Re: [PATCH v6 0/5] mm: Unconditional per-VMA locks and cleanups

[Suren Baghdasaryan]

On Mon, Aug 31, 2026 at 3:27 PM Carlos Llamas <cmllamas@xxxxxxxxxx> wrote:
>
> On Mon, Aug 31, 2026 at 11:13:16AM +0000, Alice Ryhl wrote:
> > On Sat, Aug 29, 2026 at 06:56:25PM -0700, Andrew Morton wrote:
> > > On Thu, 13 Aug 2026 12:34:28 -0700 Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
> > >
> > > > v2 version of this patchset [1] was written by Dave Hansen and per his
> > > > request, I'm taking over this series.
> > > >
> > > > tl;dr: Make per-VMA locks available in all configs. Simplify some
> > > > of the per-VMA lock users now that they can rely on them being
> > > > always available.
> > >
> > > It's been 2+ weeks so perhaps a refresh-and-remind would be helpful.
> > >
> > > But it applies well enough and is adequately reviewed so I put it in
> > > there for testing, thanks.
> > >
> > > AI review might have found a couple of pre-existing binder bugs:
> > >
> > >     https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@xxxxxxxxxx
> > >
> > > and a small rusty thing which you might wish to attend to.
> >
> > The binder bug is not actually a bug. When using VM_MIXEDMAP and
> > vm_insert_page(), the vma takes a refcount on the page, so there is no
> > use-after-free even if free_page() is invoked without removing it from
> > the vma.
>
> Exactly! I agree the refcount on the page would prevent the UAF.
>
> However, we should still reject mremap() because this leaves the page in
> limbo since it is not given back to the shrinker and also binder can't
> make use of it anymore. I'll send out a patch to fix this.

Ok. Should that block this series or it will apply over it?

>
> Thanks,
> --
> Carlos Llamas