Re: [PATCH] mm/vma: clear vm_file before unmap on mmap hook failure

[Andrew Morton]

On Wed,  7 Oct 2026 09:09:13 +0200 Oleg Keri <okerixx@xxxxxxxxx> wrote:

> Since commit 2ceb21171dd9 ("mm: consistently validate VMA state after
> mmap[_prepare] hooks"), the mmap error path clears vma->vm_file only
> after unmap_region(), so free_pgtables() unlinks the never-linked VMA
> and drops i_mmap_writable. Once it goes negative, every later shared
> writable mmap of that file fails with -EPERM until reboot.
> 
> Clear vm_file before unmap_region(), so that free_pgtables() does not
> unlink a VMA that was never linked to the file.

Thanks.

Sashiko thinks this fix might cause a null-deref:
	https://sashiko.dev/#/patchset/20261007070913.3923-1-okerixx@xxxxxxxxx

> Fixes: 2ceb21171dd9 ("mm: consistently validate VMA state after mmap[_prepare] hooks")
> Signed-off-by: Oleg Keri <okerixx@xxxxxxxxx>
> ---
> Seen on next-20261006: one refused PCM mmap probe from alsa-lib left the
> device unmappable, so PipeWire could not play anything.

Not good.  I'll add a note against the suspect mm-unstable patch.