Re: [PATCH 1/2] mm/vmalloc: drop VM_DMA_COHERENT from remap_vmalloc_range_partial

["Jose A. Perez de Azpillaga" <azpijr@gmail.com>]

On 10/26/26 7:09 AM, Ye Liu wrote:
> From: Ye Liu <liuye@kylinos.cn>
> 
> No caller maps a VM_DMA_COHERENT area through this path: such areas
> come from dma_alloc_coherent() internals and are freed via vunmap(),
> never through remap_vmalloc_range[_partial](); all 13 callers pass
> vmalloc_user()/vmalloc()-backed addresses.
> 
> The flag was added in commit fe9041c245196 ("vmalloc: lift the arm
> flag for coherent mappings to common code") as a mechanical
> translation of ARM's VM_ARM_DMA_CONSISTENT. It is also unsafe to keep
> since commit 5ea8ec74c57c0 ("mm/vmalloc: free unused pages on
> vrealloc() shrink"), which frees tail pages of non-VM_USERMAP areas
> (VM_DMA_COHERENT is not in that skip-list): a shrunk-then-mapped area
> would hit vmalloc_to_page()==NULL and vm_insert_page() would
> dereference it unchecked.

this isn't quite true, is it? the dma remap helpers vmap() without
VM_MAP_PUT_PAGES, so nr_pages stays 0 and the shrink never frees
anything there.

> 
> Drop it so DMA-coherent areas can never enter the path.
> 
> Signed-off-by: Ye Liu <liuye@kylinos.cn>
> ---
>  mm/vmalloc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index db669103dc66..a888eca016a8 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -4894,7 +4894,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
>  	if (!area)
>  		return -EINVAL;
>  
> -	if (!(area->flags & (VM_USERMAP | VM_DMA_COHERENT)))
> +	if (!(area->flags & VM_USERMAP))
>  		return -EINVAL;
>  
>  	if (check_add_overflow(size, off, &end_index) ||
> 

the change itself looks fine to me.

-- 
cheers,
jose a. p-a