linux.git/tools/testing/vma/include, branch v7.2-rc1

mm/vma: eliminate mmap_action->error_hook, introduce error_override

2026-06-04T21:45:00+00:00

Rather than providing a hook, simplify things by providing the ability to
override mmap action errors.  This allows us to more carefully validate
the value provided and thus ensure only a valid error code is specified,
and simplifies the interface.

This way, we eliminate all hooks but mmap_prepare and allow only mmap
actions to be specified (which core mm controls).

This significantly improves robustness and eliminates any unnecessary code
duplication in driver mmap hooks.

We also update the /dev/mem logic (the only user) to use
mmap_action->error_override instead.

Link: https://lore.kernel.org/55d13f7d016b827c459946d46a56105635be111c.1780397980.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes 
Acked-by: David Hildenbrand (Arm) 
Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Cc: Jann Horn 
Cc: Liam R. Howlett 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Pedro Falcato 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Signed-off-by: Andrew Morton

mm/vma: remove mmap_action->success_hook

2026-06-04T21:45:00+00:00

This hook was introduced to work around code that seemed to absolutely
require access to a VMA pointer upon mmap().

However, providing this hook leaves a backdoor to drivers getting access
to the very thing mmap_prepare eliminates - a pointer to the VMA.

Let's solve this contradiction by removing it.  The key intended user was
hugetlb, however it seems that the best course now is to avoid allowing
all drivers the ability to work around mmap_prepare, and find a different
solution there.

Link: https://lore.kernel.org/f79434e6d30af6d92999be6b76e197f1847105fa.1780397980.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes 
Acked-by: David Hildenbrand (Arm) 
Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Cc: Jann Horn 
Cc: Liam R. Howlett 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Pedro Falcato 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Signed-off-by: Andrew Morton

drivers/char/mem: eliminate unnecessary use of success_hook

2026-06-04T21:44:59+00:00

Patch series "remove mmap_action success, error hooks", v3.

The mmap_action->success_hook was a strange beast added to enable code
which appeared to absolutely require access to a VMA pointer to work
correctly.

Primarily this was for hugetlb, however a different approach will be taken
there, as clearly more work is required to figure out a sensible way of
converting hugetlb to use mmap_prepare.

The other user was the memory char driver, specifically /dev/zero which
has the unusual property of explicitly setting file-backed VMAs anonymous.

Providing the success hook was always foolish, as it allowed drivers a way
to workaround the restriction that they should not access a pointer to a
not-yet-correctly-initialised VMA - which defeats the purpose of the
mmap_prepare work.

We can achieve the same thing in memory char driver without needing the
success hook, so this series removes that, then removes the success hook
altogether.

The error hook is also unnecessary - the motivation for this was for
functions which need to override the error code when performing an mmap
action in order to avoid breaking userspace.

We can achieve this by just providing a field for the error code.  Doing
this means we don't have to worry about the hook doing anything odd.

We also add a check to ensure the error code is in fact valid.

Again the memory char driver is the only current user of this, so this
series updates it to use that.

After this change mmap_action has no custom hooks at all, which seems
rather more cromulent than before.


This patch (of 3):

/dev/zero, uniquely, marks memory mapped there as anonymous.  This is
currently achieved using the mmap_action->success_hook.

However this hook circumvents the abstraction of VMA initialisation so
it's preferable to do things a different way.

To achieve this, this patch firstly defaults the VMA descriptor's vm_ops
field to the dummy VMA operations, which is what file-backed VMAs default
this field to.

That way, we can detect whether a driver sets this field to NULL in order
to mark it anonymous.

We then introduce vma_desc_set_anonymous() to do this explicitly, and
invoke it in mmap_zero_prepare().

This way, any driver which does not explicitly set desc->vm_ops, retains
the dummy vm_ops as they would previously.

We also update set_vma_user_defined_fields() to make clear that we are
either setting vma->vm_ops to what is provided by the driver (or
defaulting to dummy_vm_ops if not set), or setting the VMA anonymous.

This lays the groundwork for removing the success hook.

Link: https://lore.kernel.org/cover.1780397980.git.ljs@kernel.org
Link: https://lore.kernel.org/010579cca6787cf7bb057ab1f7228978b10601c8.1780397980.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes 
Acked-by: David Hildenbrand (Arm) 
Cc: Arnd Bergmann 
Cc: Greg Kroah-Hartman 
Cc: Jann Horn 
Cc: Liam R. Howlett 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Pedro Falcato 
Cc: Suren Baghdasaryan 
Cc: Vlastimil Babka 
Signed-off-by: Andrew Morton

mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()

2026-04-27T12:54:24+00:00

The mmap_prepare hook functionality includes the ability to invoke
mmap_prepare() from the mmap() hook of existing 'stacked' drivers, that is
ones which are capable of calling the mmap hooks of other drivers/file
systems (e.g.  overlayfs, shm).

As part of the mmap_prepare action functionality, we deal with errors by
unmapping the VMA should one arise.  This works in the usual mmap_prepare
case, as we invoke this action at the last moment, when the VMA is
established in the maple tree.

However, the mmap() hook passes a not-fully-established VMA pointer to the
caller (which is the motivation behind the mmap_prepare() work), which is
detached.

So attempting to unmap a VMA in this state will be problematic, with the
most obvious symptom being a warning in vma_mark_detached(), because the
VMA is already detached.

It's also unncessary - the mmap() handler will clean up the VMA on error.

So to fix this issue, this patch propagates whether or not an mmap action
is being completed via the compatibility layer or directly.

If the former, then we do not attempt VMA cleanup, if the latter, then we
do.

This patch also updates the userland VMA tests to reflect the change.

Link: https://lore.kernel.org/20260421102150.189982-1-ljs@kernel.org
Fixes: ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc")
Signed-off-by: Lorenzo Stoakes 
Reported-by: syzbot+db390288d141a1dccf96@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69e69734.050a0220.24bfd3.0027.GAE@google.com/
Cc: David Hildenbrand 
Cc: Jann Horn 
Cc: Liam Howlett 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Pedro Falcato 
Cc: Suren Baghdasaryan 
Cc: 
Signed-off-by: Andrew Morton

mm: add mmap_action_map_kernel_pages[_full]()

2026-04-05T20:53:45+00:00

A user can invoke mmap_action_map_kernel_pages() to specify that the
mapping should map kernel pages starting from desc->start of a specified
number of pages specified in an array.

In order to implement this, adjust mmap_action_prepare() to be able to
return an error code, as it makes sense to assert that the specified
parameters are valid as quickly as possible as well as updating the VMA
flags to include VMA_MIXEDMAP_BIT as necessary.

This provides an mmap_prepare equivalent of vm_insert_pages().  We
additionally update the existing vm_insert_pages() code to use
range_in_vma() and add a new range_in_vma_desc() helper function for the
mmap_prepare case, sharing the code between the two in range_is_subset().

We add both mmap_action_map_kernel_pages() and
mmap_action_map_kernel_pages_full() to allow for both partial and full VMA
mappings.

We update the documentation to reflect the new features.

Finally, we update the VMA tests accordingly to reflect the changes.

Link: https://lkml.kernel.org/r/926ac961690d856e67ec847bee2370ab3c6b9046.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Reviewed-by: Suren Baghdasaryan 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton

mm: allow handling of stacked mmap_prepare hooks in more drivers

2026-04-05T20:53:44+00:00

While the conversion of mmap hooks to mmap_prepare is underway, we will
encounter situations where mmap hooks need to invoke nested mmap_prepare
hooks.

The nesting of mmap hooks is termed 'stacking'.  In order to flexibly
facilitate the conversion of custom mmap hooks in drivers which stack, we
must split up the existing __compat_vma_mmap() function into two separate
functions:

* compat_set_desc_from_vma() - This allows the setting of a vm_area_desc
  object's fields to the relevant fields of a VMA.

* __compat_vma_mmap() - Once an mmap_prepare hook has been executed upon a
  vm_area_desc object, this function performs any mmap actions specified by
  the mmap_prepare hook and then invokes its vm_ops->mapped() hook if any
  were specified.

In ordinary cases, where a file's f_op->mmap_prepare() hook simply needs
to be invoked in a stacked mmap() hook, compat_vma_mmap() can be used.

However some drivers define their own nested hooks, which are invoked in
turn by another hook.

A concrete example is vmbus_channel->mmap_ring_buffer(), which is invoked
in turn by bin_attribute->mmap():

vmbus_channel->mmap_ring_buffer() has a signature of:

int (*mmap_ring_buffer)(struct vmbus_channel *channel,
			struct vm_area_struct *vma);

And bin_attribute->mmap() has a signature of:

	int (*mmap)(struct file *, struct kobject *,
		    const struct bin_attribute *attr,
		    struct vm_area_struct *vma);

And so compat_vma_mmap() cannot be used here for incremental conversion of
hooks from mmap() to mmap_prepare().

There are many such instances like this, where conversion to mmap_prepare
would otherwise cascade to a huge change set due to nesting of this kind.

The changes in this patch mean we could now instead convert
vmbus_channel->mmap_ring_buffer() to
vmbus_channel->mmap_prepare_ring_buffer(), and implement something like:

	struct vm_area_desc desc;
	int err;

	compat_set_desc_from_vma(&desc, file, vma);
	err = channel->mmap_prepare_ring_buffer(channel, &desc);
	if (err)
		return err;

	return __compat_vma_mmap(&desc, vma);

Allowing us to incrementally update this logic, and other logic like it.

Unfortunately, as part of this change, we need to be able to flexibly
assign to the VMA descriptor, so have to remove some of the const
declarations within the structure.

Also update the VMA tests to reflect the changes.

Link: https://lkml.kernel.org/r/24aac3019dd34740e788d169fccbe3c62781e648.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Suren Baghdasaryan 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton

mm: add mmap_action_simple_ioremap()

2026-04-05T20:53:43+00:00

Currently drivers use vm_iomap_memory() as a simple helper function for
I/O remapping memory over a range starting at a specified physical address
over a specified length.

In order to utilise this from mmap_prepare, separate out the core logic
into __simple_ioremap_prep(), update vm_iomap_memory() to use it, and add
simple_ioremap_prepare() to do the same with a VMA descriptor object.

We also add MMAP_SIMPLE_IO_REMAP and relevant fields to the struct
mmap_action type to permit this operation also.

We use mmap_action_ioremap() to set up the actual I/O remap operation once
we have checked and figured out the parameters, which makes
simple_ioremap_prepare() easy to implement.

We then add mmap_action_simple_ioremap() to allow drivers to make use of
this mode.

We update the mmap_prepare documentation to describe this mode.  Finally,
we update the VMA tests to reflect this change.

Link: https://lkml.kernel.org/r/a08ef1c4542202684da63bb37f459d5dbbeddd91.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Reviewed-by: Suren Baghdasaryan 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton

mm: add vm_ops->mapped hook

2026-04-05T20:53:43+00:00

Previously, when a driver needed to do something like establish a
reference count, it could do so in the mmap hook in the knowledge that the
mapping would succeed.

With the introduction of f_op->mmap_prepare this is no longer the case, as
it is invoked prior to actually establishing the mapping.

mmap_prepare is not appropriate for this kind of thing as it is called
before any merge might take place, and after which an error might occur
meaning resources could be leaked.

To take this into account, introduce a new vm_ops->mapped callback which
is invoked when the VMA is first mapped (though notably - not when it is
merged - which is correct and mirrors existing mmap/open/close behaviour).

We do better that vm_ops->open() here, as this callback can return an
error, at which point the VMA will be unmapped.

Note that vm_ops->mapped() is invoked after any mmap action is complete
(such as I/O remapping).

We intentionally do not expose the VMA at this point, exposing only the
fields that could be used, and an output parameter in case the operation
needs to update the vma->vm_private_data field.

In order to deal with stacked filesystems which invoke inner filesystem's
mmap() invocations, add __compat_vma_mapped() and invoke it on vfs_mmap()
(via compat_vma_mmap()) to ensure that the mapped callback is handled when
an mmap() caller invokes a nested filesystem's mmap_prepare() callback.

Update the mmap_prepare documentation to describe the mapped hook and make
it clear what its intended use is.

The vm_ops->mapped() call is handled by the mmap complete logic to ensure
the same code paths are handled by both the compatibility and VMA layers.

Additionally, update VMA userland test headers to reflect the change.

Link: https://lkml.kernel.org/r/4c5e98297eb0aae9565c564e1c296a112702f144.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Suren Baghdasaryan 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton

mm: have mmap_action_complete() handle the rmap lock and unmap

2026-04-05T20:53:42+00:00

Rather than have the callers handle this both the rmap lock release and
unmapping the VMA on error, handle it within the mmap_action_complete()
logic where it makes sense to, being careful not to unlock twice.

This simplifies the logic and makes it harder to make mistake with this,
while retaining correct behaviour with regard to avoiding deadlocks.

Also replace the call_action_complete() function with a direct invocation
of mmap_action_complete() as the abstraction is no longer required.

Also update the VMA tests to reflect this change.

Link: https://lkml.kernel.org/r/8d1ee8ebd3542d006a47e8382fb80cf5b57ecf10.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Suren Baghdasaryan 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton

mm: switch the rmap lock held option off in compat layer

2026-04-05T20:53:42+00:00

In the mmap_prepare compatibility layer, we don't need to hold the rmap
lock, as we are being called from an .mmap handler.

The .mmap_prepare hook, when invoked in the VMA logic, is called prior to
the VMA being instantiated, but the completion hook is called after the VMA
is linked into the maple tree, meaning rmap walkers can reach it.

The mmap hook does not link the VMA into the tree, so this cannot happen.

Therefore it's safe to simply disable this in the mmap_prepare
compatibility layer.

Also update VMA tests code to reflect current compatibility layer state.

[akpm@linux-foundation.org: fix comment typo, per Vlastimil]
Link: https://lkml.kernel.org/r/dda74230d26a1fcd79a3efab61fa4101dd1cac64.1774045440.git.ljs@kernel.org
Signed-off-by: Lorenzo Stoakes (Oracle) 
Acked-by: Vlastimil Babka (SUSE) 
Cc: Alexander Shishkin 
Cc: Alexandre Torgue 
Cc: Al Viro 
Cc: Arnd Bergmann 
Cc: Bodo Stroesser 
Cc: Christian Brauner 
Cc: Clemens Ladisch 
Cc: David Hildenbrand 
Cc: David Howells 
Cc: Dexuan Cui 
Cc: Greg Kroah-Hartman 
Cc: Haiyang Zhang 
Cc: Jan Kara 
Cc: Jann Horn 
Cc: Jonathan Corbet 
Cc: K. Y. Srinivasan 
Cc: Liam Howlett 
Cc: Long Li 
Cc: Marc Dionne 
Cc: "Martin K. Petersen" 
Cc: Maxime Coquelin 
Cc: Michal Hocko 
Cc: Mike Rapoport 
Cc: Miquel Raynal 
Cc: Pedro Falcato 
Cc: Richard Weinberger 
Cc: Ryan Roberts 
Cc: Suren Baghdasaryan 
Cc: Vignesh Raghavendra 
Cc: Wei Liu 
Signed-off-by: Andrew Morton