From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABC1B3491F6 for ; Tue, 20 Jan 2026 13:14:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768914847; cv=none; b=JbzyXsptX83uS81J4Cvt1vLJfIkkCxtvP0AyEVYFESvQl+uwW4VXoYxdWfwFUVgnz1V+XFOjcUGHzJXwb3KIzkINCRBHZTIcoNOhxNqYvaJH1xRHSqWmkAXSIlCSW6Lr1AnbO0suJ64brADELd1CBXR5pnl3zLeX242Omt0AehM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768914847; c=relaxed/simple; bh=TPrmhATyhlHtwPEsGxSguZyJGDFAwvlmHvpTQS5C/n4=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=YJchR+uOCKivPQN7y0bGx7KmgKufQQ0alN2Chvo60BR4pgqfoNqyCLCX1Un2DKBjodbeB5irdxLzeFuREve0ULJwACE9otUqaQElp712wI61cUrRn0VKISvbkS/9qyHZvPsV/Mj66CRyF2PlqE0lSuegYMtG1/aSW4DgE0uKdjw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cji5i8Da; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="cji5i8Da" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5FB6C16AAE; Tue, 20 Jan 2026 13:14:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768914847; bh=TPrmhATyhlHtwPEsGxSguZyJGDFAwvlmHvpTQS5C/n4=; h=Subject:To:Cc:From:Date:From; b=cji5i8Da0koXytcvreuTyOL3Ke2Kl9W7WTKOLDtaTvZ1XgAwe1udDGbRvUHyxkhPA 1vJqeLzgAYJSITTWhHBxLXJ7rnmV2iNpZV8g6Nhy4sNur4Bbn0vE4Wy7Fo73xYo8eL Fr2C8nvwQ7m7lIDuGdCseI5eflUyQ9vocjCEN3Nw= Subject: FAILED: patch "[PATCH] mm/vma: enforce VMA fork limit on unfaulted,faulted mremap" failed to apply to 6.18-stable tree To: lorenzo.stoakes@oracle.com,aha310510@gmail.com,akpm@linux-foundation.org,david@kernel.org,harry.yoo@oracle.com,jannh@google.com,liam.howlett@oracle.com,pfalcato@suse.de,riel@surriel.com,stable@vger.kernel.org,vbabka@suse.cz,yeoreum.yun@arm.com Cc: From: Date: Tue, 20 Jan 2026 14:14:04 +0100 Message-ID: <2026012004-conduit-immorally-15d5@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 3b617fd3d317bf9dd7e2c233e56eafef05734c9d # git commit -s git send-email --to '' --in-reply-to '2026012004-conduit-immorally-15d5@gregkh' --subject-prefix 'PATCH 6.18.y' HEAD^.. Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 3b617fd3d317bf9dd7e2c233e56eafef05734c9d Mon Sep 17 00:00:00 2001 From: Lorenzo Stoakes Date: Mon, 5 Jan 2026 20:11:49 +0000 Subject: [PATCH] mm/vma: enforce VMA fork limit on unfaulted,faulted mremap merge too The is_mergeable_anon_vma() function uses vmg->middle as the source VMA. However when merging a new VMA, this field is NULL. In all cases except mremap(), the new VMA will either be newly established and thus lack an anon_vma, or will be an expansion of an existing VMA thus we do not care about whether VMA is CoW'd or not. In the case of an mremap(), we can end up in a situation where we can accidentally allow an unfaulted/faulted merge with a VMA that has been forked, violating the general rule that we do not permit this for reasons of anon_vma lock scalability. Now we have the ability to be aware of the fact we are copying a VMA and also know which VMA that is, we can explicitly check for this, so do so. This is pertinent since commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges"), as this patch permits unfaulted/faulted merges that were previously disallowed running afoul of this issue. While we are here, vma_had_uncowed_parents() is a confusing name, so make it simple and rename it to vma_is_fork_child(). Link: https://lkml.kernel.org/r/6e2b9b3024ae1220961c8b81d74296d4720eaf2b.1767638272.git.lorenzo.stoakes@oracle.com Fixes: 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA merges") Signed-off-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Reviewed-by: Jeongjun Park Acked-by: Vlastimil Babka Cc: David Hildenbrand (Red Hat) Cc: Jann Horn Cc: Liam Howlett Cc: Pedro Falcato Cc: Rik van Riel Cc: Yeoreum Yun Cc: Signed-off-by: Andrew Morton diff --git a/mm/vma.c b/mm/vma.c index 9df9e3b78604..dc92f3dd8514 100644 --- a/mm/vma.c +++ b/mm/vma.c @@ -67,18 +67,13 @@ struct mmap_state { .state = VMA_MERGE_START, \ } -/* - * If, at any point, the VMA had unCoW'd mappings from parents, it will maintain - * more than one anon_vma_chain connecting it to more than one anon_vma. A merge - * would mean a wider range of folios sharing the root anon_vma lock, and thus - * potential lock contention, we do not wish to encourage merging such that this - * scales to a problem. - */ -static bool vma_had_uncowed_parents(struct vm_area_struct *vma) +/* Was this VMA ever forked from a parent, i.e. maybe contains CoW mappings? */ +static bool vma_is_fork_child(struct vm_area_struct *vma) { /* * The list_is_singular() test is to avoid merging VMA cloned from - * parents. This can improve scalability caused by anon_vma lock. + * parents. This can improve scalability caused by the anon_vma root + * lock. */ return vma && vma->anon_vma && !list_is_singular(&vma->anon_vma_chain); } @@ -115,11 +110,19 @@ static bool is_mergeable_anon_vma(struct vma_merge_struct *vmg, bool merge_next) VM_WARN_ON(src && src_anon != src->anon_vma); /* Case 1 - we will dup_anon_vma() from src into tgt. */ - if (!tgt_anon && src_anon) - return !vma_had_uncowed_parents(src); + if (!tgt_anon && src_anon) { + struct vm_area_struct *copied_from = vmg->copied_from; + + if (vma_is_fork_child(src)) + return false; + if (vma_is_fork_child(copied_from)) + return false; + + return true; + } /* Case 2 - we will simply use tgt's anon_vma. */ if (tgt_anon && !src_anon) - return !vma_had_uncowed_parents(tgt); + return !vma_is_fork_child(tgt); /* Case 3 - the anon_vma's are already shared. */ return src_anon == tgt_anon; }