From 35f7ecd55ce7e51cb6d5ef49e6dd51f3c80f61e4 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Sat, 31 Oct 2026 10:39:52 +0100 Subject: [PATCH] mm/userfaultfd: write-lock the VMA before waking waiters when unregistering userfaultfd_unregister() wakes pending missing faults before clearing the VMA's userfaultfd registration. With per-VMA fault locking, holding mmap_lock for write does not prevent another fault from queuing after the wakeup but before userfaultfd_clear_vma() write-locks the VMA. That waiter can then remain asleep indefinitely. Call vma_start_write() before waking waiters. Existing fault handlers queue themselves before dropping the VMA read lock, and new readers are excluded until mmap_write_unlock(). Fixes: 29a22b9e08d7 ("mm: handle userfaults under VMA lock") Cc: stable@vger.kernel.org Reported-by: Josef Bacik Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes (ARM) Reviewed-by: Suren Baghdasaryan Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-23-d6437171ecc3@kernel.org Signed-off-by: David Hildenbrand (Arm) --- mm/userfaultfd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 928ad95eeb2b..3ca04b582329 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -3991,6 +3991,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, start = vma->vm_start; vma_end = min(end, vma->vm_end); + /* Prevent new userfaults from being queued after the wakeup. */ + vma_start_write(vma); + if (userfaultfd_missing(vma)) { /* * Wake any concurrent pending userfault while