From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D858E351C27 for ; Fri, 10 Jul 2026 11:09:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783681770; cv=none; b=i5h9i1aqqgWppT8CML3iJbCMSMvuyH4fVx2IylnMTQQ3H36qjVodT3XY05tpA6iF3rSN3vf7FcSBaOmDoe1nNfSdtHtk9u3XeDKGz8DwjcJfl3GBlgX8Vs2QDczmIW0DX/RS4o8AWvr0QSamRYojbkgY1z1WB21d6d7TTfjVFFE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783681770; c=relaxed/simple; bh=2dY/ol1ucM0VIEQcCT+GMs6Ii7Tymk0iuTCX9nUAhUA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=a6QN5mUH7P8h8xWSmEMdbm7G3lnG7TOgtmW7ynHmHtuU9g8sVexCznipr+bE/IigvRG85LOaajlX1nF0F7o//rREszqH/G7MH9V93lHapZ5Q2Pc7EHEmq7/V9uOPkSlk+7eJh6XMSJPMnZ0rdIDEQgq8o3aulgOJubW30jOWMmA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dHd61WTE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dHd61WTE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F7621F000E9; Fri, 10 Jul 2026 11:09:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783681769; bh=bHILUlDZoX4t/qKzqQQOpbCYe7EYjBu+NwQXW5zJMg0=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=dHd61WTE6dRX1ADsW3LCgIwlPfeL0FFPcX6IVgMBjkg87WUmnMA2AKWQONqkOFjCM QmcY0kJZFuTDQNozdTeg242zEBBWSnFBBm+qxhjeoIi9+NoCLzv4JEcKGzMIBLkRl6 +GxihKeNl8O6Pcb8o/03hOJVJ/E5FRAcdp36w89UNNeElv9WWcbminYAI+Al4yx9Ye nlzNXI2uH0pGHO5lAWyOL++lpA3ms27JIPi9+/ZhaJH5JIvvAxER0T0HPEVyF6KH9B 9JKUpbD4ljOoN57Nd64AJh9lP8AuxZncvck6Axz+741g28FbfozTQRfPLInCHxHLa4 TXcWyFaWP1I9A== Date: Fri, 10 Jul 2026 12:09:18 +0100 From: Lorenzo Stoakes To: Hajime Tazaki Cc: akpm@linux-foundation.org, liam@infradead.org, vbabka@kernel.org, jannh@google.com, pfalcato@suse.de, linux-mm@kvack.org, geert@linux-m68k.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] mm: nommu: free unused resources when mremap shrinks the vma Message-ID: References: <20260710054648.924005-1-thehajime@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Fri, Jul 10, 2026 at 04:30:08PM +0900, Hajime Tazaki wrote: > > On Fri, 10 Jul 2026 14:46:48 +0900, > Hajime Tazaki wrote: > > > > When shrinking a VMA via mremap, the bounds are modified directly: > > mm/nommu.c:do_mremap() { > > ... > > vma->vm_end = vma->vm_start + new_len; > > ... > > } > > This shrink the VMA without updating its bounds in the maple tree. > > If the maple tree (mm->mm_mt) still contains the old bounds, a user > > process could access the freed portion. The stale maple tree would > > incorrectly return the shrunk VMA for an address past its new vm_end. > > > > This commit fixes this issue by calling vmi_shrink_vma() when shrink > > happens. Additionally, if a file-backed map is to be shrunk, it reports > > -EINVAL like do_munmap() does. > > > > The issue is reported by Sashiko review, linked below. > > > > Link: https://sashiko.dev/#/patchset/20260702012546.665383-1-thehajime@gmail.com > > Link: https://sashiko.dev/#/patchset/20260710021028.892645-1-thehajime%40gmail.com > > Signed-off-by: Hajime Tazaki > > I think the original issue reported by Sashiko is addressed, but found > another existing issue, which might take a bit to look into detail > (e.g., currently under nommu we cannot map (actually kernel_read()) > /dev/zero, vma_set_anonymous() isn't called for /dev/zero on nommu, > etc). > > So I will address this in a different patch, not in this one. OK thanks sorry for not getting to these quicker, between jobs atm and my inbox is an ongoing disaster :) > > -- Hajime Thanks, Lorenzo