Re: [RFC PATCH v2 03/13] mm: implement __anon_node_prepare for ANON_VMA_FRACTAL

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] `__anon_node_prepare` casts a `struct anon_node *` to a `struct anon_vma *` and assigns it to `vma->anon_vma`, resulting in severe type confusion.
--

--- Patch [3]: [RFC PATCH v2 03/13] mm: implement __anon_node_prepare for ANON_VMA_FRACTAL ---
commit 1ab3065664fb86573b65c2ad490a2b4e7c508707
Author: tao <tao.wangtao@honor.com>

    mm: implement __anon_node_prepare for ANON_VMA_FRACTAL

This commit introduces anon_node APIs corresponding to existing anon_vma
operations for the ANON_VMA_FRACTAL feature. It currently implements
__anon_node_prepare() to attach an anon_node to a VMA.

> diff --git a/mm/rmap.c b/mm/rmap.c
> --- a/mm/rmap.c
> +++ b/mm/rmap.c

[ ... ]

> +int __anon_node_prepare(struct vm_area_struct *vma)
> +{
> +	struct mm_struct *mm = vma->vm_mm;
> +	unsigned long rmap_base = vma_rmap_base(vma);
> +	struct anon_node *anon_nod;
> +	struct anon_vma *anon_old = NULL, *anon_new;

[ ... ]

> +	anon_nod = anon_node_alloc(vma, NULL, false);
> +	if (unlikely(!anon_nod))
> +		return -ENOMEM;
> +
> +	anon_new = (struct anon_vma *)anon_nod;
> +	/* maybe prepared by another thread */
> +	if (!try_cmpxchg(&vma->anon_vma, &anon_old, anon_new)) {

[Severity: Critical]
Will this cause memory corruption for existing reverse mapping and page fault
paths that expect a standard anon_vma?

Because struct anon_node and struct anon_vma have significantly different
memory layouts, storing an anon_node pointer into vma->anon_vma will cause
type confusion. For instance, anon_node places vm_lock_ref at the exact
memory offset where anon_vma expects refcount. 

When standard VMA operations (like folio_lock_anon_vma_read() or
unlink_anon_vmas()) access vma->anon_vma->refcount, won't they read and write
the wrong fields, corrupting vm_lock_ref and permanently leaking the anon_node
since its actual refcount is never decremented?

> +		try_untrack_rmap(anon_nod, rmap_base, &test_empty);
> +		put_anon_node(anon_nod);
> +	}
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707063308.29176-1-tao.wangtao@honor.com?part=3