From: Hongfu Li <lihongfu@kylinos.cn>

In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its
returned remapped address into remapped_mapping, while the BUG_ON
incorrectly checks dest_mapping instead.

If mremap() fails, dest_mapping still holds a valid pointer obtained from
the prior mmap() call, making this BUG_ON never trigger at all. Correct
the check to validate the actual mremap() return value stored in
remapped_mapping.

Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
---
 tools/testing/selftests/mm/mremap_dontunmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/mm/mremap_dontunmap.c b/tools/testing/selftests/mm/mremap_dontunmap.c
index a4f75d836733..96ba537facf7 100644
--- a/tools/testing/selftests/mm/mremap_dontunmap.c
+++ b/tools/testing/selftests/mm/mremap_dontunmap.c
@@ -313,7 +313,7 @@ static void mremap_dontunmap_partial_mapping_overwrite(void)
 	    mremap(source_mapping, 5 * page_size,
 		   5 * page_size,
 		   MREMAP_DONTUNMAP | MREMAP_MAYMOVE | MREMAP_FIXED, dest_mapping);
-	BUG_ON(dest_mapping == MAP_FAILED, "mremap");
+	BUG_ON(remapped_mapping == MAP_FAILED, "mremap");
 	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");
 
 	BUG_ON(check_region_contains_byte(source_mapping, 5 * page_size, 0) !=
-- 
2.54.0

On Fri, 17 Jul 2026 15:02:51 +0800 Hongfu Li <hongfu.li@linux.dev> wrote:

> From: Hongfu Li <lihongfu@kylinos.cn>
> 
> In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its
> returned remapped address into remapped_mapping, while the BUG_ON
> incorrectly checks dest_mapping instead.
> 
> If mremap() fails, dest_mapping still holds a valid pointer obtained from
> the prior mmap() call, making this BUG_ON never trigger at all. Correct
> the check to validate the actual mremap() return value stored in
> remapped_mapping.

Nice catch.

> 
> Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>

Reviewed-by: SJ Park <sj@kernel.org>


Thanks,
SJ

[...]

On 7/17/26 09:02, Hongfu Li wrote:
> From: Hongfu Li <lihongfu@kylinos.cn>
> 
> In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its
> returned remapped address into remapped_mapping, while the BUG_ON
> incorrectly checks dest_mapping instead.
> 
> If mremap() fails, dest_mapping still holds a valid pointer obtained from
> the prior mmap() call, making this BUG_ON never trigger at all. Correct
> the check to validate the actual mremap() return value stored in
> remapped_mapping.
> 
> Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
> ---
>  tools/testing/selftests/mm/mremap_dontunmap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/mm/mremap_dontunmap.c b/tools/testing/selftests/mm/mremap_dontunmap.c
> index a4f75d836733..96ba537facf7 100644
> --- a/tools/testing/selftests/mm/mremap_dontunmap.c
> +++ b/tools/testing/selftests/mm/mremap_dontunmap.c
> @@ -313,7 +313,7 @@ static void mremap_dontunmap_partial_mapping_overwrite(void)
>  	    mremap(source_mapping, 5 * page_size,
>  		   5 * page_size,
>  		   MREMAP_DONTUNMAP | MREMAP_MAYMOVE | MREMAP_FIXED, dest_mapping);
> -	BUG_ON(dest_mapping == MAP_FAILED, "mremap");
> +	BUG_ON(remapped_mapping == MAP_FAILED, "mremap");
>  	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");

Given that we know from a previous

	BUG_ON(dest_mapping == MAP_FAILED, "mmap");

We can just drop this line completely and rely on the

	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");

-- 
Cheers,

David

> > From: Hongfu Li <lihongfu@kylinos.cn>
> > 
> > In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its
> > returned remapped address into remapped_mapping, while the BUG_ON
> > incorrectly checks dest_mapping instead.
> > 
> > If mremap() fails, dest_mapping still holds a valid pointer obtained from
> > the prior mmap() call, making this BUG_ON never trigger at all. Correct
> > the check to validate the actual mremap() return value stored in
> > remapped_mapping.
> > 
> > Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
> > ---
> >  tools/testing/selftests/mm/mremap_dontunmap.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/tools/testing/selftests/mm/mremap_dontunmap.c b/tools/testing/selftests/mm/mremap_dontunmap.c
> > index a4f75d836733..96ba537facf7 100644
> > --- a/tools/testing/selftests/mm/mremap_dontunmap.c
> > +++ b/tools/testing/selftests/mm/mremap_dontunmap.c
> > @@ -313,7 +313,7 @@ static void mremap_dontunmap_partial_mapping_overwrite(void)
> >  	    mremap(source_mapping, 5 * page_size,
> >  		   5 * page_size,
> >  		   MREMAP_DONTUNMAP | MREMAP_MAYMOVE | MREMAP_FIXED, dest_mapping);
> > -	BUG_ON(dest_mapping == MAP_FAILED, "mremap");
> > +	BUG_ON(remapped_mapping == MAP_FAILED, "mremap");
> >  	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");
> 
> Given that we know from a previous
> 
> 	BUG_ON(dest_mapping == MAP_FAILED, "mmap");
> 
> We can just drop this line completely and rely on the
> 
> 	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");

The subsequent BUG_ON comparison will implicitly catch the MAP_FAILED
condition, so this check is redundant.

This line will be dropped in the next revision. Thanks a lot for your
review.

Best regards,
Hongfu