From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D82553976B2 for ; Tue, 7 Jul 2026 23:51:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783468308; cv=none; b=rpI6CudDSGEtW8yj0nlrTOUMVu/sBIHej7y5i47x7e0kkrOb8+ddx+STpWs6C4V7GIIJeOcupaAvdINghs/V3tGPBzuc0qRCTrEjq6m4e7l7cODSG2gxRB0f1aBJsexe9UQ+a7bluPHaDrXllCG5Rre2w+3/bvlNszLeB688TNc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783468308; c=relaxed/simple; bh=kaqt/1AUYMzg+WlrvDEQ220yFNumD/N+1mBY0VBJDqw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CrBGuTUx6rUxkrD2NpK7E5Z6TNt8EDMCDChtFqtaD4XlZvt9m1gvkbpTOfrmSgYCCV7+qM/aeG+c2kwKf65xgLLzj9r7wgjN0QZYAZU/mpYn5bft2urZ/s8kqdeNc70AXr6wt5ShDmoj7UU7IQA3LS36fupyFEiHU8Ns40vvxw4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bwzKSfvo; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bwzKSfvo" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2cac59f8b64so1470745ad.0 for ; Tue, 07 Jul 2026 16:51:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783468306; x=1784073106; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NjoZ3kU3AvUL0LV6smVKBwxGmvcLVEM8ZIL8h6Quy60=; b=bwzKSfvo/1HgX5GqWwUSXG0J146fLerTKygo7sVFwVoJYdrODAzjFnPX+enkbtdvP1 PZncQVxdIVMTS5iKU1N3YM9E5o6I1Ke6zj1LOCY4U8k0HGM+rII6/ndNsZb+gSK9TryZ skqw+JiNDbPmOHVKQ5paLL6RYwRu1oioGbA34ZDTAm/LriipSVLW3M/rJOr/sXvlKXtY aPJC3s+avbCk0gjEEH2bmhtSWdVwB0HlNoovRDHMEWDnoE9Otgyg6ie7ZCtuigj5ufm/ IiQNsAaUArbK0VSHDMmtWRpKYE9PpxK5WBQlTwV1QCI3rLM3gtmnuAZB1S9wgvHp/7eM PvXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783468306; x=1784073106; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=NjoZ3kU3AvUL0LV6smVKBwxGmvcLVEM8ZIL8h6Quy60=; b=eW9RTxjRCxtWsc0ALtENVr99wuXrvX0vsochuRgfFQgzhCXfP4GsfX7Y1WHT13fsX+ lHKVp6QZ35l+yw3lCqLDjFtuA3S6N7njMKbKpHWw7D+2ZHgUk1UUNJG56HMZ8WQFDGcQ +COjd8+fs/RavOXDbgeI2qKhU9fzs9UujCTQj/6Ny9nkfQhrwb3XUVLA5r6srTXXbpdV W6y2nTqk9QEiuuDaRC0WM0zx/hXIhT77OEB5eVGHxtHHelIPtMlLBpr9+3woh5HtHzU4 vmePMDuVvqXFl4riN3cHRkhGqvp4WTBDh0pKZ5A7Zg5se5zG6CfYzKkcQpTvb5XUDPZS 8usA== X-Gm-Message-State: AOJu0YwwoYwHWZGBeMMzLhkRiVkTBXmHiUNc5fSiSpF6QJMlvz+wtvad GyWJjp4LC8f2XcyhpY5Sbr6d9hG46FJR980Z87x1n96K5+xw4wFoa40M X-Gm-Gg: AfdE7cnJ9GkWcyxpUQQhFQsuGpb49GWLi/L4rPEUAfyXXzROtayydoDZGJ736bxS5TB FZSUin9AVamu24Qd5QiUN9+Xf4L6HYLz8XKLdVU4xNDTi/lUlWLac/xDYPcA2LMjoOtfeq0d+ne V51nX0IEUXvii20+vMX1IBj/RW2+r7Omfl99vmcxbIk7jbtGggRzCsST6DcEhWuiM/wN6x+9t13 Kk/0dfTjhbWb9k4ZE91PSSpbWJZ7BqNJEI4JPYvWGpkqME2XsZLq5KJgglm2/B4zp9uRdAktwSR mW/nCkDJZHKFWGRvdnC0sGCS9rF30yv8/gMLiSjMyZl5z7zs6p/y+eunAIZdGskCPEAkLvavIvA oejLIKbVCl6nNWCSiQLQJ6tNlI5Kis+I4/0911JTjCexdLYzHmzpoyZ40/sJAcKNdmiUoVJ1uXq Gi+yZYxJfuSgbfxow4rzBRPCqcBiRGUMCzqIfyvhEsbKb4xnozac5t7foTSoq3bj86RmE0IAlPP xpa4kQv6vGAnBMoAg== X-Received: by 2002:a17:903:2286:b0:2c9:97a8:afe8 with SMTP id d9443c01a7336-2ccea3d8697mr1162125ad.43.1783468306055; Tue, 07 Jul 2026 16:51:46 -0700 (PDT) Received: from ikb-h07-29-noble.in.iijlab.net ([202.214.97.5]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bdb877sm18937045ad.14.2026.07.07.16.51.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 16:51:45 -0700 (PDT) Received: by ikb-h07-29-noble.in.iijlab.net (Postfix, from userid 1010) id 0322B148F31E; Wed, 8 Jul 2026 08:51:45 +0900 (JST) From: Hajime Tazaki To: akpm@linux-foundation.org, liam@infradead.org, ljs@kernel.org, vbabka@kernel.org, jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org, geert@linux-m68k.org Cc: linux-kernel@vger.kernel.org, Hajime Tazaki Subject: [PATCH 2/2] mm: nommu: fix error handling on vma_iter_prealloc() failure Date: Wed, 8 Jul 2026 08:51:37 +0900 Message-ID: <20260707235137.498738-2-thehajime@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260707235137.498738-1-thehajime@gmail.com> References: <20260707235137.498738-1-thehajime@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If do_mmap() finds an existing overlapping shared region, it increments its usage, sets region to this existing pregion, and jumps to share: region = pregion; result = start; goto share; When vma_iter_prealloc() fails and jumps to error_vma_iter_prealloc, the error path unconditionally frees the region: error: ... if (region->vm_file) fput(region->vm_file); kmem_cache_free(vm_region_jar, region); This potentially leaves a dangling pointer in nommu_region_tree and causes RB-tree corruption. Additionally, when establishing a new private mapping, do_mmap_private() allocates physical pages and assigns them to region->vm_start: base = alloc_pages_exact(total << PAGE_SHIFT, GFP_KERNEL); ... region->vm_start = (unsigned long) base; If we later fail at vma_iter_prealloc() and jump to error_vma_iter_prealloc, the region struct is freed, but the backing physical memory doesn't seem to be freed via free_page_series(). This commit fixes those issues, discovered Sashiko, linked below. Link: https://sashiko.dev/#/patchset/c8513ee5aa8444ec9bf6c276043c9f833016a2fa.1783304131.git.thehajime%40gmail.com Signed-off-by: Hajime Tazaki --- mm/nommu.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/mm/nommu.c b/mm/nommu.c index ad619611e83f..24bd8c529c2a 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1222,9 +1222,16 @@ unsigned long do_mmap(struct file *file, up_write(&nommu_region_sem); error: vma_iter_free(&vmi); - if (region->vm_file) - fput(region->vm_file); - kmem_cache_free(vm_region_jar, region); + + /* if the error was from shared mapping/existing region, don't free the region */ + if (region->vm_usage == 1) { + if (region->vm_file) + fput(region->vm_file); + kmem_cache_free(vm_region_jar, region); + + } else + region->vm_usage--; + if (vma->vm_file) fput(vma->vm_file); vm_area_free(vma); @@ -1240,6 +1247,11 @@ unsigned long do_mmap(struct file *file, up_write(&nommu_region_sem); pr_warn("Failed vma_iter_prealloc()\n"); ret = -ENOMEM; + + /* in case that the region is allocated via do_mmap_private() */ + if ((region->vm_usage == 1) && + (!file || !(vma->vm_flags & VM_SHARED))) + free_page_series(region->vm_start, region->vm_top); goto error; error_getting_vma: -- 2.43.0