mm-nommu-point-to-the-write-iterator-upon-split_vma.patch removed from -mm tree

The quilt patch titled
Subject: mm: nommu: point to the write iterator upon split_vma
has been removed from the -mm tree. Its filename was
mm-nommu-point-to-the-write-iterator-upon-split_vma.patch

This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Hajime Tazaki <[email protected]>
Subject: mm: nommu: point to the write iterator upon split_vma
Date: Thu, 2 Jul 2026 10:25:46 +0900

When a user invokes munmap(2) on a partial region allocated by mmap(), the kernel may split the original region if necessary and shrink it to the correct size. At the beginning of vmi_shrink_vma(), the unused part is cleared; however, an assertion is triggered if the shrink occurs after split_vma().

This commit fixes the issue by correctly configuring the pointer to the iterator at the end of split_vma().

This bug was detected using the Linux Test Project (LTP) test linked below, running on a nommu UML (User-Mode Linux) environment (via an out-of-tree extension to UML).

Here is a minimal reproducible chunk of code for this issue:

	void *addr;
	size_t pagesize = getpagesize();

	addr = mmap(NULL, pagesize * 4, PROT_READ | PROT_WRITE,
		    MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
	munmap(addr + pagesize * 1, pagesize);

This is the console output with CONFIG_DEBUG_MAPLE_TREE=y.

nommu: WARN at __mas_set_range:791 (1)
MAS: tree=0000000091c23b08 enode=0000000065057663
(ma_active)
Store Type:
node_store
[9/9] index=70af8000 last=ffffffffffffffff

     min=0 max=ffffffffffffffff sheaf=0000000000000000, request 0

depth=0, flags=0
maple_tree(0000000091c23b08) flags 307, height 1 root 0000000083394c06 0-ffffffffffffffff: node 0000000010c90bd6 depth 0 type 1 parent 0000000050e1ddf8 contents: 0000000000000000 707A
7FFF 00000000eb0ac2b5 707AFFFF 0000000000000000 7093FFFF 0000000045ead616 7095FFFF 0000000000000000 7096CFFF 000 00000681c7151 7096FFFF 0000000000000000 70AF3FFF 000000006c78b9e9 70AF4FFF 000000001914ab0b 70AF7FFF 00000000000
00000 FFFFFFFFFFFFFFFF 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000000 0 0000000000000
000 0 00000000bca8be4f
0-707a7fff: 0000000000000000
707a8000-707affff: 00000000eb0ac2b5
707b0000-7093ffff: 0000000000000000
70940000-7095ffff: 0000000045ead616
70960000-7096cfff: 0000000000000000
7096d000-7096ffff: 00000000681c7151
70970000-70af3fff: 0000000000000000
70af4000-70af4fff: 000000006c78b9e9
70af5000-70af7fff: 000000001914ab0b 70af8000-ffffffffffffffff: 0000000000000000
nommu: Pass: 796 Run:797

---

 mm/nommu.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -1393,6 +1393,10 @@ static int split_vma(struct vma_iterator
 	setup_vma_to_mm(vma, mm);
 	setup_vma_to_mm(new, mm);
 	vma_iter_store_new(vmi, new);
+
+	/* vmi should point lower address */
+	if (new_below)
+		vma_next(vmi);
 	mm->map_count++;
 	return 0;
 

_

Patches currently in -mm which might be from [email protected] are