Re: [PATCH 1/2] mm: nommu: fix the error path when vma_iter_prealloc() fails

[Andrew Morton]

On Wed,  8 Jul 2026 08:51:36 +0900 Hajime Tazaki <thehajime@xxxxxxxxx> wrote:

> When vma_iter_prealloc() fails in do_mmap(), it jumps to error_just_free
> without updating ret to -ENOMEM, meaning do_mmap() will return 0 on
> failure.
> 
> Additionally, this error path unconditionally frees the region struct.
> Since the region was already added to the global nommu_region_tree via
> add_nommu_region(), leaving it makes a potential dangling pointer in
> the tree and may cause a use-after-free on the next tree walk.
> 
> This commit fixes those issues by introducing new jump
> label, error_vma_iter_prealloc, to correctly handle the error case of
> vma_iter_prealloc(), and move the region updates after the place that
> the allocation is finished.
> 
> Those issues are discovered by Sashiko, linked below.

Thanks.  Now I'm wondering if you regret opening this can of worms ;)

	https://sashiko.dev/#/patchset/20260707235137.498738-1-thehajime@xxxxxxxxx

afaict, all these issues pertain to failures from vma_iter_prealloc().