[PATCH v2 0/2] mm/vmalloc: harden remap_vmalloc_range_partial against NULL pages

[PATCH v2 0/2] mm/vmalloc: harden remap_vmalloc_range_partial against NULL pages

[Ye Liu]

remap_vmalloc_range_partial() passes vmalloc_to_page()'s result to
vm_insert_page() unchecked, oopsing via page_folio() if the page is
NULL. The NULL case never happens today because VM_USERMAP areas keep
every page mapped, but that assumption is nowhere checked.

Patch 1 drops VM_DMA_COHERENT from the allow-list -- a dead entry (no
caller maps a DMA-coherent area through this path).

Patch 2 fails the mapping with -EINVAL instead of oopsing if
vmalloc_to_page() ever returns NULL, with a WARN to mark the broken
invariant.

Patch 1 is a behavior change (no in-tree caller affected)
Patch 2 only changes a failure path that cannot be reached today. 
The two are independent.

Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
Changes in v2:
- patch 1: drop the vrealloc-shrink justification. 
- patch 2: fail with -EINVAL rather than oopsing.
- Link to v1: https://patch.msgid.link/20261026-vmalloc_remap-v1-0-b7a907814e90@linux.dev

---
Ye Liu (2):
      mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial
      mm/vmalloc: reject NULL pages in remap_vmalloc_range_partial

 mm/vmalloc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
---
base-commit: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
change-id: 20261026-vmalloc_remap-012cf418c2a8

Best regards,
--  
Ye Liu <ye.liu@linux.dev>

[PATCH v2 1/2] mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial

[Ye Liu]

From: Ye Liu <liuye@kylinos.cn>

No caller maps a VM_DMA_COHERENT area through this path: such areas
come from dma_alloc_coherent() internals and are freed via vunmap(),
never through remap_vmalloc_range[_partial](); all 13 callers pass
vmalloc_user()/vmalloc()-backed addresses.

The flag was added in commit fe9041c245196 ("vmalloc: lift the arm
flag for coherent mappings to common code") as a mechanical
translation of ARM's VM_ARM_DMA_CONSISTENT.

Drop it so DMA-coherent areas can never enter the path.

Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
 mm/vmalloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index db669103dc66..a888eca016a8 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4894,7 +4894,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
 	if (!area)
 		return -EINVAL;
 
-	if (!(area->flags & (VM_USERMAP | VM_DMA_COHERENT)))
+	if (!(area->flags & VM_USERMAP))
 		return -EINVAL;
 
 	if (check_add_overflow(size, off, &end_index) ||

-- 
2.43.0

[PATCH v2 2/2] mm/vmalloc: reject NULL pages in remap_vmalloc_range_partial

[Ye Liu]

From: Ye Liu <liuye@kylinos.cn>

remap_vmalloc_range_partial() passes vmalloc_to_page()'s result to
vm_insert_page() unchecked, oopsing via page_folio() on a NULL page.
The NULL case cannot happen today because VM_USERMAP areas keep every
page mapped, but nothing enforces that invariant. Warn once and fail
the mapping with -EINVAL instead of oopsing if it is ever broken.

Suggested-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
Signed-off-by: Ye Liu <liuye@kylinos.cn>
---
 mm/vmalloc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index a888eca016a8..dabef40ea88b 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4906,6 +4906,9 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
 		struct page *page = vmalloc_to_page(kaddr);
 		int ret;
 
+		if (WARN_ON_ONCE(!page))
+			return -EINVAL;
+
 		ret = vm_insert_page(vma, uaddr, page);
 		if (ret)
 			return ret;

-- 
2.43.0

Re: [PATCH v2 1/2] mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial

[Jose A. Perez de Azpillaga]

On 10/29/26 10:19 AM, Ye Liu wrote:
> From: Ye Liu <liuye@kylinos.cn>
> 
> No caller maps a VM_DMA_COHERENT area through this path: such areas
> come from dma_alloc_coherent() internals and are freed via vunmap(),
> never through remap_vmalloc_range[_partial](); all 13 callers pass
> vmalloc_user()/vmalloc()-backed addresses.
> 
> The flag was added in commit fe9041c245196 ("vmalloc: lift the arm
> flag for coherent mappings to common code") as a mechanical
> translation of ARM's VM_ARM_DMA_CONSISTENT.
> 
> Drop it so DMA-coherent areas can never enter the path.
> 
> Signed-off-by: Ye Liu <liuye@kylinos.cn>
> ---
>  mm/vmalloc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index db669103dc66..a888eca016a8 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -4894,7 +4894,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
>  	if (!area)
>  		return -EINVAL;
>  
> -	if (!(area->flags & (VM_USERMAP | VM_DMA_COHERENT)))
> +	if (!(area->flags & VM_USERMAP))
>  		return -EINVAL;
>  
>  	if (check_add_overflow(size, off, &end_index) ||
> 

Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>

-- 
cheers,
jose a. p-a

Re: [PATCH v2 2/2] mm/vmalloc: reject NULL pages in remap_vmalloc_range_partial

[Jose A. Perez de Azpillaga]

On 10/29/26 10:19 AM, Ye Liu wrote:
> From: Ye Liu <liuye@kylinos.cn>
> 
> remap_vmalloc_range_partial() passes vmalloc_to_page()'s result to
> vm_insert_page() unchecked, oopsing via page_folio() on a NULL page.
> The NULL case cannot happen today because VM_USERMAP areas keep every
> page mapped, but nothing enforces that invariant. Warn once and fail
> the mapping with -EINVAL instead of oopsing if it is ever broken.
> 
> Suggested-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
> Signed-off-by: Ye Liu <liuye@kylinos.cn>
> ---
>  mm/vmalloc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index a888eca016a8..dabef40ea88b 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -4906,6 +4906,9 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
>  		struct page *page = vmalloc_to_page(kaddr);
>  		int ret;
>  
> +		if (WARN_ON_ONCE(!page))
> +			return -EINVAL;
> +

thanks for picking this up :)

Reviewed-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>

-- 
cheers,
jose a. p-a