Re: [PATCH 1/2] mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Mon, Sep 28, 2026 at 11:45:21AM +0100, Kiryl Shutsemau wrote:
> On Sun, Sep 20, 2026 at 03:13:10PM +0100, Lorenzo Stoakes (ARM) wrote:
> > The MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap()
> > operations that keep the original VMA in place.
> >
> > Historically this has led to a lot of bugs where non-obvious interactions
> > occur between existing mremap() operations and the original VMA.
> >
> > Fix another of these - self-merge.
> >
> > Self-merge occurs when a VMA is moved in front of or behind itself and the
> > attributes of the VMA permit such a merge.
> >
> > Practically this can only happen for unfaulted anonymous VMAs due to the
> > page offset equality requirement for merge:
> >
> >                            |------------|
> >                            |            |
> >                            |            v
> >         |...........||-----------||...........|
> >         |           || unfaulted ||           |
> >         |...........||-----------||...........|
> >               ^            |
> >               |            |
> >               |------------|
> >
> > This becomes problematic if the VMA is configured by the user to
> > mlock-on-fault, i.e. the VMA_LOCKED_BIT, VMA_LOCKONFAULT_BIT VMA flags are
> > set.
> >
> > MREMAP_DONTUNMAP clears mlock flags for the source VMA and maintains them
> > for the destination VMA.
> >
> > Self-merge makes this impossible (there is only one VMA) and incorrectly
> > clears the destination VMA's mlock flags.
> >
> > This causes a leak in mm->locked_vm as clearing this flag does not
> > decrement the counter and the VMA no longer has VMA_LOCKED_BIT set so it
> > is not decremented on unmap.
> >
> > Resolve this by simply disallowing a self-merge in this case - the source
> > and destination VMAs are kept distinct and then are able to have distinct
> > mlock() flags.
> >
> > Update dontunmap_complete() to make the now-redundant self-merge check a
> > VM_WARN_ON_ONCE() instead to guard against future regressions.
> >
> > Also update the VMA userland tests to reflect the change.
> >
> > Fixes: e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")
> > Cc: <stable@vger.kernel.org>
> > Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
>
> Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

Thanks!

>
> One thing: mlock semantics of MREMAP_DONTUNMAP are not documented in the
> man pages, only in the commit that added the flag. It can be surprising
> that the source gets munlocked. I am not even sure it is the right thing
> to do.

It's unavoidable as the source no longer has anything mapped (page tables moved)
and it's not correct for it to be marked as mlock()'d in that case.

Ack on man page update, I'll add to my TODO!

>
> --
>   Kiryl Shutsemau / Kirill A. Shutemov

--
Cheers, Lorenzo