[RFC PATCH 0/2] Fix gup_test long-term pin ownership

[RFC PATCH 0/2] Fix gup_test long-term pin ownership

[Richard Cheng]

gup_test currently stores long-term pin state globally, allowing one
open file descriptor to block or release pins owned by another client.
Move this state to each open file description so independent clients
have isolated pin lifecycles.

Patch 1 moves long-term pin state from global variables to per-open
file state, preventing independent clients from affecting each other.

Patch 2 adds selftest coverage for concurrent pins and verifies that
stopping or closing one descriptor does not release another
descriptor's pin.


Richard Cheng (2):
  mm/gup_test: Track long-term pins per open file
  selftests/mm: Test per-open gup_test pin ownership

 mm/gup_test.c                             |  88 +++++---
 tools/testing/selftests/mm/gup_longterm.c | 258 +++++++++++++++++++++-
 2 files changed, 313 insertions(+), 33 deletions(-)


base-commit: 66498c75b4f8017f62d720d9b59675bdf3abce91
-- 
2.43.0

[RFC PATCH 1/2] mm/gup_test: Track long-term pins per open file

[Richard Cheng]

Long-term pin state is currently global, allowing one gup_test file
descriptor to block, stop, or release pins owned by another client.

Allocate the pin state for each open file and store it in
file->private_data. Serialize START, READ, and STOP with the per-open
mutex, and release only the pages owned by that file.

Descriptors duplicated through dup() or fork() continue sharing state
because they reference the same struct file. Keep the ioctl ABI and
same-file duplicate START behavior unchanged.

Reviewed-by: Koba Ko <kobak@nvidia.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 mm/gup_test.c | 88 +++++++++++++++++++++++++++++++++------------------
 1 file changed, 57 insertions(+), 31 deletions(-)

diff --git a/mm/gup_test.c b/mm/gup_test.c
index eb4c9cda16ed..d0bd84b66624 100644
--- a/mm/gup_test.c
+++ b/mm/gup_test.c
@@ -208,23 +208,25 @@ static int __gup_test_ioctl(unsigned int cmd,
 	return ret;
 }
 
-static DEFINE_MUTEX(pin_longterm_test_mutex);
-static struct page **pin_longterm_test_pages;
-static unsigned long pin_longterm_test_nr_pages;
+struct pin_longterm_test_state {
+	struct mutex mutex;
+	struct page **pages;
+	unsigned long nr_pages;
+};
 
-static inline void pin_longterm_test_stop(void)
+static inline void pin_longterm_test_stop(struct pin_longterm_test_state *state)
 {
-	if (pin_longterm_test_pages) {
-		if (pin_longterm_test_nr_pages)
-			unpin_user_pages(pin_longterm_test_pages,
-					 pin_longterm_test_nr_pages);
-		kvfree(pin_longterm_test_pages);
-		pin_longterm_test_pages = NULL;
-		pin_longterm_test_nr_pages = 0;
+	if (state->pages) {
+		if (state->nr_pages)
+			unpin_user_pages(state->pages, state->nr_pages);
+		kvfree(state->pages);
+		state->pages = NULL;
+		state->nr_pages = 0;
 	}
 }
 
-static inline int pin_longterm_test_start(unsigned long arg)
+static inline int pin_longterm_test_start(struct pin_longterm_test_state *state,
+					  unsigned long arg)
 {
 	long nr_pages, cur_pages, addr, remaining_pages;
 	int gup_flags = FOLL_LONGTERM;
@@ -233,7 +235,7 @@ static inline int pin_longterm_test_start(unsigned long arg)
 	int ret = 0;
 	bool fast;
 
-	if (pin_longterm_test_pages)
+	if (state->pages)
 		return -EINVAL;
 
 	if (copy_from_user(&args, (void __user *)arg, sizeof(args)))
@@ -263,12 +265,12 @@ static inline int pin_longterm_test_start(unsigned long arg)
 		return -EINTR;
 	}
 
-	pin_longterm_test_pages = pages;
-	pin_longterm_test_nr_pages = 0;
+	state->pages = pages;
+	state->nr_pages = 0;
 
-	while (nr_pages - pin_longterm_test_nr_pages) {
-		remaining_pages = nr_pages - pin_longterm_test_nr_pages;
-		addr = args.addr + pin_longterm_test_nr_pages * PAGE_SIZE;
+	while (nr_pages - state->nr_pages) {
+		remaining_pages = nr_pages - state->nr_pages;
+		addr = args.addr + state->nr_pages * PAGE_SIZE;
 
 		if (fast)
 			cur_pages = pin_user_pages_fast(addr, remaining_pages,
@@ -277,11 +279,11 @@ static inline int pin_longterm_test_start(unsigned long arg)
 			cur_pages = pin_user_pages(addr, remaining_pages,
 						   gup_flags, pages);
 		if (cur_pages < 0) {
-			pin_longterm_test_stop();
+			pin_longterm_test_stop(state);
 			ret = cur_pages;
 			break;
 		}
-		pin_longterm_test_nr_pages += cur_pages;
+		state->nr_pages += cur_pages;
 		pages += cur_pages;
 	}
 
@@ -290,19 +292,20 @@ static inline int pin_longterm_test_start(unsigned long arg)
 	return ret;
 }
 
-static inline int pin_longterm_test_read(unsigned long arg)
+static inline int pin_longterm_test_read(struct pin_longterm_test_state *state,
+					 unsigned long arg)
 {
 	__u64 user_addr;
 	unsigned long i;
 
-	if (!pin_longterm_test_pages)
+	if (!state->pages)
 		return -EINVAL;
 
 	if (copy_from_user(&user_addr, (void __user *)arg, sizeof(user_addr)))
 		return -EFAULT;
 
-	for (i = 0; i < pin_longterm_test_nr_pages; i++) {
-		void *addr = kmap_local_page(pin_longterm_test_pages[i]);
+	for (i = 0; i < state->nr_pages; i++) {
+		void *addr = kmap_local_page(state->pages[i]);
 		unsigned long ret;
 
 		ret = copy_to_user((void __user *)(unsigned long)user_addr, addr,
@@ -318,25 +321,26 @@ static inline int pin_longterm_test_read(unsigned long arg)
 static long pin_longterm_test_ioctl(struct file *filep, unsigned int cmd,
 				    unsigned long arg)
 {
+	struct pin_longterm_test_state *state = filep->private_data;
 	int ret = -EINVAL;
 
-	if (mutex_lock_killable(&pin_longterm_test_mutex))
+	if (mutex_lock_killable(&state->mutex))
 		return -EINTR;
 
 	switch (cmd) {
 	case PIN_LONGTERM_TEST_START:
-		ret = pin_longterm_test_start(arg);
+		ret = pin_longterm_test_start(state, arg);
 		break;
 	case PIN_LONGTERM_TEST_STOP:
-		pin_longterm_test_stop();
+		pin_longterm_test_stop(state);
 		ret = 0;
 		break;
 	case PIN_LONGTERM_TEST_READ:
-		ret = pin_longterm_test_read(arg);
+		ret = pin_longterm_test_read(state, arg);
 		break;
 	}
 
-	mutex_unlock(&pin_longterm_test_mutex);
+	mutex_unlock(&state->mutex);
 	return ret;
 }
 
@@ -375,15 +379,37 @@ static long gup_test_ioctl(struct file *filep, unsigned int cmd,
 	return 0;
 }
 
+static int gup_test_open(struct inode *inode, struct file *file)
+{
+	struct pin_longterm_test_state *state;
+	int ret;
+
+	ret = nonseekable_open(inode, file);
+	if (ret)
+		return ret;
+
+	state = kzalloc_obj(*state, GFP_KERNEL);
+	if (!state)
+		return -ENOMEM;
+
+	mutex_init(&state->mutex);
+	file->private_data = state;
+
+	return 0;
+}
+
 static int gup_test_release(struct inode *inode, struct file *file)
 {
-	pin_longterm_test_stop();
+	struct pin_longterm_test_state *state = file->private_data;
+
+	pin_longterm_test_stop(state);
+	kfree(state);
 
 	return 0;
 }
 
 static const struct file_operations gup_test_fops = {
-	.open = nonseekable_open,
+	.open = gup_test_open,
 	.unlocked_ioctl = gup_test_ioctl,
 	.compat_ioctl = compat_ptr_ioctl,
 	.release = gup_test_release,
-- 
2.43.0

[RFC PATCH 2/2] selftests/mm: Test per-open gup_test pin ownership

[Richard Cheng]

Long-term pin state should be isolated between independently opened
gup_test file descriptions, while descriptors created with dup() should
continue to share the state associated with their struct file.

Add tests using 2 independently opened gup_test descriptors. Verify that
stopping or closing the second descriptor doesn't disturb the first
descriptor's pin, that another START on the same descriptor fails with
EINVAL, and that READ fails with EINVAL after STOP.

Close the descriptor used by the existing test matrix before running the
ownership tests. Record whether gup_test was initially available so that
a later open failure is reported as a failure instead of being hidden as
a skip.

Also exercise the shared-file-description case: start a pin through the
original descriptor, verify that START through a duplicate fails with
EINVAL, close the original descriptor, and use the duplicate to READ and
STOP the pin

Reviewed-by: Koba Ko <kobak@nvidia.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 tools/testing/selftests/mm/gup_longterm.c | 258 +++++++++++++++++++++-
 1 file changed, 256 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/mm/gup_longterm.c b/tools/testing/selftests/mm/gup_longterm.c
index c03b4f8910c0..ecae71ecedd3 100644
--- a/tools/testing/selftests/mm/gup_longterm.c
+++ b/tools/testing/selftests/mm/gup_longterm.c
@@ -36,6 +36,9 @@ static int nr_hugetlbsizes;
 static unsigned long hugetlbsizes[10];
 static int gup_fd;
 
+#define GUP_TEST_FILE	"/sys/kernel/debug/gup_test"
+#define NR_FD_OWNERSHIP_TESTS	3
+
 static __fsword_t get_fs_type(int fd)
 {
 	struct statfs fs;
@@ -500,6 +503,246 @@ static void run_test_case(struct test_case const *test_case)
 				       hugetlbsizes[i]);
 }
 
+static void test_fd_isolation(bool stop_fd2, bool gup_test_was_available)
+{
+	struct pin_longterm_test args = {
+		.size = pagesize,
+	};
+	char *mem1 = MAP_FAILED, *mem2 = MAP_FAILED;
+	char *read_buf = MAP_FAILED;
+	bool pin1 = false, pin2 = false;
+	__u64 read_addr;
+	int fd1 = -1, fd2 = -1;
+	int result = KSFT_FAIL;
+
+	log_test_start("Longterm GUP pin is isolated from fd2 %s",
+		       stop_fd2 ? "STOP" : "close");
+
+	fd1 = open(GUP_TEST_FILE, O_RDWR);
+	if (fd1 < 0) {
+		ksft_print_msg("gup_test not available (%s)\n",
+			       strerror(errno));
+		result = gup_test_was_available ? KSFT_FAIL : KSFT_SKIP;
+		goto report;
+	}
+
+	fd2 = open(GUP_TEST_FILE, O_RDWR);
+	if (fd2 < 0) {
+		ksft_print_msg("second gup_test open failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+
+	mem1 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+		    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	mem2 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+		    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	read_buf = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+			MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	if (mem1 == MAP_FAILED || mem2 == MAP_FAILED ||
+	    read_buf == MAP_FAILED) {
+		ksft_print_msg("mmap() failed (%s)\n", strerror(errno));
+		goto report;
+	}
+
+	memset(mem1, 0x11, pagesize);
+	memset(mem2, 0x22, pagesize);
+
+	args.addr = (__u64)(uintptr_t)mem1;
+	if (ioctl(fd1, PIN_LONGTERM_TEST_START, &args)) {
+		ksft_print_msg("fd1 PIN_LONGTERM_TEST_START failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+	pin1 = true;
+
+	args.addr = (__u64)(uintptr_t)mem2;
+	if (ioctl(fd2, PIN_LONGTERM_TEST_START, &args)) {
+		ksft_print_msg("fd2 PIN_LONGTERM_TEST_START failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+	pin2 = true;
+
+	args.addr = (__u64)(uintptr_t)mem1;
+	if (ioctl(fd1, PIN_LONGTERM_TEST_START, &args) != -1 ||
+	    errno != EINVAL) {
+		ksft_print_msg("second START on fd1 was not rejected with EINVAL\n");
+		goto report;
+	}
+
+	if (stop_fd2) {
+		if (ioctl(fd2, PIN_LONGTERM_TEST_STOP)) {
+			ksft_print_msg("fd2 PIN_LONGTERM_TEST_STOP failed (%s)\n",
+				       strerror(errno));
+			goto report;
+		}
+		pin2 = false;
+
+		read_addr = (__u64)(uintptr_t)read_buf;
+		errno = 0;
+		if (ioctl(fd2, PIN_LONGTERM_TEST_READ, &read_addr) != -1 ||
+		    errno != EINVAL) {
+			ksft_print_msg("fd2 READ after STOP was not rejected with EINVAL\n");
+			goto report;
+		}
+	} else {
+		if (close(fd2)) {
+			ksft_print_msg("close(fd2) failed (%s)\n",
+				       strerror(errno));
+			fd2 = -1;
+			pin2 = false;
+			goto report;
+		}
+		fd2 = -1;
+		pin2 = false;
+	}
+
+	read_addr = (__u64)(uintptr_t)read_buf;
+	if (ioctl(fd1, PIN_LONGTERM_TEST_READ, &read_addr)) {
+		ksft_print_msg("fd1 PIN_LONGTERM_TEST_READ failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+	if (memcmp(mem1, read_buf, pagesize)) {
+		ksft_print_msg("fd1 PIN_LONGTERM_TEST_READ data mismatch\n");
+		goto report;
+	}
+
+	result = KSFT_PASS;
+
+report:
+	if (pin2 && ioctl(fd2, PIN_LONGTERM_TEST_STOP)) {
+		ksft_print_msg("fd2 cleanup STOP failed (%s)\n",
+			       strerror(errno));
+		result = KSFT_FAIL;
+	}
+	if (pin1 && ioctl(fd1, PIN_LONGTERM_TEST_STOP)) {
+		ksft_print_msg("fd1 cleanup STOP failed (%s)\n",
+			       strerror(errno));
+		result = KSFT_FAIL;
+	}
+	if (read_buf != MAP_FAILED)
+		munmap(read_buf, pagesize);
+	if (mem2 != MAP_FAILED)
+		munmap(mem2, pagesize);
+	if (mem1 != MAP_FAILED)
+		munmap(mem1, pagesize);
+	if (fd2 >= 0)
+		close(fd2);
+	if (fd1 >= 0)
+		close(fd1);
+	log_test_result(result);
+}
+
+static void test_dup_fd_shared_state(bool gup_test_was_available)
+{
+	struct pin_longterm_test args = {
+		.size = pagesize,
+	};
+	char *mem = MAP_FAILED, *read_buf = MAP_FAILED;
+	bool pin = false;
+	__u64 read_addr;
+	int fd = -1, dup_fd = -1;
+	int cleanup_fd;
+	int result = KSFT_FAIL;
+
+	log_test_start("Longterm GUP pin state is shared by dup() descriptors");
+
+	fd = open(GUP_TEST_FILE, O_RDWR);
+	if (fd < 0) {
+		ksft_print_msg("gup_test not available (%s)\n",
+			       strerror(errno));
+		result = gup_test_was_available ? KSFT_FAIL : KSFT_SKIP;
+		goto report;
+	}
+
+	dup_fd = dup(fd);
+	if (dup_fd < 0) {
+		ksft_print_msg("dup() failed (%s)\n", strerror(errno));
+		goto report;
+	}
+
+	mem = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+		   MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	read_buf = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+			MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	if (mem == MAP_FAILED || read_buf == MAP_FAILED) {
+		ksft_print_msg("mmap() failed (%s)\n", strerror(errno));
+		goto report;
+	}
+
+	memset(mem, 0x33, pagesize);
+
+	args.addr = (__u64)(uintptr_t)mem;
+	if (ioctl(fd, PIN_LONGTERM_TEST_START, &args)) {
+		ksft_print_msg("PIN_LONGTERM_TEST_START failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+	pin = true;
+
+	errno = 0;
+	if (ioctl(dup_fd, PIN_LONGTERM_TEST_START, &args) != -1 ||
+	    errno != EINVAL) {
+		ksft_print_msg("START through dup fd was not rejected with EINVAL\n");
+		goto report;
+	}
+
+	if (close(fd)) {
+		ksft_print_msg("close(original fd) failed (%s)\n",
+			       strerror(errno));
+		fd = -1;
+		goto report;
+	}
+	fd = -1;
+
+	read_addr = (__u64)(uintptr_t)read_buf;
+	if (ioctl(dup_fd, PIN_LONGTERM_TEST_READ, &read_addr)) {
+		ksft_print_msg("READ through dup fd failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+	if (memcmp(mem, read_buf, pagesize)) {
+		ksft_print_msg("READ through dup fd data mismatch\n");
+		goto report;
+	}
+
+	if (ioctl(dup_fd, PIN_LONGTERM_TEST_STOP)) {
+		ksft_print_msg("STOP through dup fd failed (%s)\n",
+			       strerror(errno));
+		goto report;
+	}
+	pin = false;
+
+	read_addr = (__u64)(uintptr_t)read_buf;
+	errno = 0;
+	if (ioctl(dup_fd, PIN_LONGTERM_TEST_READ, &read_addr) != -1 ||
+	    errno != EINVAL) {
+		ksft_print_msg("READ after STOP through dup fd was not rejected with EINVAL\n");
+		goto report;
+	}
+
+	result = KSFT_PASS;
+
+report:
+	cleanup_fd = dup_fd >= 0 ? dup_fd : fd;
+	if (pin && cleanup_fd >= 0 &&
+	    ioctl(cleanup_fd, PIN_LONGTERM_TEST_STOP)) {
+		ksft_print_msg("cleanup STOP failed (%s)\n", strerror(errno));
+		result = KSFT_FAIL;
+	}
+	if (read_buf != MAP_FAILED)
+		munmap(read_buf, pagesize);
+	if (mem != MAP_FAILED)
+		munmap(mem, pagesize);
+	if (dup_fd >= 0)
+		close(dup_fd);
+	if (fd >= 0)
+		close(fd);
+	log_test_result(result);
+}
+
 static int tests_per_test_case(void)
 {
 	return 3 + nr_hugetlbsizes;
@@ -507,6 +750,7 @@ static int tests_per_test_case(void)
 
 int main(int argc, char **argv)
 {
+	bool gup_test_was_available;
 	int i;
 
 	pagesize = getpagesize();
@@ -514,12 +758,22 @@ int main(int argc, char **argv)
 						    ARRAY_SIZE(hugetlbsizes));
 
 	ksft_print_header();
-	ksft_set_plan(ARRAY_SIZE(test_cases) * tests_per_test_case());
+	ksft_set_plan(ARRAY_SIZE(test_cases) * tests_per_test_case() +
+		      NR_FD_OWNERSHIP_TESTS);
 
-	gup_fd = open("/sys/kernel/debug/gup_test", O_RDWR);
+	gup_fd = open(GUP_TEST_FILE, O_RDWR);
+	gup_test_was_available = gup_fd >= 0;
 
 	for (i = 0; i < ARRAY_SIZE(test_cases); i++)
 		run_test_case(&test_cases[i]);
 
+	if (gup_fd >= 0)
+		close(gup_fd);
+	gup_fd = -1;
+
+	test_fd_isolation(true, gup_test_was_available);
+	test_fd_isolation(false, gup_test_was_available);
+	test_dup_fd_shared_state(gup_test_was_available);
+
 	ksft_finished();
 }
-- 
2.43.0

Re: [RFC PATCH 1/2] mm/gup_test: Track long-term pins per open file

[David Hildenbrand (Arm)]

On 9/21/26 11:42, Richard Cheng wrote:
> Long-term pin state is currently global, allowing one gup_test file
> descriptor to block, stop, or release pins owned by another client.
> 
> Allocate the pin state for each open file and store it in
> file->private_data. Serialize START, READ, and STOP with the per-open
> mutex, and release only the pages owned by that file.
> 
> Descriptors duplicated through dup() or fork() continue sharing state
> because they reference the same struct file. Keep the ioctl ABI and
> same-file duplicate START behavior unchanged.
> 
> Reviewed-by: Koba Ko <kobak@nvidia.com>
> Signed-off-by: Richard Cheng <icheng@nvidia.com>

commit 534b19bbb67717eea2272573bc0ff7ba4ba109c1
Author: David Hildenbrand (Arm) <david@kernel.org>
Date:   Mon Aug 10 13:31:14 2026 +0200

    mm/gup_test: keep longterm pin state per file

    The pin longterm test currently stores its data globally, shared among
    multiple concurrent users of the interface (multiple open file descriptors
    -> multiple "struct file"'s).  That makes the gup_test interface
    problematic to use concurrently: two users, such as concurrent selftest
    runs, can interfere with the same longterm pin state.

    While this has not been observed as a problem so far in practice, let's
    just handle it cleanly.  There could be a way to trigger selftest failures
    by e.g., running the cow.c and gup_longerm.c selftests concurrently, but
    we usually run them sequentially.  Let's add a "Fixes" tag to be safe, but
    not need to CC stable.

Which is already upstream.

-- 
Cheers,

David

Re: [RFC PATCH 2/2] selftests/mm: Test per-open gup_test pin ownership

[David Hildenbrand (Arm)]

On 9/21/26 11:42, Richard Cheng wrote:
> Long-term pin state should be isolated between independently opened
> gup_test file descriptions, while descriptors created with dup() should
> continue to share the state associated with their struct file.
> 
> Add tests using 2 independently opened gup_test descriptors. Verify that
> stopping or closing the second descriptor doesn't disturb the first
> descriptor's pin, that another START on the same descriptor fails with
> EINVAL, and that READ fails with EINVAL after STOP.
> 
> Close the descriptor used by the existing test matrix before running the
> ownership tests. Record whether gup_test was initially available so that
> a later open failure is reported as a failure instead of being hidden as
> a skip.
> 
> Also exercise the shared-file-description case: start a pin through the
> original descriptor, verify that START through a duplicate fails with
> EINVAL, close the original descriptor, and use the duplicate to READ and
> STOP the pin
> 
> Reviewed-by: Koba Ko <kobak@nvidia.com>
> Signed-off-by: Richard Cheng <icheng@nvidia.com>
> ---
>  tools/testing/selftests/mm/gup_longterm.c | 258 +++++++++++++++++++++-
>  1 file changed, 256 insertions(+), 2 deletions(-)

Sorry, we won't be adding tests for gup_test interface functionality. This is a
testing interface.

(I'd be quite surprised if no LLM was inovolved in writing this patch :) )

-- 
Cheers,

David