Re: [PATCH v1 01/16] mm/madvise: drop range checks in madvise_free_single_vma()

Lorenzo Stoakes (Oracle)
2026-03-06T12:24:41Z

On Fri, Feb 27, 2026 at 09:08:32PM +0100, David Hildenbrand (Arm) wrote:
> madvise_vma_behavior()-> madvise_dontneed_free()->madvise_free_single_vma()
> is only called from madvise_walk_vmas()
>
> (a) After try_vma_read_lock() confirmed that the whole range falls into
> a single VMA (see is_vma_lock_sufficient()).
>
> (b) After adjusting the range to the VMA in the loop afterwards.
>
> madvise_dontneed_free() might drop the MM lock when handling
> userfaultfd, but it properly looks up the VMA again to adjust the range.
>
> So in madvise_free_single_vma(), the given range should always fall into
> a single VMA and should also span at least one page.
>
> Let's drop the error checks.
>
> The code now matches what we do in madvise_dontneed_single_vma(), where
> we call zap_vma_range_batched() that documents: "The range must fit into
> one VMA.". Although that function still adjusts that range, we'll change
> that soon.
>
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Yeah I did wonder about some of these checks, thanks for going through and
confirming these are useless.

Checked the madvise_dontneed_free() case to be sure and LGTM so overall:

Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>

> ---
> mm/madvise.c | 13 ++++---------
> 1 file changed, 4 insertions(+), 9 deletions(-)
>
> diff --git a/mm/madvise.c b/mm/madvise.c
> index c0370d9b4e23..efc04334a000 100644
> --- a/mm/madvise.c
> +++ b/mm/madvise.c
> @@ -799,9 +799,10 @@ static int madvise_free_single_vma(struct madvise_behavior *madv_behavior)
> {
> struct mm_struct *mm = madv_behavior->mm;
> struct vm_area_struct *vma = madv_behavior->vma;
> - unsigned long start_addr = madv_behavior->range.start;
> - unsigned long end_addr = madv_behavior->range.end;
> - struct mmu_notifier_range range;
> + struct mmu_notifier_range range = {
> + .start = madv_behavior->range.start,
> + .end = madv_behavior->range.end,
> + };
> struct mmu_gather *tlb = madv_behavior->tlb;
> struct mm_walk_ops walk_ops = {
> .pmd_entry = madvise_free_pte_range,
> @@ -811,12 +812,6 @@ static int madvise_free_single_vma(struct madvise_behavior *madv_behavior)
> if (!vma_is_anonymous(vma))
> return -EINVAL;
>
> - range.start = max(vma->vm_start, start_addr);
> - if (range.start >= vma->vm_end)
> - return -EINVAL;
> - range.end = min(vma->vm_end, end_addr);
> - if (range.end <= vma->vm_start)
> - return -EINVAL;
> mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, mm,
> range.start, range.end);
>
> --
> 2.43.0
>