Skip to contentSkip to conversation

selftests/mm: Fix BUG_ON checking wrong variable in mremap_dontunmap

PATCH Applied Hongfu Li 3 participants 4 messages Jul 17 – Jul 18

Subsystems (3)
Memory management Kselftest MM misc
lore
Share & tools
lore

Hongfu Li

author
#0 lore raw

PATCH 1/1 selftests/mm: Fix BUG_ON checking wrong variable in mremap_dontunmap

From: Hongfu Li <[email protected]>

In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its returned remapped address into remapped_mapping, while the BUG_ON incorrectly checks dest_mapping instead.

If mremap() fails, dest_mapping still holds a valid pointer obtained from the prior mmap() call, making this BUG_ON never trigger at all. Correct the check to validate the actual mremap() return value stored in remapped_mapping.

Signed-off-by Hongfu Li <[email protected]>
---
 tools/testing/selftests/mm/mremap_dontunmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/mm/mremap_dontunmap.c +1 -1
index a4f75d836733..96ba537facf7 100644
@@ -313,7 +313,7 @@ static void mremap_dontunmap_partial_mapping_overwrite(void)
 	    mremap(source_mapping, 5 * page_size,
 		   5 * page_size,
 		   MREMAP_DONTUNMAP | MREMAP_MAYMOVE | MREMAP_FIXED, dest_mapping);
-	BUG_ON(dest_mapping == MAP_FAILED, "mremap");
+	BUG_ON(remapped_mapping == MAP_FAILED, "mremap");
 	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");
 
 	BUG_ON(check_region_contains_byte(source_mapping, 5 * page_size, 0) !=
Signature · 1 line
2.54.0
maintainer
#1 lore raw
Quoted 21 lines · Hongfu Li

From: Hongfu Li <[email protected]>

In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its returned remapped address into remapped_mapping, while the BUG_ON incorrectly checks dest_mapping instead.

If mremap() fails, dest_mapping still holds a valid pointer obtained from the prior mmap() call, making this BUG_ON never trigger at all. Correct the check to validate the actual mremap() return value stored in remapped_mapping.

Signed-off-by Hongfu Li <[email protected]>
---
 tools/testing/selftests/mm/mremap_dontunmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/mm/mremap_dontunmap.c +0 -0
index a4f75d836733..96ba537facf7 100644

tools/testing/selftests/mm/mremap_dontunmap.c static void mremap_dontunmap_partial_mapping_overwrite(void) · line 317

Quoted 6 lines
tools/testing/selftests/mm/mremap_dontunmap.c +1 -1
@@ -313,7 +313,7 @@ static void mremap_dontunmap_partial_mapping_overwrite(void)
 	    mremap(source_mapping, 5 * page_size,
 		   5 * page_size,
 		   MREMAP_DONTUNMAP | MREMAP_MAYMOVE | MREMAP_FIXED, dest_mapping);
-	BUG_ON(dest_mapping == MAP_FAILED, "mremap");
+	BUG_ON(remapped_mapping == MAP_FAILED, "mremap");
 	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");

Given that we know from a previous

	BUG_ON(dest_mapping == MAP_FAILED, "mmap");

We can just drop this line completely and rely on the

	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");
Signature · 3 lines
Cheers,

David
author
#2 lore raw
Quoted 30 lines
Quoted 21 lines

From: Hongfu Li <[email protected]>

In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its returned remapped address into remapped_mapping, while the BUG_ON incorrectly checks dest_mapping instead.

If mremap() fails, dest_mapping still holds a valid pointer obtained from the prior mmap() call, making this BUG_ON never trigger at all. Correct the check to validate the actual mremap() return value stored in remapped_mapping.

Signed-off-by Hongfu Li <[email protected]>
---
 tools/testing/selftests/mm/mremap_dontunmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/mm/mremap_dontunmap.c +0 -0
index a4f75d836733..96ba537facf7 100644

tools/testing/selftests/mm/mremap_dontunmap.c static void mremap_dontunmap_partial_mapping_overwrite(void) · line 317

Quoted 6 lines
tools/testing/selftests/mm/mremap_dontunmap.c +1 -1
@@ -313,7 +313,7 @@ static void mremap_dontunmap_partial_mapping_overwrite(void)
 	    mremap(source_mapping, 5 * page_size,
 		   5 * page_size,
 		   MREMAP_DONTUNMAP | MREMAP_MAYMOVE | MREMAP_FIXED, dest_mapping);
-	BUG_ON(dest_mapping == MAP_FAILED, "mremap");
+	BUG_ON(remapped_mapping == MAP_FAILED, "mremap");
 	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");

Given that we know from a previous

Quoted 5 lines
	BUG_ON(dest_mapping == MAP_FAILED, "mmap");

We can just drop this line completely and rely on the

	BUG_ON(dest_mapping != remapped_mapping, "expected to remap to dest_mapping");

The subsequent BUG_ON comparison will implicitly catch the MAP_FAILED condition, so this check is redundant.

This line will be dropped in the next revision. Thanks a lot for your review.

Best regards,
Hongfu

Reviewed-by on v1 1/1
#3 lore raw
In reply to Hongfu Li
Quoted 10 lines · On Fri, 17 Jul 2026 15:02:51 +0800 Hongfu Li <[email protected]> wrote:

From: Hongfu Li <[email protected]>

In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its returned remapped address into remapped_mapping, while the BUG_ON incorrectly checks dest_mapping instead.

If mremap() fails, dest_mapping still holds a valid pointer obtained from the prior mmap() call, making this BUG_ON never trigger at all. Correct the check to validate the actual mremap() return value stored in remapped_mapping.

Nice catch.

Quoted 2 lines
Signed-off-by Hongfu Li <[email protected]>
Reviewed-by SJ Park <[email protected]>

Thanks,
SJ

[...]