[PATCH 23/46] mm/userfaultfd: write-lock the VMA before waking waiters when unregistering

[David Hildenbrand (Arm)]

On 10/27/26 09:43, Lorenzo Stoakes (ARM) wrote:
> On Tue, Oct 27, 2026 at 12:17:43AM +0100, David Hildenbrand (Arm) wrote:
>> userfaultfd_unregister() wakes pending missing faults before clearing the
>> VMA's userfaultfd registration. With per-VMA fault locking, holding
>> mmap_lock for write does not prevent another fault from queuing after
>> the wakeup but before userfaultfd_clear_vma() write-locks the VMA. That
>> waiter can then remain asleep indefinitely.
> 
> Oof.
> 
> I guess userfaultfd_clear_vma() only implicitly takes the VMA write lock via
> vma_modify_flags_uffd().

Yes. And the original AI fix wanted to reshuffle waiting because of that (stupid).

-- 
Cheers,

David