Re: [PATCH v2] mm/filemap: stop fault-around when the walk steps back

[Andrew Morton]

On Sat, 31 Oct 2026 04:33:59 +0000 "Jose Fernandez (Anthropic)" <jose.fernandez@xxxxxxxxx> wrote:

> filemap_map_pages() can dereference a PTE pointer outside the page table
> it locked. KASAN has reported this as a use-after-free read [1]. The
> same path can also write out of bounds. When the stray entry reads as
> none, the fault-around loop maps a page there with set_pte_range().
> 
> Its fault-around loop walks the page cache and moves vmf->pte by the
> change in index. A lower index moves it back. xas_find() can step back
> to a lower index when a multi-index entry is split during the walk.
> 
> [1] fixes xas_find(), but the loop still relies on the walk never
> stepping back. Stop the fault-around when the walk steps back. ->fault()
> maps the faulting page if the loop did not.

Thanks.

Can I add your tested-by to [1]?

> Link: https://lore.kernel.org/20260904121301.200049-1-krystianmkaniewski@xxxxxxxxx [1]

"xarray: fix index jumping backwards in xas_find()".