[to-be-updated] mm-gup-check-folio-mapping-under-folio-lock-in-memfd_pin_folios.patch removed from -mm tree

[to-be-updated] mm-gup-check-folio-mapping-under-folio-lock-in-memfd_pin_folios.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: mm/gup: check folio->mapping under folio lock in memfd_pin_folios()
has been removed from the -mm tree.  Its filename was
     mm-gup-check-folio-mapping-under-folio-lock-in-memfd_pin_folios.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Samiullah Khawaja <skhawaja@google.com>
Subject: mm/gup: check folio->mapping under folio lock in memfd_pin_folios()
Date: Sat, 31 Oct 2026 20:35:40 +0000

memfd_pin_folios() pins folios from the page cache without taking the
folio lock. So khugepaged or MADV_COLLAPSE can replace the folio after
its refcount check while memfd_pin_folios() still pins the old folio,
and the caller ends up with a folio that is no longer part of the memfd.

Lock the folio and recheck folio->mapping before pinning it, like other
page cache users do. If the folio was removed, retry the folio lookup
from the index that was removed.

Link: https://lore.kernel.org/20261031203540.2282507-1-skhawaja@google.com
Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios")
Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Andy Lutomirski <luto@amacapital.net>
Closes: https://lore.kernel.org/all/CALCETrV5eqg6d9=+BQhCpRwBNe3aCQiut8vxPBs8b7PToqjaHg@mail.gmail.com/
Cc: David Hildenbrand <david@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Chris Mason <mason@kernel.org>
Cc: <stable@vger.kernel.org>
---

 mm/gup.c |   17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

--- a/mm/gup.c~mm-gup-check-folio-mapping-under-folio-lock-in-memfd_pin_folios
+++ a/mm/gup.c
@@ -3464,7 +3464,7 @@ long memfd_pin_folios(struct file *memfd
 {
 	unsigned int flags, nr_folios, nr_found;
 	unsigned int i, pgshift = PAGE_SHIFT;
-	pgoff_t start_idx, end_idx;
+	pgoff_t start_idx, end_idx, retry_idx;
 	struct folio *folio = NULL;
 	struct folio_batch fbatch;
 	struct hstate *h;
@@ -3505,6 +3505,7 @@ long memfd_pin_folios(struct file *memfd
 			 * reason, we try to allocate them and add them to the
 			 * page cache.
 			 */
+			retry_idx = start_idx;
 			nr_found = filemap_get_folios_contig(memfd->f_mapping,
 							     &start_idx,
 							     end_idx,
@@ -3517,7 +3518,21 @@ long memfd_pin_folios(struct file *memfd
 			for (i = 0; i < nr_found; i++) {
 				folio = fbatch.folios[i];
 
+				/*
+				 * The folio might have been removed from the
+				 * page cache (e.g., truncated or collapsed)
+				 * after the lookup. Recheck under the folio
+				 * lock.
+				 */
+				folio_lock(folio);
+				if (unlikely(folio->mapping != memfd->f_mapping)) {
+					folio_unlock(folio);
+					start_idx = retry_idx;
+					break;
+				}
+
 				if (try_grab_folio(folio, 1, FOLL_PIN)) {
+					folio_unlock(folio);
 					folio_batch_release(&fbatch);
 					ret = -EINVAL;
 					goto err;
_

Patches currently in -mm which might be from skhawaja@google.com are