On Thu, Feb 2, 2017 at 11:29 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: > > get_user_pages() relies upon find_extend_vma() to reject kernel > addresses; the fast side of get_user_pages_fast() doesn't have anything > of that sort It is *supposed* to have it. See pte_allows_gup(), for example. In particular, it requires the _PAGE_USER bit in the PTE (and the devpte case should require _PAGE_BIT_DEVMAP). So no, get_user_pages_fast() can not look up kernel pages. If it does, that would be a bug. Linus