I have a kernel module that implements mmap and page fault handling. The page fault handler for a mapping returns previously pinned user pages (from get_user_pages) from another mapping.

After my user code faults on all pages in a mapping, I've confirmed that the PTEs point to the correct physical page frames (i.e. those now shared between two VMAs). However, if my user code writes to the VAs again (this time without faults because the the pages are present), the kernel replaces the faulted-in, shared pages with other, seemingly arbitrary physical page frames. I have no idea where these new pages come from.

My question: under what circumstances will the kernel MM decide to blow away a mapping to pinned physical pages and substitute in other physical memory? Could this be a problem with my virtual mapping flags? It seems strange that the page fault path would use the page I return only to replace it later.

Thanks.