Re: [PATCH v6 0/5] mm: Unconditional per-VMA locks and cleanups

[Carlos Llamas]

On Mon, Aug 31, 2026 at 04:19:39PM -0700, Suren Baghdasaryan wrote:
> On Mon, Aug 31, 2026 at 3:27 PM Carlos Llamas <cmllamas@xxxxxxxxxx> wrote:
> >
> > On Mon, Aug 31, 2026 at 11:13:16AM +0000, Alice Ryhl wrote:
> > > On Sat, Aug 29, 2026 at 06:56:25PM -0700, Andrew Morton wrote:
> > > > On Thu, 13 Aug 2026 12:34:28 -0700 Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
> > > >
> > > > > v2 version of this patchset [1] was written by Dave Hansen and per his
> > > > > request, I'm taking over this series.
> > > > >
> > > > > tl;dr: Make per-VMA locks available in all configs. Simplify some
> > > > > of the per-VMA lock users now that they can rely on them being
> > > > > always available.
> > > >
> > > > It's been 2+ weeks so perhaps a refresh-and-remind would be helpful.
> > > >
> > > > But it applies well enough and is adequately reviewed so I put it in
> > > > there for testing, thanks.
> > > >
> > > > AI review might have found a couple of pre-existing binder bugs:
> > > >
> > > >     https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@xxxxxxxxxx
> > > >
> > > > and a small rusty thing which you might wish to attend to.
> > >
> > > The binder bug is not actually a bug. When using VM_MIXEDMAP and
> > > vm_insert_page(), the vma takes a refcount on the page, so there is no
> > > use-after-free even if free_page() is invoked without removing it from
> > > the vma.
> >
> > Exactly! I agree the refcount on the page would prevent the UAF.
> >
> > However, we should still reject mremap() because this leaves the page in
> > limbo since it is not given back to the shrinker and also binder can't
> > make use of it anymore. I'll send out a patch to fix this.
> 
> Ok. Should that block this series or it will apply over it?

The issue is pre-exiting and unrelated to this series. So I'll take care
of this separately. Thanks!