Re: KASAN: use-after-free Read in __do_page_fault

Linus Torvalds writes: (Summary) An unfortunate issue with userfaultfd.
unfortunate issue with userfaultfd.
The suggested fix to simply look up pkey beforehand seems sane and simple. afterwards
but much more importantly, I think __get_user_pages() is broken in two ways: but much more importantly, I think __get_user_pages() is broken in two ways: - faultin_page() does:
- faultin_page() does:
ret = handle_mm_fault(vma, address, fault_flags);
...

        if ((ret & VM_WRITE))

   (easily fixed the same way)

 - more annoyingly and harder to fix: the retry case in
__get_user_pages(), and the VMA saving there.