Re: [PATCH v6 0/5] mm: Unconditional per-VMA locks and cleanups

On Mon, Aug 31, 2026 at 04:19:39PM -0700, Suren Baghdasaryan wrote:

On Mon, Aug 31, 2026 at 3:27 PM Carlos Llamas [off-list ref] wrote:

quoted

On Mon, Aug 31, 2026 at 11:13:16AM +0000, Alice Ryhl wrote:

quoted

On Sat, Aug 29, 2026 at 06:56:25PM -0700, Andrew Morton wrote:

quoted

On Thu, 13 Aug 2026 12:34:28 -0700 Suren Baghdasaryan [off-list ref] wrote:

quoted

v2 version of this patchset [1] was written by Dave Hansen and per his
request, I'm taking over this series.

tl;dr: Make per-VMA locks available in all configs. Simplify some
of the per-VMA lock users now that they can rely on them being
always available.

It's been 2+ weeks so perhaps a refresh-and-remind would be helpful.

But it applies well enough and is adequately reviewed so I put it in
there for testing, thanks.

AI review might have found a couple of pre-existing binder bugs:

    https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@google.com

and a small rusty thing which you might wish to attend to.

The binder bug is not actually a bug. When using VM_MIXEDMAP and
vm_insert_page(), the vma takes a refcount on the page, so there is no
use-after-free even if free_page() is invoked without removing it from
the vma.

Exactly! I agree the refcount on the page would prevent the UAF.

However, we should still reject mremap() because this leaves the page in
limbo since it is not given back to the shrinker and also binder can't
make use of it anymore. I'll send out a patch to fix this.

Ok. Should that block this series or it will apply over it?

The issue is pre-exiting and unrelated to this series. So I'll take care
of this separately. Thanks!