Re: [PATCH net] rds: mark snapshot pages dirty in rds_info_getsockopt()

[Allison Henderson <achender@kernel.org>]

On Mon, 2026-06-08 at 02:32 -0700, Breno Leitao wrote:
> rds_info_getsockopt() pins the destination user pages with FOLL_WRITE and
> the RDS_INFO_* producers memcpy the snapshot into them through
> kmap_atomic(). Because that copy goes through the kernel direct map, the
> dirty bit on the user PTE is never set, so unpin_user_pages() releases the
> pages without marking them dirty. A file-backed destination page can then
> be reclaimed without writeback, silently discarding the copied data.
> 
> Use unpin_user_pages_dirty_lock() with make_dirty=true so the modified
> pages are marked dirty before they are unpinned.
> 
> Fixes: a8c879a7ee98 ("RDS: Info and stats")
> Signed-off-by: Breno Leitao <leitao@debian.org>
Hi Breno,

Thanks for adding the Fixes tag. One thing though: now that this is
standalone, it collides with "[PATCH net-next v3 2/2] rds: convert to
getsockopt_iter" since both rewrite the same unpin in the out: block of
rds_info_getsockopt().  

Easiest on everyone is to just keep it folded into the net-next series as
a three-patch set, rather than splitting the fix out to net.

With that, you can add my:
Reviewed-by: Allison Henderson <achender@kernel.org>

Thanks!
Allison


> ---
>  net/rds/info.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/rds/info.c b/net/rds/info.c
> index f1b29994934a..17061f6ff74e 100644
> --- a/net/rds/info.c
> +++ b/net/rds/info.c
> @@ -235,7 +235,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
>  
>  out:
>  	if (pages)
> -		unpin_user_pages(pages, nr_pages);
> +		unpin_user_pages_dirty_lock(pages, nr_pages, true);
>  	kfree(pages);
>  
>  	return ret;
> 
> ---
> base-commit: 9772589b57e44aedc240211c5c3f7a684a034d3a
> change-id: 20260608-rds_fix-92d6c7f04fe2
> 
> Best regards,