24.09.2026 12:55, Honglei Huang пишет:
> + mm = current->mm;
> + mmgrab(mm);
> + lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
> + new_pinned = atomic64_add_return(userptr->npages, &mm->pinned_vm);
> + if (new_pinned < 0 ||
> + (new_pinned > lock_limit && !capable(CAP_IPC_LOCK))) {
> + atomic64_sub(userptr->npages, &mm->pinned_vm)
At a quick glance over other kernel code touching pinned_vm, nobody else
check for new_pinned < 0 and then doing atomic64_sub() for the negative
value will be incorrect.
--
Best regards,
Dmitry
