/r/ac5zcDUY8CFHr6Lw@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrei Vagin <avagin@google.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: Harry Yoo (Oracle) <harry@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nikita Kalyazin <kalyazin@amazon.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/userfaultfd.c | 3 ---
1 file changed, 3 deletions(-)
--- a/mm/userfaultfd.c~userfaultfd-mfill_atomic-remove-retry-logic-fix
+++ a/mm/userfaultfd.c
@@ -530,9 +530,6 @@ err_filemap_remove:
ops->filemap_remove(folio, state->vma);
err_folio_put:
folio_put(folio);
- /* Don't return -ENOENT so that our caller won't retry */
- if (ret == -ENOENT)
- ret = -EFAULT;
return ret;
}
_
Patches currently in -mm which might be from rppt@kernel.org are
userfaultfd-introduce-mfill_copy_folio_locked-helper.patch
userfaultfd-introduce-struct-mfill_state.patch
userfaultfd-introduce-mfill_establish_pmd-helper.patch
userfaultfd-introduce-mfill_get_vma-and-mfill_put_vma.patch
userfaultfd-retry-copying-with-locks-dropped-in-mfill_atomic_pte_copy.patch
userfaultfd-move-vma_can_userfault-out-of-line.patch
userfaultfd-introduce-vm_uffd_ops.patch
shmem-userfaultfd-use-a-vma-callback-to-handle-uffdio_continue.patch
userfaultfd-introduce-vm_uffd_ops-alloc_folio.patch
shmem-userfaultfd-implement-shmem-uffd-operations-using-vm_uffd_ops.patch
userfaultfd-mfill_atomic-remove-retry-logic.patch
userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
* + userfaultfd-mfill_atomic-remove-retry-logic-fix.patch added to mm-unstable branch
@ 2026-04-09 15:40 Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-04-09 15:40 UTC (permalink / raw)
To: mm-commits, willy, vbabka, surenb, shuah, seanjc, rppt, peterx,
pbonzini, osalvador, muchun.song, mhocko, ljs, liam.howlett,
kalyazin, jthoughton, hughd, harry.yoo, harry, david, baolin.wang,
axelrasmussen, avagin, aarcange, devnexen, akpm
The patch titled
Subject: mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()
has been added to the -mm mm-unstable branch. Its filename is
userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: David Carlier <devnexen@gmail.com>
Subject: mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()
Date: Thu, 9 Apr 2026 13:06:53 +0100
mfill_copy_folio_retry() drops mmap_lock for the copy_from_user() call.
During this window, the VMA can be replaced with a different type (e.g.
hugetlb), making the caller's ops pointer stale. Subsequent use of the
stale ops can lead to incorrect folio handling or a kernel crash.
Pass the caller's ops into mfill_copy_folio_retry() and compare against
the current vma_uffd_ops() after re-acquiring the lock. Return -EAGAIN if
they differ so the operation can be retried.
Link: https://lkml.kernel.org/r/20260409120653.290386-1-devnexen@gmail.com
Fixes: 59da5c32ffa3 ("userfaultfd: mfill_atomic(): remove retry logic")
Signed-off-by: David Carlier <devnexen@gmail.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrei Vagin <avagin@google.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: Harry Yoo (Oracle) <harry@kernel.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nikita Kalyazin <kalyazin@amazon.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/userfaultfd.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/mm/userfaultfd.c~userfaultfd-mfill_atomic-remove-retry-logic-fix
+++ a/mm/userfaultfd.c
@@ -443,7 +443,9 @@ static int mfill_copy_folio_locked(struc
return ret;
}
-static int mfill_copy_folio_retry(struct mfill_state *state, struct folio *folio)
+static int mfill_copy_folio_retry(struct mfill_state *state,
+ const struct vm_uffd_ops *ops,
+ struct folio *folio)
{
unsigned long src_addr = state->src_addr;
void *kaddr;
@@ -465,6 +467,14 @@ static int mfill_copy_folio_retry(struct
if (err)
return err;
+ /*
+ * The VMA type may have changed while the lock was dropped
+ * (e.g. replaced with a hugetlb mapping), making the caller's
+ * ops pointer stale.
+ */
+ if (vma_uffd_ops(state->vma) != ops)
+ return -EAGAIN;
+
err = mfill_establish_pmd(state);
if (err)
return err;
@@ -495,7 +505,7 @@ static int __mfill_atomic_pte(struct mfi
* will take care of unlocking if needed.
*/
if (unlikely(ret)) {
- ret = mfill_copy_folio_retry(state, folio);
+ ret = mfill_copy_folio_retry(state, ops, folio);
if (ret)
goto err_folio_put;
}
_
Patches currently in -mm which might be from devnexen@gmail.com are
mm-hugetlb-restore-reservation-on-error-in-hugetlb_mfill_atomic_pte-resubmission-path.patch
userfaultfd-mfill_atomic-remove-retry-logic-fix.patch
mm-page_io-use-sio-len-for-pswpin-accounting-in-sio_read_complete.patch
ocfs2-use-get_random_u32-where-appropriate.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-09 15:40 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-09 15:40 + userfaultfd-mfill_atomic-remove-retry-logic-fix.patch added to mm-unstable branch Andrew Morton
-- strict thread matches above, loose matches on Subject: below --
2026-04-02 18:21 Andrew Morton
2026-04-02 18:20 Andrew Morton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox