[Devel] [PATCH hci-8.1 5/8] oracle/mm: set MMF_HAS_PINNED on the mm receiving preserved pages

[Konstantin Khorenko]

fork decides whether an anonymous page may be pinned with
folio_needs_cow_for_dma(), which looks at MMF_HAS_PINNED of the parent
mm before folio_maybe_dma_pinned(). Only GUP sets that flag, in the mm
whose pages it pins. Pages preserved across exec keep a long-term pin
taken through the old mm, but the new mm never has the flag, so a fork
in the new image clears PageAnonExclusive of a pinned page and maps it
read-only in both processes. The next write in the parent copies the
page and the device keeps the old one. A debug kernel catches the
shared page when the pin is dropped:

  page dumped because: VM_BUG_ON_PAGE(!PageAnonExclusive(&folio->page))
  kernel BUG at mm/gup.c:66!
  RIP: 0010:sanity_check_pinned_pages+0x237/0x960
   unpin_user_pages
   gup_test_release
   __fput

Set MMF_HAS_PINNED on the new mm when the old one has it.

Fixes: 37d9f55655ea ("oracle/mm: do not write protect COW mappings when preserving across exec")
https://virtuozzo.atlassian.net/browse/VSTOR-150231

Feature: oracle/mm: MADV_DOEXEC madvise() flag
Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 fs/exec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/exec.c b/fs/exec.c
index 62010a6d63aab..8677347963e20 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -984,6 +984,10 @@ static int vma_dup_some(struct mm_struct *old_mm, struct mm_struct *new_mm)
 	VMA_ITERATOR(vmi, old_mm, 0);
 	int ret = 0;
 
+	/* Preserved pages may be pinned, fork has to keep copying them. */
+	if (test_bit(MMF_HAS_PINNED, &old_mm->flags))
+		set_bit(MMF_HAS_PINNED, &new_mm->flags);
+
 	mmap_write_lock_nested(new_mm, SINGLE_DEPTH_NESTING);
 	for_each_vma(vmi, vma)
 		if (vma->vm_flags & VM_EXEC_KEEP) {

-- 
2.43.0