linux-kernel - Re: [PATCH linux-next] mm/madvise: prefer VMA lock for MADV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aWcZCwz__qwwKbxw@casper.infradead.org>
Date: Wed, 14 Jan 2026 04:18:19 +0000
From: Matthew Wilcox <willy@...radead.org>
To: wang.yaxin@....com.cn
Cc: akpm@...ux-foundation.org, liam.howlett@...cle.com,
	lorenzo.stoakes@...cle.com, david@...nel.org, vbabka@...e.cz,
	jannh@...gle.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	xu.xin16@....com.cn, yang.yang29@....com.cn, fan.yu9@....com.cn,
	he.peilin@....com.cn, tu.qiang35@....com.cn, qiu.yutan@....com.cn,
	jiang.kun2@....com.cn, lu.zhongjun@....com.cn
Subject: Re: [PATCH linux-next] mm/madvise: prefer VMA lock for MADV_REMOVE

On Wed, Jan 14, 2026 at 11:24:17AM +0800, wang.yaxin@....com.cn wrote:
> -	mark_mmap_lock_dropped(madv_behavior);
> +	/*
> +	 * Prefer VMA read lock path: when operating under VMA lock, we avoid
> +	 * dropping/reacquiring the mmap lock and directly perform the filesystem
> +	 * operation while the VMA is read-locked. We still take and drop a file
> +	 * reference to protect against concurrent file changes.

How does taking a reference prevent file changes?  What do you mean by
"file changes" anyway?

> +	 * When operating under mmap read lock (fallback), preserve existing
> +	 * behaviour: mark lock dropped, coordinate with userfaultfd_remove(),
> +	 * temporarily drop mmap_read_lock around vfs_fallocate(), and then
> +	 * reacquire it.

This is not the way to write an inline comment; that's how you describe
what you've done in the changelog.

> @@ -1033,12 +1045,19 @@ static long madvise_remove(struct madvise_behavior *madv_behavior)
>  			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
> 
>  	/*
> -	 * Filesystem's fallocate may need to take i_rwsem.  We need to
> -	 * explicitly grab a reference because the vma (and hence the
> -	 * vma's reference to the file) can go away as soon as we drop
> -	 * mmap_lock.
> +	 * Execute filesystem punch-hole under appropriate locking.
> +	 * - VMA lock path: no mmap lock held; call vfs_fallocate() directly.
> +	 * - mmap lock path: follow existing protocol including UFFD coordination
> +	 *   and temporary mmap_read_unlock/lock around the filesystem call.

Again, I don't like what you've done here with the comments.