Re: [PATCH] mm: nommu: fix the error path when vma_iter_prealloc() fails

[Hajime Tazaki]

On Mon, 06 Jul 2026 11:18:46 +0900,
Hajime Tazaki wrote:
> 
> When vma_iter_prealloc() fails, it jumps to error_just_free without
> updating ret to -ENOMEM, meaning do_mmap() will return 0 on failure.
> 
> Additionally, this error path unconditionally frees the region struct.
> Since the region was already added to the global nommu_region_tree via
> add_nommu_region(), leaving it makes a potential dangling pointer in
> the tree and may cause a use-after-free on the next tree walk.
> 
> This commit fixes those issues by updating return value as well as moving
> the region updates after the place that allocation is finished.
> 
> The issue is discovered by Sashiko, linked below.
> 
> Link: https://sashiko.dev/#/patchset/20260702012830.667205-1-thehajime%40gmail.com
> Signed-off-by: Hajime Tazaki <thehajime@xxxxxxxxx>

hmm, there are still several issues on this function, reported with
new sashiko review.

https://sashiko.dev/#/patchset/c8513ee5aa8444ec9bf6c276043c9f833016a2fa.1783304131.git.thehajime%40gmail.com

I would try to find a way to do a similar review locally, and will be
back here once I don't see further pre-existing issues around this code.

-- Hajime