[PATCH] mm: nommu: fix the error path when vma_iter_prealloc() fails

[PATCH] mm: nommu: fix the error path when vma_iter_prealloc() fails

[Hajime Tazaki]

When vma_iter_prealloc() fails, it jumps to error_just_free without
updating ret to -ENOMEM, meaning do_mmap() will return 0 on failure.

Additionally, this error path unconditionally frees the region struct.
Since the region was already added to the global nommu_region_tree via
add_nommu_region(), leaving it makes a potential dangling pointer in
the tree and may cause a use-after-free on the next tree walk.

This commit fixes those issues by updating return value as well as moving
the region updates after the place that allocation is finished.

The issue is discovered by Sashiko, linked below.

Link: https://sashiko.dev/#/patchset/20260702012830.667205-1-thehajime%40gmail.com
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
---
 mm/nommu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/nommu.c b/mm/nommu.c
index 815ebefddfae..8b30fe9079fe 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1181,7 +1181,6 @@ unsigned long do_mmap(struct file *file,
 		ret = do_mmap_private(vma, region, len, capabilities);
 	if (ret < 0)
 		goto error_just_free;
-	add_nommu_region(region);
 
 	/* clear anonymous mappings that don't ask for uninitialized data */
 	if (!vma->vm_file &&
@@ -1198,8 +1197,12 @@ unsigned long do_mmap(struct file *file,
 share:
 	BUG_ON(!vma->vm_region);
 	vma_iter_config(&vmi, vma->vm_start, vma->vm_end);
-	if (vma_iter_prealloc(&vmi, vma))
+	if (vma_iter_prealloc(&vmi, vma)) {
+		ret = -ENOMEM;
 		goto error_just_free;
+	}
+
+	add_nommu_region(region);
 
 	setup_vma_to_mm(vma, current->mm);
 	current->mm->map_count++;
-- 
2.43.0

Re: [PATCH] mm: nommu: fix the error path when vma_iter_prealloc() fails

[Hajime Tazaki]

On Mon, 06 Jul 2026 11:18:46 +0900,
Hajime Tazaki wrote:
> 
> When vma_iter_prealloc() fails, it jumps to error_just_free without
> updating ret to -ENOMEM, meaning do_mmap() will return 0 on failure.
> 
> Additionally, this error path unconditionally frees the region struct.
> Since the region was already added to the global nommu_region_tree via
> add_nommu_region(), leaving it makes a potential dangling pointer in
> the tree and may cause a use-after-free on the next tree walk.
> 
> This commit fixes those issues by updating return value as well as moving
> the region updates after the place that allocation is finished.
> 
> The issue is discovered by Sashiko, linked below.
> 
> Link: https://sashiko.dev/#/patchset/20260702012830.667205-1-thehajime%40gmail.com
> Signed-off-by: Hajime Tazaki <thehajime@gmail.com>

hmm, there are still several issues on this function, reported with
new sashiko review.

https://sashiko.dev/#/patchset/c8513ee5aa8444ec9bf6c276043c9f833016a2fa.1783304131.git.thehajime%40gmail.com

I would try to find a way to do a similar review locally, and will be
back here once I don't see further pre-existing issues around this code.

-- Hajime