Re: [PATCH 6.18.y] mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Thu, Sep 10, 2026 at 09:23:56PM -0400, Sasha Levin wrote:
> From: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
>
> [ Upstream commit 35b0fb391b0df57383bc15985bb769f4555c97ba ]
>
> Uniquely an mremap() invocation using the MREMAP_DONTUNMAP flag can reset
> a faulted VMA into an unfaulted one.
>
> It does so after the page tables have been moved to the copied VMA with
> MREMAP_DONTUNMAP leaving the old VMA in place which is naturally unfaulted
> as the page tables it had are no longer present.
>
> However, in doing so, it violates the invariant that the anonymous page
> offset of an unfaulted VMA is vma->vm_start >> PAGE_SHIFT.
>
> This is because a VMA may have been faulted in, mremap()'d (causing a
> delta between its page offset and vma->vm_start >> PAGE_SHIFT), and then
> mremap()'d again with MREMAP_DONTUNMAP resulting in the unfaulting.
>
> This condition is a violation of a fundamental assumption in mm, but now
> also triggers an assert in assert_sane_pgoff() which explicitly checks for
> this condition.
>
> Correct it by resetting the VMA's page offset at the point of completing
> the MREMAP_DONTUNMAP operation.
>
> Link: https://lore.kernel.org/20260825-fix-mremap-dontunmap-pgoff-v1-1-39a40b2c98b3@kernel.org
> Fixes: 1583aa278f5f ("mm: mremap: unlink anon_vmas when mremap with MREMAP_DONTUNMAP success")
> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> Reported-by: syzbot+f12658786a4153df5113@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6a87853b.ae6ddae5.3da009.0023.GAE@google.com/
> Tested-by: syzbot+f12658786a4153df5113@syzkaller.appspotmail.com
> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
> Reviewed-by: Kunwu Chan <kunwu.chan@gmail.com>
> Reviewed-by: Pedro Falcato <pfalcato@suse.de>
> Cc: Jann Horn <jannh@google.com>
> Cc: Liam R. Howlett <liam@infradead.org>
> Cc: Li Xinhai <lixinhai.lxh@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> [ adapted VMA page-offset helpers to use the branch’s single vm_pgoff field. ]
> Signed-off-by: Sasha Levin <sashal@kernel.org>

LGTM thanks!

> ---
>  mm/mremap.c | 21 ++++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)
>
> diff --git a/mm/mremap.c b/mm/mremap.c
> index 419a0ea0a8708..bdf63ffaad3d5 100644
> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -1247,18 +1247,29 @@ static void dontunmap_complete(struct vma_remap_struct *vrm,
>  {
>  	unsigned long start = vrm->addr;
>  	unsigned long end = vrm->addr + vrm->old_len;
> -	unsigned long old_start = vrm->vma->vm_start;
> -	unsigned long old_end = vrm->vma->vm_end;
> +	struct vm_area_struct *vma = vrm->vma;
> +	unsigned long old_start = vma->vm_start;
> +	unsigned long old_end = vma->vm_end;
>
>  	/* We always clear VM_LOCKED[ONFAULT] on the old VMA. */
> -	vm_flags_clear(vrm->vma, VM_LOCKED_MASK);
> +	vm_flags_clear(vma, VM_LOCKED_MASK);
>
>  	/*
>  	 * anon_vma links of the old vma is no longer needed after its page
>  	 * table has been moved.
>  	 */
> -	if (new_vma != vrm->vma && start == old_start && end == old_end)
> -		unlink_anon_vmas(vrm->vma);
> +	if (new_vma != vma && start == old_start && end == old_end) {
> +		const pgoff_t pgoff_unfaulted = vma->vm_start >> PAGE_SHIFT;
> +
> +		unlink_anon_vmas(vma);
> +		/*
> +		 * The VMA is now unfaulted and it is an invariant that
> +		 * unfaulted anonymous VMAs have page offset equal to
> +		 * vma->vm_start >> PAGE_SHIFT.
> +		 */
> +		if (vma_is_anonymous(vma) && !vma->vm_file)
> +			vma->vm_pgoff = pgoff_unfaulted;
> +	}
>
>  	/* Because we won't unmap we don't need to touch locked_vm. */
>  }
> --
> 2.53.0
>

--
Cheers, Lorenzo