Re: [PATCH] io_uring: take page references for NOMMU pbuf_ring mmaps

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Tue, Apr 21, 2026 at 08:26:08PM -0600, Jens Axboe wrote:
> On 4/21/26 7:56 PM, Jens Axboe wrote:
> > On 4/21/26 7:17 PM, Jens Axboe wrote:
> >> On 4/21/26 11:39 AM, Jens Axboe wrote:
> >>>
> >>> On Tue, 21 Apr 2026 15:46:16 +0200, Greg Kroah-Hartman wrote:
> >>>> Under !CONFIG_MMU, io_uring_get_unmapped_area() returns the kernel
> >>>> virtual address of the io_mapped_region's backing pages directly;
> >>>> the user's VMA aliases the kernel allocation. io_uring_mmap() then
> >>>> just returns 0 -- it takes no page references.
> >>>>
> >>>> The CONFIG_MMU path uses vm_insert_pages(), which takes a reference on
> >>>> each inserted page.  Those references are released when the VMA is torn
> >>>> down (zap_pte_range -> put_page). io_free_region() -> release_pages()
> >>>> drops the io_uring-side references, but the pages survive until munmap
> >>>> drops the VMA-side references.
> >>>>
> >>>> [...]
> >>>
> >>> Applied, thanks!
> >>>
> >>> [1/1] io_uring: take page references for NOMMU pbuf_ring mmaps
> >>>       commit: d9b7b3d9c5286a786c7fe8220c55a6e012088c2e
> >>
> >> Actually, I take that back - what prevents the io_mmap_get_region()
> >> in the newly added io_uring_nommu_vm_close() from getting the same
> >> region that we initially referenced the pages from in the nommu
> >> variant of io_uring_mmap()?
> > 
> > I think we can get rid of that and simplify the code at the same
> > time. Rather than need to re-lookup the buffer list, we can just iterate
> > the pages mapped in the vma. Since this is a file backed mapping and
> > io_uring doesn't allow remaps, that should always be the same.
> > 
> > Greg, can you test this? I will fold this in.
> 
> Here's the full patch - the incremental was missing a ')'. And
> for good measure, ensure that the vma size matches the pages in
> the region.

Yes, this works, thanks!

Tested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>