Re: [PATCH 1/2] mm/memfd: handle GUP pins more reliably when write-sealing

[Lance Yang]

On Tue, Nov 03, 2026 at 07:31:44PM +0100, David Hildenbrand (Arm) wrote:
>memfd_wait_for_pins() detects GUP references by comparing a folio's
>actual refcount with its expected refcount. As spelled out by
>folio_expected_ref_count(), obtaining the expected refcount when there
>can be concurrent folio (un)mapping is racy.
>
>So it is possible that a changing folio mapcount can race with our
>check for GUP references, and F_SEAL_WRITE might succeed even if there
>are some, allowing file contents to be modified after sealing.
>
>For folios with a reliable pincount, detect FOLL_PIN references using
>folio_maybe_dma_pinned() before falling back to the refcount comparison.
>For small folios without that, the 1024 pinning BIAS makes it very hard
>(although not impossible) to misguide the refcount comparison.
>
>This improves FOLL_PIN detection for folios with a pincount. Handling
>FOLL_GET and small folios requires a more fundamental change.
>
>Fortunately, most interfaces that allow for GUP'ing such pages use
>FOLL_PIN, in particular interfaces using FOLL_LONGTERM. However, we
>still have some FOLL_GET leftovers ...
>
>Fixes: 05f65b5c7090 ("shm: wait for pins to be released when sealing")
>Cc: stable@xxxxxxxxxxxxxxx
>Cc: Chris Mason <mason@xxxxxxxxxx>
>Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>---

Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>