Re: [PATCH v2] mm: nommu: free unused resources when mremap shrinks the vma

[Hajime Tazaki <thehajime@gmail.com>]

On Fri, 10 Jul 2026 14:46:48 +0900,
Hajime Tazaki wrote:
> 
> When shrinking a VMA via mremap, the bounds are modified directly:
> mm/nommu.c:do_mremap() {
>     ...
>     vma->vm_end = vma->vm_start + new_len;
>     ...
> }
> This shrink the VMA without updating its bounds in the maple tree.
> If the maple tree (mm->mm_mt) still contains the old bounds, a user
> process could access the freed portion. The stale maple tree would
> incorrectly return the shrunk VMA for an address past its new vm_end.
> 
> This commit fixes this issue by calling vmi_shrink_vma() when shrink
> happens.  Additionally, if a file-backed map is to be shrunk, it reports
> -EINVAL like do_munmap() does.
> 
> The issue is reported by Sashiko review, linked below.
> 
> Link: https://sashiko.dev/#/patchset/20260702012546.665383-1-thehajime@gmail.com
> Link: https://sashiko.dev/#/patchset/20260710021028.892645-1-thehajime%40gmail.com
> Signed-off-by: Hajime Tazaki <thehajime@gmail.com>

I think the original issue reported by Sashiko is addressed, but found
another existing issue, which might take a bit to look into detail
(e.g., currently under nommu we cannot map (actually kernel_read())
/dev/zero, vma_set_anonymous() isn't called for /dev/zero on nommu,
etc).

So I will address this in a different patch, not in this one.

-- Hajime