From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792832448; b=FDaZjb7WiDxuJdLzGY3TSvUfHNMKOMdOVauo9pyBwpq5UaOlcNx2akeyxgxkLZOYXT2t mc9dqXPYZj4Po+kdXjzBIXED/410fnkaqkmw1IeYCNcGIm/FtNWvAWkep9AF5drAgxVKb mFtm4ZTdrD2MuZCu/8WCcnJT2hCpa2YTqZ0lBRtau1WUheeed6SGi/5ee18ebp6NnFLmo pq/FW8liRzNXqW80yPzwIMNz8HpjmXtCgn/H7Xf5JYE31lVqpQU9+1rBSd12AAFt2TRrG DEaAHv1ibJEkIjjOyeG+Vu+MM11pF43ZvSnpeOcS8jB4MRyTQqHJtkrNtMKftLBi77w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792832448; h=Received:DKIM-Signature:Date:To:From:Subject:Message-Id; bh=C6RixL9e4bfeR8kcip9AVZOsb2OfiDaEpz2hEsLF8Tg=; b=p2/IO0ut+RvIYC9jRl8aJfHYBQkLMCGOb7qehSzwFTR+MxXAGxw1akrVGaR4MQDpf9dm GT8xKP305rOjhjo3eh9UE93f3kMHBA6iGMd3NtF7bYRicGhKsPQLJ06B4IXKiGbZi5onW 3m7fgR8iu+yk8QL8Hj14NvjwQKdbAe2XGSVv3XK47zfruK08vhCT1DTjBmqCybAbzH3M7 Db4KEr0/YV5nSy03X+sIwHTG810dGev3xK7nd6cKADOc7OEd6m0ubUKpBYJNWDoneWp44 lh9ZmPbquCZGDEYnqeeJl2CqzBuqg8l3BD8k+HK3xABlT+oZsVxgyzzZ/DrpGyHbR2w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=veLD1fQU; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BE4D606A31A for ; Sat, 24 Oct 2026 09:00:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=veLD1fQU Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC2681F01828; Sat, 24 Oct 2026 09:00:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1792832447; bh=C6RixL9e4bfeR8kcip9AVZOsb2OfiDaEpz2hEsLF8Tg=; h=Date:To:From:Subject; b=veLD1fQU/ov2eLUwtZEAfPV2MCD7rANhnPPc3l+bopWDWBOcptEQx5X2WqkXSXIRm LbaF+YAqFe03HX7YP45+ZjSRwEUm87Ii5k4N1jvq7qX6G/AiNdIrD7xOksoItZI/hC NaZa6+IcY8xludEEkKbU3EmCkWMC+KdoEV5cUk18= Date: Sat, 24 Oct 2026 02:00:47 -0700 To: mm-commits@vger.kernel.org,urezki@gmail.com,glider@google.com,elver@google.com,dvyukov@google.com,dmytrokoziuk68@gmail.com,akpm@linux-foundation.org From: Andrew Morton Subject: [merged mm-stable] mm-kmsan-fix-iounmap-metadata-teardown.patch removed from -mm tree Message-Id: <20261024090047.CC2681F01828@smtp.kernel.org> X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list The quilt patch titled Subject: mm: kmsan: fix iounmap metadata teardown has been removed from the -mm tree. Its filename was mm-kmsan-fix-iounmap-metadata-teardown.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Dima Koziuk Subject: mm: kmsan: fix iounmap metadata teardown Date: Fri, 2 Oct 2026 23:05:07 +0300 kmsan_vmalloc_to_page_or_null() rejects addresses outside the regular vmalloc and module ranges, including the shadow and origin addresses passed by its callers. As a result, iounmap does not free the metadata backing pages. Also, the first iteration of the teardown loop unmaps the entire metadata range, preventing subsequent iterations from finding their pages even if the address lookup is fixed. Factor the page-table walk out of vmalloc_to_page() into __vmalloc_to_page(), keeping the address check in the public wrapper. Use the unchecked helper in kmsan_vmalloc_to_page_or_null() and check for NULL before converting the returned page to a PFN. Mark __vmalloc_to_page() as __always_inline to avoid an additional function call in vmalloc_to_page(). Move metadata teardown into kmsan_iounmap_pages(). Free the backing blocks while their mappings are still available, then unmap each metadata range once and flush its TLB entries. Link: https://lore.kernel.org/20261002200508.546-1-dmytrokoziuk68@gmail.com Fixes: b073d7f8aee4 ("mm: kmsan: maintain KMSAN metadata for page operations") Signed-off-by: Dima Koziuk Signed-off-by: Andrew Morton Suggested-by: Alexander Potapenko Link: https://lkml.iu.edu/2609.3/12748.html Cc: Marco Elver Cc: Dmitry Vyukov Cc: Uladzislau Rezki (Sony) --- mm/kmsan/core.c | 8 ++----- mm/kmsan/hooks.c | 51 +++++++++++++++++++++++++++++---------------- mm/vmalloc.c | 21 +++++++++++------- mm/vmalloc.h | 1 4 files changed, 50 insertions(+), 31 deletions(-) --- a/mm/kmsan/core.c~mm-kmsan-fix-iounmap-metadata-teardown +++ a/mm/kmsan/core.c @@ -27,6 +27,7 @@ #include #include "../slab.h" +#include "../vmalloc.h" #include "kmsan.h" bool kmsan_enabled __read_mostly; @@ -240,11 +241,8 @@ struct page *kmsan_vmalloc_to_page_or_nu { struct page *page; - if (!kmsan_internal_is_vmalloc_addr(vaddr) && - !kmsan_internal_is_module_addr(vaddr)) - return NULL; - page = vmalloc_to_page(vaddr); - if (pfn_valid(page_to_pfn(page))) + page = __vmalloc_to_page(vaddr); + if (page && pfn_valid(page_to_pfn(page))) return page; else return NULL; --- a/mm/kmsan/hooks.c~mm-kmsan-fix-iounmap-metadata-teardown +++ a/mm/kmsan/hooks.c @@ -20,6 +20,8 @@ #include #include +#include + #include "../internal.h" #include "../vmalloc.h" #include "../slab.h" @@ -142,6 +144,36 @@ void kmsan_vunmap_range_noflush(unsigned flush_cache_vmap(vmalloc_origin(start), vmalloc_origin(end)); } +#define KMSAN_IOREMAP_META_ORDER 1 + +static void kmsan_iounmap_pages(unsigned long start, unsigned long end) +{ + unsigned long shadow_start = vmalloc_shadow(start), + shadow_end = vmalloc_shadow(end); + unsigned long origin_start = vmalloc_origin(start), + origin_end = vmalloc_origin(end); + unsigned long v_shadow, v_origin; + struct page *shadow, *origin; + int nr; + + nr = (end - start) / PAGE_SIZE; + v_shadow = shadow_start; + v_origin = origin_start; + for (int i = 0; i < nr; + i++, v_shadow += PAGE_SIZE, v_origin += PAGE_SIZE) { + shadow = kmsan_vmalloc_to_page_or_null((void *)v_shadow); + origin = kmsan_vmalloc_to_page_or_null((void *)v_origin); + if (shadow) + __free_pages(shadow, KMSAN_IOREMAP_META_ORDER); + if (origin) + __free_pages(origin, KMSAN_IOREMAP_META_ORDER); + } + __vunmap_range_noflush(shadow_start, shadow_end); + __vunmap_range_noflush(origin_start, origin_end); + flush_tlb_kernel_range(shadow_start, shadow_end); + flush_tlb_kernel_range(origin_start, origin_end); +} + /* * This function creates new shadow/origin pages for the physical pages mapped * into the virtual memory. If those physical pages already had shadow/origin, @@ -219,28 +251,11 @@ ret: void kmsan_iounmap_page_range(unsigned long start, unsigned long end) { - unsigned long v_shadow, v_origin; - struct page *shadow, *origin; - int nr; - if (!kmsan_enabled || kmsan_in_runtime()) return; - nr = (end - start) / PAGE_SIZE; kmsan_enter_runtime(); - v_shadow = (unsigned long)vmalloc_shadow(start); - v_origin = (unsigned long)vmalloc_origin(start); - for (int i = 0; i < nr; - i++, v_shadow += PAGE_SIZE, v_origin += PAGE_SIZE) { - shadow = kmsan_vmalloc_to_page_or_null((void *)v_shadow); - origin = kmsan_vmalloc_to_page_or_null((void *)v_origin); - __vunmap_range_noflush(v_shadow, vmalloc_shadow(end)); - __vunmap_range_noflush(v_origin, vmalloc_origin(end)); - if (shadow) - __free_pages(shadow, 1); - if (origin) - __free_pages(origin, 1); - } + kmsan_iounmap_pages(start, end); flush_cache_vmap(vmalloc_shadow(start), vmalloc_shadow(end)); flush_cache_vmap(vmalloc_origin(start), vmalloc_origin(end)); kmsan_leave_runtime(); --- a/mm/vmalloc.c~mm-kmsan-fix-iounmap-metadata-teardown +++ a/mm/vmalloc.c @@ -817,9 +817,10 @@ EXPORT_SYMBOL_GPL(is_vmalloc_or_module_a /* * Walk a vmap address to the struct page it maps. Huge vmap mappings will * return the tail page that corresponds to the base page address, which - * matches small vmap mappings. + * matches small vmap mappings. Unlike vmalloc_to_page(), this also accepts + * addresses outside the vmalloc and module ranges, such as KMSAN metadata. */ -struct page *vmalloc_to_page(const void *vmalloc_addr) +__always_inline struct page *__vmalloc_to_page(const void *vmalloc_addr) { unsigned long addr = (unsigned long) vmalloc_addr; struct page *page = NULL; @@ -829,12 +830,6 @@ struct page *vmalloc_to_page(const void pmd_t *pmd; pte_t *ptep, pte; - /* - * XXX we might need to change this if we add VIRTUAL_BUG_ON for - * architectures that do not vmalloc module space - */ - VIRTUAL_BUG_ON(!is_vmalloc_or_module_addr(vmalloc_addr)); - if (pgd_none(*pgd)) return NULL; if (WARN_ON_ONCE(pgd_leaf(*pgd))) @@ -873,6 +868,16 @@ struct page *vmalloc_to_page(const void return page; } + +struct page *vmalloc_to_page(const void *vmalloc_addr) +{ + /* + * XXX we might need to change this if we add VIRTUAL_BUG_ON for + * architectures that do not vmalloc module space + */ + VIRTUAL_BUG_ON(!is_vmalloc_or_module_addr(vmalloc_addr)); + return __vmalloc_to_page(vmalloc_addr); +} EXPORT_SYMBOL(vmalloc_to_page); /* --- a/mm/vmalloc.h~mm-kmsan-fix-iounmap-metadata-teardown +++ a/mm/vmalloc.h @@ -8,6 +8,7 @@ #include #ifdef CONFIG_MMU +struct page *__vmalloc_to_page(const void *vmalloc_addr); void __init vmalloc_init(void); int __must_check vmap_pages_range_noflush(unsigned long addr, unsigned long end, pgprot_t prot, struct page **pages, _ Patches currently in -mm which might be from dmytrokoziuk68@gmail.com are