From nobody Sun May 24 20:33:11 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85457383323 for ; Thu, 21 May 2026 16:22:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779380526; cv=none; b=fdmYSLqbrVicbuzoSowcN3KGaQHPwEzoL3O1L7u/wh/gRjpj1M+HC1DrSzM929rnlOLIduGtIufJnun4ea8xuswhu+uyNkoFVfR8lAcCmAn/2zTgsjsGzxUwZmpzAS/3mo0qbu9LUzqsE0adqDXpxXHUpmWOvx+wbRr6SHWufvY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779380526; c=relaxed/simple; bh=WK0l9+vzVVCbYlX7zepos3VbftKtGp22qSUGWAJi0Pw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Db9I3GJwyi43k3sfc8yzh1bhRgeKFZiaLOkaubqrvcUciaVx3AxaMkYhNAxMDzSPpesmm49i8XBE3EwpRAcqiRLRL5c17q3fN/CflEMKZJm5N1AfId9aJQimLTd1hDhbWz08+wVJhagc+qBYw7dy4kpCymYpP39I2eLM3Tj9rP8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nqjZAVh3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nqjZAVh3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B27081F000E9; Thu, 21 May 2026 16:22:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779380525; bh=dcfNGGjgx+NSZAuu90jBs3Qr8P55dHAXd7ftObLSo1w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nqjZAVh3PyIoAeEkzPIV1rUZ6koUPIajoobZVez4REJMBrP5PUMiCT4NA+vjfKxzC 5VXS/ogr8g8x8JzO1bGf6z3gEI4LpMM6VQMB7WzQRDK2EheYvrUDs9KSP51FxqiGw7 KcjFZl6X+Tl2CHi9HHx0JMxuXTej35em5oq4Xm9SZRwtg2eJ0Y7gCY0buuxkjbWhg5 7eoPyLV/T1+hQJEwZErnyU9Qyo+fbXbrbTLjRAPD9R3mNV7nul71qXBUj+lqnTg4Qt MzwY+EqvemEENsHd3SueAxjspmnc0uzm4mtOyY6NBla/uvDuoYKOYRrYgPEGo3DXnX uvq30KXMIO8yw== From: Lorenzo Stoakes To: Andrew Morton Cc: Arnd Bergmann , Greg Kroah-Hartman , David Hildenbrand , "Liam R . Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jann Horn , Pedro Falcato , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 1/3] drivers/char/mem: eliminate unnecessary use of success_hook Date: Thu, 21 May 2026 17:21:52 +0100 Message-ID: <68bd08d2c7432f94b87f9e40f379336860a9997c.1779379804.git.ljs@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Introduce vma_desc_set_anonymous() and invoke it from mmap_zero_prepare() in order to eliminate the use of the mmap_action->success_hook. Note that file-backed VMAs default to vma->vm_ops =3D=3D dummy_vm_ops, so i= f an mmap or mmap_prepare hook does not set desc->vm_ops, the VMA will remain file-backed. We also update set_vma_user_defined_fields() to make clear that we are either setting vma->vm_ops to what is provided by the driver (or defaulting to dummy_vm_ops if not set), or setting the VMA anonymous. This lays the groundwork for removing the success hook, which was provided as a workaround for drivers (mostly, hugetlb) that still absolutely seemed to rely upon having access to a VMA pointer. However, for the transition to be useful, we really must eliminate this and make no exceptions, otherwise drivers can simply work around it. Signed-off-by: Lorenzo Stoakes --- drivers/char/mem.c | 17 +++++------------ include/linux/mm.h | 5 +++++ mm/vma.c | 2 ++ 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 5fd421e48c04..a4297eb39887 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -504,17 +504,6 @@ static ssize_t read_zero(struct file *file, char __use= r *buf, return cleared; } =20 -static int mmap_zero_private_success(const struct vm_area_struct *vma) -{ - /* - * This is a highly unique situation where we mark a MAP_PRIVATE mapping - * of /dev/zero anonymous, despite it not being. - */ - vma_set_anonymous((struct vm_area_struct *)vma); - - return 0; -} - static int mmap_zero_prepare(struct vm_area_desc *desc) { #ifndef CONFIG_MMU @@ -523,7 +512,11 @@ static int mmap_zero_prepare(struct vm_area_desc *desc) if (vma_desc_test(desc, VMA_SHARED_BIT)) return shmem_zero_setup_desc(desc); =20 - desc->action.success_hook =3D mmap_zero_private_success; + /* + * This is a highly unique situation where we mark a MAP_PRIVATE mapping + * of /dev/zero anonymous, despite it not being. + */ + vma_desc_set_anonymous(desc); return 0; } =20 diff --git a/include/linux/mm.h b/include/linux/mm.h index 9cedc5e75aa9..2138c86403f5 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1489,6 +1489,11 @@ static inline void vma_set_anonymous(struct vm_area_= struct *vma) vma->vm_ops =3D NULL; } =20 +static inline void vma_desc_set_anonymous(struct vm_area_desc *desc) +{ + desc->vm_ops =3D NULL; +} + static inline bool vma_is_anonymous(struct vm_area_struct *vma) { return !vma->vm_ops; diff --git a/mm/vma.c b/mm/vma.c index d90791b00a7b..07486390c692 100644 --- a/mm/vma.c +++ b/mm/vma.c @@ -2697,6 +2697,8 @@ static void set_vma_user_defined_fields(struct vm_are= a_struct *vma, { if (map->vm_ops) vma->vm_ops =3D map->vm_ops; + else /* Only /dev/zero should do this. */ + vma_set_anonymous(vma); vma->vm_private_data =3D map->vm_private_data; } =20 --=20 2.54.0 From nobody Sun May 24 20:33:11 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAB513839A0 for ; Thu, 21 May 2026 16:22:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779380528; cv=none; b=WtW2IGTNsHgha0ZlTKlmJtkmogG3xUlzjlpjHipbcatCyOanPfBcgey1Lvzah75clzUuBwXyX0Hm6Yvho4G+0+WkyYIreo3TXiFji+X8zi+v3rzoRtZf9yX5Ighkez0xxxdGUja3ggjej5u8FyzwX/n2WTNmNGUoIjZ5A7YjUWM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779380528; c=relaxed/simple; bh=Hd8PpWWVRciJf9GqXEtCy1Hv49PKhz7O8e3vD9mIWz4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BnVeYvZMHeJuB2ayGpnxB0/+IXs3m5i6YrQd5bUNTJGNvChtwSDz66KcD84A46MGsc+ufxa3dx5crS4u4t4bopFlJ+EIHq7QRAcAIzlUN0y33F8bjcqDwD6xIoQM8gUBfj9QEYdPQNR3MCSJelwGjQsLcDttYOCi8iJsegMpia8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d/l53IBf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d/l53IBf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 059951F00A3B; Thu, 21 May 2026 16:22:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779380527; bh=vijgKaU0lPNHdbdrYG3yt4b6w/oPC8D35ILFYzM+gXA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=d/l53IBfQcd2seHBXKgpwkQaIxIQvK5L+KxBbNiQcTdAS1o2SxqEpiVaaKbTUNLhb rDQPADYmh5cOUHkLPD1TfK5YIpPPkAtNiPgq3GBkhXsDZ2q9IRNCgJ3d+Aj0dOZ2Mv RYWrL/BBczayfUQd4P0XeDYrXgLOB+p7yu+P7mX3XpaCHmaGTpZNq6MM6/DCjlG1th 6sh47ECU/wMJPH7KL54zr1QAl4IjqGNlqr0rPgcxhXyKwPFicdLg9HCdqg2utaNitZ HDzQCRvraMVB29FWjQPH1bpYuPOKAitRLzlae/dfRsvfMl5kfFugjoXnOzCnuvZKLW zQ1V6rxoUvesA== From: Lorenzo Stoakes To: Andrew Morton Cc: Arnd Bergmann , Greg Kroah-Hartman , David Hildenbrand , "Liam R . Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jann Horn , Pedro Falcato , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 2/3] mm/vma: remove mmap_action->success_hook Date: Thu, 21 May 2026 17:21:53 +0100 Message-ID: <24b5ba4470961abd870d5fe7d180d3e295b6d9af.1779379804.git.ljs@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This hook was introduced to work around code that seemed to absolutely require access to a VMA pointer upon mmap(). However, providing this hook leaves a backdoor to drivers getting access to the very thing mmap_prepare eliminates - a pointer to the VMA. Let's solve this contradiction by removing it. The key intended user was hugetlb, however it seems that the best course now is to avoid allowing all drivers the ability to work around mmap_prepare, and find a different solution there. Signed-off-by: Lorenzo Stoakes --- include/linux/mm_types.h | 10 ---------- mm/util.c | 2 -- tools/testing/vma/include/dup.h | 10 ---------- 3 files changed, 22 deletions(-) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index a308e2c23b82..945c0a5386d6 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -843,16 +843,6 @@ struct mmap_action { }; enum mmap_action_type type; =20 - /* - * If specified, this hook is invoked after the selected action has been - * successfully completed. Note that the VMA write lock still held. - * - * The absolute minimum ought to be done here. - * - * Returns 0 on success, or an error code. - */ - int (*success_hook)(const struct vm_area_struct *vma); - /* * If specified, this hook is invoked when an error occurred when * attempting the selected action. diff --git a/mm/util.c b/mm/util.c index 3cc949a0b7ed..1555aa1487b8 100644 --- a/mm/util.c +++ b/mm/util.c @@ -1396,8 +1396,6 @@ static int mmap_action_finish(struct vm_area_struct *= vma, =20 if (!err) err =3D call_vma_mapped(vma); - if (!err && action->success_hook) - err =3D action->success_hook(vma); =20 /* do_munmap() might take rmap lock, so release if held. */ maybe_rmap_unlock_action(vma, action); diff --git a/tools/testing/vma/include/dup.h b/tools/testing/vma/include/du= p.h index 9e0dfd3a85b0..bf67a80a8332 100644 --- a/tools/testing/vma/include/dup.h +++ b/tools/testing/vma/include/dup.h @@ -482,16 +482,6 @@ struct mmap_action { }; enum mmap_action_type type; =20 - /* - * If specified, this hook is invoked after the selected action has been - * successfully completed. Note that the VMA write lock still held. - * - * The absolute minimum ought to be done here. - * - * Returns 0 on success, or an error code. - */ - int (*success_hook)(const struct vm_area_struct *vma); - /* * If specified, this hook is invoked when an error occurred when * attempting the selection action. --=20 2.54.0 From nobody Sun May 24 20:33:11 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A6D237C0FF for ; Thu, 21 May 2026 16:22:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779380531; cv=none; b=gWmhw9aIKNVeH8OGnKjrHM++0wS35ed3zltCjRGsabeVpItzfapJH2lJLLwSN7T0tUpLaJFwD+A57Ol1L5ipIqizmmqhhlfrLRyF/OciEobx3X6NQKR1boG8oKxJs4A/4ftwVHLhMZwTpHI5pe5u6G2fMCinY6Ak/C4n3rlJa4g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779380531; c=relaxed/simple; bh=h3VasNqiyHqk+3FpjQDruY6Ah/WIpdY6y4efkvwS7E0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eBbqGv1B49u7RRJwq3ZPbVQFprsqVZmd3oMOft7vUid1x7DoaQ6LKTaG1Wt/3fUtoRBKVr3RcAeJVJxG3pPGtRh9u9FeTv2EzA8vBF3qBZ+HiI4OrhMidQYM/f6pMhfH3QV6Ul82xQeAoyuybgninpLTZkY2sq283zS11soH7y8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HVNb/v0B; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HVNb/v0B" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5559C1F000E9; Thu, 21 May 2026 16:22:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779380529; bh=atLo39KUHSbdrUnGByF6jC4S9Ytfud1UYa6uCnPklXc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HVNb/v0B7xQNW4EcbSe1zWM13aDZe+C3XtSDg6ukc+rD5Va8iUNrtk1d4xuScUmgt TGAbAHNTc1mAOGK2DxkiUHP32LcZpKvl4Zme2sbIfz949DEgvYrOrNCxv2B6Hh6feN 1dRyweyrwhBrZv6mF7z/ABqxobmLrAhWY5TyKIYJXyJDkRhA29uragL6PK8/oL2mTg c39RAl6l7UkkbKcG1PZ8Csa4V8VJMi4CVV6tVEEfCWKHSPO5Je07+1Dz4kwoLbYzZS Pk3h3uspW8Oz24BRpnF8eYN9iGGY/b0N37xVcen8n/zwoEDO2hUAvkPaxZhtBKO329 YxgFhZNjrjubg== From: Lorenzo Stoakes To: Andrew Morton Cc: Arnd Bergmann , Greg Kroah-Hartman , David Hildenbrand , "Liam R . Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jann Horn , Pedro Falcato , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 3/3] mm/vma: eliminate mmap_action->error_hook, introduce error_filter Date: Thu, 21 May 2026 17:21:54 +0100 Message-ID: X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Rather than providing a hook, simplify things by providing the ability to filter errors. This allows us to more carefully validate the value provided and thus ensure only a valid error code is specified, and simplifies the interface. This way, we eliminate all hooks but mmap_prepare and allow only mmap actions to be specified (which core mm controls). This significantly improves robustness and eliminates any unnecessary code duplication in driver mmap hooks. We also update the /dev/mem logic (the only user) to use mmap_action->error_filter instead. Signed-off-by: Lorenzo Stoakes --- drivers/char/mem.c | 8 +------- include/linux/mm_types.h | 9 +++------ mm/util.c | 29 +++++++++++++++++++++-------- tools/testing/vma/include/dup.h | 9 +++------ 4 files changed, 28 insertions(+), 27 deletions(-) diff --git a/drivers/char/mem.c b/drivers/char/mem.c index a4297eb39887..11639d988e47 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -322,11 +322,6 @@ static const struct vm_operations_struct mmap_mem_ops = =3D { #endif }; =20 -static int mmap_filter_error(int err) -{ - return -EAGAIN; -} - static int mmap_mem_prepare(struct vm_area_desc *desc) { struct file *file =3D desc->file; @@ -362,8 +357,7 @@ static int mmap_mem_prepare(struct vm_area_desc *desc) =20 /* Remap-pfn-range will mark the range with the I/O flag. */ mmap_action_remap_full(desc, desc->pgoff); - /* We filter remap errors to -EAGAIN. */ - desc->action.error_hook =3D mmap_filter_error; + desc->action.error_filter =3D -EAGAIN; =20 return 0; } diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 945c0a5386d6..8d1fb85e7684 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -844,13 +844,10 @@ struct mmap_action { enum mmap_action_type type; =20 /* - * If specified, this hook is invoked when an error occurred when - * attempting the selected action. - * - * The hook can return an error code in order to filter the error, but - * it is not valid to clear the error here. + * If non-zero, filter errors that arise from mmap actions such that we + * return error_filter instead. Only valid error codes may be specified. */ - int (*error_hook)(int err); + int error_filter; =20 /* * This should be set in rare instances where the operation required diff --git a/mm/util.c b/mm/util.c index 1555aa1487b8..939ed0b0bb5d 100644 --- a/mm/util.c +++ b/mm/util.c @@ -1413,16 +1413,22 @@ static int mmap_action_finish(struct vm_area_struct= *vma, */ len =3D vma_pages(vma) << PAGE_SHIFT; do_munmap(current->mm, vma->vm_start, len, NULL); - if (action->error_hook) { - /* We may want to filter the error. */ - err =3D action->error_hook(err); - /* The caller should not clear the error. */ - VM_WARN_ON_ONCE(!err); - } - return err; + + return action->error_filter ?: err; } =20 #ifdef CONFIG_MMU + +static int check_mmap_action(struct mmap_action *action) +{ + const unsigned long filter =3D action->error_filter; + + if (WARN_ON_ONCE(filter && !IS_ERR_VALUE(filter))) + return -EINVAL; + + return 0; +} + /** * mmap_action_prepare - Perform preparatory setup for an VMA descriptor * action which need to be performed. @@ -1432,7 +1438,14 @@ static int mmap_action_finish(struct vm_area_struct = *vma, */ int mmap_action_prepare(struct vm_area_desc *desc) { - switch (desc->action.type) { + struct mmap_action *action =3D &desc->action; + int err; + + err =3D check_mmap_action(action); + if (err) + return err; + + switch (action->type) { case MMAP_NOTHING: return 0; case MMAP_REMAP_PFN: diff --git a/tools/testing/vma/include/dup.h b/tools/testing/vma/include/du= p.h index bf67a80a8332..4f7dd92075a3 100644 --- a/tools/testing/vma/include/dup.h +++ b/tools/testing/vma/include/dup.h @@ -483,13 +483,10 @@ struct mmap_action { enum mmap_action_type type; =20 /* - * If specified, this hook is invoked when an error occurred when - * attempting the selection action. - * - * The hook can return an error code in order to filter the error, but - * it is not valid to clear the error here. + * If non-zero, filter errors that arise from mmap actions such that we + * return error_filter instead. Only valid error codes may be specified. */ - int (*error_hook)(int err); + int error_filter; =20 /* * This should be set in rare instances where the operation required --=20 2.54.0