[PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[Hongfu Li]

From: Hongfu Li <lihongfu@kylinos.cn>

range_contains_unmapped() accepts an explicit struct mm_struct *mm
argument, yet hardcodes current->mm inside VMA_ITERATOR(), ignoring
the passed address space.

Its only caller do_mseal() currently passes current->mm, so the bug
does not manifest right now. However this mismatch between prototype
and implementation is a latent bug.

Replace current->mm with the passed mm parameter to match the
function prototype.

Fixes: 530e09096413 ("mm/mseal: simplify and rename VMA gap check")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
---
 mm/mseal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mseal.c b/mm/mseal.c
index 9781647483d1..8d82e50900ba 100644
--- a/mm/mseal.c
+++ b/mm/mseal.c
@@ -41,7 +41,7 @@ static bool range_contains_unmapped(struct mm_struct *mm,
 {
 	struct vm_area_struct *vma;
 	unsigned long prev_end = start;
-	VMA_ITERATOR(vmi, current->mm, start);
+	VMA_ITERATOR(vmi, mm, start);
 
 	for_each_vma_range(vmi, vma, end) {
 		if (vma->vm_start > prev_end)
-- 
2.54.0

Re: [PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[Lorenzo Stoakes (ARM)]

On Thu, Jul 16, 2026 at 05:33:47PM +0800, Hongfu Li wrote:
> From: Hongfu Li <lihongfu@kylinos.cn>
>
> range_contains_unmapped() accepts an explicit struct mm_struct *mm
> argument, yet hardcodes current->mm inside VMA_ITERATOR(), ignoring
> the passed address space.
>
> Its only caller do_mseal() currently passes current->mm, so the bug
> does not manifest right now. However this mismatch between prototype
> and implementation is a latent bug.
>
> Replace current->mm with the passed mm parameter to match the
> function prototype.
>
> Fixes: 530e09096413 ("mm/mseal: simplify and rename VMA gap check")

There's no point in a Fixes tag for something that's not a bug.

> Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
> ---
>  mm/mseal.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/mseal.c b/mm/mseal.c
> index 9781647483d1..8d82e50900ba 100644
> --- a/mm/mseal.c
> +++ b/mm/mseal.c
> @@ -41,7 +41,7 @@ static bool range_contains_unmapped(struct mm_struct *mm,
>  {
>  	struct vm_area_struct *vma;
>  	unsigned long prev_end = start;
> -	VMA_ITERATOR(vmi, current->mm, start);
> +	VMA_ITERATOR(vmi, mm, start);

We're never going to sensibly allow a remote mm here, and even suggesting so is
problematic.

Sorry but I think it's just easier if I send a broader cleanup patch to fix
things up here more clearly.

>
>  	for_each_vma_range(vmi, vma, end) {
>  		if (vma->vm_start > prev_end)
> --
> 2.54.0
>

Thanks, Lorenzo