From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC6F341C72 for ; Thu, 2 Jul 2026 01:25:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782955552; cv=none; b=UNN+fayuRYGOAIq7Jg/7xhe9Y56j6wWOsiNRSQgLLPbfE/2/7HzlSvCsmgg6qGEWWeMTR7xHSEccjYPCUYlBqettxvt2CMrcGDeDNlqwa87pLVttWFALr2wDWa/G8nQ6VyNWhASw6PebvlokDrfz0fmMeha1W2HWQeM3Q0GhQRk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782955552; c=relaxed/simple; bh=50vIDilQumZRXdABuX6Wfxqlf9ElQTnBjnu7t0lDBiQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=micKW+riHcAmHp+PP3xCNPvNiuf2SrYbA9fMjQqifmq24hS47RXy2fl2MXToFE+b9jnDtTuOuBSC1JtlsdGl4ZglyDrxa46ZB9sCT0sBXDCbia3g60bbOG29YeqpzGJPPjbTR+R3xYYHeImI0ZIJflbm42tJPAnV60tpR1snY50= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Mv6yFOOF; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Mv6yFOOF" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-37e1607f7faso918925a91.1 for ; Wed, 01 Jul 2026 18:25:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782955550; x=1783560350; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=aGfWJ/oO0ryVNa+u4Vv8lonllz/PfAnyULLVF4CQHe8=; b=Mv6yFOOF2/D5puhKu1Oq49Dw/5qAowWWwFk3BKGpQ2oOC04JakiegIEGm2QL+XT7NJ PwTuoHXBibA8yo4xGPQ8h4BCW6H5qImcKJLcOq3GGh2+Trdk8lx7Ot3E4Sq0T0qOjlcy qHtIHfvuZAkwtCGSoeCb/hoEcyZJkz0lgyLoEbRcRWla8+xBpx0O+bLIRYHKgb0UU2I4 FMI0jt73FUFbTdBES9/n4soaKYPXSSCSxXUQ4gDYKl5EGogEe247YdExBj9ckESD03JV JRD2V8/shjUGNEv4iK/SxV5axUShVDWuyg3muGqBuRJLgB4N+QuZTGdAnmc4PmZ3nNFa naKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782955550; x=1783560350; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=aGfWJ/oO0ryVNa+u4Vv8lonllz/PfAnyULLVF4CQHe8=; b=RgOR0UArGdwUnoyxhFN59zPN8NgAVDAaZgiaJL4zF4kiWzrQLhGcp93G2h3+t+H67U WGlNg7xP0ups9AtCm4PLheQNsuraE1R9a/6vBI9E+4VMHgRUq9rcqFvVRzyCXOLaEkbc nHvICSbu4+MRePTsHyYbMuEGwP4h0yIMjLvtW+VHOBlljQuP7HpqtsFs4SeDIQx/8e6R JNUr6ix3DJ7O6yOgvMXBmU6iRC3t/X3l8ocYummSj5HhBLt7kn3os9Q4zQ/vGJeCj5nc g4ERdo5gXY26pvGWXgLhfq5XkQKc+W7LbL6S+bGK4QfD2ATII0PvpU9iJBkSUYHSLZ5l qyEg== X-Gm-Message-State: AOJu0Yxyfm8+hsC5J1hNy1nexiOgKx/ysiJCvQbhXgZHJA5U0d7PmBmX agZLqkn1701AVyS7GE+IhwsEAU8SJ3rBsHOhEsRHrzEY8UwLep/5ghOl X-Gm-Gg: AfdE7ck2Rwh1E8aLpgg+4ghGQbnUy/X0ZEZk7yyQKET6mvU06Iyhyv9u9amQrKPa2bN iJKtGugETkQzG3jud4UAKY1+v7OP1/I/M28ajHSNAkgBDeHyklo6oSgCj/JfIPrmmBuqNtZK1CO hIOji67S0Bl52oYKUZVGDeckwPAfNIEI6cAEUn+0sipiNk0XObvG4AW7lQZ5S0tLM1phxOHDkvk bnKlmyVKfJbb/1Enow/CUa0C8lhRHIjnbO1JrkEZnc2gQ5q9BVJ4uESKPOCSOYTTTQU7r1OVs9c LYYUbSBleXXa1I4LLVqA4169OAfNyEZwDfHvqvJsCW6zeflRR9J8kqk+JOtWJyZYLfKei2stW5q HKc7GAYYFpMyXD3WEobhP5FYyekmGPZANgBpp62g/3B5yc3V488AJy4Eem+Ou4JGx34bXmZE3bn yllEsaSdC6X1d3PngKhAA/Z345ccoyD/PA71MrN8s4SFz2aq7H8FP8ydreRUwQbkv1QH7kJ7jTd PeeVqGjfVdfO2XHzw== X-Received: by 2002:a17:90b:3c03:b0:37d:ee77:78ac with SMTP id 98e67ed59e1d1-380aa206b8amr3607082a91.19.1782955549771; Wed, 01 Jul 2026 18:25:49 -0700 (PDT) Received: from ikb-h07-29-noble.in.iijlab.net ([202.214.97.5]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-380e17aa25fsm102519a91.12.2026.07.01.18.25.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 18:25:49 -0700 (PDT) Received: by ikb-h07-29-noble.in.iijlab.net (Postfix, from userid 1010) id D14C313C0C70; Thu, 2 Jul 2026 10:25:47 +0900 (JST) From: Hajime Tazaki To: akpm@linux-foundation.org, liam@infradead.org, ljs@kernel.org, vbabka@kernel.org, jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, Hajime Tazaki Subject: [PATCH] mm: nommu: point to the write iterator upon split_vma Date: Thu, 2 Jul 2026 10:25:46 +0900 Message-ID: <20260702012546.665383-1-thehajime@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When users munmap(2) the partial region allocated by mmap, it might split the original region if necessary and shrink to the right size. At the begining of vmi_shrink_vma(), it clears the unused part but generates assetion when the shrink happenes after split_vma(). This commit fixes this issue by configuring the right pointer to the iterator at the end of split_vma(). This was detected with a LTP (Linux Test Project) test, which linked below, on the nommu UML environment (out-of-tree extension to UML). Here is a minimal reproducible chunk of code for this issue: void *addr; size_t pagesize = getpagesize(); addr = mmap(NULL, pagesize * 4, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); munmap(addr + pagesize * 1, pagesize); This is the console output with CONFIG_DEBUG_MAPLE_TREE=y. nommu: WARN at __mas_set_range:791 (1) MAS: tree=0000000091c23b08 enode=0000000065057663 (ma_active) Store Type: node_store [9/9] index=70af8000 last=ffffffffffffffff min=0 max=ffffffffffffffff sheaf=0000000000000000, request 0 depth=0, flags=0 maple_tree(0000000091c23b08) flags 307, height 1 root 0000000083394c06 0-ffffffffffffffff: node 0000000010c90bd6 depth 0 type 1 parent 0000000050e1ddf8 contents: 0000000000000000 707A 7FFF 00000000eb0ac2b5 707AFFFF 0000000000000000 7093FFFF 0000000045ead616 7095FFFF 0000000000000000 7096CFFF 000 00000681c7151 7096FFFF 0000000000000000 70AF3FFF 000000006c78b9e9 70AF4FFF 000000001914ab0b 70AF7FFF 00000000000 00000 FFFFFFFFFFFFFFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000 000 0 00000000bca8be4f 0-707a7fff: 0000000000000000 707a8000-707affff: 00000000eb0ac2b5 707b0000-7093ffff: 0000000000000000 70940000-7095ffff: 0000000045ead616 70960000-7096cfff: 0000000000000000 7096d000-7096ffff: 00000000681c7151 70970000-70af3fff: 0000000000000000 70af4000-70af4fff: 000000006c78b9e9 70af5000-70af7fff: 000000001914ab0b 70af8000-ffffffffffffffff: 0000000000000000 nommu: Pass: 796 Run:797 Link: https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/mseal/mseal02.c Signed-off-by: Hajime Tazaki --- mm/nommu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/nommu.c b/mm/nommu.c index ed3934bc2de4..5d461ddc3405 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1367,6 +1367,10 @@ static int split_vma(struct vma_iterator *vmi, struct vm_area_struct *vma, setup_vma_to_mm(vma, mm); setup_vma_to_mm(new, mm); vma_iter_store_new(vmi, new); + + /* vmi should point lower address */ + if (new_below) + vma_next(vmi); mm->map_count++; return 0; -- 2.43.0