[PATCH 0/2] mm/vmalloc: harden remap_vmalloc_range_partial against NULL pages

[PATCH 0/2] mm/vmalloc: harden remap_vmalloc_range_partial against NULL pages

[Ye Liu]

remap_vmalloc_range_partial() passes vmalloc_to_page()'s result to
vm_insert_page() unchecked, oopsing via page_folio() if the page is
NULL. The NULL case never happens today because VM_USERMAP areas keep
every page mapped, but that assumption is nowhere checked.

Patch 1 drops VM_DMA_COHERENT from the allow-list -- a dead entry (no
caller maps a DMA-coherent area through this path) whose presence also
opens a NULL-deref path, since VM_DMA_COHERENT is not in vrealloc's
shrink skip-list.

Patch 2 adds a WARN_ON(!page) to flag any future break at the
vmalloc_to_page() call site before the oops.

Patch 1 is a behavior change (no in-tree caller affected); Patch 2 is
dead code. The two are independent.

Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
Ye Liu (2):
      mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial
      mm/vmalloc: warn on NULL page in remap_vmalloc_range_partial

 mm/vmalloc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
---
base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
change-id: 20261026-vmalloc_remap-012cf418c2a8

Best regards,
--  
Ye Liu <ye.liu@linux.dev>

[PATCH 1/2] mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial

[Ye Liu]

From: Ye Liu <liuye@kylinos.cn>

No caller maps a VM_DMA_COHERENT area through this path: such areas
come from dma_alloc_coherent() internals and are freed via vunmap(),
never through remap_vmalloc_range[_partial](); all 13 callers pass
vmalloc_user()/vmalloc()-backed addresses.

The flag was added in commit fe9041c245196 ("vmalloc: lift the arm
flag for coherent mappings to common code") as a mechanical
translation of ARM's VM_ARM_DMA_CONSISTENT. It is also unsafe to keep
since commit 5ea8ec74c57c0 ("mm/vmalloc: free unused pages on
vrealloc() shrink"), which frees tail pages of non-VM_USERMAP areas
(VM_DMA_COHERENT is not in that skip-list): a shrunk-then-mapped area
would hit vmalloc_to_page()==NULL and vm_insert_page() would
dereference it unchecked.

Drop it so DMA-coherent areas can never enter the path.

Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
 mm/vmalloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index db669103dc66..a888eca016a8 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4894,7 +4894,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
 	if (!area)
 		return -EINVAL;
 
-	if (!(area->flags & (VM_USERMAP | VM_DMA_COHERENT)))
+	if (!(area->flags & VM_USERMAP))
 		return -EINVAL;
 
 	if (check_add_overflow(size, off, &end_index) ||

-- 
2.43.0

[PATCH 2/2] mm/vmalloc: warn on NULL page in remap_vmalloc_range_partial

[Ye Liu]

From: Ye Liu <liuye@kylinos.cn>

remap_vmalloc_range_partial() oopses if vmalloc_to_page() returns
NULL, which never happens today because VM_USERMAP areas keep every
page mapped. Add a WARN_ON(!page) to flag a break before the oops.

Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
 mm/vmalloc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index a888eca016a8..59ba203a4eff 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4906,6 +4906,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
 		struct page *page = vmalloc_to_page(kaddr);
 		int ret;
 
+		WARN_ON(!page);
 		ret = vm_insert_page(vma, uaddr, page);
 		if (ret)
 			return ret;

-- 
2.43.0

Re: [PATCH 1/2] mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial

[Jose A. Perez de Azpillaga]

On 10/26/26 7:09 AM, Ye Liu wrote:
> From: Ye Liu <liuye@kylinos.cn>
> 
> No caller maps a VM_DMA_COHERENT area through this path: such areas
> come from dma_alloc_coherent() internals and are freed via vunmap(),
> never through remap_vmalloc_range[_partial](); all 13 callers pass
> vmalloc_user()/vmalloc()-backed addresses.
> 
> The flag was added in commit fe9041c245196 ("vmalloc: lift the arm
> flag for coherent mappings to common code") as a mechanical
> translation of ARM's VM_ARM_DMA_CONSISTENT. It is also unsafe to keep
> since commit 5ea8ec74c57c0 ("mm/vmalloc: free unused pages on
> vrealloc() shrink"), which frees tail pages of non-VM_USERMAP areas
> (VM_DMA_COHERENT is not in that skip-list): a shrunk-then-mapped area
> would hit vmalloc_to_page()==NULL and vm_insert_page() would
> dereference it unchecked.

this isn't quite true, is it? the dma remap helpers vmap() without
VM_MAP_PUT_PAGES, so nr_pages stays 0 and the shrink never frees
anything there.

> 
> Drop it so DMA-coherent areas can never enter the path.
> 
> Signed-off-by: Ye Liu <liuye@kylinos.cn>
> ---
>  mm/vmalloc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index db669103dc66..a888eca016a8 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -4894,7 +4894,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
>  	if (!area)
>  		return -EINVAL;
>  
> -	if (!(area->flags & (VM_USERMAP | VM_DMA_COHERENT)))
> +	if (!(area->flags & VM_USERMAP))
>  		return -EINVAL;
>  
>  	if (check_add_overflow(size, off, &end_index) ||
> 

the change itself looks fine to me.

-- 
cheers,
jose a. p-a

Re: [PATCH 2/2] mm/vmalloc: warn on NULL page in remap_vmalloc_range_partial

[Jose A. Perez de Azpillaga]

On 10/26/26 7:09 AM, Ye Liu wrote:
> From: Ye Liu <liuye@kylinos.cn>
> 
> remap_vmalloc_range_partial() oopses if vmalloc_to_page() returns
> NULL, which never happens today because VM_USERMAP areas keep every
> page mapped. Add a WARN_ON(!page) to flag a break before the oops.
> 
> Signed-off-by: Ye Liu <liuye@kylinos.cn>
> ---
>  mm/vmalloc.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index a888eca016a8..59ba203a4eff 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -4906,6 +4906,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
>  		struct page *page = vmalloc_to_page(kaddr);
>  		int ret;
>  
> +		WARN_ON(!page);
>  		ret = vm_insert_page(vma, uaddr, page);

doesn't this still hand the NULL page to vm_insert_page() right after,
so we warn and then oops anyway? wouldn't something like this be what
you want here?

		if (WARN_ON_ONCE(!page))
			return -EINVAL;

-- 
cheers,
jose a. p-a