v8
2026-07-15
HMM支持userfaultfd时释放mmap锁 · v8
扩展 HMM 支持 userfaultfd，通过 hmm_range_fault_unlockable() 允许在缺页处理中释放 mmap 读锁。
原始补丁链接
子 Patch（8）
1/8
mm/hmm: move page fault handling out of walk callbacks
将页错误处理从walk回调中分离，避免walk期间释放mmap_lock导致VMA释放后hugetlb解锁的UAF。回调仅记录需fault的区间并返回HMM_FAULT_PENDING，由外层循环在walk_page_range外统一处理handle_mm_fault。
2/8
mm/hmm: add hmm_range_fault_unlocked_timeout() for mmap lock-drop support
[mm/hmm: add hmm_range_fault_unlocked_timeout() for mmap lock-drop support] hmm_range_fault() requires the caller to hold the mmap read lock for the duration of the call. This is incompatible with map
3/8
selftests/mm: add HMM test for mmap lock-dropping faults
Add test_hmm coverage for the HMM lock-dropping fault path. The test module gets a new HMM_DMIRROR_READ_UNLOCKED ioctl that calls hmm_range_fault_unlocked_timeout() with a timeout of 0, exercising the
4/8
mshv: Use hmm_range_fault_unlocked_timeout() for region faults
[mshv: Use hmm_range_fault_unlocked_timeout() for region faults] MSHV currently faults movable memory regions by taking mmap_read_lock() around hmm_range_fault(). That prevents the fault path from han
5/8
drm/nouveau: Use hmm_range_fault_unlocked_timeout() for SVM faults
[drm/nouveau: Use hmm_range_fault_unlocked_timeout() for SVM faults] nouveau_range_fault() takes mmap_read_lock() only to call hmm_range_fault(). It also keeps a single HMM_RANGE_DEFAULT_TIMEOUT deadl
6/8
RDMA/umem: Use hmm_range_fault_unlocked_timeout() for ODP faults
ib_umem_odp_map_dma_and_lock() takes mmap_read_lock() only around hmm_range_fault(), then retries -EBUSY until HMM_RANGE_DEFAULT_TIMEOUT expires. Use hmm_range_fault_unlocked_timeout() instead. The H
7/8
accel/amdxdna: Use hmm_range_fault_unlocked_timeout() for range population
[accel/amdxdna: Use hmm_range_fault_unlocked_timeout() for range population] aie2_populate_range() takes mmap_read_lock() only around hmm_range_fault(). It keeps a single HMM_RANGE_DEFAULT_TIMEOUT dea
8/8
drm/gpusvm: Use hmm_range_fault_unlocked_timeout() for range faults
[drm/gpusvm: Use hmm_range_fault_unlocked_timeout() for range faults] Several GPU SVM paths take mmap_read_lock() only to call hmm_range_fault(), then retry -EBUSY until HMM_RANGE_DEFAULT_TIMEOUT expi