Re: [PATCH 1/2] mm/memfd: handle GUP pins more reliably when write-sealing

[David Hildenbrand (Arm)]

On Tue, 03 Nov 2026 19:31:44 +0100, David Hildenbrand (Arm) wrote:
> memfd_wait_for_pins() detects GUP references by comparing a folio's
> actual refcount with its expected refcount. As spelled out by
> folio_expected_ref_count(), obtaining the expected refcount when there
> can be concurrent folio (un)mapping is racy.
> 
> So it is possible that a changing folio mapcount can race with our
> check for GUP references, and F_SEAL_WRITE might succeed even if there
> are some, allowing file contents to be modified after sealing.
> 
> [...]

I'm applying the first patch for now, as that is an obvious improvement
for many GUP users (esp. iouring fixed buffers etc).

tree: mm/core.git
branch: for-next-fixes

Applied patches will appear soon in mm-next, followed by linux-next.

Please report any outstanding bugs that were missed during review, so we
can either drop the patch series or decide how to fix it up.

It is encouraged to provide Acked-bys, Reviewed-bys, and Tested-bys even
though the patches have already been applied. If possible, patch trailers
will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. Further, this is not a guarantee that the
patches will go upstream. If in doubt, please check the listed branch.

[1/2] mm/memfd: handle GUP pins more reliably when write-sealing
      https://git.kernel.org/mm/core/c/42990cfe

-- 
Cheers,

David