On Wed, 2 Nov 2022 15:02:35 -0400 Peter Xu <peterx@xxxxxxxxxx> wrote:
> mfill_atomic_install_pte() checks page->mapping to detect whether one page
> is used in the page cache. However as pointed out by Matthew, the page can
> logically be a tail page rather than always the head in the case of uffd
> minor mode with UFFDIO_CONTINUE. It means we could wrongly install one pte
> with shmem thp tail page assuming it's an anonymous page.
>
> It's not that clear even for anonymous page, since normally anonymous pages
> also have page->mapping being setup with the anon vma. It's safe here only
> because the only such caller to mfill_atomic_install_pte() is always
> passing in a newly allocated page (mcopy_atomic_pte()), whose page->mapping
> is not yet setup. However that's not extremely obvious either.
>
> For either of above, use page_mapping() instead.
>
> And this should be stable material.
I added
Fixes: 153132571f02 ("userfaultfd/shmem: support UFFDIO_CONTINUE for shmem")
