Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 2 Nov 2022 13:47:14 -0700
From:   Andrew Morton <akpm@linux-foundation.org>
To:     Peter Xu <peterx@redhat.com>
Cc:     Matthew Wilcox <willy@infradead.org>,
        "Vishal Moola (Oracle)" <vishal.moola@gmail.com>,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        linux-fsdevel@vger.kernel.org, Hugh Dickins <hughd@google.com>,
        Axel Rasmussen <axelrasmussen@google.com>
Subject: Re: [PATCH 3/5] userfualtfd: Replace lru_cache functions with
 folio_add functions
Message-Id: <20221102134714.c72bea3c997ba3ef90d72c53@linux-foundation.org>
In-Reply-To: <Y2K+y7wnhC4vbnP2@x1n>
References: <20221101175326.13265-1-vishal.moola@gmail.com>
        <20221101175326.13265-4-vishal.moola@gmail.com>
        <Y2Fl/pZyLSw/ddZY@casper.infradead.org>
        <Y2K+y7wnhC4vbnP2@x1n>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Wed, 2 Nov 2022 15:02:35 -0400 Peter Xu <peterx@redhat.com> wrote:

> mfill_atomic_install_pte() checks page->mapping to detect whether one page
> is used in the page cache.  However as pointed out by Matthew, the page can
> logically be a tail page rather than always the head in the case of uffd
> minor mode with UFFDIO_CONTINUE.  It means we could wrongly install one pte
> with shmem thp tail page assuming it's an anonymous page.
> 
> It's not that clear even for anonymous page, since normally anonymous pages
> also have page->mapping being setup with the anon vma. It's safe here only
> because the only such caller to mfill_atomic_install_pte() is always
> passing in a newly allocated page (mcopy_atomic_pte()), whose page->mapping
> is not yet setup.  However that's not extremely obvious either.
> 
> For either of above, use page_mapping() instead.
> 
> And this should be stable material.

I added

Fixes: 153132571f02 ("userfaultfd/shmem: support UFFDIO_CONTINUE for shmem")