tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm/userfaultfd: detect VMA type change after copy retry in mfill_copy_folio_retry()

mfill_copy_folio_retry() drops mmap_lock for the copy_from_user() call.
During this window, the VMA can be replaced with a different type (e.g.
hugetlb), making the caller's ops pointer stale. Subsequent use of the
stale ops would dispatch into the wrong per-vma handlers.

Capture the VMA's ops via vma_uffd_ops() before dropping the lock and
compare against the current vma_uffd_ops() after re-acquiring it.
Return -EAGAIN if they differ so the operation can be retried. This
avoids comparing against the caller's ops which may have been
overridden to anon_uffd_ops for MAP_PRIVATE file-backed mappings.

Link: https://lore.kernel.org/20260424183638.196227-1-devnexen@gmail.com
Fixes: 6ab703034f14 ("userfaultfd: mfill_atomic(): remove retry logic")
Reported-by: Usama Arif <usama.arif@linux.dev>
Closes: https://lore.kernel.org/all/20260410114809.3592720-1-usama.arif@linux.dev/
Signed-off-by: David Carlier <devnexen@gmail.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

David Carlier and committed by
Andrew Morton 292411fd ba13b28d

+11 -1
+11 -1
mm/userfaultfd.c
··· 443 443 return ret; 444 444 } 445 445 446 - static int mfill_copy_folio_retry(struct mfill_state *state, struct folio *folio) 446 + static int mfill_copy_folio_retry(struct mfill_state *state, 447 + struct folio *folio) 447 448 { 449 + const struct vm_uffd_ops *orig_ops = vma_uffd_ops(state->vma); 448 450 unsigned long src_addr = state->src_addr; 449 451 void *kaddr; 450 452 int err; ··· 466 464 err = mfill_get_vma(state); 467 465 if (err) 468 466 return err; 467 + 468 + /* 469 + * The VMA type may have changed while the lock was dropped 470 + * (e.g. replaced with a hugetlb mapping), making the caller's 471 + * ops pointer stale. 472 + */ 473 + if (vma_uffd_ops(state->vma) != orig_ops) 474 + return -EAGAIN; 469 475 470 476 err = mfill_establish_pmd(state); 471 477 if (err)