Re: [PATCH 2/4] mm/vma: write lock source VMA before duplicating it in __split_vma()

[Pedro Falcato]

On Fri, Oct 23, 2026 at 02:47:28PM +0100, Lorenzo Stoakes (ARM) wrote:
> From: "David Hildenbrand (Arm)" <david@xxxxxxxxxx>
> 
> __split_vma() duplicates the source VMA before taking its VMA write lock,
> and until the VMA is write-locked, a concurrent thread might set
> VMA_MAYBE_GUARD_BIT, resulting in the duplication missing the flag.
> 
> If this happens, then fork may fail to duplicate guard markers and, if a
> file-backed mapping, THP collapse may also discard the markers.
> 
> Resolve this by taking the VMA write lock before vm_area_dup() and, since
> all callers of vm_area_dup() now hold the VMA write lock, assert that this
> is the case there, and add a comment to explain why it's needed.
> 
> Fixes: 2ab7f1bbafc9 ("mm/madvise: allow guard page install/remove under VMA lock")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
> [ ljs - add VMA write assert in vm_area_dup(), commit message touchup ]
> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>

Reviewed-by: Pedro Falcato <pfalcato@xxxxxxx> 

-- 
Pedro