On 3/3/25 12:08, Lorenzo Stoakes wrote:
> Consider the case of a a partial mremap() (that results in a VMA split) of
> an accountable VMA (i.e. which has the VM_ACCOUNT flag set) whose start
> address is zero, with the MREMAP_MAYMOVE flag specified and a scenario
> where a move does in fact occur:
>
> addr end
> | |
> v v
> |-------------|
> | vma |
> |-------------|
> 0
>
> This move is affected by unmapping the range [addr, end). In order to
> prevent an incorrect decrement of accounted memory which has already been
> determined, the mremap() code in move_vma() clears VM_ACCOUNT from the VMA
> prior to doing so, before reestablishing it in each of the VMAs post-split:
>
> addr end
> | |
> v v
> |---| |---|
> | A | | B |
> |---| |---|
>
> Commit 6b73cff239e5 ("mm: change munmap splitting order and move_vma()")
> changed this logic such as to determine whether there is a need to do so by
> establishing account_start and account_end and, in the instance where such
> an operation is required, assigning them to vma->vm_start and vma->vm_end.
>
> Later the code checks if the operation is required for 'A' referenced above
> thusly:
>
> if (account_start) {
> ...
> }
>
> However, if the VMA described above has vma->vm_start == 0, which is now
> assigned to account_start, this branch will not be executed.
>
> As a result, the VMA 'A' above will remain stripped of its VM_ACCOUNT flag,
> incorrectly.
>
> The fix is to simply convert these variables to booleans and set them as
> required.
>
> Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@xxxxxxxxxx>
> Fixes: 6b73cff239e5 ("mm: change munmap splitting order and move_vma()")
> Cc: stable@xxxxxxxxxxxxxxx
Looks like the variables would be more accurately named account_prev and
account_next? But maybe it's refactored later anyway. Keeps the diff to
stable backport smaller.
Reviewed-by: Vlastimil Babka <vbabka@xxxxxxx>
