vma_merge_next_range() requires that the caller specify prev AND next. Failure to specify results in missed merges. Fix this by explicitly looking up next. This function is explicitly used by mremap() in extend cases. Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@xxxxxxxxxx> Reported-by: Mark Brown <broonie@xxxxxxxxxx> --- mm/vma.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/vma.c b/mm/vma.c index 7cddeea907f8..bd35abc70ed8 100644 --- a/mm/vma.c +++ b/mm/vma.c @@ -1489,6 +1489,10 @@ struct vm_area_struct *vma_merge_extend(struct vma_iterator *vmi, { VMG_VMA_STATE(vmg, vmi, vma, vma, vma->vm_end, vma->vm_end + delta); + vmg.next = vma_next(vmi); + if (vma_prev(vmi)) + vma_iter_next_range(vmi); + /* We use the VMA to populate VMG fields only. */ vmg.vma = NULL; return vma_merge_new_range(&vmg); -- 2.46.0