linux-stable.git/tools/testing/vma, branch v7.0.4

mm: various small mmap_prepare cleanups

2026-05-07T04:14:15+00:00

[ Upstream commit 3e4bb2706817710d9461394da8b75be79981586b ]

Patch series "mm: expand mmap_prepare functionality and usage", v4.

This series expands the mmap_prepare functionality, which is intended to
replace the deprecated f_op->mmap hook which has been the source of bugs
and security issues for some time.

This series starts with some cleanup of existing mmap_prepare logic, then
adds documentation for the mmap_prepare call to make it easier for
filesystem and driver writers to understand how it works.

It then importantly adds a vm_ops->mapped hook, a key feature that was
missing from mmap_prepare previously - this is invoked when a driver which
specifies mmap_prepare has successfully been mapped but not merged with
another VMA.

mmap_prepare is invoked prior to a merge being attempted, so you cannot
manipulate state such as reference counts as if it were a new mapping.

The vm_ops->mapped hook allows a driver to perform tasks required at this
stage, and provides symmetry against subsequent vm_ops->open,close calls.

The series uses this to correct the afs implementation which wrongly
manipulated reference count at mmap_prepare time.

It then adds an mmap_prepare equivalent of vm_iomap_memory() -
mmap_action_simple_ioremap(), then uses this to update a number of drivers.

It then splits out the mmap_prepare compatibility layer (which allows for
invocation of mmap_prepare hooks in an mmap() hook) in such a way as to
allow for more incremental implementation of mmap_prepare hooks.

It then uses this to extend mmap_prepare usage in drivers.

Finally it adds an mmap_prepare equivalent of vm_map_pages(), which lays
the foundation for future work which will extend mmap_prepare to DMA
coherent mappings.

This patch (of 21):

Rather than passing arbitrary fields, pass a vm_area_desc pointer to mmap
prepare functions to mmap prepare, and an action and vma pointer to mmap
complete in order to put all the action-specific logic in the function
actually doing the work.

Additionally, allow mmap prepare functions to return an error so we can
error out as soon as possible if there is something logically incorrect in
the input.

Update remap_pfn_range_prepare() to properly check the input range for the
CoW case.

Also remove io_remap_pfn_range_complete(), as we can simply set up the
fields correctly in io_remap_pfn_range_prepare() and use
remap_pfn_range_complete() for this.

While we're here, make remap_pfn_range_prepare_vma() a little neater, and
pass mmap_action directly to call_action_complete().

Then, update compat_vma_mmap() to perform its logic directly, as
__compat_vma_map() is not used by anything so we don't need to export it.

Also update compat_vma_mmap() to use vfs_mmap_prepare() rather than
calling the mmap_prepare op directly.

Finally, update the VMA userland tests to reflect the changes.

Link: https://lkml.kernel.org/r/cover.1774045440.git.ljs@kernel.org
Link: https://lkml.kernel.org/r/99f408e4694f44ab12bdc55fe0bd9685d3bd1117.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Suren Baghdasaryan 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton 
Stable-dep-of: f96e1d5f15b7 ("mm: avoid deadlock when holding rmap on mmap_prepare error")
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

mm: prevent droppable mappings from being locked

2026-05-07T04:13:44+00:00

commit d239462787b072c78eb19fc1f155c3d411256282 upstream.

Droppable mappings must not be lockable.  There is a check for VMAs with
VM_DROPPABLE set in mlock_fixup() along with checks for other types of
unlockable VMAs which ensures this when calling mlock()/mlock2().

For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.  In
apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
applied to it.  VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
When these flags are set as default in this manner they are cleared in
__mmap_complete() for new mappings that do not support mlock.  A check for
VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
mappings created with VM_LOCKED set.  To fix this and reduce that chance
of similar bugs in the future, introduce and use vma_supports_mlock().

Link: https://lkml.kernel.org/r/20260310155821.17869-1-anthony.yznaga@oracle.com
Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
Signed-off-by: Anthony Yznaga 
Suggested-by: David Hildenbrand 
Acked-by: David Hildenbrand (Arm) 
Reviewed-by: Pedro Falcato 
Reviewed-by: Lorenzo Stoakes (Oracle) 
Tested-by: Lorenzo Stoakes (Oracle) 
Cc: Jann Horn 
Cc: Jason A. Donenfeld 
Cc: Liam Howlett 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Shuah Khan 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

tools/testing/vma: add VMA userland tests for VMA flag functions

2026-02-12T23:42:59+00:00

Now we have the capability to test the new helpers for the bitmap VMA
flags in userland, do so.

We also update the Makefile such that both VMA (and while we're here)
mm_struct flag sizes can be customised on build.  We default to 128-bit to
enable testing of flags above word size even on 64-bit systems.

We add userland tests to ensure that we do not regress VMA flag behaviour
with the introduction when using bitmap VMA flags, nor accidentally
introduce unexpected results due to for instance higher bit values not
being correctly cleared/set.

As part of this change, make __mk_vma_flags() a custom function so we can
handle specifying invalid VMA bits.  This is purposeful so we can have the
VMA tests work at lower and higher number of VMA flags without having to
duplicate code too much.

Link: https://lkml.kernel.org/r/7fe6afe9c8c61e4d3cfc9a2d50a5d24da8528e68.1769097829.git.lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes 
Reviewed-by: Liam R. Howlett 
Cc: Baolin Wang 
Cc: Barry Song 
Cc: David Hildenbrand 
Cc: Dev Jain 
Cc: Jason Gunthorpe 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Cc: Zi Yan 
Cc: Damien Le Moal 
Cc: "Darrick J. Wong" 
Cc: Jarkko Sakkinen 
Cc: Yury Norov 
Cc: Chris Mason 
Cc: Pedro Falcato 
Signed-off-by: Andrew Morton

tools/testing/vma: separate out vma_internal.h into logical headers

2026-02-12T23:42:59+00:00

The vma_internal.h file is becoming entirely unmanageable.  It combines
duplicated kernel implementation logic that needs to be kept in-sync with
the kernel, stubbed out declarations that we simply ignore for testing
purposes and custom logic added to aid testing.

If we separate each of the three things into separate headers it makes
things far more manageable, so do so:

* include/stubs.h  contains the stubbed declarations,
* include/dup.h    contains the duplicated kernel declarations, and
* include/custom.h contains declarations customised for testing.

[lorenzo.stoakes@oracle.com: avoid a duplicate struct define]
  Link: https://lkml.kernel.org/r/1e032732-61c3-485c-9aa7-6a09016fefc1@lucifer.local
Link: https://lkml.kernel.org/r/dd57baf5b5986cb96a167150ac712cbe804b63ee.1769097829.git.lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes 
Reviewed-by: Liam R. Howlett 
Cc: Baolin Wang 
Cc: Barry Song 
Cc: David Hildenbrand 
Cc: Dev Jain 
Cc: Jason Gunthorpe 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Cc: Zi Yan 
Cc: Damien Le Moal 
Cc: "Darrick J. Wong" 
Cc: Jarkko Sakkinen 
Cc: Yury Norov 
Cc: Chris Mason 
Cc: Pedro Falcato 
Signed-off-by: Andrew Morton

tools/testing/vma: separate VMA userland tests into separate files

2026-02-12T23:42:59+00:00

So far the userland VMA tests have been established as a rough expression
of what's been possible.

Adapt it into a more usable form by separating out tests and shared
helper functions.

Since we test functions that are declared statically in mm/vma.c, we make
use of the trick of #include'ing kernel C files directly.

In order for the tests to continue to function, we must therefore also
this way into the tests/ directory.

We try to keep as much shared logic actually modularised into a separate
compilation unit in shared.c, however the merge_existing() and
attach_vma() helpers rely on statically declared mm/vma.c functions so
these must be declared in main.c.

Link: https://lkml.kernel.org/r/a0455ccfe4fdcd1c962c64f76304f612e5662a4e.1769097829.git.lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes 
Reviewed-by: Liam R. Howlett 
Cc: Baolin Wang 
Cc: Barry Song 
Cc: David Hildenbrand 
Cc: Dev Jain 
Cc: Jason Gunthorpe 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Cc: Zi Yan 
Cc: Damien Le Moal 
Cc: "Darrick J. Wong" 
Cc: Jarkko Sakkinen 
Cc: Yury Norov 
Cc: Chris Mason 
Cc: Pedro Falcato 
Signed-off-by: Andrew Morton

mm: make vm_area_desc utilise vma_flags_t only

2026-02-12T23:42:59+00:00

Now we have eliminated all uses of vm_area_desc->vm_flags, eliminate this
field, and have mmap_prepare users utilise the vma_flags_t
vm_area_desc->vma_flags field only.

As part of this change we alter is_shared_maywrite() to accept a
vma_flags_t parameter, and introduce is_shared_maywrite_vm_flags() for use
with legacy vm_flags_t flags.

We also update struct mmap_state to add a union between vma_flags and
vm_flags temporarily until the mmap logic is also converted to using
vma_flags_t.

Also update the VMA userland tests to reflect this change.

Link: https://lkml.kernel.org/r/fd2a2938b246b4505321954062b1caba7acfc77a.1769097829.git.lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes 
Reviewed-by: Pedro Falcato 
Reviewed-by: Liam R. Howlett 
Cc: Baolin Wang 
Cc: Barry Song 
Cc: David Hildenbrand 
Cc: Dev Jain 
Cc: Jason Gunthorpe 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Cc: Zi Yan 
Cc: Damien Le Moal 
Cc: "Darrick J. Wong" 
Cc: Jarkko Sakkinen 
Cc: Yury Norov 
Cc: Chris Mason 
Signed-off-by: Andrew Morton

mm: add basic VMA flag operation helper functions

2026-02-12T23:42:57+00:00

Now we have the mk_vma_flags() macro helper which permits easy
specification of any number of VMA flags, add helper functions which
operate with vma_flags_t parameters.

This patch provides vma_flags_test[_mask](), vma_flags_set[_mask]() and
vma_flags_clear[_mask]() respectively testing, setting and clearing flags
with the _mask variants accepting vma_flag_t parameters, and the non-mask
variants implemented as macros which accept a list of flags.

This allows us to trivially test/set/clear aggregate VMA flag values as
necessary, for instance:

	if (vma_flags_test(&flags, VMA_READ_BIT, VMA_WRITE_BIT))
		goto readwrite;

	vma_flags_set(&flags, VMA_READ_BIT, VMA_WRITE_BIT);

	vma_flags_clear(&flags, VMA_READ_BIT, VMA_WRITE_BIT);

We also add a function for testing that ALL flags are set for convenience,
e.g.:

	if (vma_flags_test_all(&flags, VMA_READ_BIT, VMA_MAYREAD_BIT)) {
		/* Both READ and MAYREAD flags set */
		...
	}

The compiler generates optimal assembly for each such that they behave as
if the caller were setting the bitmap flags manually.

This is important for e.g.  drivers which manipulate flag values rather
than a VMA's specific flag values.

We also add helpers for testing, setting and clearing flags for VMA's and
VMA descriptors to reduce boilerplate.

Also add the EMPTY_VMA_FLAGS define to aid initialisation of empty flags.

Finally, update the userland VMA tests to add the helpers there so they
can be utilised as part of userland testing.

Link: https://lkml.kernel.org/r/885d4897d67a6a57c0b07fa182a7055ad752df11.1769097829.git.lorenzo.stoakes@oracle.com
Signed-off-by: Lorenzo Stoakes 
Reviewed-by: Pedro Falcato 
Reviewed-by: Liam R. Howlett 
Cc: Baolin Wang 
Cc: Barry Song 
Cc: David Hildenbrand 
Cc: Dev Jain 
Cc: Jason Gunthorpe 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Cc: Zi Yan 
Cc: Damien Le Moal 
Cc: "Darrick J. Wong" 
Cc: Jarkko Sakkinen 
Cc: Yury Norov 
Cc: Chris Mason 
Signed-off-by: Andrew Morton

mm: use unmap_desc struct for freeing page tables

2026-02-12T23:42:56+00:00

Pass through the unmap_desc to free_pgtables() because it almost has
everything necessary and is already on the stack.

Updates testing code as necessary.

No functional changes intended.

[Liam.Howlett@oracle.com: fix up unmap desc use on exit_mmap()]
  Link: https://lkml.kernel.org/r/20260210214214.364856-1-Liam.Howlett@oracle.com
Link: https://lkml.kernel.org/r/20260121164946.2093480-12-Liam.Howlett@oracle.com
Signed-off-by: Liam R. Howlett 
Reviewed-by: Lorenzo Stoakes 
Cc: Suren Baghdasaryan 
Cc: Baoquan He 
Cc: Barry Song 
Cc: Chris Li 
Cc: David Hildenbrand 
Cc: David Hildenbrand 
Cc: Jann Horn 
Cc: Kairui Song 
Cc: Kemeng Shi 
Cc: Matthew Wilcox (Oracle) 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Nhat Pham 
Cc: Pedro Falcato 
Cc: SeongJae Park 
Cc: Vlastimil Babka 
Signed-off-by: Andrew Morton

mm/vma: use unmap_desc in exit_mmap() and vms_clear_ptes()

2026-02-12T23:42:55+00:00

Convert vms_clear_ptes() to use unmap_desc to call unmap_vmas() instead of
the large argument list.  The UNMAP_STATE() cannot be used because the vma
iterator in the vms does not point to the correct maple state
(mas_detach), and the tree_end will be set incorrectly.  Setting up the
arguments manually avoids setting the struct up incorrectly and doing
extra work to get the correct pagetable range.

exit_mmap() also calls unmap_vmas() with many arguments.  Using the
unmap_all_init() function to set the unmap descriptor for all vmas makes
this a bit easier to read.

Update to the vma test code is necessary to ensure testing continues to
function.

No functional changes intended.

Link: https://lkml.kernel.org/r/20260121164946.2093480-10-Liam.Howlett@oracle.com
Signed-off-by: Liam R. Howlett 
Cc: Baoquan He 
Cc: Barry Song 
Cc: Chris Li 
Cc: David Hildenbrand 
Cc: David Hildenbrand 
Cc: Jann Horn 
Cc: Kairui Song 
Cc: Kemeng Shi 
Cc: Lorenzo Stoakes 
Cc: Matthew Wilcox (Oracle) 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Nhat Pham 
Cc: Pedro Falcato 
Cc: SeongJae Park 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Signed-off-by: Andrew Morton

mm/memory: add tree limit to free_pgtables()

2026-02-12T23:42:54+00:00

The ceiling and tree search limit need to be different arguments for the
future change in the failed fork attempt.  The ceiling and floor variables
are not very descriptive, so change them to pg_start/pg_end.

Adding a new variable for the vma_end to the function as it will differ
from the pg_end in the later patches in the series.

Add a kernel doc about the free_pgtables() function.

Test code also updated.

No functional changes intended.

Link: https://lkml.kernel.org/r/20260121164946.2093480-6-Liam.Howlett@oracle.com
Signed-off-by: Liam R. Howlett 
Reviewed-by: Lorenzo Stoakes 
Reviewed-by: Pedro Falcato 
Cc: Baoquan He 
Cc: Barry Song 
Cc: Chris Li 
Cc: David Hildenbrand 
Cc: David Hildenbrand 
Cc: Jann Horn 
Cc: Kairui Song 
Cc: Kemeng Shi 
Cc: Matthew Wilcox (Oracle) 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Nhat Pham 
Cc: SeongJae Park 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Signed-off-by: Andrew Morton