Re: [PATCH net v2] net/rds: Do not unpin a page after a failed atomic pin

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Dave Miller <davem@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>:

On Fri,  6 Nov 2026 20:18:04 -0800 you wrote:
> rds_cmsg_atomic() assumes that a non-NULL output from rds_pin_pages()
> represents a pin that it owns. However, pin_user_pages_fast() can roll
> back a fast-GUP pin after racing fork() and then fail in the slow path,
> for example after a concurrent mprotect(PROT_NONE). The output slot can
> still contain the already-unpinned page.
> 
> The common error path calls unpin_user_page() on that stale pointer.
> This can consume another subsystem's pin and allow the page to be freed
> while it is still in use. A local unprivileged reproducer triggers a
> KASAN use-after-free write through an io_uring registered buffer.
> 
> [...]

Here is the summary with links:
  - [net,v2] net/rds: Do not unpin a page after a failed atomic pin
    https://git.kernel.org/netdev/net/c/8d5ce4751fad

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html