linux-kernel - Re: [PATCH linux-next] mm/madvise: prefer VMA lock for MADV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202601141500292511NYBdWwzTilw10jiTcGlN@zte.com.cn>
Date: Wed, 14 Jan 2026 15:00:29 +0800 (CST)
From: <wang.yaxin@....com.cn>
To: <willy@...radead.org>
Cc: <akpm@...ux-foundation.org>, <liam.howlett@...cle.com>,
        <lorenzo.stoakes@...cle.com>, <david@...nel.org>, <vbabka@...e.cz>,
        <jannh@...gle.com>, <linux-mm@...ck.org>,
        <linux-kernel@...r.kernel.org>, <xu.xin16@....com.cn>,
        <yang.yang29@....com.cn>, <fan.yu9@....com.cn>, <he.peilin@....com.cn>,
        <tu.qiang35@....com.cn>, <qiu.yutan@....com.cn>,
        <jiang.kun2@....com.cn>, <lu.zhongjun@....com.cn>
Subject: Re: [PATCH linux-next] mm/madvise: prefer VMA lock for MADV_REMOVE

>> -	mark_mmap_lock_dropped(madv_behavior);
>> +	/*
>> +	 * Prefer VMA read lock path: when operating under VMA lock, we avoid
>> +	 * dropping/reacquiring the mmap lock and directly perform the filesystem
>> +	 * operation while the VMA is read-locked. We still take and drop a file
>> +	 * reference to protect against concurrent file changes.
>
>How does taking a reference prevent file changes?  What do you mean by
"file changes" anyway?

Thanks for the review.

Taking a reference with get_file(f) does not prevent file content or
metadata changes; it pins the struct file so the pointer remains valid
while we temporarily drop mmap_lock. The VMA can be split, unmapped, or
otherwise changed during that window, and without a ref the vma->vm_file
could be freed.

By “file changes” I meant lifetime changes to the VMA → file association
(e.g. concurrent munmap/mremap or VMA splits) while mmap_lock is dropped,
not changes to the file’s data or inode state. Those are serialized by
the filesystem (e.g. inode locks) and are unrelated to the refcount.

>> +	 * When operating under mmap read lock (fallback), preserve existing
>> +	 * behaviour: mark lock dropped, coordinate with userfaultfd_remove(),
>> +	 * temporarily drop mmap_read_lock around vfs_fallocate(), and then
>> +	 * reacquire it.
>
>This is not the way to write an inline comment; that's how you describe
>what you've done in the changelog.
>
>> @@ -1033,12 +1045,19 @@ static long madvise_remove(struct madvise_behavior *madv_behavior)
>>  			+ ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
>> 
>>  	/*
>> -	 * Filesystem's fallocate may need to take i_rwsem.  We need to
>> -	 * explicitly grab a reference because the vma (and hence the
>> -	 * vma's reference to the file) can go away as soon as we drop
>> -	 * mmap_lock.
>> +	 * Execute filesystem punch-hole under appropriate locking.
>> +	 * - VMA lock path: no mmap lock held; call vfs_fallocate() directly.
>> +	 * - mmap lock path: follow existing protocol including UFFD coordination
>> +	 *   and temporary mmap_read_unlock/lock around the filesystem call.
>
>Again, I don't like what you've done here with the comments.

I’ll fix the inline comment to say: “Pin struct file across potential
mmap_lock drop so the file pointer remains valid even if the VMA is
modified or freed,” and remove the changelog-style prose.

Thanks,
Jiang Kun