v1
2026-11-13
修复vm_ops访问检查 · v1
修正核心 mm 对 vm_ops->access 的 FOLL_ANON、VMA 权限和大小检查，并同步修复 i915、spufs 与 selftest。
原始补丁链接
子 Patch（5）
1/5
mm: do not call vm_ops->access with FOLL_ANON
__access_remote_vm() 在 GUP 失败回退到 vma->vm_ops->access() 时未检查 FOLL_ANON，导致读 /proc/pid/cmdline 等可能访问设备映射；现 FOLL_ANON 时跳过该回退，真正只读匿名内存。
2/5
drm/i915: consider vm_pgoff in vm_access()
i915 的 vm_access() 原先总把 VMA 起点当作 GEM 对象起始，VMA split 后 vm_pgoff 指向对象中段，ptrace 和 /proc/pid/mem 读写会错位；改为像 fault 路径一样按 vm_pgoff 加偏移。
3/5
drm/i915/selftests: request read access for mmap access tests
__igt_mmap_access() reads the buffer with access_process_vm() without FOLL_FORCE, but creates the mapping with only PROT_WRITE. Request PROT_READ as well so the test remains valid when we fix the ->ac
4/5
powerpc/spufs: consider vm_pgoff in spufs_mem_mmap_access()
spufs_mem_mmap_access() calculates the local store offset relative to the start of the VMA and ignores vm_pgoff. After VMA splits, debugger reads and writes access the wrong part of the local store. M
5/5
mm: check permissions and bounds for vm_ops->access
GUP rejects VM_IO and VM_PFNMAP mappings early. __access_remote_vm() then falls back to vm_ops->access without checking VMA permissions and without limiting the request to the VMA size. Consequently,