[PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[Hongfu Li]

From: Hongfu Li <lihongfu@kylinos.cn>

range_contains_unmapped() accepts an explicit struct mm_struct *mm
argument, yet hardcodes current->mm inside VMA_ITERATOR(), ignoring
the passed address space.

Its only caller do_mseal() currently passes current->mm, so the bug
does not manifest right now. However this mismatch between prototype
and implementation is a latent bug.

Replace current->mm with the passed mm parameter to match the
function prototype.

Fixes: 530e09096413 ("mm/mseal: simplify and rename VMA gap check")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
---
 mm/mseal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mseal.c b/mm/mseal.c
index 9781647483d1..8d82e50900ba 100644
--- a/mm/mseal.c
+++ b/mm/mseal.c
@@ -41,7 +41,7 @@ static bool range_contains_unmapped(struct mm_struct *mm,
 {
 	struct vm_area_struct *vma;
 	unsigned long prev_end = start;
-	VMA_ITERATOR(vmi, current->mm, start);
+	VMA_ITERATOR(vmi, mm, start);
 
 	for_each_vma_range(vmi, vma, end) {
 		if (vma->vm_start > prev_end)
-- 
2.54.0

Re: [PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[Lorenzo Stoakes (ARM)]

On Thu, Jul 16, 2026 at 05:33:47PM +0800, Hongfu Li wrote:
> From: Hongfu Li <lihongfu@kylinos.cn>
>
> range_contains_unmapped() accepts an explicit struct mm_struct *mm
> argument, yet hardcodes current->mm inside VMA_ITERATOR(), ignoring
> the passed address space.
>
> Its only caller do_mseal() currently passes current->mm, so the bug
> does not manifest right now. However this mismatch between prototype
> and implementation is a latent bug.
>
> Replace current->mm with the passed mm parameter to match the
> function prototype.
>
> Fixes: 530e09096413 ("mm/mseal: simplify and rename VMA gap check")

There's no point in a Fixes tag for something that's not a bug.

> Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
> ---
>  mm/mseal.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/mseal.c b/mm/mseal.c
> index 9781647483d1..8d82e50900ba 100644
> --- a/mm/mseal.c
> +++ b/mm/mseal.c
> @@ -41,7 +41,7 @@ static bool range_contains_unmapped(struct mm_struct *mm,
>  {
>  	struct vm_area_struct *vma;
>  	unsigned long prev_end = start;
> -	VMA_ITERATOR(vmi, current->mm, start);
> +	VMA_ITERATOR(vmi, mm, start);

We're never going to sensibly allow a remote mm here, and even suggesting so is
problematic.

Sorry but I think it's just easier if I send a broader cleanup patch to fix
things up here more clearly.

>
>  	for_each_vma_range(vmi, vma, end) {
>  		if (vma->vm_start > prev_end)
> --
> 2.54.0
>

Thanks, Lorenzo

Re: [PATCH] mm/mseal: Fix range_contains_unmapped() ignoring its mm argument

[Hongfu Li]

Hi,

On 7/16/26 6:19 PM, Lorenzo Stoakes (ARM) wrote:
> On Thu, Jul 16, 2026 at 05:33:47PM +0800, Hongfu Li wrote:
>> From: Hongfu Li <lihongfu@kylinos.cn>
>>
>> range_contains_unmapped() accepts an explicit struct mm_struct *mm
>> argument, yet hardcodes current->mm inside VMA_ITERATOR(), ignoring
>> the passed address space.
>>
>> Its only caller do_mseal() currently passes current->mm, so the bug
>> does not manifest right now. However this mismatch between prototype
>> and implementation is a latent bug.
>>
>> Replace current->mm with the passed mm parameter to match the
>> function prototype.
>>
>> Fixes: 530e09096413 ("mm/mseal: simplify and rename VMA gap check")
> There's no point in a Fixes tag for something that's not a bug.
>
>> Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
>> ---
>>   mm/mseal.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/mm/mseal.c b/mm/mseal.c
>> index 9781647483d1..8d82e50900ba 100644
>> --- a/mm/mseal.c
>> +++ b/mm/mseal.c
>> @@ -41,7 +41,7 @@ static bool range_contains_unmapped(struct mm_struct *mm,
>>   {
>>   	struct vm_area_struct *vma;
>>   	unsigned long prev_end = start;
>> -	VMA_ITERATOR(vmi, current->mm, start);
>> +	VMA_ITERATOR(vmi, mm, start);
> We're never going to sensibly allow a remote mm here, and even suggesting so is
> problematic.
>
> Sorry but I think it's just easier if I send a broader cleanup patch to fix
> things up here more clearly.
Got it, thanks a lot for explaining the issue with remote mm. A unified 
broad cleanup patch works better for this code path. I will withdraw my 
patch and follow your series. Feel free to reach out if you need any 
testing help later.
Best regards,
Hongfu