Re: [PATCH] net/rds: Do not unpin a page after a failed atomic pin

[Paolo Abeni <pabeni@redhat.com>]

On 10/30/26 05:21, Kyle Zeng wrote:
> rds_cmsg_atomic() assumes that a non-NULL output from rds_pin_pages()
> represents a pin that it owns. However, pin_user_pages_fast() can roll
> back a fast-GUP pin after racing fork() and then fail in the slow path,
> for example after a concurrent mprotect(PROT_NONE). The output slot can
> still contain the already-unpinned page.
> 
> The common error path calls unpin_user_page() on that stale pointer.
> This can consume another subsystem's pin and allow the page to be
> freed while it is still in use.
> 
> Clear page when rds_pin_pages() does not return one. The error path
> continues to release the page on errors after a successful pin, and
> successful requests retain their existing ownership and behavior. All
> four RDS atomic ancillary operations share this path.
> 
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
Picking this patch randomly.

Please slow down a bit: you have already a dozen standalone patches in flight.

Note that that 15 patches limits apply to patches tied in a single series, having more
than a couple of series in flight is quite unusual. Having more than an handful is putting
quite a bit of pressure on the maintainers.

Thanks,

Paolo