On Mon, Jul 24, 2023 at 05:46:21PM +0200, Jann Horn wrote: > > + if ((vmf->flags & FAULT_FLAG_VMA_LOCK) && !vma_is_anonymous(vmf->vma)) { > > + vma_end_read(vmf->vma); > > + return VM_FAULT_RETRY; > > + } > > At this point we can have vmf->pte mapped, right? Does this mean this > bailout leaks a kmap_local() on CONFIG_HIGHPTE? Yup. Guess nobody's testing on 32-bit machines. Thanks, fixed.