Kernel mm series piles on userfaultfd, MGLRU and memfd fixes

David Hildenbrand has sent a large core memory-management fix series aimed at the stable path, grouping dozens of patches that span hugetlb, userfaultfd, multi-gen LRU, shmem, GUP and related code. He asked for prioritized review so the more urgent items can reach mainline and stable trees quickly.

Several of the serious bugs leave processes stuck or corrupt data under concurrency. userfaultfd could strand fault waiters when a range’s tracking mode changed or when a range was unregistered: switching missing-page tracking to write-protect, or clearing registration without waking non-missing waiters, left threads asleep until an explicit wake or close. A related unregister race under per-VMA fault locking allowed a new waiter to queue after the wakeup and never resume.

memfds had a quieter failure. Because their files are built through the pseudo-file path rather than ordinary open, they never received the atomic file-position flag POSIX regular files get. Two threads writing the same memfd could each read offset zero and overwrite one another, shrinking the apparent file; the same workload on tmpfs did not drop bytes. Fork had a long-standing window in which a concurrent brk in the parent left the child with a stale heap limit and newer mappings, so later brk calls failed.

Multi-gen LRU page-table walks passed stack copies of PUD and PMD entries that could go stale when khugepaged or MADV_DONTNEED reclaimed tables underneath, a latent pattern later locking changes exposed. Separately, TLB gather range sizing used a 32-bit length, so flushes of 4 GiB or larger (possible with arm64 hugetlb PMD/PUD unshare) truncated, sometimes to zero. Other fixes stop wrong-type inode access when seal and memfd logic mistook wrapper mappings for shmem, repair truncate and zap races on THPs, reject remote COW on PFN mappings, break an mremap versus UFFDIO_MOVE deadlock, and set mmu-notifier mm pointers only after a successful grab so failed inserts cannot confuse drivers such as Radeon.

Hildenbrand described the batch as his largest so far, much of it reworked from Anthropic-generated fixes originally sent privately by Chris Mason and Josef Bacik, plus issues he found while cleaning that work. He reported basic x86-64 testing and invited broader coverage. The series is staged on Andrew Morton’s mm-stable tree.