From nobody Tue Apr 7 21:49:30 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82A3C3E276D for ; Wed, 11 Mar 2026 17:26:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773249961; cv=none; b=Rw/eLk4WVsy+IzjvUWq3PiwtPe2zVZW3/Zp5VMbDV8ZJSAKUMx97KxC0lBS92v48cqnhHDD9eb1ZtYxcbZ58dtCquemDSPI/W1lQSOdsFeOKqtFFsH/85FoOaOUvYWA1pJQZ+btRIl+94EZG1wcd0lH+D+TuKWo7ppofocxEKyE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773249961; c=relaxed/simple; bh=VxzFdwK5BomklsvpZZhqobXHAFHf//CC8QYNa1lC21M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QdfRFbjCQTWs3ouDkCBJwBS8z5/75fH7VEa40/5C2J+puqURTriLMiRzVp+CPD1MsvLiIg2suCnAwUX0T4/+dbiGJ2Qpn/IaC4ncaTLu/I3FAKhUjzzyT5L3N13jFXED9igZ7ptnGGMkTAUN41TTzLCzU6IDr1x+EBQ044pY/x8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=qW//qMDT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qW//qMDT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEE2CC19424; Wed, 11 Mar 2026 17:26:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773249961; bh=VxzFdwK5BomklsvpZZhqobXHAFHf//CC8QYNa1lC21M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qW//qMDTN9l3K4RFZ4aKjbmKRIzEVbcsxU+DjhapouOY/hCn4xpJuchd3euhDk4gF 2FvEXorHzo0aLS5ruc2Q5U8dl2EfIMn3R7dGo4U/hVobzG4HDIuNRlNOYG880GL8cR aHVzw0E8Rt9LPK064RAU8+cxVjnXtiuzPB1A9nLGHicvrhCVUTNLzerw/rxhOIyQdI XOz4RmL6naN+xwarzFTeoiST9dBbehmvGNtID+wgeBjen72bQBsVE8z2cmwlkSxSvT 8uhlveZEHd7sUU2ToBjw7QcSi6+6GvGV+gFK4a3z/3w9i3M4H+5Zxq1u/NK8/jkFhs boSwzuBbrngjg== From: "Lorenzo Stoakes (Oracle)" To: Andrew Morton Cc: "Liam R . Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jann Horn , Pedro Falcato , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Jianzhou Zhao , Oscar Salvador Subject: [PATCH 2/3] mm: abstract reading sysctl_max_map_count, and READ_ONCE() Date: Wed, 11 Mar 2026 17:24:37 +0000 Message-ID: <0715259eb37cbdfde4f9e5db92a20ec7110a1ce5.1773249037.git.ljs@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Concurrent reads and writes of sysctl_max_map_count are possible, so we should READ_ONCE() and WRITE_ONCE(). The sysctl procfs logic already enforces WRITE_ONCE(), so abstract the read side with get_sysctl_max_map_count(). While we're here, also move the field to mm/internal.h and add the getter there since only mm interacts with it, there's no need for anybody else to have access. Finally, update the VMA userland tests to reflect the change. Signed-off-by: Lorenzo Stoakes (Oracle) Reviewed-by: Pedro Falcato --- include/linux/mm.h | 2 -- mm/internal.h | 6 ++++++ mm/mmap.c | 2 +- mm/mremap.c | 4 ++-- mm/nommu.c | 2 +- mm/vma.c | 6 +++--- tools/testing/vma/include/custom.h | 3 --- tools/testing/vma/include/dup.h | 9 +++++++++ tools/testing/vma/main.c | 2 ++ 9 files changed, 24 insertions(+), 12 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 4c4fd55fc823..1168374e2219 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -207,8 +207,6 @@ static inline void __mm_zero_struct_page(struct page *p= age) #define MAPCOUNT_ELF_CORE_MARGIN (5) #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN) =20 -extern int sysctl_max_map_count; - extern unsigned long sysctl_user_reserve_kbytes; extern unsigned long sysctl_admin_reserve_kbytes; =20 diff --git a/mm/internal.h b/mm/internal.h index 95b583e7e4f7..68bc509757c9 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -1848,4 +1848,10 @@ static inline int pmdp_test_and_clear_young_notify(s= truct vm_area_struct *vma, =20 #endif /* CONFIG_MMU_NOTIFIER */ =20 +extern int sysctl_max_map_count; +static inline int get_sysctl_max_map_count(void) +{ + return READ_ONCE(sysctl_max_map_count); +} + #endif /* __MM_INTERNAL_H */ diff --git a/mm/mmap.c b/mm/mmap.c index 843160946aa5..79544d893411 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -375,7 +375,7 @@ unsigned long do_mmap(struct file *file, unsigned long = addr, return -EOVERFLOW; =20 /* Too many mappings? */ - if (mm->map_count > sysctl_max_map_count) + if (mm->map_count > get_sysctl_max_map_count()) return -ENOMEM; =20 /* diff --git a/mm/mremap.c b/mm/mremap.c index e8c3021dd841..ba6c690f6c1b 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -1045,7 +1045,7 @@ static unsigned long prep_move_vma(struct vma_remap_s= truct *vrm) * which may not merge, then (if MREMAP_DONTUNMAP is not set) unmap the * source, which may split, causing a net increase of 2 mappings. */ - if (current->mm->map_count + 2 > sysctl_max_map_count) + if (current->mm->map_count + 2 > get_sysctl_max_map_count()) return -ENOMEM; =20 if (vma->vm_ops && vma->vm_ops->may_split) { @@ -1813,7 +1813,7 @@ static unsigned long check_mremap_params(struct vma_r= emap_struct *vrm) * net increased map count of 2. In move_vma() we check for headroom of * 2 additional mappings, so check early to avoid bailing out then. */ - if (current->mm->map_count + 4 > sysctl_max_map_count) + if (current->mm->map_count + 4 > get_sysctl_max_map_count()) return -ENOMEM; =20 return 0; diff --git a/mm/nommu.c b/mm/nommu.c index c3a23b082adb..ed3934bc2de4 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1317,7 +1317,7 @@ static int split_vma(struct vma_iterator *vmi, struct= vm_area_struct *vma, return -ENOMEM; =20 mm =3D vma->vm_mm; - if (mm->map_count >=3D sysctl_max_map_count) + if (mm->map_count >=3D get_sysctl_max_map_count()) return -ENOMEM; =20 region =3D kmem_cache_alloc(vm_region_jar, GFP_KERNEL); diff --git a/mm/vma.c b/mm/vma.c index be64f781a3aa..07882d2040b1 100644 --- a/mm/vma.c +++ b/mm/vma.c @@ -590,7 +590,7 @@ __split_vma(struct vma_iterator *vmi, struct vm_area_st= ruct *vma, static int split_vma(struct vma_iterator *vmi, struct vm_area_struct *vma, unsigned long addr, int new_below) { - if (vma->vm_mm->map_count >=3D sysctl_max_map_count) + if (vma->vm_mm->map_count >=3D get_sysctl_max_map_count()) return -ENOMEM; =20 return __split_vma(vmi, vma, addr, new_below); @@ -1394,7 +1394,7 @@ static int vms_gather_munmap_vmas(struct vma_munmap_s= truct *vms, * its limit temporarily, to help free resources as expected. */ if (vms->end < vms->vma->vm_end && - vms->vma->vm_mm->map_count >=3D sysctl_max_map_count) { + vms->vma->vm_mm->map_count >=3D get_sysctl_max_map_count()) { error =3D -ENOMEM; goto map_count_exceeded; } @@ -2870,7 +2870,7 @@ int do_brk_flags(struct vma_iterator *vmi, struct vm_= area_struct *vma, if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) return -ENOMEM; =20 - if (mm->map_count > sysctl_max_map_count) + if (mm->map_count > get_sysctl_max_map_count()) return -ENOMEM; =20 if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT)) diff --git a/tools/testing/vma/include/custom.h b/tools/testing/vma/include= /custom.h index 833ff4d7f799..adabd732ad3a 100644 --- a/tools/testing/vma/include/custom.h +++ b/tools/testing/vma/include/custom.h @@ -21,9 +21,6 @@ extern unsigned long dac_mmap_min_addr; #define VM_BUG_ON(_expr) (BUG_ON(_expr)) #define VM_BUG_ON_VMA(_expr, _vma) (BUG_ON(_expr)) =20 -/* We hardcode this for now. */ -#define sysctl_max_map_count 0x1000000UL - #define TASK_SIZE ((1ul << 47)-PAGE_SIZE) =20 /* diff --git a/tools/testing/vma/include/dup.h b/tools/testing/vma/include/du= p.h index 5eb313beb43d..8865ffe046d8 100644 --- a/tools/testing/vma/include/dup.h +++ b/tools/testing/vma/include/dup.h @@ -419,6 +419,9 @@ struct vma_iterator { =20 #define EMPTY_VMA_FLAGS ((vma_flags_t){ }) =20 +#define MAPCOUNT_ELF_CORE_MARGIN (5) +#define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN) + /* What action should be taken after an .mmap_prepare call is complete? */ enum mmap_action_type { MMAP_NOTHING, /* Mapping is complete, no further action. */ @@ -1342,3 +1345,9 @@ static inline void vma_set_file(struct vm_area_struct= *vma, struct file *file) swap(vma->vm_file, file); fput(file); } + +extern int sysctl_max_map_count; +static inline int get_sysctl_max_map_count(void) +{ + return READ_ONCE(sysctl_max_map_count); +} diff --git a/tools/testing/vma/main.c b/tools/testing/vma/main.c index 49b09e97a51f..18338f5d29e0 100644 --- a/tools/testing/vma/main.c +++ b/tools/testing/vma/main.c @@ -14,6 +14,8 @@ #include "tests/mmap.c" #include "tests/vma.c" =20 +int sysctl_max_map_count __read_mostly =3D DEFAULT_MAX_MAP_COUNT; + /* Helper functions which utilise static kernel functions. */ =20 struct vm_area_struct *merge_existing(struct vma_merge_struct *vmg) --=20 2.53.0