I don't think this situation can ever happen MREMAP_DONTUNMAP is already restricted to anonymous mappings (defined as not having vm_ops) and vma_to_resize checks that the mapping is anonymous before move_vma is called. On Mon, Dec 14, 2020 at 7:08 PM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > > From: Dmitry Safonov <dima@xxxxxxxxxx> > Subject: mremap: don't allow MREMAP_DONTUNMAP on special_mappings and aio > > As kernel expect to see only one of such mappings, any further operations > on the VMA-copy may be unexpected by the kernel. Maybe it's being on the > safe side, but there doesn't seem to be any expected use-case for this, so > restrict it now. > > Link: https://lkml.kernel.org/r/20201013013416.390574-4-dima@xxxxxxxxxx > Fixes: commit e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()") > Signed-off-by: Dmitry Safonov <dima@xxxxxxxxxx> > Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> > Cc: Andy Lutomirski <luto@xxxxxxxxxx> > Cc: Brian Geffon <bgeffon@xxxxxxxxxx> > Cc: Catalin Marinas <catalin.marinas@xxxxxxx> > Cc: Dan Carpenter <dan.carpenter@xxxxxxxxxx> > Cc: Dan Williams <dan.j.williams@xxxxxxxxx> > Cc: Dave Jiang <dave.jiang@xxxxxxxxx> > Cc: Hugh Dickins <hughd@xxxxxxxxxx> > Cc: Ingo Molnar <mingo@xxxxxxxxxx> > Cc: Jason Gunthorpe <jgg@xxxxxxxx> > Cc: John Hubbard <jhubbard@xxxxxxxxxx> > Cc: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx> > Cc: Mike Kravetz <mike.kravetz@xxxxxxxxxx> > Cc: Minchan Kim <minchan@xxxxxxxxxx> > Cc: Ralph Campbell <rcampbell@xxxxxxxxxx> > Cc: Russell King <linux@xxxxxxxxxxxxxxx> > Cc: Thomas Bogendoerfer <tsbogend@xxxxxxxxxxxxxxxx> > Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> > Cc: Vishal Verma <vishal.l.verma@xxxxxxxxx> > Cc: Vlastimil Babka <vbabka@xxxxxxx> > Cc: Will Deacon <will@xxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > --- > > arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 2 +- > fs/aio.c | 5 ++++- > include/linux/mm.h | 2 +- > mm/mmap.c | 6 +++++- > mm/mremap.c | 2 +- > 5 files changed, 12 insertions(+), 5 deletions(-) > > --- a/arch/x86/kernel/cpu/resctrl/pseudo_lock.c~mremap-dont-allow-mremap_dontunmap-on-special_mappings-and-aio > +++ a/arch/x86/kernel/cpu/resctrl/pseudo_lock.c > @@ -1458,7 +1458,7 @@ static int pseudo_lock_dev_release(struc > return 0; > } > > -static int pseudo_lock_dev_mremap(struct vm_area_struct *area) > +static int pseudo_lock_dev_mremap(struct vm_area_struct *area, unsigned long flags) > { > /* Not supported */ > return -EINVAL; > --- a/fs/aio.c~mremap-dont-allow-mremap_dontunmap-on-special_mappings-and-aio > +++ a/fs/aio.c > @@ -324,13 +324,16 @@ static void aio_free_ring(struct kioctx > } > } > > -static int aio_ring_mremap(struct vm_area_struct *vma) > +static int aio_ring_mremap(struct vm_area_struct *vma, unsigned long flags) > { > struct file *file = vma->vm_file; > struct mm_struct *mm = vma->vm_mm; > struct kioctx_table *table; > int i, res = -EINVAL; > > + if (flags & MREMAP_DONTUNMAP) > + return -EINVAL; > + > spin_lock(&mm->ioctx_lock); > rcu_read_lock(); > table = rcu_dereference(mm->ioctx_table); > --- a/include/linux/mm.h~mremap-dont-allow-mremap_dontunmap-on-special_mappings-and-aio > +++ a/include/linux/mm.h > @@ -558,7 +558,7 @@ struct vm_operations_struct { > void (*open)(struct vm_area_struct * area); > void (*close)(struct vm_area_struct * area); > int (*split)(struct vm_area_struct * area, unsigned long addr); > - int (*mremap)(struct vm_area_struct * area); > + int (*mremap)(struct vm_area_struct *area, unsigned long flags); > vm_fault_t (*fault)(struct vm_fault *vmf); > vm_fault_t (*huge_fault)(struct vm_fault *vmf, > enum page_entry_size pe_size); > --- a/mm/mmap.c~mremap-dont-allow-mremap_dontunmap-on-special_mappings-and-aio > +++ a/mm/mmap.c > @@ -3405,10 +3405,14 @@ static const char *special_mapping_name( > return ((struct vm_special_mapping *)vma->vm_private_data)->name; > } > > -static int special_mapping_mremap(struct vm_area_struct *new_vma) > +static int special_mapping_mremap(struct vm_area_struct *new_vma, > + unsigned long flags) > { > struct vm_special_mapping *sm = new_vma->vm_private_data; > > + if (flags & MREMAP_DONTUNMAP) > + return -EINVAL; > + > if (WARN_ON_ONCE(current->mm != new_vma->vm_mm)) > return -EFAULT; > > --- a/mm/mremap.c~mremap-dont-allow-mremap_dontunmap-on-special_mappings-and-aio > +++ a/mm/mremap.c > @@ -534,7 +534,7 @@ static unsigned long move_vma(struct vm_ > if (moved_len < old_len) { > err = -ENOMEM; > } else if (vma->vm_ops && vma->vm_ops->mremap) { > - err = vma->vm_ops->mremap(new_vma); > + err = vma->vm_ops->mremap(new_vma, flags); > } > > if (unlikely(err)) { > _
