From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792776250; b=hoXJHnNETxSGPAEU+K30MRtyrEV5rO07jMkJcgyYh8/pmaixLtw0vFW89EUJnEarkRL4 8FPipqDslD3j9zfL+8iLOkKkRMe9ybtrSpAMN8TYj8GNX8r88ZqN4p2PdzZHsX/rm6fqc 6ciElQNzNIDOzRk3pQ5xHY2dhQTkg0Rm6TcVDxxUB0swdkgmBOMvC1h2Rzs+Tjc9OI3tb lxxv06NdJWXvb09OtTFHPtbHrhS0RknCKSMX9/djFqYP9L/nr0eZh89dA0aXOVV0Dy94c iodzu4oFtP8gABlO3zdJo9kONDKT0gaCF5AQdeSRNT0e/3CYvxTbzjy87LG6VpsDVSQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792776250; h=Received:DKIM-Signature:Date:To:From:Subject:Message-Id; bh=CSTcT4VtkmtV1V2TDvj/wN9qE4yR0q2BZxq4dLtp+xI=; b=2a4MpJjjFW/yAnXGuVCubARGsXYxSlQ6IsIUXbWEDhO6x0Jyx0hCfqOc/2qavzFA5iRd pg94CPigvAQBDNuJBS1ZoTiRWNu4CkiMyUiSlb2vTAqg42SV06Qhzla1EKHX1zZ7Aw282 gHuPRSeCSTtArtLIMZV26CijFYDCGiw9xIPO0gvDxPaZwCJx/pcOgz+gnqaTull9dY26t /JnrxM9NQ+DwMEaJwZ+nMFjDYy2XDPryNPjQs0UR3QVqcj5wqcvslKFt2otH7uTN613v6 qsUnhCgbIujZKBlkeN3mboik144kRujb8aeQtOhHPJuKOFtUL3VRDLVUQCw5mbYGIWw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b="v/Fet2bv"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D9C0606A31A; Fri, 23 Oct 2026 17:24:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=v/Fet2bv Received: by smtp.kernel.org (Postfix) with ESMTPSA id D40F81F01825; Fri, 23 Oct 2026 17:24:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1792776249; bh=CSTcT4VtkmtV1V2TDvj/wN9qE4yR0q2BZxq4dLtp+xI=; h=Date:To:From:Subject; b=v/Fet2bvbfP/FiN+HTz74yw2H3dsTKEsgM+LjVP8w+Lx1bCTnjzc+7VO+QdraYsoc 0m//iBoYqHEHGeOmYD1OGXsDWmfapZ1QIroj7P309x+bsHlOXmlLyZlfaDLCKZuRzu ZBbYj53Gxb9rOh3hBhk18VQ4bT5AAxXaxKJHSvCo= Date: Fri, 23 Oct 2026 10:24:09 -0700 To: mm-commits@vger.kernel.org,vbabka@kernel.org,stable@vger.kernel.org,pfalcato@suse.de,matenajakub@gmail.com,luizcap@redhat.com,liam@infradead.org,jannh@google.com,ljs@kernel.org,akpm@linux-foundation.org From: Andrew Morton Subject: + mm-vma-fix-expansion-of-vma_mixedmap_bit-vmas.patch added to mm-unstable branch Message-Id: <20261023172409.D40F81F01825@smtp.kernel.org> X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list The patch titled Subject: mm/vma: fix expansion of VMA_MIXEDMAP_BIT VMAs has been added to the -mm mm-unstable branch. Its filename is mm-vma-fix-expansion-of-vma_mixedmap_bit-vmas.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-vma-fix-expansion-of-vma_mixedmap_bit-vmas.patch This patch will later appear in the mm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: "Lorenzo Stoakes (ARM)" Subject: mm/vma: fix expansion of VMA_MIXEDMAP_BIT VMAs Date: Fri, 23 Oct 2026 16:17:31 +0100 Commit ca3d76b0aa80 ("mm: add merging after mremap resize") combined merging with expansion of mremap()'d VMAs, however it also unintentionally disallowed the expansion of unmergeable VMAs. Previously it was possible to expand a mixed mapping which mremap() had already ensured was a legal expansion. This is clearly seen in the mremap() logic, as it checks vma_is_fixed_mapping() to determine legality of an expansion rather than vma_can_merge(). Additionally, copy_vma() allows for a failed merge to result in a new VMA being instantiated if MREMAP_MAYMOVE is specified. However, this is not attempted, as a failure in vma_merge_extend() is assumed to be an -ENOMEM failure. Since vma_merge_extend() is used exclusively by mremap() to perform a merge and/or expansion, resolve the issue by invoking vma_expand() for unmergeable VMAs there. Explicitly assert that the VMA is both non-fixed and a mixed mapping. This provides double insurance against broken changes in future. Note that khugepaged_enter_vma() (which vma_merge_new_range() runs) is redundant in this case, as a mixed mapping is not subject to khugepaged. Also update the VMA userland tests to add a required predicate. Link: https://lore.kernel.org/20261023-vma-expansion-fix-v1-1-6142baf1f46b@kernel.org Fixes: ca3d76b0aa80 ("mm: add merging after mremap resize") Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Andrew Morton Reported-by: Luiz Capitulino Closes: https://lore.kernel.org/all/20261023023106.515365-1-luizcap@redhat.com/ Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Jann Horn Cc: Pedro Falcato Cc: Jakub Matěna Cc: --- mm/vma.c | 19 ++++++++++++++++--- tools/testing/vma/include/dup.h | 5 +++++ 2 files changed, 21 insertions(+), 3 deletions(-) --- a/mm/vma.c~mm-vma-fix-expansion-of-vma_mixedmap_bit-vmas +++ a/mm/vma.c @@ -1851,12 +1851,25 @@ struct vm_area_struct *vma_merge_extend( struct vm_area_struct *vma, unsigned long delta) { - VMG_VMA_STATE(vmg, vmi, vma, vma, vma->vm_end, vma->vm_end + delta); + const unsigned long start = + vma_can_merge(vma) ? vma->vm_end : vma->vm_start; + VMG_VMA_STATE(vmg, vmi, vma, vma, start, vma->vm_end + delta); - vmg.next = vma_iter_next_rewind(vmi, NULL); vmg.middle = NULL; /* We use the VMA to populate VMG fields only. */ - return vma_merge_new_range(&vmg); + if (vma_can_merge(vma)) { + vmg.next = vma_iter_next_rewind(vmi, NULL); + return vma_merge_new_range(&vmg); + } + + /* Mixed mappings are permitted to be expanded, not merged. */ + VM_WARN_ON_ONCE(vma_is_fixed_mapping(vma)); + VM_WARN_ON_ONCE(!vma_test(vma, VMA_MIXEDMAP_BIT)); + vma_prev(vmi); /* Reposition to start of VMA. */ + vmg.target = vma; + if (vma_expand(&vmg)) + return NULL; + return vma; } void unlink_file_vma_batch_init(struct unlink_vma_file_batch *vb) --- a/tools/testing/vma/include/dup.h~mm-vma-fix-expansion-of-vma_mixedmap_bit-vmas +++ a/tools/testing/vma/include/dup.h @@ -1727,3 +1727,8 @@ static inline bool vma_flags_can_merge(c */ return !vma_flags_is_hugetlb(flags); } + +static inline bool vma_can_merge(const struct vm_area_struct *vma) +{ + return vma_flags_can_merge(&vma->flags); +} _ Patches currently in -mm which might be from ljs@kernel.org are mm-vma-fix-mmap_prepare-file-handling-remove-file_doesnt_need_get.patch mm-vma-introduce-and-use-vma_can_merge.patch mm-consistently-validate-vma-state-after-mmap-hooks.patch mm-vma-ensure-mmap_prepare-doesnt-set-actions-on-a-mergeable-vma.patch mm-make-map_kernel_pages_-internal-and-unexported.patch mm-vma-tidy-up-map-kernel-pages-enum-values.patch mm-assert-mmap-lock-held-use-new-flags-api-in-vm_insert_page.patch mm-add-mmap-action-for-discontiguous-kernel-page-mapping.patch docs-filesystems-update-mmap_prepare-docs-for-discontig-kernel-pgs.patch drivers-usb-mon-update-to-use-mmap_prepare-map-kernel-pages.patch infiniband-update-hfi1-to-use-remap_vmalloc_range.patch selinux-reject-writable-opens-of-policy-file-drop-mmap-shared-write-check.patch alsa-pcm-use-vm_insert_page-to-map-pcm-status-page.patch bpf-arena-mark-arena_map_mmap-mappings-vm_mixedmap.patch mm-vma-add-vma_is_mm_managed-predicates.patch mm-vma-only-allow-mmap-to-clear-vma_maywrite_bit-if-not-mm-managed.patch mm-vma-add-and-use-vma__is_fixed_mapping.patch scsi-sg-convert-mmap-hook-to-mmap_prepare-and-rework.patch fbdev-defio-assert-fbinfo_virtfb-drop-vm_io-add-vm_mixedmap.patch hsi-cmt_speech-convert-mmap-hook-to-mmap_prepare-refactor.patch mm-gup-error-out-early-on-vma_mayread_bit-vmas.patch uprobes-remove-vm_io-set-vm_mixedmap-for-mapped-kernel-pages.patch mm-mlock-clear-vma_locked_mask-over-mmap-callback.patch mm-mlock-eliminate-weird-vma_io_bit-abuse-and-simplify.patch mm-vma-enforce-that-mm-managed-mappings-may-not-set-vma_io_bit.patch mm-remove-vma_io_bit-check-in-vma_is_mm_managed.patch mm-remove-hugetlb_inlineh.patch mm-rename-is_vm_hugetlb_page-to-vma_is_hugetlb.patch mm-drop-some-redundant-checks-around-hugetlb-vmas.patch mm-vma-introduce-vma_is_mm_backed.patch mm-madvise-update-is_valid_guard_vma-to-use-vma_is_mm_backed.patch mm-uffd-use-predicates-for-userfaultfd-checks.patch mm-madvise-use-predicates-for-madvise-madv_dofork.patch mm-eliminate-vma_special_flags-usage-when-hugetlb-explicitly-tested.patch mm-eliminate-vma_special_flags-check-in-lru_gen_look_around.patch mm-avoid-use-of-vma_special_flags-in-migrate_vma_setup.patch mm-eliminate-vm_special-vma_special_flags.patch fuse-dax-do-not-set-vm_mixedmap.patch mm-huge_memory-remove-vma_is_special_huge.patch mm-vma-const-ify-vma_assert_stabilised-and-associated-functions.patch mm-implement-and-use-vma_has_anon_rmap-silence-kcsan.patch mm-update-comments-to-refer-to-anon-rmap-rather-than-anon_vma.patch mm-vma-dont-remove-vma-from-rmap-if-pgoff-unchanged.patch mm-vma-avoid-spurious-write-locks-when-mm-mm_lock_seq-overflows.patch mm-mremap-populate-calculated-fields-in-vrm-state-correctly.patch mm-mremap-correctly-uncharge-accountable-vmas-in-error-path.patch mm-vma-avoid-broken-uffd-merge-on-mremap.patch mm-vma-fix-expansion-of-vma_mixedmap_bit-vmas.patch