The patch titled Subject: mm/mempolicy.c: check range first in queue_pages_test_walk has been added to the -mm tree. Its filename is mm-check-range-first-in-queue_pages_test_walk.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-check-range-first-in-queue_pages_test_walk.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-check-range-first-in-queue_pages_test_walk.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Li Xinhai <lixinhai.lxh@xxxxxxxxx> Subject: mm/mempolicy.c: check range first in queue_pages_test_walk Checking unmapped hole and updating the previous vma must be handled first, otherwise the unmapped hole could be calculated from a wrong previous vma. Several commits were relevant to this error: commit 6f4576e3687b ("mempolicy: apply page table walker on queue_pages_range()"), This commit was correct, the VM_PFNMAP check was after updating previous vma commit 48684a65b4e3 (mm: pagewalk: fix misbehavior of walk_page_range for vma(VM_PFNMAP)), This commit added VM_PFNMAP check before updating previous vma. Then, there were two VM_PFNMAP check did same thing twice. commit acda0c334028 (mm/mempolicy.c: get rid of duplicated check for vma(VM_PFNMAP) in queue_page s_range()), This commit tried to fix the duplicated VM_PFNMAP check, but it wrongly removed the one which was after updating vma. Link: http://lkml.kernel.org/r/1573218104-11021-2-git-send-email-lixinhai.lxh@xxxxxxxxx Fixes: acda0c334028 (mm/mempolicy.c: get rid of duplicated check for vma(VM_PFNMAP) in queue_pages_range()) Signed-off-by: Li Xinhai <lixinhai.lxh@xxxxxxxxx> Cc: Naoya Horiguchi <n-horiguchi@xxxxxxxxxxxxx> Cc: Michal Hocko <mhocko@xxxxxxxx> Cc: Vlastimil Babka <vbabka@xxxxxxx> Cc: Hugh Dickins <hughd@xxxxxxxxxx> Cc: linux-man <linux-man@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/mempolicy.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) --- a/mm/mempolicy.c~mm-check-range-first-in-queue_pages_test_walk +++ a/mm/mempolicy.c @@ -618,6 +618,16 @@ static int queue_pages_test_walk(unsigne unsigned long endvma = vma->vm_end; unsigned long flags = qp->flags; + /* range check first */ + if (!(flags & MPOL_MF_DISCONTIG_OK)) { + if (!vma->vm_next && vma->vm_end < end) + return -EFAULT; + if (qp->prev && qp->prev->vm_end < vma->vm_start) + return -EFAULT; + } + + qp->prev = vma; + /* * Need check MPOL_MF_STRICT to return -EIO if possible * regardless of vma_migratable @@ -631,15 +641,6 @@ static int queue_pages_test_walk(unsigne if (vma->vm_start > start) start = vma->vm_start; - if (!(flags & MPOL_MF_DISCONTIG_OK)) { - if (!vma->vm_next && vma->vm_end < end) - return -EFAULT; - if (qp->prev && qp->prev->vm_end < vma->vm_start) - return -EFAULT; - } - - qp->prev = vma; - if (flags & MPOL_MF_LAZY) { /* Similar to task_numa_work, skip inaccessible VMAs */ if (!is_vm_hugetlb_page(vma) && _ Patches currently in -mm which might be from lixinhai.lxh@xxxxxxxxx are mm-check-range-first-in-queue_pages_test_walk.patch mm-fix-checking-unmapped-holes-for-mbind.patch