From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC878433AD for ; Fri, 10 Jul 2026 05:47:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783662431; cv=none; b=F0/B2nbUVaY2cJXi7pdgbrCwfyqhPCQA3nDFh42USEsLsUZL8zK+lv5hX7nJsiuvZgX8WUThAPsLyz1gg7zieiriyS7gS3LWq5xgRwnx2ZD3LG5eL2zDuLARdLbwOSQ90VMjMKLClm47Z1dWv1+BVpmAxPf7KBSIR3/Q1ogEcYA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783662431; c=relaxed/simple; bh=85vC3gKmSXHiXhj5agjGpT9JnK/KVfQAX4VvLr97SoI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jdlk1OwSO2QCw4wekilWvbIs6e8wYTXMo+1lT+AtQwpnZxsek1yIqqaQrma2Prv9COObj7mbrwzFzWZJ1eFXXOYVqNqKoWfmMZqwA9XD1h7/4lcArTSgo4YD1mFtDode05uxljEzar3oaGTa9eSRGrgtKrDbmUathx7mLLgSljs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cAFk6Gpn; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cAFk6Gpn" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2ca70925c25so6735415ad.1 for ; Thu, 09 Jul 2026 22:47:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783662429; x=1784267229; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=tdRhJB/OghWJG/3wbKJ2IGD+9QSPJ/wrl2a3I1KSz+c=; b=cAFk6GpnICsCgYXKVYYHqtG8g0aGHiLdPylXljEcmEYGQCWoVAXQKFttMcb3g2LAgs 56kUQyVDtCtvpDHJT8UDdr7UF3QDmdWI22pP/dqcw6WnWTq45swnR8drXOw1prbn0GSK 5KO5a7tlaYZDZX6KslqnCKgHB0RbL6xsPzV//tMl1cc7txNyzo2FJZWNuvGcMZ75WAs7 +SIBYbC0xBygq7cbX9ITd0qVWnJ+4KTF2VDzgMIjidjgQs5QnYo99iifFekO4XMSiIFy SbuZJQtM7AxoepeFX1gYdZcbPXi/UCGmwLZeyOpUgrrq/uNsXwZBk4J3QMsrl1SDuvTj 5bnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783662429; x=1784267229; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tdRhJB/OghWJG/3wbKJ2IGD+9QSPJ/wrl2a3I1KSz+c=; b=kH8cDpOcN+TTfRXgS9ei67Pnqg2WQVZgnYxdZvIK7DwHvWDPAzzTOOkT3ZB2O9kmj6 RLCeVXo10BdnfmmqrqO7XsVmU/FGfoVTt6ZZl5MobW1TYfEBYEUikhC0IjPSoE9X6ZTB MQk1CDoL2RGX0BkPfjki68yUu3FIDa7Kku0uKLoYlmyzn7T0Tmbv1H2LRJQiii8uTraz zX3g47gemlzY9MhIY+bHVMNdCM8nkgSyUtUn5bqrDooxjwXgG8sogAZ1vJxfpWeCM3IP EIyEYSb39HPGLZEI5wL9V7WAjbaYfRD+7nEd0D3v59TkzJvMcqbHQYh50cAcXu4zMaD2 Z9WA== X-Gm-Message-State: AOJu0YzkzIH4tJ61RZbSAkrR2ExO+yM4lMdyxaHxaQ/L07KQw8r1KBjU Zu9Wn5MccFjyIUvx4GIEPeLKuiWMdw58hq4bDaSG4B0yDsEMDXxL5R4d X-Gm-Gg: AfdE7clqOs6ZerSkSkIxhv9sBE+dhVbtbBc1mfocfImpV9VQOoFHhNwGU3ppwLdbw3i 1tlkmDypiPSoaMMkkKyaFIQuw2x+N6+udKsXWqYh2eDA3Bx3sKWN82pZORA601g+9sYUk/VxEZ0 x25PSrvGNnaozfUlSHi28wNVdAFEDB0KCKZhJdPgQN12wOM82F2lwOicYLnMmgNPQwFla9ZdU93 z4vhnHF01/UqAOiPl8kAjR7t6LruAJ0iHIaorcvoJ81ilzWP49Dq86g2HoMYrjQCuIijN9C7N22 JUm8GH//vgCyUblUksVGZESL10pahOXGRFGSiA1+J8gBkJPHDY+rpgpoW5asEiNCS4ZS0Zai2Di yi/cEv2kld7YW4f5ivFH5cuVXCB8TygK0n/KY3kxKPXxLQLnEK0CM82asV1TyuRMBdQOWODg5A3 Akokds9BWEDQ1y8C7Gf9QcP+9J1foQHK0Q5kc2tzejTEMeDY5eycppWXE2VP96nU/rN+LrPtHrS nD4yh0J5Zzk+fecyU3UhR9LCSCt X-Received: by 2002:a17:902:ce03:b0:2cc:ee78:3236 with SMTP id d9443c01a7336-2ccee7832d2mr100808235ad.33.1783662429102; Thu, 09 Jul 2026 22:47:09 -0700 (PDT) Received: from ikb-h07-29-noble.in.iijlab.net ([202.214.97.5]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bdb76asm56102255ad.12.2026.07.09.22.47.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Jul 2026 22:47:08 -0700 (PDT) Received: by ikb-h07-29-noble.in.iijlab.net (Postfix, from userid 1010) id A435814961CF; Fri, 10 Jul 2026 14:47:06 +0900 (JST) From: Hajime Tazaki To: akpm@linux-foundation.org, liam@infradead.org, ljs@kernel.org, vbabka@kernel.org, jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org, geert@linux-m68k.org Cc: linux-kernel@vger.kernel.org, Hajime Tazaki Subject: [PATCH v2] mm: nommu: free unused resources when mremap shrinks the vma Date: Fri, 10 Jul 2026 14:46:48 +0900 Message-ID: <20260710054648.924005-1-thehajime@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When shrinking a VMA via mremap, the bounds are modified directly: mm/nommu.c:do_mremap() { ... vma->vm_end = vma->vm_start + new_len; ... } This shrink the VMA without updating its bounds in the maple tree. If the maple tree (mm->mm_mt) still contains the old bounds, a user process could access the freed portion. The stale maple tree would incorrectly return the shrunk VMA for an address past its new vm_end. This commit fixes this issue by calling vmi_shrink_vma() when shrink happens. Additionally, if a file-backed map is to be shrunk, it reports -EINVAL like do_munmap() does. The issue is reported by Sashiko review, linked below. Link: https://sashiko.dev/#/patchset/20260702012546.665383-1-thehajime@gmail.com Link: https://sashiko.dev/#/patchset/20260710021028.892645-1-thehajime%40gmail.com Signed-off-by: Hajime Tazaki -- v1 -> v2: - handle error when vmi_shrink_vma() failed (reported by Sashiko) - prevents mremap() with being shrunk for file-backed one like munmap() v1: https://lore.kernel.org/linux-mm/20260710021028.892645-1-thehajime@gmail.com/ --- mm/nommu.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/mm/nommu.c b/mm/nommu.c index 852ec9bd0505..c8effbffa0f0 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1597,8 +1597,26 @@ static unsigned long do_mremap(unsigned long addr, if (new_len > vma->vm_region->vm_end - vma->vm_region->vm_start) return (unsigned long) -ENOMEM; + /* like do_munmap(), we're allowed to shrink an anonymous VMA but not a file-backed one */ + if (vma->vm_file) + return (unsigned long) -EINVAL; + /* all checks complete - do it */ - vma->vm_end = vma->vm_start + new_len; + if (new_len < old_len) { + /* shrink only happens addr + new_len and old_len are in different pages */ + VMA_ITERATOR(vmi, current->mm, addr); + int ret; + + /* vmi_shrink_vma() needs from/to pointers to be removed, + * (mainly used in munmap) so, specify them. + */ + ret = vmi_shrink_vma(&vmi, vma, addr + new_len, addr + old_len); + if (ret < 0) + return (unsigned long) ret; + } else { + /* when there are no shrink, update vma. */ + vma->vm_end = vma->vm_start + new_len; + } return vma->vm_start; } -- 2.43.0