Re: [PATCH 03/10] mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()

[Lance Yang]

On Thu, Oct 15, 2026 at 06:07:09PM +0200, David Hildenbrand (Arm) wrote:
>Let's fix another instance where we use a folio after dropping the PTL,
>where someone else could e.g., MADV_DONTNEED it once we drop the PTL,
>making us trigger a use-after-free on the folio.
>
>Fixes: cb6acd01e2e4 ("hugetlbfs: fix races and page leaks during migration")
>Fixes: 1c9e8def43a3 ("userfaultfd: hugetlbfs: add UFFDIO_COPY support for shared mappings")
>Cc: stable@xxxxxxxxxxxxxxx
>Reported-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
>Reviewed-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
>Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>---

Nice work!

Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>