tree: https://android.googlesource.com/kernel/common android13-5.15 head: 2c37ba03094d66f3dcb478ef7aa2aa9f737089f7 commit: c7c68b81e19379204a80515cf1b5c444b0128ba0 [2/9] Revert "ANDROID: mm: fix up new call to vma_merge()" config: i386-tinyconfig (https://download.01.org/0day-ci/archive/20220119/202201191342.IuLE52KL-lk...) compiler: gcc-9 (Debian 9.3.0-22) 9.3.0 reproduce (this is a W=1 build): git remote add android-common https://android.googlesource.com/kernel/common git fetch --no-tags android-common android13-5.15 git checkout c7c68b81e19379204a80515cf1b5c444b0128ba0 # save the config file to linux build tree mkdir build_dir make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; Note: the android-common/android13-5.15 HEAD 2c37ba03094d66f3dcb478ef7aa2aa9f737089f7 builds fine. It only hurts bisectability. All errors (new ones prefixed by >>): mm/mmap.c: In function 'mmap_region': 1815 | merge = vma_merge(mm, prev, vma->vm_start, vma->vm_end, vma->vm_flags, | ^~~~~~~~~ mm/mmap.c:1163:24: note: declared here 1163 | struct vm_area_struct *vma_merge(struct mm_struct *mm, | ^~~~~~~~~ vim +/vma_merge +1815 mm/mmap.c fc8744adc870a8d Linus Torvalds 2009-01-31 1724 0165ab443556bdf Miklos Szeredi 2007-07-15 1725 unsigned long mmap_region(struct file *file, unsigned long addr, 897ab3e0c49e24b Mike Rapoport 2017-02-24 1726 unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, 897ab3e0c49e24b Mike Rapoport 2017-02-24 1727 struct list_head *uf) 0165ab443556bdf Miklos Szeredi 2007-07-15 1728 { 0165ab443556bdf Miklos Szeredi 2007-07-15 1729 struct mm_struct *mm = current->mm; d70cec8983241a6 Miaohe Lin 2020-08-06 1730 struct vm_area_struct *vma, *prev, *merge; 0165ab443556bdf Miklos Szeredi 2007-07-15 1731 int error; 0165ab443556bdf Miklos Szeredi 2007-07-15 1732 struct rb_node **rb_link, *rb_parent; 0165ab443556bdf Miklos Szeredi 2007-07-15 1733 unsigned long charged = 0; 0165ab443556bdf Miklos Szeredi 2007-07-15 1734 e8420a8ece80b3f Cyril Hrubis 2013-04-29 1735 /* Check against address space limit. */ 84638335900f199 Konstantin Khlebnikov 2016-01-14 1736 if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) { e8420a8ece80b3f Cyril Hrubis 2013-04-29 1737 unsigned long nr_pages; e8420a8ece80b3f Cyril Hrubis 2013-04-29 1738 e8420a8ece80b3f Cyril Hrubis 2013-04-29 1739 /* e8420a8ece80b3f Cyril Hrubis 2013-04-29 1740 * MAP_FIXED may remove pages of mappings that intersects with e8420a8ece80b3f Cyril Hrubis 2013-04-29 1741 * requested mapping. Account for the pages it would unmap. e8420a8ece80b3f Cyril Hrubis 2013-04-29 1742 */ e8420a8ece80b3f Cyril Hrubis 2013-04-29 1743 nr_pages = count_vma_pages_range(mm, addr, addr + len); e8420a8ece80b3f Cyril Hrubis 2013-04-29 1744 84638335900f199 Konstantin Khlebnikov 2016-01-14 1745 if (!may_expand_vm(mm, vm_flags, 84638335900f199 Konstantin Khlebnikov 2016-01-14 1746 (len >> PAGE_SHIFT) - nr_pages)) e8420a8ece80b3f Cyril Hrubis 2013-04-29 1747 return -ENOMEM; e8420a8ece80b3f Cyril Hrubis 2013-04-29 1748 } e8420a8ece80b3f Cyril Hrubis 2013-04-29 1749 fb8090b699c3e14 Liam R. Howlett 2020-10-17 1750 /* Clear old maps, set up prev, rb_link, rb_parent, and uf */ fb8090b699c3e14 Liam R. Howlett 2020-10-17 1751 if (munmap_vma_range(mm, addr, len, &prev, &rb_link, &rb_parent, uf)) ^1da177e4c3f415 Linus Torvalds 2005-04-16 1752 return -ENOMEM; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1753 /* ^1da177e4c3f415 Linus Torvalds 2005-04-16 1754 * Private writable mapping: check memory availability ^1da177e4c3f415 Linus Torvalds 2005-04-16 1755 */ 5a6fe1259506760 Mel Gorman 2009-02-10 1756 if (accountable_mapping(file, vm_flags)) { ^1da177e4c3f415 Linus Torvalds 2005-04-16 1757 charged = len >> PAGE_SHIFT; 191c542442fdf53 Al Viro 2012-02-13 1758 if (security_vm_enough_memory_mm(mm, charged)) ^1da177e4c3f415 Linus Torvalds 2005-04-16 1759 return -ENOMEM; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1760 vm_flags |= VM_ACCOUNT; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1761 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 1762 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1763 /* de33c8db5910cda Linus Torvalds 2009-01-29 1764 * Can we just expand an old mapping? ^1da177e4c3f415 Linus Torvalds 2005-04-16 1765 */ 19a809afe2fe089 Andrea Arcangeli 2015-09-04 1766 vma = vma_merge(mm, prev, addr, addr + len, vm_flags, 60500a42286de35 Colin Cross 2015-10-27 1767 NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX, NULL); ba470de43188cdb Rik van Riel 2008-10-18 1768 if (vma) ^1da177e4c3f415 Linus Torvalds 2005-04-16 1769 goto out; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1770 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1771 /* ^1da177e4c3f415 Linus Torvalds 2005-04-16 1772 * Determine the object being mapped and call the appropriate ^1da177e4c3f415 Linus Torvalds 2005-04-16 1773 * specific mapper. the address has already been validated, but ^1da177e4c3f415 Linus Torvalds 2005-04-16 1774 * not unmapped, but the maps are removed from the list. ^1da177e4c3f415 Linus Torvalds 2005-04-16 1775 */ 490fc053865c9cc Linus Torvalds 2018-07-21 1776 vma = vm_area_alloc(mm); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1777 if (!vma) { ^1da177e4c3f415 Linus Torvalds 2005-04-16 1778 error = -ENOMEM; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1779 goto unacct_error; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1780 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 1781 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1782 vma->vm_start = addr; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1783 vma->vm_end = addr + len; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1784 vma->vm_flags = vm_flags; 3ed75eb8f1cd895 Coly Li 2007-10-18 1785 vma->vm_page_prot = vm_get_page_prot(vm_flags); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1786 vma->vm_pgoff = pgoff; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1787 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1788 if (file) { 4bb5f5d9395bc11 David Herrmann 2014-08-08 1789 if (vm_flags & VM_SHARED) { 4bb5f5d9395bc11 David Herrmann 2014-08-08 1790 error = mapping_map_writable(file->f_mapping); 4bb5f5d9395bc11 David Herrmann 2014-08-08 1791 if (error) 8d0920bde5eb8ec David Hildenbrand 2021-04-22 1792 goto free_vma; 4bb5f5d9395bc11 David Herrmann 2014-08-08 1793 } 4bb5f5d9395bc11 David Herrmann 2014-08-08 1794 cb0942b81249798 Al Viro 2012-08-27 1795 vma->vm_file = get_file(file); f74ac01520c9f6d Miklos Szeredi 2017-02-20 1796 error = call_mmap(file, vma); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1797 if (error) ^1da177e4c3f415 Linus Torvalds 2005-04-16 1798 goto unmap_and_free_vma; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1799 309d08d9b3a3659 Liu Zixian 2020-12-05 1800 /* Can addr have changed?? 309d08d9b3a3659 Liu Zixian 2020-12-05 1801 * 309d08d9b3a3659 Liu Zixian 2020-12-05 1802 * Answer: Yes, several device drivers can do it in their 309d08d9b3a3659 Liu Zixian 2020-12-05 1803 * f_op->mmap method. -DaveM 309d08d9b3a3659 Liu Zixian 2020-12-05 1804 * Bug: If addr is changed, prev, rb_link, rb_parent should 309d08d9b3a3659 Liu Zixian 2020-12-05 1805 * be updated for vma_link() 309d08d9b3a3659 Liu Zixian 2020-12-05 1806 */ 309d08d9b3a3659 Liu Zixian 2020-12-05 1807 WARN_ON_ONCE(addr != vma->vm_start); 309d08d9b3a3659 Liu Zixian 2020-12-05 1808 309d08d9b3a3659 Liu Zixian 2020-12-05 1809 addr = vma->vm_start; 309d08d9b3a3659 Liu Zixian 2020-12-05 1810 d70cec8983241a6 Miaohe Lin 2020-08-06 1811 /* If vm_flags changed after call_mmap(), we should try merge vma again d70cec8983241a6 Miaohe Lin 2020-08-06 1812 * as we may succeed this time. d70cec8983241a6 Miaohe Lin 2020-08-06 1813 */ d70cec8983241a6 Miaohe Lin 2020-08-06 1814 if (unlikely(vm_flags != vma->vm_flags && prev)) { d70cec8983241a6 Miaohe Lin 2020-08-06 @1815 merge = vma_merge(mm, prev, vma->vm_start, vma->vm_end, vma->vm_flags, c7c68b81e193792 Suren Baghdasaryan 2021-12-28 1816 NULL, vma->vm_file, vma->vm_pgoff, NULL, NULL_VM_UFFD_CTX); d70cec8983241a6 Miaohe Lin 2020-08-06 1817 if (merge) { bc4fe4cdd602b3b Miaohe Lin 2020-10-10 1818 /* ->mmap() can change vma->vm_file and fput the original file. So bc4fe4cdd602b3b Miaohe Lin 2020-10-10 1819 * fput the vma->vm_file here or we would add an extra fput for file bc4fe4cdd602b3b Miaohe Lin 2020-10-10 1820 * and cause general protection fault ultimately. bc4fe4cdd602b3b Miaohe Lin 2020-10-10 1821 */ bc4fe4cdd602b3b Miaohe Lin 2020-10-10 1822 fput(vma->vm_file); d70cec8983241a6 Miaohe Lin 2020-08-06 1823 vm_area_free(vma); d70cec8983241a6 Miaohe Lin 2020-08-06 1824 vma = merge; 309d08d9b3a3659 Liu Zixian 2020-12-05 1825 /* Update vm_flags to pick up the change. */ d70cec8983241a6 Miaohe Lin 2020-08-06 1826 vm_flags = vma->vm_flags; d70cec8983241a6 Miaohe Lin 2020-08-06 1827 goto unmap_writable; d70cec8983241a6 Miaohe Lin 2020-08-06 1828 } d70cec8983241a6 Miaohe Lin 2020-08-06 1829 } d70cec8983241a6 Miaohe Lin 2020-08-06 1830 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1831 vm_flags = vma->vm_flags; f8dbf0a7a4c5d98 Huang Shijie 2009-09-21 1832 } else if (vm_flags & VM_SHARED) { f8dbf0a7a4c5d98 Huang Shijie 2009-09-21 1833 error = shmem_zero_setup(vma); f8dbf0a7a4c5d98 Huang Shijie 2009-09-21 1834 if (error) f8dbf0a7a4c5d98 Huang Shijie 2009-09-21 1835 goto free_vma; bfd40eaff5abb9f Kirill A. Shutemov 2018-07-26 1836 } else { bfd40eaff5abb9f Kirill A. Shutemov 2018-07-26 1837 vma_set_anonymous(vma); f8dbf0a7a4c5d98 Huang Shijie 2009-09-21 1838 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 1839 c462ac288f2c97e Catalin Marinas 2019-11-25 1840 /* Allow architectures to sanity-check the vm_flags */ c462ac288f2c97e Catalin Marinas 2019-11-25 1841 if (!arch_validate_flags(vma->vm_flags)) { c462ac288f2c97e Catalin Marinas 2019-11-25 1842 error = -EINVAL; c462ac288f2c97e Catalin Marinas 2019-11-25 1843 if (file) c462ac288f2c97e Catalin Marinas 2019-11-25 1844 goto unmap_and_free_vma; c462ac288f2c97e Catalin Marinas 2019-11-25 1845 else c462ac288f2c97e Catalin Marinas 2019-11-25 1846 goto free_vma; c462ac288f2c97e Catalin Marinas 2019-11-25 1847 } c462ac288f2c97e Catalin Marinas 2019-11-25 1848 4d3d5b41a72b525 Oleg Nesterov 2008-04-28 1849 vma_link(mm, vma, prev, rb_link, rb_parent); 4d3d5b41a72b525 Oleg Nesterov 2008-04-28 1850 /* Once vma denies write, undo our temporary denial count */ d70cec8983241a6 Miaohe Lin 2020-08-06 1851 unmap_writable: 8d0920bde5eb8ec David Hildenbrand 2021-04-22 1852 if (file && vm_flags & VM_SHARED) 4bb5f5d9395bc11 David Herrmann 2014-08-08 1853 mapping_unmap_writable(file->f_mapping); e86867720e61777 Oleg Nesterov 2013-09-11 1854 file = vma->vm_file; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1855 out: cdd6c482c9ff9c5 Ingo Molnar 2009-09-21 1856 perf_event_mmap(vma); 0a4a93919bdc5ce Peter Zijlstra 2009-03-30 1857 84638335900f199 Konstantin Khlebnikov 2016-01-14 1858 vm_stat_account(mm, vm_flags, len >> PAGE_SHIFT); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1859 if (vm_flags & VM_LOCKED) { e1fb4a0864958fa Dave Jiang 2018-08-17 1860 if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) || e1fb4a0864958fa Dave Jiang 2018-08-17 1861 is_vm_hugetlb_page(vma) || e1fb4a0864958fa Dave Jiang 2018-08-17 1862 vma == get_gate_vma(current->mm)) de60f5f10c58d4f Eric B Munson 2015-11-05 1863 vma->vm_flags &= VM_LOCKED_CLEAR_MASK; e1fb4a0864958fa Dave Jiang 2018-08-17 1864 else e1fb4a0864958fa Dave Jiang 2018-08-17 1865 mm->locked_vm += (len >> PAGE_SHIFT); bebeb3d68b24bb4 Michel Lespinasse 2013-02-22 1866 } 2b144498350860b Srikar Dronamraju 2012-02-09 1867 c7a3a88c938fbe3 Oleg Nesterov 2012-08-19 1868 if (file) c7a3a88c938fbe3 Oleg Nesterov 2012-08-19 1869 uprobe_mmap(vma); 2b144498350860b Srikar Dronamraju 2012-02-09 1870 d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1871 /* d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1872 * New (or expanded) vma always get soft dirty status. d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1873 * Otherwise user-space soft-dirty page tracker won't d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1874 * be able to distinguish situation when vma area unmapped, d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1875 * then new mapped in-place (which must be aimed as d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1876 * a completely new data area). d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1877 */ d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1878 vma->vm_flags |= VM_SOFTDIRTY; d9104d1ca966249 Cyrill Gorcunov 2013-09-11 1879 64e455079e1bd77 Peter Feiner 2014-10-13 1880 vma_set_page_prot(vma); 64e455079e1bd77 Peter Feiner 2014-10-13 1881 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1882 return addr; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1883 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1884 unmap_and_free_vma: 1527f926fd04490 Christian König 2020-10-09 1885 fput(vma->vm_file); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1886 vma->vm_file = NULL; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1887 ^1da177e4c3f415 Linus Torvalds 2005-04-16 1888 /* Undo any partial mapping done by a device driver. */ e0da382c92626ad Hugh Dickins 2005-04-19 1889 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); e0da382c92626ad Hugh Dickins 2005-04-19 1890 charged = 0; 4bb5f5d9395bc11 David Herrmann 2014-08-08 1891 if (vm_flags & VM_SHARED) 4bb5f5d9395bc11 David Herrmann 2014-08-08 1892 mapping_unmap_writable(file->f_mapping); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1893 free_vma: 3928d4f5ee37cdc Linus Torvalds 2018-07-21 1894 vm_area_free(vma); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1895 unacct_error: ^1da177e4c3f415 Linus Torvalds 2005-04-16 1896 if (charged) ^1da177e4c3f415 Linus Torvalds 2005-04-16 1897 vm_unacct_memory(charged); ^1da177e4c3f415 Linus Torvalds 2005-04-16 1898 return error; ^1da177e4c3f415 Linus Torvalds 2005-04-16 1899 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 1900 :::::: The code at line 1815 was first introduced by commit :::::: d70cec8983241a6aafadf78e2d65bbafac87ab6a mm: mmap: merge vma after call_mmap() if possible :::::: TO: Miaohe Lin <linmiaohe(a)huawei.com&gt; :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org&gt; --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org