Re: [PATCH] mm: check VMA flags to avoid invalid PROT_NONE NUMA balancing

[Linus Torvalds]

On Sun, Sep 25, 2016 at 5:49 PM, Rik van Riel <riel@xxxxxxxxxx> wrote:
>
> Reading the code for a little bit, it looks like get_user_pages
> interprets both PROT_NONE and PAGE_NUMA ptes as present, and will
> simply return the page to the caller.

So the thing is, I don't think the code should even get that far.

It should just fail in check_vma_flags() (possibly after doing the
fast-lookup of the page tables, but that would fail with PROT_NONE).

But thanks to FOLL_FORCE, it doesn't. So things that actually use the
page array and prot_none can get access to the underlying data.

                 Linus