[merged mm-stable] mm-nommu-add-sysctl_max_map_count-check-for-do_mmap.patch removed from -mm tree

[merged mm-stable] mm-nommu-add-sysctl_max_map_count-check-for-do_mmap.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: mm: nommu: add sysctl_max_map_count() check for do_mmap()
has been removed from the -mm tree.  Its filename was
     mm-nommu-add-sysctl_max_map_count-check-for-do_mmap.patch

This patch was dropped because it was merged into the mm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Hajime Tazaki <thehajime@gmail.com>
Subject: mm: nommu: add sysctl_max_map_count() check for do_mmap()
Date: Thu, 2 Jul 2026 10:28:30 +0900

The sysctl variable vm.max_map_count (sysctl_max_map_count) is not exposed
under !MMU configurations, but its default value (DEFAULT_MAX_MAP_COUNT)
is still used as a allocation limit.  Currently, this limit is enforced
when a VMA entry is split into two chunks (split_vma()), but it is not
checked during initial allocation (do_mmap()).  As a result, if a user
requests a large number of memory allocations, the system will continue
allocating until it hits an Out-Of-Memory (OOM) condition.

This commit introduces a check at the beginning of do_mmap() in nommu.c to
prevent this situation.

This issue was detected using the Linux Test Project (LTP) test linked
below.

Link: https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/munmap/munmap04.c
Link: https://lore.kernel.org/20260702012830.667205-1-thehajime@gmail.com
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/nommu.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/mm/nommu.c~mm-nommu-add-sysctl_max_map_count-check-for-do_mmap
+++ a/mm/nommu.c
@@ -1035,6 +1035,9 @@ unsigned long do_mmap(struct file *file,
 	if (ret < 0)
 		return ret;
 
+	if (current->mm->map_count >= get_sysctl_max_map_count())
+		return -ENOMEM;
+
 	/* we ignore the address hint */
 	addr = 0;
 	len = PAGE_ALIGN(len);
_

Patches currently in -mm which might be from thehajime@gmail.com are

mm-nommu-point-to-the-write-iterator-upon-split_vma.patch
mm-nommu-fix-the-error-path-when-vma_iter_prealloc-fails.patch