* [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions
@ 2026-09-11 12:35 Yeoreum Yun
2026-09-11 12:59 ` Lorenzo Stoakes (ARM)
0 siblings, 1 reply; 6+ messages in thread
From: Yeoreum Yun @ 2026-09-11 12:35 UTC (permalink / raw)
To: linux-mm, linux-kselftest, linux-kernel
Cc: akpm, david, ljs, liam, vbabka, rppt, surenb, mhocko, Yeoreum Yun
check_vmflag_guard() uses /proc/self/smaps to retrieve the VMA flags,
but this can fail if the mapping is merged with an adjacent VMA.
To avoid this potential failure, first allocate a temporary region with
extra pages at both ends, unmap it, and then map the test region within
the temporary address range, leaving an unmapped page on each side to
prevent VMA merging.
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
---
tools/testing/selftests/mm/guard-regions.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/mm/guard-regions.c b/tools/testing/selftests/mm/guard-regions.c
index 5c8ec3ca75d7..a28a57d34e97 100644
--- a/tools/testing/selftests/mm/guard-regions.c
+++ b/tools/testing/selftests/mm/guard-regions.c
@@ -2257,8 +2257,18 @@ TEST_F(guard_regions, smaps)
char *ptr, *ptr2;
int i;
- /* Map a region. */
- ptr = mmap_(self, variant, NULL, 10 * page_size, PROT_READ | PROT_WRITE, 0, 0);
+ /* Try to Map a region. */
+ ptr = mmap_(self, variant, NULL, 12 * page_size, PROT_READ | PROT_WRITE, 0, 0);
+ ASSERT_NE(ptr, MAP_FAILED);
+ ASSERT_EQ(munmap(ptr, 12 * page_size), 0);
+
+ /*
+ * Map a region for the test. Since the preceding temporary mapping
+ * succeeded, this mapping should also succeed without merging with
+ * adjacent VMAs.
+ */
+ ptr = mmap_(self, variant, ptr + page_size, 10 * page_size,
+ PROT_READ | PROT_WRITE, MAP_FIXED, 0);
ASSERT_NE(ptr, MAP_FAILED);
/* We shouldn't yet see a guard flag. */
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions
2026-09-11 12:35 [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions Yeoreum Yun
@ 2026-09-11 12:59 ` Lorenzo Stoakes (ARM)
2026-09-11 13:34 ` Yeoreum Yun
0 siblings, 1 reply; 6+ messages in thread
From: Lorenzo Stoakes (ARM) @ 2026-09-11 12:59 UTC (permalink / raw)
To: Yeoreum Yun
Cc: linux-mm, linux-kselftest, linux-kernel, akpm, david, liam,
vbabka, rppt, surenb, mhocko
On Fri, Sep 11, 2026 at 01:35:34PM +0100, Yeoreum Yun wrote:
> check_vmflag_guard() uses /proc/self/smaps to retrieve the VMA flags,
> but this can fail if the mapping is merged with an adjacent VMA.
>
> To avoid this potential failure, first allocate a temporary region with
> extra pages at both ends, unmap it, and then map the test region within
> the temporary address range, leaving an unmapped page on each side to
> prevent VMA merging.
>
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> ---
> tools/testing/selftests/mm/guard-regions.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/tools/testing/selftests/mm/guard-regions.c b/tools/testing/selftests/mm/guard-regions.c
> index 5c8ec3ca75d7..a28a57d34e97 100644
> --- a/tools/testing/selftests/mm/guard-regions.c
> +++ b/tools/testing/selftests/mm/guard-regions.c
> @@ -2257,8 +2257,18 @@ TEST_F(guard_regions, smaps)
> char *ptr, *ptr2;
> int i;
>
> - /* Map a region. */
> - ptr = mmap_(self, variant, NULL, 10 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> + /* Try to Map a region. */
Map -> map
> + ptr = mmap_(self, variant, NULL, 12 * page_size, PROT_READ | PROT_WRITE, 0, 0);
Should be PROT_NONE otherwise it'll merge with the below.
> + ASSERT_NE(ptr, MAP_FAILED);
> + ASSERT_EQ(munmap(ptr, 12 * page_size), 0);
> +
> + /*
> + * Map a region for the test. Since the preceding temporary mapping
> + * succeeded, this mapping should also succeed without merging with
> + * adjacent VMAs.
> + */
> + ptr = mmap_(self, variant, ptr + page_size, 10 * page_size,
> + PROT_READ | PROT_WRITE, MAP_FIXED, 0);
> ASSERT_NE(ptr, MAP_FAILED);
>
> /* We shouldn't yet see a guard flag. */
> --
> LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
>
--
Cheers, Lorenzo
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions
2026-09-11 12:59 ` Lorenzo Stoakes (ARM)
@ 2026-09-11 13:34 ` Yeoreum Yun
2026-09-11 13:51 ` Lorenzo Stoakes (ARM)
0 siblings, 1 reply; 6+ messages in thread
From: Yeoreum Yun @ 2026-09-11 13:34 UTC (permalink / raw)
To: Lorenzo Stoakes (ARM)
Cc: Yeoreum Yun, linux-mm, linux-kselftest, linux-kernel, akpm, david,
liam, vbabka, rppt, surenb, mhocko
On Fri, Sep 11, 2026 at 01:59:31PM +0100, Lorenzo Stoakes (ARM) wrote:
> On Fri, Sep 11, 2026 at 01:35:34PM +0100, Yeoreum Yun wrote:
> > check_vmflag_guard() uses /proc/self/smaps to retrieve the VMA flags,
> > but this can fail if the mapping is merged with an adjacent VMA.
> >
> > To avoid this potential failure, first allocate a temporary region with
> > extra pages at both ends, unmap it, and then map the test region within
> > the temporary address range, leaving an unmapped page on each side to
> > prevent VMA merging.
> >
> > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > ---
> > tools/testing/selftests/mm/guard-regions.c | 14 ++++++++++++--
> > 1 file changed, 12 insertions(+), 2 deletions(-)
> >
> > diff --git a/tools/testing/selftests/mm/guard-regions.c b/tools/testing/selftests/mm/guard-regions.c
> > index 5c8ec3ca75d7..a28a57d34e97 100644
> > --- a/tools/testing/selftests/mm/guard-regions.c
> > +++ b/tools/testing/selftests/mm/guard-regions.c
> > @@ -2257,8 +2257,18 @@ TEST_F(guard_regions, smaps)
> > char *ptr, *ptr2;
> > int i;
> >
> > - /* Map a region. */
> > - ptr = mmap_(self, variant, NULL, 10 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> > + /* Try to Map a region. */
>
> Map -> map
>
> > + ptr = mmap_(self, variant, NULL, 12 * page_size, PROT_READ | PROT_WRITE, 0, 0);
>
> Should be PROT_NONE otherwise it'll merge with the below.
It doesn't matter. since this memory is unmapped and then second map
at ptr + page_size.
IOW, though the first one is merged, it unammped and then
the second is allocated at ptr + page_size, it wouldn't be merged:
after unmap:
[existing VMA][ 12 pages ][existing VMA]
second:
[exiting VMA] [hole (page)] [ 10 pages (for test)] [hole (page)] [existing VMA]
Am I missing something?
--
Sincerely,
Yeoreum Yun
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions
2026-09-11 13:34 ` Yeoreum Yun
@ 2026-09-11 13:51 ` Lorenzo Stoakes (ARM)
2026-09-11 14:14 ` Lorenzo Stoakes (ARM)
0 siblings, 1 reply; 6+ messages in thread
From: Lorenzo Stoakes (ARM) @ 2026-09-11 13:51 UTC (permalink / raw)
To: Yeoreum Yun
Cc: linux-mm, linux-kselftest, linux-kernel, akpm, david, liam,
vbabka, rppt, surenb, mhocko
On Fri, Sep 11, 2026 at 02:34:37PM +0100, Yeoreum Yun wrote:
> On Fri, Sep 11, 2026 at 01:59:31PM +0100, Lorenzo Stoakes (ARM) wrote:
> > On Fri, Sep 11, 2026 at 01:35:34PM +0100, Yeoreum Yun wrote:
> > > check_vmflag_guard() uses /proc/self/smaps to retrieve the VMA flags,
> > > but this can fail if the mapping is merged with an adjacent VMA.
> > >
> > > To avoid this potential failure, first allocate a temporary region with
> > > extra pages at both ends, unmap it, and then map the test region within
> > > the temporary address range, leaving an unmapped page on each side to
> > > prevent VMA merging.
> > >
> > > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > > ---
> > > tools/testing/selftests/mm/guard-regions.c | 14 ++++++++++++--
> > > 1 file changed, 12 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/tools/testing/selftests/mm/guard-regions.c b/tools/testing/selftests/mm/guard-regions.c
> > > index 5c8ec3ca75d7..a28a57d34e97 100644
> > > --- a/tools/testing/selftests/mm/guard-regions.c
> > > +++ b/tools/testing/selftests/mm/guard-regions.c
> > > @@ -2257,8 +2257,18 @@ TEST_F(guard_regions, smaps)
> > > char *ptr, *ptr2;
> > > int i;
> > >
> > > - /* Map a region. */
> > > - ptr = mmap_(self, variant, NULL, 10 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> > > + /* Try to Map a region. */
> >
> > Map -> map
> >
> > > + ptr = mmap_(self, variant, NULL, 12 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> >
> > Should be PROT_NONE otherwise it'll merge with the below.
>
> It doesn't matter. since this memory is unmapped and then second map
> at ptr + page_size.
>
> IOW, though the first one is merged, it unammped and then
> the second is allocated at ptr + page_size, it wouldn't be merged:
>
> after unmap:
> [existing VMA][ 12 pages ][existing VMA]
>
> second:
> [exiting VMA] [hole (page)] [ 10 pages (for test)] [hole (page)] [existing VMA]
>
> Am I missing something?
Yeah, unmapped (unfaulted) VMAs can be merged with mapped (faulted) VMAs.
In general it's also better to be explicit by specifying distinct attributes
anyway to spell out clearly that the VMAs are intended to perform that task.
>
> --
> Sincerely,
> Yeoreum Yun
--
Cheers, Lorenzo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions
2026-09-11 13:51 ` Lorenzo Stoakes (ARM)
@ 2026-09-11 14:14 ` Lorenzo Stoakes (ARM)
2026-09-11 14:18 ` Yeoreum Yun
0 siblings, 1 reply; 6+ messages in thread
From: Lorenzo Stoakes (ARM) @ 2026-09-11 14:14 UTC (permalink / raw)
To: Yeoreum Yun
Cc: linux-mm, linux-kselftest, linux-kernel, akpm, david, liam,
vbabka, rppt, surenb, mhocko
On Fri, Sep 11, 2026 at 02:51:09PM +0100, Lorenzo Stoakes (ARM) wrote:
> On Fri, Sep 11, 2026 at 02:34:37PM +0100, Yeoreum Yun wrote:
> > On Fri, Sep 11, 2026 at 01:59:31PM +0100, Lorenzo Stoakes (ARM) wrote:
> > > On Fri, Sep 11, 2026 at 01:35:34PM +0100, Yeoreum Yun wrote:
> > > > check_vmflag_guard() uses /proc/self/smaps to retrieve the VMA flags,
> > > > but this can fail if the mapping is merged with an adjacent VMA.
> > > >
> > > > To avoid this potential failure, first allocate a temporary region with
> > > > extra pages at both ends, unmap it, and then map the test region within
> > > > the temporary address range, leaving an unmapped page on each side to
> > > > prevent VMA merging.
> > > >
> > > > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > > > ---
> > > > tools/testing/selftests/mm/guard-regions.c | 14 ++++++++++++--
> > > > 1 file changed, 12 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/tools/testing/selftests/mm/guard-regions.c b/tools/testing/selftests/mm/guard-regions.c
> > > > index 5c8ec3ca75d7..a28a57d34e97 100644
> > > > --- a/tools/testing/selftests/mm/guard-regions.c
> > > > +++ b/tools/testing/selftests/mm/guard-regions.c
> > > > @@ -2257,8 +2257,18 @@ TEST_F(guard_regions, smaps)
> > > > char *ptr, *ptr2;
> > > > int i;
> > > >
> > > > - /* Map a region. */
> > > > - ptr = mmap_(self, variant, NULL, 10 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> > > > + /* Try to Map a region. */
> > >
> > > Map -> map
> > >
> > > > + ptr = mmap_(self, variant, NULL, 12 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> > >
> > > Should be PROT_NONE otherwise it'll merge with the below.
> >
> > It doesn't matter. since this memory is unmapped and then second map
> > at ptr + page_size.
> >
> > IOW, though the first one is merged, it unammped and then
> > the second is allocated at ptr + page_size, it wouldn't be merged:
> >
> > after unmap:
> > [existing VMA][ 12 pages ][existing VMA]
> >
> > second:
> > [exiting VMA] [hole (page)] [ 10 pages (for test)] [hole (page)] [existing VMA]
> >
> > Am I missing something?
>
> Yeah, unmapped (unfaulted) VMAs can be merged with mapped (faulted) VMAs.
>
> In general it's also better to be explicit by specifying distinct attributes
> anyway to spell out clearly that the VMAs are intended to perform that task.
Oops, I missed that you immediately unmapped the VMA too :)
In that case it's fine but I'd still prefer it PROT_NONE to clearly single it
out as a placeholder.
Also a comment above it like:
/* Map then unmap placeholder to avoid adjacent merges */
>
> >
> > --
> > Sincerely,
> > Yeoreum Yun
>
> --
> Cheers, Lorenzo
--
Cheers, Lorenzo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions
2026-09-11 14:14 ` Lorenzo Stoakes (ARM)
@ 2026-09-11 14:18 ` Yeoreum Yun
0 siblings, 0 replies; 6+ messages in thread
From: Yeoreum Yun @ 2026-09-11 14:18 UTC (permalink / raw)
To: Lorenzo Stoakes (ARM)
Cc: Yeoreum Yun, linux-mm, linux-kselftest, linux-kernel, akpm, david,
liam, vbabka, rppt, surenb, mhocko
> On Fri, Sep 11, 2026 at 02:51:09PM +0100, Lorenzo Stoakes (ARM) wrote:
> > On Fri, Sep 11, 2026 at 02:34:37PM +0100, Yeoreum Yun wrote:
> > > On Fri, Sep 11, 2026 at 01:59:31PM +0100, Lorenzo Stoakes (ARM) wrote:
> > > > On Fri, Sep 11, 2026 at 01:35:34PM +0100, Yeoreum Yun wrote:
> > > > > check_vmflag_guard() uses /proc/self/smaps to retrieve the VMA flags,
> > > > > but this can fail if the mapping is merged with an adjacent VMA.
> > > > >
> > > > > To avoid this potential failure, first allocate a temporary region with
> > > > > extra pages at both ends, unmap it, and then map the test region within
> > > > > the temporary address range, leaving an unmapped page on each side to
> > > > > prevent VMA merging.
> > > > >
> > > > > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > > > > ---
> > > > > tools/testing/selftests/mm/guard-regions.c | 14 ++++++++++++--
> > > > > 1 file changed, 12 insertions(+), 2 deletions(-)
> > > > >
> > > > > diff --git a/tools/testing/selftests/mm/guard-regions.c b/tools/testing/selftests/mm/guard-regions.c
> > > > > index 5c8ec3ca75d7..a28a57d34e97 100644
> > > > > --- a/tools/testing/selftests/mm/guard-regions.c
> > > > > +++ b/tools/testing/selftests/mm/guard-regions.c
> > > > > @@ -2257,8 +2257,18 @@ TEST_F(guard_regions, smaps)
> > > > > char *ptr, *ptr2;
> > > > > int i;
> > > > >
> > > > > - /* Map a region. */
> > > > > - ptr = mmap_(self, variant, NULL, 10 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> > > > > + /* Try to Map a region. */
> > > >
> > > > Map -> map
> > > >
> > > > > + ptr = mmap_(self, variant, NULL, 12 * page_size, PROT_READ | PROT_WRITE, 0, 0);
> > > >
> > > > Should be PROT_NONE otherwise it'll merge with the below.
> > >
> > > It doesn't matter. since this memory is unmapped and then second map
> > > at ptr + page_size.
> > >
> > > IOW, though the first one is merged, it unammped and then
> > > the second is allocated at ptr + page_size, it wouldn't be merged:
> > >
> > > after unmap:
> > > [existing VMA][ 12 pages ][existing VMA]
> > >
> > > second:
> > > [exiting VMA] [hole (page)] [ 10 pages (for test)] [hole (page)] [existing VMA]
> > >
> > > Am I missing something?
> >
> > Yeah, unmapped (unfaulted) VMAs can be merged with mapped (faulted) VMAs.
> >
> > In general it's also better to be explicit by specifying distinct attributes
> > anyway to spell out clearly that the VMAs are intended to perform that task.
>
> Oops, I missed that you immediately unmapped the VMA too :)
>
> In that case it's fine but I'd still prefer it PROT_NONE to clearly single it
> out as a placeholder.
>
> Also a comment above it like:
>
> /* Map then unmap placeholder to avoid adjacent merges */
Might the ASSERT() made you miss the unmap :).
I'll post soon again.
Thanks!
--
Sincerely,
Yeoreum Yun
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-11 14:18 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-11 12:35 [PATCH] kselftest: mm: fix potential failure for merged VMA in guard-regions Yeoreum Yun
2026-09-11 12:59 ` Lorenzo Stoakes (ARM)
2026-09-11 13:34 ` Yeoreum Yun
2026-09-11 13:51 ` Lorenzo Stoakes (ARM)
2026-09-11 14:14 ` Lorenzo Stoakes (ARM)
2026-09-11 14:18 ` Yeoreum Yun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox