Re: [PATCH] mm/gup: check folio->mapping under folio lock in memfd_pin_folios()

[Andy Lutomirski]

On Sat, Oct 31, 2026 at 1:35 PM Samiullah Khawaja <skhawaja@xxxxxxxxxx> wrote:
>
> memfd_pin_folios() pins folios from the page cache without taking the
> folio lock. So khugepaged or MADV_COLLAPSE can replace the folio after
> its refcount check while memfd_pin_folios() still pins the old folio,
> and the caller ends up with a folio that is no longer part of the memfd.
>
> Lock the folio and recheck folio->mapping before pinning it, like other
> page cache users do. If the folio was removed, retry the folio lookup
> from the index that was removed.
>
> Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios")
> Reported-by: Andy Lutomirski <luto@xxxxxxxxxxxxxx>

Reviewed-by: Andy Lutomirski <luto@xxxxxxxxxxxxxx>

(with the caveat that I still don't like the fact that pinning a folio
does not keep it associated with the mapping.)