* [RFC PATCH 1/2] mm/gup_test: Track long-term pins per open file
2026-09-21 9:42 [RFC PATCH 0/2] Fix gup_test long-term pin ownership Richard Cheng
@ 2026-09-21 9:42 ` Richard Cheng
2026-09-21 10:26 ` David Hildenbrand (Arm)
2026-09-21 9:42 ` [RFC PATCH 2/2] selftests/mm: Test per-open gup_test pin ownership Richard Cheng
1 sibling, 1 reply; 5+ messages in thread
From: Richard Cheng @ 2026-09-21 9:42 UTC (permalink / raw)
To: akpm, david
Cc: jgg, jhubbard, peterx, linux-mm, linux-kernel, ljs, liam, vbabka,
rppt, surenb, mhocko, shuah, linux-kselftest, kobak, kaihengf,
newtonl, kristinc, Richard Cheng
Long-term pin state is currently global, allowing one gup_test file
descriptor to block, stop, or release pins owned by another client.
Allocate the pin state for each open file and store it in
file->private_data. Serialize START, READ, and STOP with the per-open
mutex, and release only the pages owned by that file.
Descriptors duplicated through dup() or fork() continue sharing state
because they reference the same struct file. Keep the ioctl ABI and
same-file duplicate START behavior unchanged.
Reviewed-by: Koba Ko <kobak@nvidia.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
mm/gup_test.c | 88 +++++++++++++++++++++++++++++++++------------------
1 file changed, 57 insertions(+), 31 deletions(-)
diff --git a/mm/gup_test.c b/mm/gup_test.c
index eb4c9cda16ed..d0bd84b66624 100644
--- a/mm/gup_test.c
+++ b/mm/gup_test.c
@@ -208,23 +208,25 @@ static int __gup_test_ioctl(unsigned int cmd,
return ret;
}
-static DEFINE_MUTEX(pin_longterm_test_mutex);
-static struct page **pin_longterm_test_pages;
-static unsigned long pin_longterm_test_nr_pages;
+struct pin_longterm_test_state {
+ struct mutex mutex;
+ struct page **pages;
+ unsigned long nr_pages;
+};
-static inline void pin_longterm_test_stop(void)
+static inline void pin_longterm_test_stop(struct pin_longterm_test_state *state)
{
- if (pin_longterm_test_pages) {
- if (pin_longterm_test_nr_pages)
- unpin_user_pages(pin_longterm_test_pages,
- pin_longterm_test_nr_pages);
- kvfree(pin_longterm_test_pages);
- pin_longterm_test_pages = NULL;
- pin_longterm_test_nr_pages = 0;
+ if (state->pages) {
+ if (state->nr_pages)
+ unpin_user_pages(state->pages, state->nr_pages);
+ kvfree(state->pages);
+ state->pages = NULL;
+ state->nr_pages = 0;
}
}
-static inline int pin_longterm_test_start(unsigned long arg)
+static inline int pin_longterm_test_start(struct pin_longterm_test_state *state,
+ unsigned long arg)
{
long nr_pages, cur_pages, addr, remaining_pages;
int gup_flags = FOLL_LONGTERM;
@@ -233,7 +235,7 @@ static inline int pin_longterm_test_start(unsigned long arg)
int ret = 0;
bool fast;
- if (pin_longterm_test_pages)
+ if (state->pages)
return -EINVAL;
if (copy_from_user(&args, (void __user *)arg, sizeof(args)))
@@ -263,12 +265,12 @@ static inline int pin_longterm_test_start(unsigned long arg)
return -EINTR;
}
- pin_longterm_test_pages = pages;
- pin_longterm_test_nr_pages = 0;
+ state->pages = pages;
+ state->nr_pages = 0;
- while (nr_pages - pin_longterm_test_nr_pages) {
- remaining_pages = nr_pages - pin_longterm_test_nr_pages;
- addr = args.addr + pin_longterm_test_nr_pages * PAGE_SIZE;
+ while (nr_pages - state->nr_pages) {
+ remaining_pages = nr_pages - state->nr_pages;
+ addr = args.addr + state->nr_pages * PAGE_SIZE;
if (fast)
cur_pages = pin_user_pages_fast(addr, remaining_pages,
@@ -277,11 +279,11 @@ static inline int pin_longterm_test_start(unsigned long arg)
cur_pages = pin_user_pages(addr, remaining_pages,
gup_flags, pages);
if (cur_pages < 0) {
- pin_longterm_test_stop();
+ pin_longterm_test_stop(state);
ret = cur_pages;
break;
}
- pin_longterm_test_nr_pages += cur_pages;
+ state->nr_pages += cur_pages;
pages += cur_pages;
}
@@ -290,19 +292,20 @@ static inline int pin_longterm_test_start(unsigned long arg)
return ret;
}
-static inline int pin_longterm_test_read(unsigned long arg)
+static inline int pin_longterm_test_read(struct pin_longterm_test_state *state,
+ unsigned long arg)
{
__u64 user_addr;
unsigned long i;
- if (!pin_longterm_test_pages)
+ if (!state->pages)
return -EINVAL;
if (copy_from_user(&user_addr, (void __user *)arg, sizeof(user_addr)))
return -EFAULT;
- for (i = 0; i < pin_longterm_test_nr_pages; i++) {
- void *addr = kmap_local_page(pin_longterm_test_pages[i]);
+ for (i = 0; i < state->nr_pages; i++) {
+ void *addr = kmap_local_page(state->pages[i]);
unsigned long ret;
ret = copy_to_user((void __user *)(unsigned long)user_addr, addr,
@@ -318,25 +321,26 @@ static inline int pin_longterm_test_read(unsigned long arg)
static long pin_longterm_test_ioctl(struct file *filep, unsigned int cmd,
unsigned long arg)
{
+ struct pin_longterm_test_state *state = filep->private_data;
int ret = -EINVAL;
- if (mutex_lock_killable(&pin_longterm_test_mutex))
+ if (mutex_lock_killable(&state->mutex))
return -EINTR;
switch (cmd) {
case PIN_LONGTERM_TEST_START:
- ret = pin_longterm_test_start(arg);
+ ret = pin_longterm_test_start(state, arg);
break;
case PIN_LONGTERM_TEST_STOP:
- pin_longterm_test_stop();
+ pin_longterm_test_stop(state);
ret = 0;
break;
case PIN_LONGTERM_TEST_READ:
- ret = pin_longterm_test_read(arg);
+ ret = pin_longterm_test_read(state, arg);
break;
}
- mutex_unlock(&pin_longterm_test_mutex);
+ mutex_unlock(&state->mutex);
return ret;
}
@@ -375,15 +379,37 @@ static long gup_test_ioctl(struct file *filep, unsigned int cmd,
return 0;
}
+static int gup_test_open(struct inode *inode, struct file *file)
+{
+ struct pin_longterm_test_state *state;
+ int ret;
+
+ ret = nonseekable_open(inode, file);
+ if (ret)
+ return ret;
+
+ state = kzalloc_obj(*state, GFP_KERNEL);
+ if (!state)
+ return -ENOMEM;
+
+ mutex_init(&state->mutex);
+ file->private_data = state;
+
+ return 0;
+}
+
static int gup_test_release(struct inode *inode, struct file *file)
{
- pin_longterm_test_stop();
+ struct pin_longterm_test_state *state = file->private_data;
+
+ pin_longterm_test_stop(state);
+ kfree(state);
return 0;
}
static const struct file_operations gup_test_fops = {
- .open = nonseekable_open,
+ .open = gup_test_open,
.unlocked_ioctl = gup_test_ioctl,
.compat_ioctl = compat_ptr_ioctl,
.release = gup_test_release,
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [RFC PATCH 2/2] selftests/mm: Test per-open gup_test pin ownership
2026-09-21 9:42 [RFC PATCH 0/2] Fix gup_test long-term pin ownership Richard Cheng
2026-09-21 9:42 ` [RFC PATCH 1/2] mm/gup_test: Track long-term pins per open file Richard Cheng
@ 2026-09-21 9:42 ` Richard Cheng
2026-09-21 10:28 ` David Hildenbrand (Arm)
1 sibling, 1 reply; 5+ messages in thread
From: Richard Cheng @ 2026-09-21 9:42 UTC (permalink / raw)
To: akpm, david
Cc: jgg, jhubbard, peterx, linux-mm, linux-kernel, ljs, liam, vbabka,
rppt, surenb, mhocko, shuah, linux-kselftest, kobak, kaihengf,
newtonl, kristinc, Richard Cheng
Long-term pin state should be isolated between independently opened
gup_test file descriptions, while descriptors created with dup() should
continue to share the state associated with their struct file.
Add tests using 2 independently opened gup_test descriptors. Verify that
stopping or closing the second descriptor doesn't disturb the first
descriptor's pin, that another START on the same descriptor fails with
EINVAL, and that READ fails with EINVAL after STOP.
Close the descriptor used by the existing test matrix before running the
ownership tests. Record whether gup_test was initially available so that
a later open failure is reported as a failure instead of being hidden as
a skip.
Also exercise the shared-file-description case: start a pin through the
original descriptor, verify that START through a duplicate fails with
EINVAL, close the original descriptor, and use the duplicate to READ and
STOP the pin
Reviewed-by: Koba Ko <kobak@nvidia.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
tools/testing/selftests/mm/gup_longterm.c | 258 +++++++++++++++++++++-
1 file changed, 256 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/mm/gup_longterm.c b/tools/testing/selftests/mm/gup_longterm.c
index c03b4f8910c0..ecae71ecedd3 100644
--- a/tools/testing/selftests/mm/gup_longterm.c
+++ b/tools/testing/selftests/mm/gup_longterm.c
@@ -36,6 +36,9 @@ static int nr_hugetlbsizes;
static unsigned long hugetlbsizes[10];
static int gup_fd;
+#define GUP_TEST_FILE "/sys/kernel/debug/gup_test"
+#define NR_FD_OWNERSHIP_TESTS 3
+
static __fsword_t get_fs_type(int fd)
{
struct statfs fs;
@@ -500,6 +503,246 @@ static void run_test_case(struct test_case const *test_case)
hugetlbsizes[i]);
}
+static void test_fd_isolation(bool stop_fd2, bool gup_test_was_available)
+{
+ struct pin_longterm_test args = {
+ .size = pagesize,
+ };
+ char *mem1 = MAP_FAILED, *mem2 = MAP_FAILED;
+ char *read_buf = MAP_FAILED;
+ bool pin1 = false, pin2 = false;
+ __u64 read_addr;
+ int fd1 = -1, fd2 = -1;
+ int result = KSFT_FAIL;
+
+ log_test_start("Longterm GUP pin is isolated from fd2 %s",
+ stop_fd2 ? "STOP" : "close");
+
+ fd1 = open(GUP_TEST_FILE, O_RDWR);
+ if (fd1 < 0) {
+ ksft_print_msg("gup_test not available (%s)\n",
+ strerror(errno));
+ result = gup_test_was_available ? KSFT_FAIL : KSFT_SKIP;
+ goto report;
+ }
+
+ fd2 = open(GUP_TEST_FILE, O_RDWR);
+ if (fd2 < 0) {
+ ksft_print_msg("second gup_test open failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+
+ mem1 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ mem2 = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ read_buf = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (mem1 == MAP_FAILED || mem2 == MAP_FAILED ||
+ read_buf == MAP_FAILED) {
+ ksft_print_msg("mmap() failed (%s)\n", strerror(errno));
+ goto report;
+ }
+
+ memset(mem1, 0x11, pagesize);
+ memset(mem2, 0x22, pagesize);
+
+ args.addr = (__u64)(uintptr_t)mem1;
+ if (ioctl(fd1, PIN_LONGTERM_TEST_START, &args)) {
+ ksft_print_msg("fd1 PIN_LONGTERM_TEST_START failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ pin1 = true;
+
+ args.addr = (__u64)(uintptr_t)mem2;
+ if (ioctl(fd2, PIN_LONGTERM_TEST_START, &args)) {
+ ksft_print_msg("fd2 PIN_LONGTERM_TEST_START failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ pin2 = true;
+
+ args.addr = (__u64)(uintptr_t)mem1;
+ if (ioctl(fd1, PIN_LONGTERM_TEST_START, &args) != -1 ||
+ errno != EINVAL) {
+ ksft_print_msg("second START on fd1 was not rejected with EINVAL\n");
+ goto report;
+ }
+
+ if (stop_fd2) {
+ if (ioctl(fd2, PIN_LONGTERM_TEST_STOP)) {
+ ksft_print_msg("fd2 PIN_LONGTERM_TEST_STOP failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ pin2 = false;
+
+ read_addr = (__u64)(uintptr_t)read_buf;
+ errno = 0;
+ if (ioctl(fd2, PIN_LONGTERM_TEST_READ, &read_addr) != -1 ||
+ errno != EINVAL) {
+ ksft_print_msg("fd2 READ after STOP was not rejected with EINVAL\n");
+ goto report;
+ }
+ } else {
+ if (close(fd2)) {
+ ksft_print_msg("close(fd2) failed (%s)\n",
+ strerror(errno));
+ fd2 = -1;
+ pin2 = false;
+ goto report;
+ }
+ fd2 = -1;
+ pin2 = false;
+ }
+
+ read_addr = (__u64)(uintptr_t)read_buf;
+ if (ioctl(fd1, PIN_LONGTERM_TEST_READ, &read_addr)) {
+ ksft_print_msg("fd1 PIN_LONGTERM_TEST_READ failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ if (memcmp(mem1, read_buf, pagesize)) {
+ ksft_print_msg("fd1 PIN_LONGTERM_TEST_READ data mismatch\n");
+ goto report;
+ }
+
+ result = KSFT_PASS;
+
+report:
+ if (pin2 && ioctl(fd2, PIN_LONGTERM_TEST_STOP)) {
+ ksft_print_msg("fd2 cleanup STOP failed (%s)\n",
+ strerror(errno));
+ result = KSFT_FAIL;
+ }
+ if (pin1 && ioctl(fd1, PIN_LONGTERM_TEST_STOP)) {
+ ksft_print_msg("fd1 cleanup STOP failed (%s)\n",
+ strerror(errno));
+ result = KSFT_FAIL;
+ }
+ if (read_buf != MAP_FAILED)
+ munmap(read_buf, pagesize);
+ if (mem2 != MAP_FAILED)
+ munmap(mem2, pagesize);
+ if (mem1 != MAP_FAILED)
+ munmap(mem1, pagesize);
+ if (fd2 >= 0)
+ close(fd2);
+ if (fd1 >= 0)
+ close(fd1);
+ log_test_result(result);
+}
+
+static void test_dup_fd_shared_state(bool gup_test_was_available)
+{
+ struct pin_longterm_test args = {
+ .size = pagesize,
+ };
+ char *mem = MAP_FAILED, *read_buf = MAP_FAILED;
+ bool pin = false;
+ __u64 read_addr;
+ int fd = -1, dup_fd = -1;
+ int cleanup_fd;
+ int result = KSFT_FAIL;
+
+ log_test_start("Longterm GUP pin state is shared by dup() descriptors");
+
+ fd = open(GUP_TEST_FILE, O_RDWR);
+ if (fd < 0) {
+ ksft_print_msg("gup_test not available (%s)\n",
+ strerror(errno));
+ result = gup_test_was_available ? KSFT_FAIL : KSFT_SKIP;
+ goto report;
+ }
+
+ dup_fd = dup(fd);
+ if (dup_fd < 0) {
+ ksft_print_msg("dup() failed (%s)\n", strerror(errno));
+ goto report;
+ }
+
+ mem = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ read_buf = mmap(NULL, pagesize, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (mem == MAP_FAILED || read_buf == MAP_FAILED) {
+ ksft_print_msg("mmap() failed (%s)\n", strerror(errno));
+ goto report;
+ }
+
+ memset(mem, 0x33, pagesize);
+
+ args.addr = (__u64)(uintptr_t)mem;
+ if (ioctl(fd, PIN_LONGTERM_TEST_START, &args)) {
+ ksft_print_msg("PIN_LONGTERM_TEST_START failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ pin = true;
+
+ errno = 0;
+ if (ioctl(dup_fd, PIN_LONGTERM_TEST_START, &args) != -1 ||
+ errno != EINVAL) {
+ ksft_print_msg("START through dup fd was not rejected with EINVAL\n");
+ goto report;
+ }
+
+ if (close(fd)) {
+ ksft_print_msg("close(original fd) failed (%s)\n",
+ strerror(errno));
+ fd = -1;
+ goto report;
+ }
+ fd = -1;
+
+ read_addr = (__u64)(uintptr_t)read_buf;
+ if (ioctl(dup_fd, PIN_LONGTERM_TEST_READ, &read_addr)) {
+ ksft_print_msg("READ through dup fd failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ if (memcmp(mem, read_buf, pagesize)) {
+ ksft_print_msg("READ through dup fd data mismatch\n");
+ goto report;
+ }
+
+ if (ioctl(dup_fd, PIN_LONGTERM_TEST_STOP)) {
+ ksft_print_msg("STOP through dup fd failed (%s)\n",
+ strerror(errno));
+ goto report;
+ }
+ pin = false;
+
+ read_addr = (__u64)(uintptr_t)read_buf;
+ errno = 0;
+ if (ioctl(dup_fd, PIN_LONGTERM_TEST_READ, &read_addr) != -1 ||
+ errno != EINVAL) {
+ ksft_print_msg("READ after STOP through dup fd was not rejected with EINVAL\n");
+ goto report;
+ }
+
+ result = KSFT_PASS;
+
+report:
+ cleanup_fd = dup_fd >= 0 ? dup_fd : fd;
+ if (pin && cleanup_fd >= 0 &&
+ ioctl(cleanup_fd, PIN_LONGTERM_TEST_STOP)) {
+ ksft_print_msg("cleanup STOP failed (%s)\n", strerror(errno));
+ result = KSFT_FAIL;
+ }
+ if (read_buf != MAP_FAILED)
+ munmap(read_buf, pagesize);
+ if (mem != MAP_FAILED)
+ munmap(mem, pagesize);
+ if (dup_fd >= 0)
+ close(dup_fd);
+ if (fd >= 0)
+ close(fd);
+ log_test_result(result);
+}
+
static int tests_per_test_case(void)
{
return 3 + nr_hugetlbsizes;
@@ -507,6 +750,7 @@ static int tests_per_test_case(void)
int main(int argc, char **argv)
{
+ bool gup_test_was_available;
int i;
pagesize = getpagesize();
@@ -514,12 +758,22 @@ int main(int argc, char **argv)
ARRAY_SIZE(hugetlbsizes));
ksft_print_header();
- ksft_set_plan(ARRAY_SIZE(test_cases) * tests_per_test_case());
+ ksft_set_plan(ARRAY_SIZE(test_cases) * tests_per_test_case() +
+ NR_FD_OWNERSHIP_TESTS);
- gup_fd = open("/sys/kernel/debug/gup_test", O_RDWR);
+ gup_fd = open(GUP_TEST_FILE, O_RDWR);
+ gup_test_was_available = gup_fd >= 0;
for (i = 0; i < ARRAY_SIZE(test_cases); i++)
run_test_case(&test_cases[i]);
+ if (gup_fd >= 0)
+ close(gup_fd);
+ gup_fd = -1;
+
+ test_fd_isolation(true, gup_test_was_available);
+ test_fd_isolation(false, gup_test_was_available);
+ test_dup_fd_shared_state(gup_test_was_available);
+
ksft_finished();
}
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread