mm: prevent droppable mappings from being locked

Droppable mappings must not be lockable.  There is a check for VMAs with
VM_DROPPABLE set in mlock_fixup() along with checks for other types of
unlockable VMAs which ensures this when calling mlock()/mlock2().

For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.  In
apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
applied to it.  VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
When these flags are set as default in this manner they are cleared in
__mmap_complete() for new mappings that do not support mlock.  A check for
VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
mappings created with VM_LOCKED set.  To fix this and reduce that chance
of similar bugs in the future, introduce and use vma_supports_mlock().

Link: https://lkml.kernel.org/r/20260310155821.17869-1-anthony.yznaga@oracle.com
Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
Suggested-by: David Hildenbrand <david@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Tested-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Jason A. Donenfeld <jason@zx2c4.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
index 84afc3c3e2e4b18af96a876fc1368d7e7382951c..565b473fd1353b4cb81cc1d33878c5288630154a 100644 (file)
--- a/include/linux/hugetlb_inline.h
+++ b/include/linux/hugetlb_inline.h
@@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
 
 #endif
 
-static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
+static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
 {
        return is_vm_hugetlb_flags(vma->vm_flags);
 }

diff --git a/mm/internal.h b/mm/internal.h
index 4ab833b8bcdf5473f9c7da91ae0a5af1111e0a95..ebb68ad10d5c74a4964009ed11a412ee4506f8ba 100644 (file)
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -1243,6 +1243,16 @@ static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
        }
        return fpin;
 }
+
+static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
+{
+       if (vma->vm_flags & (VM_SPECIAL | VM_DROPPABLE))
+               return false;
+       if (vma_is_dax(vma) || is_vm_hugetlb_page(vma))
+               return false;
+       return vma != get_gate_vma(current->mm);
+}
+
 #else /* !CONFIG_MMU */
 static inline void unmap_mapping_folio(struct folio *folio) { }
 static inline void mlock_new_folio(struct folio *folio) { }

diff --git a/mm/mlock.c b/mm/mlock.c
index 1a92d16f36847e9f350e70ace05e3073a7c4f210..fd648138bc72e30ba4cd59ac246277d7b0bf99f7 100644 (file)
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -472,10 +472,12 @@ static int mlock_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma,
        int ret = 0;
        vm_flags_t oldflags = vma->vm_flags;
 
-       if (newflags == oldflags || (oldflags & VM_SPECIAL) ||
-           is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm) ||
-           vma_is_dax(vma) || vma_is_secretmem(vma) || (oldflags & VM_DROPPABLE))
-               /* don't set VM_LOCKED or VM_LOCKONFAULT and don't count */
+       if (newflags == oldflags || vma_is_secretmem(vma) ||
+           !vma_supports_mlock(vma))
+               /*
+                * Don't set VM_LOCKED or VM_LOCKONFAULT and don't count.
+                * For secretmem, don't allow the memory to be unlocked.
+                */
                goto out;
 
        vma = vma_modify_flags(vmi, *prev, vma, start, end, &newflags);

diff --git a/mm/vma.c b/mm/vma.c
index e95fd5a5fe5c6a9557535250cf0f5b7d3039d80b..b7055c264b5d3fbfeb0c2232ec1e3573c7248137 100644 (file)
--- a/mm/vma.c
+++ b/mm/vma.c
@@ -2589,9 +2589,7 @@ static void __mmap_complete(struct mmap_state *map, struct vm_area_struct *vma)
 
        vm_stat_account(mm, vma->vm_flags, map->pglen);
        if (vm_flags & VM_LOCKED) {
-               if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) ||
-                                       is_vm_hugetlb_page(vma) ||
-                                       vma == get_gate_vma(mm))
+               if (!vma_supports_mlock(vma))
                        vm_flags_clear(vma, VM_LOCKED_MASK);
                else
                        mm->locked_vm += map->pglen;

diff --git a/tools/testing/vma/include/stubs.h b/tools/testing/vma/include/stubs.h
index 947a3a0c2566587f3eea3809152b3807318911fe..416bb93f50053b0d36291289e667f7558eb4777e 100644 (file)
--- a/tools/testing/vma/include/stubs.h
+++ b/tools/testing/vma/include/stubs.h
@@ -426,3 +426,8 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
 }
 
 static inline void hugetlb_split(struct vm_area_struct *, unsigned long) {}
+
+static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
+{
+       return false;
+}