From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECE9C378817 for ; Mon, 30 Mar 2026 23:42:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774914157; cv=none; b=rw/xXa/OdunBLS7LJkBd73WEMv3R5oLPGzy0O+SfNQc9BPEST4XdQ7CqFiZ1X6NdWlj7myViG4vxHCJ7P9My58y8o6Lofv/o1tqEvgE2C/sF/kRPJZfdycjSU2BLbxhOTOkloQ5UW/3c2Eo5Rr7/TKPlmy0dIsEDadCkWxrA2Us= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774914157; c=relaxed/simple; bh=jv6cD/q7SMBzZgAN/xegm3WLMkkHCzw2zMQnbm3fxvo=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=VXjqGuR5JcL+MxOQz2+1nb/a/j/G1iIbQwgiFj9JY5y9IrVBD3ryCP7s9OHVa598XLC1XbA5TBDxhkXEmoOoDSbgrNJhZZR6ZW70CS19kiuI0hBkr9/FnNVFr8GvP5clWcq4YHZtEeWh5HoEK3in6OrcUq8bq21lNql81sy0tMw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=1VYQ4zdV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="1VYQ4zdV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 678AFC19423; Mon, 30 Mar 2026 23:42:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1774914156; bh=jv6cD/q7SMBzZgAN/xegm3WLMkkHCzw2zMQnbm3fxvo=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=1VYQ4zdVoyfMw3Nm2mUHwPV+28Ids9paCCz+j9OvZEYHP9XBbUK38E2Vnp/KyAlkF zBW7+rXFyv9xYdpL0Wtf3Z57p+4GvZXNHOkzLLR4kVQK54KDts/3uGxFpfpxjJEpr0 n6xJgcOy5+khOAUdD7z4GyYzZUTbmA3XXQElmyIA= Date: Mon, 30 Mar 2026 16:42:35 -0700 From: Andrew Morton To: David CARLIER Cc: Peter Xu , Mike Rapoport , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] mm/userfaultfd: detect VMA replacement after copy retry in mfill_copy_folio_retry() Message-Id: <20260330164235.1d1c8968993d5409f1922ce4@linux-foundation.org> In-Reply-To: References: <20260330202909.136776-1-devnexen@gmail.com> <20260330134021.171441c4c236b03efebc9a77@linux-foundation.org> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 30 Mar 2026 22:32:58 +0100 David CARLIER wrote: > The userspace-visible effect is a kernel NULL pointer dereference. When > a shared shmem VMA gets replaced by an anonymous VMA during the > retry > window, the stale ops->filemap_add() ends up calling > shmem_mfill_filemap_add() which dereferences vma->vm_file via > file_inode(). Since vm_file is NULL for anonymous mappings, this is a > straight kernel oops. > > The window is particularly wide when copy_from_user() blocks on slow > backing stores (FUSE, NFS) as it runs with page faults enabled. > > The Fixes target would be 56a3706fd7f9 ("shmem, userfaultfd: > implement > shmem uffd operations using vm_uffd_ops") but that's mm-unstable only, > so no Cc: stable for now. Ah, OK, thanks. I'll add a note to "shmem, userfaultfd: implement shmem uffd operations using vm_uffd_ops" for now, let's see what Mike thinks.