Re: [PATCH 6.6.y] mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Thu, Sep 10, 2026 at 10:31:02PM -0400, Sasha Levin wrote:
> From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
>
> [ Upstream commit 35b0fb391b0df57383bc15985bb769f4555c97ba ]
>
> Uniquely an mremap() invocation using the MREMAP_DONTUNMAP flag can reset
> a faulted VMA into an unfaulted one.
>
> It does so after the page tables have been moved to the copied VMA with
> MREMAP_DONTUNMAP leaving the old VMA in place which is naturally unfaulted
> as the page tables it had are no longer present.
>
> However, in doing so, it violates the invariant that the anonymous page
> offset of an unfaulted VMA is vma->vm_start >> PAGE_SHIFT.
>
> This is because a VMA may have been faulted in, mremap()'d (causing a
> delta between its page offset and vma->vm_start >> PAGE_SHIFT), and then
> mremap()'d again with MREMAP_DONTUNMAP resulting in the unfaulting.
>
> This condition is a violation of a fundamental assumption in mm, but now
> also triggers an assert in assert_sane_pgoff() which explicitly checks for
> this condition.
>
> Correct it by resetting the VMA's page offset at the point of completing
> the MREMAP_DONTUNMAP operation.
>
> Link: https://lore.kernel.org/20260825-fix-mremap-dontunmap-pgoff-v1-1-39a40b2c98b3@kernel.org
> Fixes: 1583aa278f5f ("mm: mremap: unlink anon_vmas when mremap with MREMAP_DONTUNMAP success")
> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> Reported-by: syzbot+f12658786a4153df5113@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6a87853b.ae6ddae5.3da009.0023.GAE@google.com/
> Tested-by: syzbot+f12658786a4153df5113@syzkaller.appspotmail.com
> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
> Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
> Reviewed-by: Pedro Falcato <pfalcato@suse.de>
> Cc: Jann Horn <jannh@google.com>
> Cc: Liam R. Howlett <liam@infradead.org>
> Cc: Li Xinhai <lixinhai.lxh@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> [ adapted dontunmap_complete() changes to move_vma() using direct vm_pgoff assignment instead of unavailable helpers. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>

LGTM thanks!

> ---
>  mm/mremap.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/mm/mremap.c b/mm/mremap.c
> index d458ef218a372..d35f603c9738e 100644
> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -714,8 +714,18 @@ static unsigned long move_vma(struct vm_area_struct *vma,
>  		 * table has been moved.
>  		 */
>  		if (new_vma != vma && vma->vm_start == old_addr &&
> -			vma->vm_end == (old_addr + old_len))
> +			vma->vm_end == (old_addr + old_len)) {
> +			const pgoff_t pgoff_unfaulted = vma->vm_start >> PAGE_SHIFT;
> +
>  			unlink_anon_vmas(vma);
> +			/*
> +			 * The VMA is now unfaulted and it is an invariant that
> +			 * unfaulted anonymous VMAs have page offset equal to
> +			 * vma->vm_start >> PAGE_SHIFT.
> +			 */
> +			if (vma_is_anonymous(vma) && !vma->vm_file)
> +				vma->vm_pgoff = pgoff_unfaulted;
> +		}
>
>  		/* Because we won't unmap we don't need to touch locked_vm */
>  		return new_addr;
> --
> 2.53.0
>

--
Cheers, Lorenzo