Re: [PATCH v2 1/1] mm: disallow raw PFN mappings of huge/shared zeropage

[Lorenzo Stoakes (ARM)]

On Mon, Sep 21, 2026 at 01:42:25PM +0800, Lance Yang wrote:
> From: Lance Yang <lance.yang@xxxxxxxxx>
>
> Handling the huge/shared zeropage correctly in vmf_insert_pfn_pmd() and
> vmf_insert_pfn_prot() is more involved. We would need to check whether the
> VMA allows it and keep the mapping read-only, similar to the checks in
> vm_mixed_ok().
>
> No in-tree user needs that support, so reject these mappings with
> VM_FAULT_SIGBUS rather than complicate the code for now.
>
> Link: https://lore.kernel.org/all/20260917121010.60966-1-lance.yang@xxxxxxxxx/
> Suggested-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> Suggested-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> Signed-off-by: Lance Yang <lance.yang@xxxxxxxxx>

Seems sensible to me!

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>

> ---
> v1 -> v2:
>  - Reject the shared zeropage in vmf_insert_pfn_prot() (per Kiryl) - thanks!
>  - Explain the VMA validation and read-only requirements (per David) - thanks!
>  - Pick up Kiryl's Reviewed-by tag.
>  - https://lore.kernel.org/all/20260917121010.60966-1-lance.yang@xxxxxxxxx/
>
>  mm/huge_memory.c | 3 +++
>  mm/memory.c      | 3 +++
>  2 files changed, 6 insertions(+)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 8aa2daba3739..1d4fe4452c98 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1728,6 +1728,9 @@ vm_fault_t vmf_insert_pfn_pmd(struct vm_fault *vmf, unsigned long pfn,
>  						(VM_PFNMAP|VM_MIXEDMAP));
>  	BUG_ON((vma->vm_flags & VM_PFNMAP) && vma_is_cow_mapping(vma));
>
> +	if (unlikely(is_huge_zero_pfn(pfn)))
> +		return VM_FAULT_SIGBUS;
> +
>  	pfnmap_setup_cachemode_pfn(pfn, &pgprot);
>
>  	return insert_pmd(vma, addr, vmf->pmd, fop, pgprot, write);
> diff --git a/mm/memory.c b/mm/memory.c
> index 926276d41920..7d821b110df0 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -2860,6 +2860,9 @@ vm_fault_t vmf_insert_pfn_prot(struct vm_area_struct *vma, unsigned long addr,
>  	BUG_ON((vma->vm_flags & VM_PFNMAP) && vma_is_cow_mapping(vma));
>  	BUG_ON((vma->vm_flags & VM_MIXEDMAP) && pfn_valid(pfn));
>
> +	if (unlikely(is_zero_pfn(pfn)))
> +		return VM_FAULT_SIGBUS;
> +
>  	if (addr < vma->vm_start || addr >= vma->vm_end)
>  		return VM_FAULT_SIGBUS;
>
> --
> 2.49.0

--
Cheers, Lorenzo