[PATCH v2 1/2] mm: prevent droppable mappings from being locked

[PATCH v2 1/2] mm: prevent droppable mappings from being locked

[Anthony Yznaga]

Droppable mappings must not be lockable. There is a check for VMAs with
VM_DROPPABLE set in mlock_fixup() along with checks for other types of
unlockable VMAs which ensures this when calling mlock()/mlock2().

For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
When these flags are set as default in this manner they are cleared in
__mmap_complete() for new mappings that do not support mlock. A check for
VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
mappings created with VM_LOCKED set. To fix this and reduce that chance of
similar bugs in the future, introduce and use vma_supports_mlock().

Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
Suggested-by: David Hildenbrand <david@kernel.org>
Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
---
v2:
 - Implement vma_supports_mlock() instead of vma flags mask (DavidH)
 - Add selftests (Lorenzo)

 include/linux/hugetlb_inline.h    |  2 +-
 mm/internal.h                     | 10 ++++++++++
 mm/mlock.c                        | 10 ++++++----
 mm/vma.c                          |  4 +---
 tools/testing/vma/include/stubs.h |  5 +++++
 5 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
index 593f5d4e108b..755281fab23d 100644
--- a/include/linux/hugetlb_inline.h
+++ b/include/linux/hugetlb_inline.h
@@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
 
 #endif
 
-static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
+static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
 {
 	return is_vm_hugetlb_flags(vma->vm_flags);
 }
diff --git a/mm/internal.h b/mm/internal.h
index cb0af847d7d9..8c67637abcdd 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -1218,6 +1218,16 @@ static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
 	}
 	return fpin;
 }
+
+static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
+{
+	if (vma->vm_flags & (VM_SPECIAL | VM_DROPPABLE))
+		return false;
+	if (vma_is_dax(vma) || is_vm_hugetlb_page(vma))
+		return false;
+	return vma != get_gate_vma(current->mm);
+}
+
 #else /* !CONFIG_MMU */
 static inline void unmap_mapping_folio(struct folio *folio) { }
 static inline void mlock_new_folio(struct folio *folio) { }
diff --git a/mm/mlock.c b/mm/mlock.c
index 2f699c3497a5..73551c71cebf 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -472,10 +472,12 @@ static int mlock_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma,
 	int ret = 0;
 	vm_flags_t oldflags = vma->vm_flags;
 
-	if (newflags == oldflags || (oldflags & VM_SPECIAL) ||
-	    is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm) ||
-	    vma_is_dax(vma) || vma_is_secretmem(vma) || (oldflags & VM_DROPPABLE))
-		/* don't set VM_LOCKED or VM_LOCKONFAULT and don't count */
+	if (newflags == oldflags || vma_is_secretmem(vma) ||
+	    !vma_supports_mlock(vma))
+		/*
+		 * Don't set VM_LOCKED or VM_LOCKONFAULT and don't count.
+		 * For secretmem, don't allow the memory to be unlocked.
+		 */
 		goto out;
 
 	vma = vma_modify_flags(vmi, *prev, vma, start, end, &newflags);
diff --git a/mm/vma.c b/mm/vma.c
index be64f781a3aa..18c3c5280748 100644
--- a/mm/vma.c
+++ b/mm/vma.c
@@ -2589,9 +2589,7 @@ static void __mmap_complete(struct mmap_state *map, struct vm_area_struct *vma)
 
 	vm_stat_account(mm, vma->vm_flags, map->pglen);
 	if (vm_flags & VM_LOCKED) {
-		if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) ||
-					is_vm_hugetlb_page(vma) ||
-					vma == get_gate_vma(mm))
+		if (!vma_supports_mlock(vma))
 			vm_flags_clear(vma, VM_LOCKED_MASK);
 		else
 			mm->locked_vm += map->pglen;
diff --git a/tools/testing/vma/include/stubs.h b/tools/testing/vma/include/stubs.h
index 947a3a0c2566..416bb93f5005 100644
--- a/tools/testing/vma/include/stubs.h
+++ b/tools/testing/vma/include/stubs.h
@@ -426,3 +426,8 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
 }
 
 static inline void hugetlb_split(struct vm_area_struct *, unsigned long) {}
+
+static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
+{
+	return false;
+}
-- 
2.47.3

[PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Anthony Yznaga]

Verify that a mapping created with MAP_DROPPABLE cannot be locked
via mlock(), and that it will not be locked if it's created after
mlockall(MCL_FUTURE).

Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
---
 tools/testing/selftests/mm/mlock2-tests.c | 78 ++++++++++++++++++++---
 1 file changed, 69 insertions(+), 9 deletions(-)

diff --git a/tools/testing/selftests/mm/mlock2-tests.c b/tools/testing/selftests/mm/mlock2-tests.c
index b474f2b20def..b5790e717dd6 100644
--- a/tools/testing/selftests/mm/mlock2-tests.c
+++ b/tools/testing/selftests/mm/mlock2-tests.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #define _GNU_SOURCE
 #include <sys/mman.h>
+#include <linux/mman.h>
 #include <stdint.h>
 #include <unistd.h>
 #include <string.h>
@@ -163,14 +164,17 @@ static int lock_check(unsigned long addr)
 	return (vma_rss == vma_size);
 }
 
-static int unlock_lock_check(char *map)
+static int unlock_lock_check(char *map, bool mlock_supported)
 {
-	if (is_vmflag_set((unsigned long)map, LOCKED)) {
+	if (!is_vmflag_set((unsigned long)map, LOCKED))
+		return 0;
+
+	if (mlock_supported)
 		ksft_print_msg("VMA flag %s is present on page 1 after unlock\n", LOCKED);
-		return 1;
-	}
+	else
+		ksft_print_msg("VMA flag %s is present on an unsupported VMA\n", LOCKED);
 
-	return 0;
+	return 1;
 }
 
 static void test_mlock_lock(void)
@@ -196,7 +200,7 @@ static void test_mlock_lock(void)
 		ksft_exit_fail_msg("munlock(): %s\n", strerror(errno));
 	}
 
-	ksft_test_result(!unlock_lock_check(map), "%s: Unlocked\n", __func__);
+	ksft_test_result(!unlock_lock_check(map, true), "%s: Unlocked\n", __func__);
 	munmap(map, 2 * page_size);
 }
 
@@ -296,7 +300,7 @@ static void test_munlockall0(void)
 		ksft_exit_fail_msg("munlockall(): %s\n", strerror(errno));
 	}
 
-	ksft_test_result(!unlock_lock_check(map), "%s: No locked memory\n", __func__);
+	ksft_test_result(!unlock_lock_check(map, true), "%s: No locked memory\n", __func__);
 	munmap(map, 2 * page_size);
 }
 
@@ -336,7 +340,61 @@ static void test_munlockall1(void)
 		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
 	}
 
-	ksft_test_result(!unlock_lock_check(map), "%s: No locked memory\n", __func__);
+	ksft_test_result(!unlock_lock_check(map, true), "%s: No locked memory\n", __func__);
+	munmap(map, 2 * page_size);
+}
+
+/*
+ * Droppable memory should not be lockable.
+ */
+static void test_mlock_droppable(void)
+{
+	char *map;
+	unsigned long page_size = getpagesize();
+
+	/*
+	 * Ensure MCL_FUTURE is not set.
+	 */
+	if (mlockall(MCL_CURRENT))
+		ksft_exit_fail_msg("mlockall(MCL_CURRENT): %s\n", strerror(errno));
+	if (munlockall())
+		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
+
+	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
+		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
+	if (map == MAP_FAILED)
+		ksft_exit_fail_msg("mmap error: %s", strerror(errno));
+
+	if (mlock2_(map, 2 * page_size, 0)) {
+		munmap(map, 2 * page_size);
+		ksft_exit_fail_msg("mlock2(0): %s\n", strerror(errno));
+	}
+
+	ksft_test_result(!unlock_lock_check(map, false), "%s: droppable memory not locked\n",
+			__func__);
+
+	munmap(map, 2 * page_size);
+}
+
+static void test_mlockall_future_droppable(void)
+{
+	char *map;
+	unsigned long page_size = getpagesize();
+
+	if (mlockall(MCL_CURRENT | MCL_FUTURE))
+		ksft_exit_fail_msg("mlockall(MCL_CURRENT | MCL_FUTURE): %s\n", strerror(errno));
+
+	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
+		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
+
+	ksft_test_result(!unlock_lock_check(map, false), "%s: droppable memory not locked\n",
+			__func__);
+
+	if (munlockall()) {
+		munmap(map, 2 * page_size);
+		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
+	}
+
 	munmap(map, 2 * page_size);
 }
 
@@ -442,7 +500,7 @@ int main(int argc, char **argv)
 
 	munmap(map, size);
 
-	ksft_set_plan(13);
+	ksft_set_plan(15);
 
 	test_mlock_lock();
 	test_mlock_onfault();
@@ -451,6 +509,8 @@ int main(int argc, char **argv)
 	test_lock_onfault_of_present();
 	test_vma_management(true);
 	test_mlockall();
+	test_mlock_droppable();
+	test_mlockall_future_droppable();
 
 	ksft_finished();
 }
-- 
2.47.3

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[David Hildenbrand (Arm)]

On 3/10/26 16:58, Anthony Yznaga wrote:
> Droppable mappings must not be lockable. There is a check for VMAs with
> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
> unlockable VMAs which ensures this when calling mlock()/mlock2().
> 
> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
> When these flags are set as default in this manner they are cleared in
> __mmap_complete() for new mappings that do not support mlock. A check for
> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
> mappings created with VM_LOCKED set. To fix this and reduce that chance of
> similar bugs in the future, introduce and use vma_supports_mlock().
> 
> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")

Should we Cc: stable? I think we should, to fix mlockall(MCL_FUTURE)
behavior.

> Suggested-by: David Hildenbrand <david@kernel.org>
> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
> ---
> v2:
>  - Implement vma_supports_mlock() instead of vma flags mask (DavidH)
>  - Add selftests (Lorenzo)
> 
>  include/linux/hugetlb_inline.h    |  2 +-
>  mm/internal.h                     | 10 ++++++++++
>  mm/mlock.c                        | 10 ++++++----
>  mm/vma.c                          |  4 +---
>  tools/testing/vma/include/stubs.h |  5 +++++
>  5 files changed, 23 insertions(+), 8 deletions(-)
> 
> diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
> index 593f5d4e108b..755281fab23d 100644
> --- a/include/linux/hugetlb_inline.h
> +++ b/include/linux/hugetlb_inline.h
> @@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
>  
>  #endif
>  
> -static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
> +static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
>  {
>  	return is_vm_hugetlb_flags(vma->vm_flags);
>  }
> diff --git a/mm/internal.h b/mm/internal.h
> index cb0af847d7d9..8c67637abcdd 100644
> --- a/mm/internal.h
> +++ b/mm/internal.h
> @@ -1218,6 +1218,16 @@ static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
>  	}
>  	return fpin;
>  }
> +
> +static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
> +{
> +	if (vma->vm_flags & (VM_SPECIAL | VM_DROPPABLE))
> +		return false;
> +	if (vma_is_dax(vma) || is_vm_hugetlb_page(vma))
> +		return false;
> +	return vma != get_gate_vma(current->mm);

As discussed, it would be great to find out whether checking
get_gate_vma() makes any sense here. Likely not. :)

Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[Pedro Falcato]

On Tue, Mar 10, 2026 at 08:58:20AM -0700, Anthony Yznaga wrote:
> Droppable mappings must not be lockable. There is a check for VMAs with
> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
> unlockable VMAs which ensures this when calling mlock()/mlock2().
> 
> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
> When these flags are set as default in this manner they are cleared in
> __mmap_complete() for new mappings that do not support mlock. A check for
> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
> mappings created with VM_LOCKED set. To fix this and reduce that chance of
> similar bugs in the future, introduce and use vma_supports_mlock().
> 
> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
> Suggested-by: David Hildenbrand <david@kernel.org>
> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>

Reviewed-by: Pedro Falcato <pfalcato@suse.de>
> ---
> v2:
>  - Implement vma_supports_mlock() instead of vma flags mask (DavidH)
>  - Add selftests (Lorenzo)
> 
>  include/linux/hugetlb_inline.h    |  2 +-
>  mm/internal.h                     | 10 ++++++++++
>  mm/mlock.c                        | 10 ++++++----
>  mm/vma.c                          |  4 +---
>  tools/testing/vma/include/stubs.h |  5 +++++
>  5 files changed, 23 insertions(+), 8 deletions(-)
> 
> diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
> index 593f5d4e108b..755281fab23d 100644
> --- a/include/linux/hugetlb_inline.h
> +++ b/include/linux/hugetlb_inline.h
> @@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
>  
>  #endif
>  
> -static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
> +static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
>  {
>  	return is_vm_hugetlb_flags(vma->vm_flags);
>  }

I don't like this. In case a future backport depends on the constification
of the is_vm_hugetlb_page() argument, they'll be hardpressed to bring the
whole patch in. But it looks like we're going to do it anyway...

-- 
Pedro

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Pedro Falcato]

On Tue, Mar 10, 2026 at 08:58:21AM -0700, Anthony Yznaga wrote:
> Verify that a mapping created with MAP_DROPPABLE cannot be locked
> via mlock(), and that it will not be locked if it's created after
> mlockall(MCL_FUTURE).
> 
> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>

Acked-by: Pedro Falcato <pfalcato@suse.de>

-- 
Pedro

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[Lorenzo Stoakes (Oracle)]

On Tue, Mar 10, 2026 at 08:58:20AM -0700, Anthony Yznaga wrote:
> Droppable mappings must not be lockable. There is a check for VMAs with
> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
> unlockable VMAs which ensures this when calling mlock()/mlock2().
>
> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
> When these flags are set as default in this manner they are cleared in
> __mmap_complete() for new mappings that do not support mlock. A check for
> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
> mappings created with VM_LOCKED set. To fix this and reduce that chance of
> similar bugs in the future, introduce and use vma_supports_mlock().
>
> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")

We should definitely cc: stable I think.

It might result in some backport pain since it'll probably pre-date the
__mmap_region() stuff :)) sorry.

> Suggested-by: David Hildenbrand <david@kernel.org>
> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>

LGTM, so:

Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>

> ---
> v2:
>  - Implement vma_supports_mlock() instead of vma flags mask (DavidH)
>  - Add selftests (Lorenzo)

I know it's a sort of subject thing, but please in future add a cover letter if
#patches > 1 :) thanks!

>
>  include/linux/hugetlb_inline.h    |  2 +-
>  mm/internal.h                     | 10 ++++++++++
>  mm/mlock.c                        | 10 ++++++----
>  mm/vma.c                          |  4 +---
>  tools/testing/vma/include/stubs.h |  5 +++++
>  5 files changed, 23 insertions(+), 8 deletions(-)
>
> diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
> index 593f5d4e108b..755281fab23d 100644
> --- a/include/linux/hugetlb_inline.h
> +++ b/include/linux/hugetlb_inline.h
> @@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
>
>  #endif
>
> -static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
> +static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
>  {
>  	return is_vm_hugetlb_flags(vma->vm_flags);
>  }

Ideally we'd use the new VMA flags approach, but I'll fix that later myself when
I make those changes.

> diff --git a/mm/internal.h b/mm/internal.h
> index cb0af847d7d9..8c67637abcdd 100644
> --- a/mm/internal.h
> +++ b/mm/internal.h
> @@ -1218,6 +1218,16 @@ static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
>  	}
>  	return fpin;
>  }
> +
> +static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
> +{
> +	if (vma->vm_flags & (VM_SPECIAL | VM_DROPPABLE))
> +		return false;
> +	if (vma_is_dax(vma) || is_vm_hugetlb_page(vma))
> +		return false;
> +	return vma != get_gate_vma(current->mm);

Honestly it's dumb that we don't have vma_is_gate(), I see arm32 have their own
is_gate_vma() macro, but we should really have one to avoid this noise :)

Anyway probably not worth it for this patch esp. if backporting.

Wonder if we should have vma_support_munlock() for secretmem ;) (again one for
another patch I guess).

> +}
> +
>  #else /* !CONFIG_MMU */
>  static inline void unmap_mapping_folio(struct folio *folio) { }
>  static inline void mlock_new_folio(struct folio *folio) { }
> diff --git a/mm/mlock.c b/mm/mlock.c
> index 2f699c3497a5..73551c71cebf 100644
> --- a/mm/mlock.c
> +++ b/mm/mlock.c
> @@ -472,10 +472,12 @@ static int mlock_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma,
>  	int ret = 0;
>  	vm_flags_t oldflags = vma->vm_flags;
>
> -	if (newflags == oldflags || (oldflags & VM_SPECIAL) ||
> -	    is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm) ||
> -	    vma_is_dax(vma) || vma_is_secretmem(vma) || (oldflags & VM_DROPPABLE))
> -		/* don't set VM_LOCKED or VM_LOCKONFAULT and don't count */
> +	if (newflags == oldflags || vma_is_secretmem(vma) ||
> +	    !vma_supports_mlock(vma))
> +		/*
> +		 * Don't set VM_LOCKED or VM_LOCKONFAULT and don't count.
> +		 * For secretmem, don't allow the memory to be unlocked.
> +		 */
>  		goto out;
>
>  	vma = vma_modify_flags(vmi, *prev, vma, start, end, &newflags);
> diff --git a/mm/vma.c b/mm/vma.c
> index be64f781a3aa..18c3c5280748 100644
> --- a/mm/vma.c
> +++ b/mm/vma.c
> @@ -2589,9 +2589,7 @@ static void __mmap_complete(struct mmap_state *map, struct vm_area_struct *vma)
>
>  	vm_stat_account(mm, vma->vm_flags, map->pglen);
>  	if (vm_flags & VM_LOCKED) {
> -		if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) ||
> -					is_vm_hugetlb_page(vma) ||
> -					vma == get_gate_vma(mm))
> +		if (!vma_supports_mlock(vma))
>  			vm_flags_clear(vma, VM_LOCKED_MASK);
>  		else
>  			mm->locked_vm += map->pglen;
> diff --git a/tools/testing/vma/include/stubs.h b/tools/testing/vma/include/stubs.h
> index 947a3a0c2566..416bb93f5005 100644
> --- a/tools/testing/vma/include/stubs.h
> +++ b/tools/testing/vma/include/stubs.h
> @@ -426,3 +426,8 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
>  }
>
>  static inline void hugetlb_split(struct vm_area_struct *, unsigned long) {}
> +
> +static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
> +{
> +	return false;
> +}

Thanks :) tested locally and working fine.

> --
> 2.47.3
>

Cheers, Lorenzo

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Lorenzo Stoakes (Oracle)]

On Tue, Mar 10, 2026 at 08:58:21AM -0700, Anthony Yznaga wrote:
> Verify that a mapping created with MAP_DROPPABLE cannot be locked
> via mlock(), and that it will not be locked if it's created after
> mlockall(MCL_FUTURE).
>
> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>

Can confirm this test fails before your patch and passes after, so LGTM :)

Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Tested-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>

> ---
>  tools/testing/selftests/mm/mlock2-tests.c | 78 ++++++++++++++++++++---
>  1 file changed, 69 insertions(+), 9 deletions(-)
>
> diff --git a/tools/testing/selftests/mm/mlock2-tests.c b/tools/testing/selftests/mm/mlock2-tests.c
> index b474f2b20def..b5790e717dd6 100644
> --- a/tools/testing/selftests/mm/mlock2-tests.c
> +++ b/tools/testing/selftests/mm/mlock2-tests.c
> @@ -1,6 +1,7 @@
>  // SPDX-License-Identifier: GPL-2.0
>  #define _GNU_SOURCE
>  #include <sys/mman.h>
> +#include <linux/mman.h>
>  #include <stdint.h>
>  #include <unistd.h>
>  #include <string.h>
> @@ -163,14 +164,17 @@ static int lock_check(unsigned long addr)
>  	return (vma_rss == vma_size);
>  }
>
> -static int unlock_lock_check(char *map)
> +static int unlock_lock_check(char *map, bool mlock_supported)
>  {
> -	if (is_vmflag_set((unsigned long)map, LOCKED)) {
> +	if (!is_vmflag_set((unsigned long)map, LOCKED))
> +		return 0;
> +
> +	if (mlock_supported)
>  		ksft_print_msg("VMA flag %s is present on page 1 after unlock\n", LOCKED);
> -		return 1;
> -	}
> +	else
> +		ksft_print_msg("VMA flag %s is present on an unsupported VMA\n", LOCKED);
>
> -	return 0;
> +	return 1;
>  }
>
>  static void test_mlock_lock(void)
> @@ -196,7 +200,7 @@ static void test_mlock_lock(void)
>  		ksft_exit_fail_msg("munlock(): %s\n", strerror(errno));
>  	}
>
> -	ksft_test_result(!unlock_lock_check(map), "%s: Unlocked\n", __func__);
> +	ksft_test_result(!unlock_lock_check(map, true), "%s: Unlocked\n", __func__);
>  	munmap(map, 2 * page_size);
>  }
>
> @@ -296,7 +300,7 @@ static void test_munlockall0(void)
>  		ksft_exit_fail_msg("munlockall(): %s\n", strerror(errno));
>  	}
>
> -	ksft_test_result(!unlock_lock_check(map), "%s: No locked memory\n", __func__);
> +	ksft_test_result(!unlock_lock_check(map, true), "%s: No locked memory\n", __func__);
>  	munmap(map, 2 * page_size);
>  }
>
> @@ -336,7 +340,61 @@ static void test_munlockall1(void)
>  		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
>  	}
>
> -	ksft_test_result(!unlock_lock_check(map), "%s: No locked memory\n", __func__);
> +	ksft_test_result(!unlock_lock_check(map, true), "%s: No locked memory\n", __func__);
> +	munmap(map, 2 * page_size);
> +}
> +
> +/*
> + * Droppable memory should not be lockable.
> + */
> +static void test_mlock_droppable(void)
> +{
> +	char *map;
> +	unsigned long page_size = getpagesize();
> +
> +	/*
> +	 * Ensure MCL_FUTURE is not set.
> +	 */
> +	if (mlockall(MCL_CURRENT))
> +		ksft_exit_fail_msg("mlockall(MCL_CURRENT): %s\n", strerror(errno));
> +	if (munlockall())
> +		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
> +
> +	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
> +		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
> +	if (map == MAP_FAILED)
> +		ksft_exit_fail_msg("mmap error: %s", strerror(errno));
> +
> +	if (mlock2_(map, 2 * page_size, 0)) {
> +		munmap(map, 2 * page_size);
> +		ksft_exit_fail_msg("mlock2(0): %s\n", strerror(errno));
> +	}
> +
> +	ksft_test_result(!unlock_lock_check(map, false), "%s: droppable memory not locked\n",
> +			__func__);
> +
> +	munmap(map, 2 * page_size);
> +}
> +
> +static void test_mlockall_future_droppable(void)
> +{
> +	char *map;
> +	unsigned long page_size = getpagesize();
> +
> +	if (mlockall(MCL_CURRENT | MCL_FUTURE))
> +		ksft_exit_fail_msg("mlockall(MCL_CURRENT | MCL_FUTURE): %s\n", strerror(errno));
> +
> +	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
> +		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
> +
> +	ksft_test_result(!unlock_lock_check(map, false), "%s: droppable memory not locked\n",
> +			__func__);
> +
> +	if (munlockall()) {
> +		munmap(map, 2 * page_size);
> +		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
> +	}
> +
>  	munmap(map, 2 * page_size);
>  }
>
> @@ -442,7 +500,7 @@ int main(int argc, char **argv)
>
>  	munmap(map, size);
>
> -	ksft_set_plan(13);
> +	ksft_set_plan(15);
>
>  	test_mlock_lock();
>  	test_mlock_onfault();
> @@ -451,6 +509,8 @@ int main(int argc, char **argv)
>  	test_lock_onfault_of_present();
>  	test_vma_management(true);
>  	test_mlockall();
> +	test_mlock_droppable();
> +	test_mlockall_future_droppable();
>
>  	ksft_finished();
>  }
> --
> 2.47.3
>

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[Andrew Morton]

On Wed, 11 Mar 2026 10:36:26 +0000 "Lorenzo Stoakes (Oracle)" <ljs@kernel.org> wrote:

> On Tue, Mar 10, 2026 at 08:58:20AM -0700, Anthony Yznaga wrote:
> > Droppable mappings must not be lockable. There is a check for VMAs with
> > VM_DROPPABLE set in mlock_fixup() along with checks for other types of
> > unlockable VMAs which ensures this when calling mlock()/mlock2().
> >
> > For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
> > In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
> > current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
> > applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
> > When these flags are set as default in this manner they are cleared in
> > __mmap_complete() for new mappings that do not support mlock. A check for
> > VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
> > mappings created with VM_LOCKED set. To fix this and reduce that chance of
> > similar bugs in the future, introduce and use vma_supports_mlock().
> >
> > Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
> 
> We should definitely cc: stable I think.

You know what I'm going to ask ;)

Why backport this?  What effect does/might the bug have upon our users?

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[anthony.yznaga]

On 3/11/26 2:27 AM, David Hildenbrand (Arm) wrote:
> On 3/10/26 16:58, Anthony Yznaga wrote:
>> Droppable mappings must not be lockable. There is a check for VMAs with
>> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
>> unlockable VMAs which ensures this when calling mlock()/mlock2().
>>
>> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
>> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
>> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
>> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
>> When these flags are set as default in this manner they are cleared in
>> __mmap_complete() for new mappings that do not support mlock. A check for
>> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
>> mappings created with VM_LOCKED set. To fix this and reduce that chance of
>> similar bugs in the future, introduce and use vma_supports_mlock().
>>
>> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
> Should we Cc: stable? I think we should, to fix mlockall(MCL_FUTURE)
> behavior.

I found this issue through code inspection while doing mshare dev work. 
I don't have a strong idea how likely it is to happen in practice. If it 
did it might not be easily diagnosed so I'm fine adding the tag.


>
>> Suggested-by: David Hildenbrand <david@kernel.org>
>> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
>> ---
>> v2:
>>   - Implement vma_supports_mlock() instead of vma flags mask (DavidH)
>>   - Add selftests (Lorenzo)
>>
>>   include/linux/hugetlb_inline.h    |  2 +-
>>   mm/internal.h                     | 10 ++++++++++
>>   mm/mlock.c                        | 10 ++++++----
>>   mm/vma.c                          |  4 +---
>>   tools/testing/vma/include/stubs.h |  5 +++++
>>   5 files changed, 23 insertions(+), 8 deletions(-)
>>
>> diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
>> index 593f5d4e108b..755281fab23d 100644
>> --- a/include/linux/hugetlb_inline.h
>> +++ b/include/linux/hugetlb_inline.h
>> @@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
>>   
>>   #endif
>>   
>> -static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
>> +static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
>>   {
>>   	return is_vm_hugetlb_flags(vma->vm_flags);
>>   }
>> diff --git a/mm/internal.h b/mm/internal.h
>> index cb0af847d7d9..8c67637abcdd 100644
>> --- a/mm/internal.h
>> +++ b/mm/internal.h
>> @@ -1218,6 +1218,16 @@ static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
>>   	}
>>   	return fpin;
>>   }
>> +
>> +static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
>> +{
>> +	if (vma->vm_flags & (VM_SPECIAL | VM_DROPPABLE))
>> +		return false;
>> +	if (vma_is_dax(vma) || is_vm_hugetlb_page(vma))
>> +		return false;
>> +	return vma != get_gate_vma(current->mm);
> As discussed, it would be great to find out whether checking
> get_gate_vma() makes any sense here. Likely not. :)

I do think the get_gate_vma() check can go away, but I figured that was 
better done in a separate patch. Is that better done as a separate 
submission or should I tack on patches to this series?


> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
>

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[anthony.yznaga]

On 3/11/26 3:36 AM, Lorenzo Stoakes (Oracle) wrote:
> On Tue, Mar 10, 2026 at 08:58:20AM -0700, Anthony Yznaga wrote:
>> Droppable mappings must not be lockable. There is a check for VMAs with
>> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
>> unlockable VMAs which ensures this when calling mlock()/mlock2().
>>
>> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
>> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set, the
>> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
>> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also set.
>> When these flags are set as default in this manner they are cleared in
>> __mmap_complete() for new mappings that do not support mlock. A check for
>> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
>> mappings created with VM_LOCKED set. To fix this and reduce that chance of
>> similar bugs in the future, introduce and use vma_supports_mlock().
>>
>> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings")
> We should definitely cc: stable I think.
>
> It might result in some backport pain since it'll probably pre-date the
> __mmap_region() stuff :)) sorry.

I could add a patch at the beginning that does the cheap fix followed by 
this patch.

>
>> Suggested-by: David Hildenbrand <david@kernel.org>
>> Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
> LGTM, so:
>
> Reviewed-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
>
>> ---
>> v2:
>>   - Implement vma_supports_mlock() instead of vma flags mask (DavidH)
>>   - Add selftests (Lorenzo)
> I know it's a sort of subject thing, but please in future add a cover letter if
> #patches > 1 :) thanks!
Noted.
>
>>   include/linux/hugetlb_inline.h    |  2 +-
>>   mm/internal.h                     | 10 ++++++++++
>>   mm/mlock.c                        | 10 ++++++----
>>   mm/vma.c                          |  4 +---
>>   tools/testing/vma/include/stubs.h |  5 +++++
>>   5 files changed, 23 insertions(+), 8 deletions(-)
>>
>> diff --git a/include/linux/hugetlb_inline.h b/include/linux/hugetlb_inline.h
>> index 593f5d4e108b..755281fab23d 100644
>> --- a/include/linux/hugetlb_inline.h
>> +++ b/include/linux/hugetlb_inline.h
>> @@ -30,7 +30,7 @@ static inline bool is_vma_hugetlb_flags(const vma_flags_t *flags)
>>
>>   #endif
>>
>> -static inline bool is_vm_hugetlb_page(struct vm_area_struct *vma)
>> +static inline bool is_vm_hugetlb_page(const struct vm_area_struct *vma)
>>   {
>>   	return is_vm_hugetlb_flags(vma->vm_flags);
>>   }
> Ideally we'd use the new VMA flags approach, but I'll fix that later myself when
> I make those changes.
>
>> diff --git a/mm/internal.h b/mm/internal.h
>> index cb0af847d7d9..8c67637abcdd 100644
>> --- a/mm/internal.h
>> +++ b/mm/internal.h
>> @@ -1218,6 +1218,16 @@ static inline struct file *maybe_unlock_mmap_for_io(struct vm_fault *vmf,
>>   	}
>>   	return fpin;
>>   }
>> +
>> +static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
>> +{
>> +	if (vma->vm_flags & (VM_SPECIAL | VM_DROPPABLE))
>> +		return false;
>> +	if (vma_is_dax(vma) || is_vm_hugetlb_page(vma))
>> +		return false;
>> +	return vma != get_gate_vma(current->mm);
> Honestly it's dumb that we don't have vma_is_gate(), I see arm32 have their own
> is_gate_vma() macro, but we should really have one to avoid this noise :)
>
> Anyway probably not worth it for this patch esp. if backporting.

But in this case no check at all is needed.

Anthony

>
> Wonder if we should have vma_support_munlock() for secretmem ;) (again one for
> another patch I guess).
>
>> +}
>> +
>>   #else /* !CONFIG_MMU */
>>   static inline void unmap_mapping_folio(struct folio *folio) { }
>>   static inline void mlock_new_folio(struct folio *folio) { }
>> diff --git a/mm/mlock.c b/mm/mlock.c
>> index 2f699c3497a5..73551c71cebf 100644
>> --- a/mm/mlock.c
>> +++ b/mm/mlock.c
>> @@ -472,10 +472,12 @@ static int mlock_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma,
>>   	int ret = 0;
>>   	vm_flags_t oldflags = vma->vm_flags;
>>
>> -	if (newflags == oldflags || (oldflags & VM_SPECIAL) ||
>> -	    is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm) ||
>> -	    vma_is_dax(vma) || vma_is_secretmem(vma) || (oldflags & VM_DROPPABLE))
>> -		/* don't set VM_LOCKED or VM_LOCKONFAULT and don't count */
>> +	if (newflags == oldflags || vma_is_secretmem(vma) ||
>> +	    !vma_supports_mlock(vma))
>> +		/*
>> +		 * Don't set VM_LOCKED or VM_LOCKONFAULT and don't count.
>> +		 * For secretmem, don't allow the memory to be unlocked.
>> +		 */
>>   		goto out;
>>
>>   	vma = vma_modify_flags(vmi, *prev, vma, start, end, &newflags);
>> diff --git a/mm/vma.c b/mm/vma.c
>> index be64f781a3aa..18c3c5280748 100644
>> --- a/mm/vma.c
>> +++ b/mm/vma.c
>> @@ -2589,9 +2589,7 @@ static void __mmap_complete(struct mmap_state *map, struct vm_area_struct *vma)
>>
>>   	vm_stat_account(mm, vma->vm_flags, map->pglen);
>>   	if (vm_flags & VM_LOCKED) {
>> -		if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) ||
>> -					is_vm_hugetlb_page(vma) ||
>> -					vma == get_gate_vma(mm))
>> +		if (!vma_supports_mlock(vma))
>>   			vm_flags_clear(vma, VM_LOCKED_MASK);
>>   		else
>>   			mm->locked_vm += map->pglen;
>> diff --git a/tools/testing/vma/include/stubs.h b/tools/testing/vma/include/stubs.h
>> index 947a3a0c2566..416bb93f5005 100644
>> --- a/tools/testing/vma/include/stubs.h
>> +++ b/tools/testing/vma/include/stubs.h
>> @@ -426,3 +426,8 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
>>   }
>>
>>   static inline void hugetlb_split(struct vm_area_struct *, unsigned long) {}
>> +
>> +static inline bool vma_supports_mlock(const struct vm_area_struct *vma)
>> +{
>> +	return false;
>> +}
> Thanks :) tested locally and working fine.
>
>> --
>> 2.47.3
>>
> Cheers, Lorenzo

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[David Hildenbrand (Arm)]

On 3/12/26 03:16, anthony.yznaga@oracle.com wrote:
> 
> On 3/11/26 3:36 AM, Lorenzo Stoakes (Oracle) wrote:
>> On Tue, Mar 10, 2026 at 08:58:20AM -0700, Anthony Yznaga wrote:
>>> Droppable mappings must not be lockable. There is a check for VMAs with
>>> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
>>> unlockable VMAs which ensures this when calling mlock()/mlock2().
>>>
>>> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
>>> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set,
>>> the
>>> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
>>> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also
>>> set.
>>> When these flags are set as default in this manner they are cleared in
>>> __mmap_complete() for new mappings that do not support mlock. A check
>>> for
>>> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
>>> mappings created with VM_LOCKED set. To fix this and reduce that
>>> chance of
>>> similar bugs in the future, introduce and use vma_supports_mlock().
>>>
>>> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always
>>> lazily freeable mappings")
>> We should definitely cc: stable I think.
>>
>> It might result in some backport pain since it'll probably pre-date the
>> __mmap_region() stuff :)) sorry.
> 
> I could add a patch at the beginning that does the cheap fix followed by
> this patch.

Any backport conflicts should be easy and fast too resolve (if any). No
need to uglify our mainline patches :)

-- 
Cheers,

David

Re: [PATCH v2 1/2] mm: prevent droppable mappings from being locked

[David Hildenbrand (Arm)]

On 3/12/26 03:01, anthony.yznaga@oracle.com wrote:
> 
> On 3/11/26 2:27 AM, David Hildenbrand (Arm) wrote:
>> On 3/10/26 16:58, Anthony Yznaga wrote:
>>> Droppable mappings must not be lockable. There is a check for VMAs with
>>> VM_DROPPABLE set in mlock_fixup() along with checks for other types of
>>> unlockable VMAs which ensures this when calling mlock()/mlock2().
>>>
>>> For mlockall(MCL_FUTURE), the check for unlockable VMAs is different.
>>> In apply_mlockall_flags(), if the flags parameter has MCL_FUTURE set,
>>> the
>>> current task's mm's default VMA flag field mm->def_flags has VM_LOCKED
>>> applied to it. VM_LOCKONFAULT is also applied if MCL_ONFAULT is also
>>> set.
>>> When these flags are set as default in this manner they are cleared in
>>> __mmap_complete() for new mappings that do not support mlock. A check
>>> for
>>> VM_DROPPABLE in __mmap_complete() is missing resulting in droppable
>>> mappings created with VM_LOCKED set. To fix this and reduce that
>>> chance of
>>> similar bugs in the future, introduce and use vma_supports_mlock().
>>>
>>> Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always
>>> lazily freeable mappings")
>> Should we Cc: stable? I think we should, to fix mlockall(MCL_FUTURE)
>> behavior.
> 
> I found this issue through code inspection while doing mshare dev work.
> I don't have a strong idea how likely it is to happen in practice. If it
> did it might not be easily diagnosed so I'm fine adding the tag.

IIUC, mlockall(MCL_FUTURE) will result in future MAP_DROPPABLE mappings
to get mlocked. I assume that implies that all pages will get faulted in
and might not be reclaimable.

With a quick test program that mmaps 4M, we indeed fault in all these
pages (I assume you test does something similar).

7f5fc4600000-7f5fc4a00000 rw-p 00000000 00:00 0
Size:               4096 kB
KernelPageSize:        4 kB
MMUPageSize:           4 kB
Rss:                4096 kB
Pss:                4096 kB
Pss_Dirty:          4096 kB
Shared_Clean:          0 kB
Shared_Dirty:          0 kB
Private_Clean:         0 kB
Private_Dirty:      4096 kB
Referenced:         4096 kB
Anonymous:          4096 kB
KSM:                   0 kB
LazyFree:              0 kB
AnonHugePages:      4096 kB
ShmemPmdMapped:        0 kB
FilePmdMapped:         0 kB
Shared_Hugetlb:        0 kB
Private_Hugetlb:       0 kB
Swap:                  0 kB
SwapPss:               0 kB
Locked:             4096 kB

It's a good question whether memory reclaim would still be able to free
these pages. I'd assume the folios would get mlocked and essentially
turned unevictable -- breaking the whole concept of droppable mappings.

So I think we should CC stable.

-- 
Cheers,

David

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 17501 bytes --]

On Tue, Mar 10, 2026 at 08:58:21AM -0700, Anthony Yznaga wrote:

> Verify that a mapping created with MAP_DROPPABLE cannot be locked
> via mlock(), and that it will not be locked if it's created after
> mlockall(MCL_FUTURE).

I'm seeing a regression in -next on 32 bit arm which bisects to this
patch:

# # ----------------------
# # running ./mlock2-tests
# # ----------------------
# # TAP version 13
# # 1..15
# # ok 1 test_mlock_lock: Locked
# # ok 2 test_mlock_lock: Unlocked
# # ok 3 test_mlock_onfault: VMA marked for lock on fault
# # ok 4 VMA open lock after fault
# # ok 5 test_munlockall0: Locked memory area
# # ok 6 test_munlockall0: No locked memory
# # ok 7 test_munlockall1: VMA marked for lock on fault
# # ok 8 test_munlockall1: Unlocked
# # ok 9 test_munlockall1: Locked
# # ok 10 test_munlockall1: No locked memory
# # ok 11 VMA with present pages is not marked lock on fault
# # ok 12 test_vma_management call_mlock 1
# # ok 13 test_vma_management call_mlock 0
# # Bail out! mmap error: Unknown error 524# Planned tests != run tests (15 != 13)
# # # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0
# # [FAIL]
# not ok 2 mlock2-tests # exit=1

Full log:

   https://lava.sirena.org.uk/scheduler/job/2617389#L2426

Previously the end of that test looked like:

# # ok 12 test_vma_management call_mlock 1
# # ok 13 test_vma_management call_mlock 0
# # # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0

The new tests do:

> +/*
> + * Droppable memory should not be lockable.
> + */
> +static void test_mlock_droppable(void)
> +{
> +	char *map;
> +	unsigned long page_size = getpagesize();
> +
> +	/*
> +	 * Ensure MCL_FUTURE is not set.
> +	 */
> +	if (mlockall(MCL_CURRENT))
> +		ksft_exit_fail_msg("mlockall(MCL_CURRENT): %s\n", strerror(errno));
> +	if (munlockall())
> +		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
> +
> +	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
> +		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
> +	if (map == MAP_FAILED)
> +		ksft_exit_fail_msg("mmap error: %s", strerror(errno));

All these failures which cause the entire test program to immediately
die seem exceessively strong...

Full bisect log:

# bad: [cf7c3c02fdd0dfccf4d6611714273dcb538af2cb] Add linux-next specific files for 20260330
# good: [a010730e610019b6d010ec43ce737cb59a37809d] Merge branch 'for-linux-next-fixes' of https://gitlab.freedesktop.org/drm/misc/kernel.git
# good: [9be71d462c33b1a00acfa4ab8f0f5332ed592817] firmware: cs_dsp: Simplify suppressing log messages during KUnit testing
# good: [7b3f8db159f710d432c4edc024fcefa9e62e8b4b] ASoC: fsl_xcvr: add bitcount and timestamp controls
# good: [8fc5c7895185d1119ae76b509892a1d14e0bd483] ASoC: wm_adsp: Combine some similar code in firmware file search
# good: [981b080a79724738882b0af1c5bb7ade30d94f24] spi: fsl-qspi: Use reinit_completion() for repeated operations
# good: [ed0313223ce6514dbd39c049e25f702980d7e3cc] ASoC: codecs: wcd9335: Remove potential undefined behavior in wcd9335_slimbus_irq()
# good: [97af961568c8682c44506c9ad4b26c8a5455ec1d] ASoC: cs35l56: Put OTP register defines in correct address order
# good: [0a208adefecb287d22321054470d4619cb303839] ASoC: cs42l43: Add support for the B variant
# good: [a8075ada4a341ce58ebf8bef0188cefe6c2f6487] ASoC: ti: davinci-mcasp: improve aux_div selection for mid-range dividers
# good: [aa3d0c93a333182e887426366a4f3e5f06ee0d83] regulator: max20411: show failure on register
# good: [b1ef855c62601ed4de2c4b0ff75a075877e3dac8] regmap: Simplify devres handling
# good: [e7662bced2e98ffa2c572126677deb9cf55d43b3] regcache: Move HW readback after cache initialisation
# good: [ef0b4783afc211a4b120e72b5a57f3d0340a9981] ASoC: cs35l56: KUnit tests for reading speaker ID from host GPIOs
# good: [96f06d055ca03d1dfb5830fd07ff6eadbd66264c] spi: dt-bindings: mpfs-spi: remove clock-names
# good: [2adac914c72b6cb5aba2612f49050c82aecd498e] ASoC: cs35l56-test: Add test cases without onchip pulls defined
# good: [f48e7a246a567e3764112e2463274c479d95cd96] ASoC: soc-core: Use guard()/scoped_guard() for mutex lock
# good: [9891b52ba12e9d5fed5901b6b5f6e0cdcd424390] regcache: Factor out regcache_hw_exit() helper
# good: [e84141846decb77d2826e553318a608b256804e5] regulator: pf9453: Allow shared IRQ
# good: [9ab637ac5d3826606947f4e861107da958eda324] regcache: Amend printf() specifiers when printing registers
# good: [34b4fc44e4f904fbb81335d53163ffdcb0180000] ASoC: soc_sdw_utils: remove index from sdca codec name
# good: [da37bfe76b5b4ccc01ed8132215098e20d78e5f3] ASoC: cs42xx8: add error checks for constraints in TDM mode
# good: [d3b693a13b39bce16e284e1c737874966b3a96de] spi: spi-mem: clean up kernel-doc in spi-mem.h
# good: [06dba254de95b16e7793224d29daa5195de2e581] ASoC: dt-bindings: nvidia,tegra-audio-max9808x: document additional board pins
# good: [1696fad8b259a2d46e51cd6e17e4bcdbe02279fa] ASoC: sti: use managed regmap_field allocations
# good: [17c6bf433742e0c1ff5ce175145877c0194e4a7a] ASoC: cs35l45: Hibernate wm_adsp on runtime suspend
# good: [2974aa42e6696a1d95b727d677dc01a71af5b998] ASoC: remove snd_soc_pcm_subclass
# good: [501efdcb3b3ab099fc0ce2f6e668b1c4095dd476] ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops
# good: [d90c0f78379454d51a428e312ac6db573060185c] regulator: cpcap-regulator: add support for Mot regulators
# good: [5c74a008ffc62fc57a041602b4517519c8bf9436] firmware: cs_dsp: Mark KUnit test suites KUNIT_SPEED_SLOW
# good: [260c3fff1fefc570d8f23e87953e181d7d248861] ASoC: cs-amp-lib-test: Stop including platform_device.h
# good: [7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4] spi: tegra210-quad: Add runtime autosuspend support
# good: [37983fad7f3ef296fa0504c8e945987459dc5487] regmap: define cleanup helper for regmap_field
# good: [e02902dd493bf9c9b05353c761737ac514ad7a5c] spi: add devm_spi_new_ancillary_device()
# good: [ada32396f90951e12465224c04742607ca56a982] ASoC: SDCA: Add CS47L47 to class driver
# good: [507a071d9868cb60e4e76f8a06fc8eb014f59ae4] spi: pxa2xx: use min() instead of min_t()
# good: [5ebc20921b7fff9feb44de465448e17a382c9965] ASoC: tas2552: Allow audio enable GPIO to sleep
# good: [fed6e5084894373d76270cad4a32eb6479ad8247] spi: atcspi200: Remove redundant assignment to .owner
# good: [c2bcf62ca75c541ec4297e6ff02a68ddc2e02029] regcache: Split regcache_count_cacheable_registers() helper
# good: [171b3663f33e1efdc97f5112f49be10b47b20fa8] ASoC: codecs: aw88261: Add firmware-name support
# good: [bf122191473e26a8f195308b1ba924c98424c8e1] ASoC: rt5677-spi: Add SPI device ID matching table
# good: [fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7] regulator: spacemit-p1: Update supply names
# good: [0556bb42a84ee391a2145ddba86756f9747bc27f] regulator: pf0900: Make regu_irqs variable static const
# good: [d075cef4af6327a5de4bee7bf77591e3201e54f4] ASoC: simple-card-utils: add sysclk ordering support
# good: [78dfbd4ad0be9f51de7b9a19388809254aeccd26] ASoC: Add quirk for Lecoo Bellator N176
git bisect start 'cf7c3c02fdd0dfccf4d6611714273dcb538af2cb' 'a010730e610019b6d010ec43ce737cb59a37809d' '9be71d462c33b1a00acfa4ab8f0f5332ed592817' '7b3f8db159f710d432c4edc024fcefa9e62e8b4b' '8fc5c7895185d1119ae76b509892a1d14e0bd483' '981b080a79724738882b0af1c5bb7ade30d94f24' 'ed0313223ce6514dbd39c049e25f702980d7e3cc' '97af961568c8682c44506c9ad4b26c8a5455ec1d' '0a208adefecb287d22321054470d4619cb303839' 'a8075ada4a341ce58ebf8bef0188cefe6c2f6487' 'aa3d0c93a333182e887426366a4f3e5f06ee0d83' 'b1ef855c62601ed4de2c4b0ff75a075877e3dac8' 'e7662bced2e98ffa2c572126677deb9cf55d43b3' 'ef0b4783afc211a4b120e72b5a57f3d0340a9981' '96f06d055ca03d1dfb5830fd07ff6eadbd66264c' '2adac914c72b6cb5aba2612f49050c82aecd498e' 'f48e7a246a567e3764112e2463274c479d95cd96' '9891b52ba12e9d5fed5901b6b5f6e0cdcd424390' 'e84141846decb77d2826e553318a608b256804e5' '9ab637ac5d3826606947f4e861107da958eda324' '34b4fc44e4f904fbb81335d53163ffdcb0180000' 'da37bfe76b5b4ccc01ed8132215098e20d78e5f3' 'd3b693a13b39bce16e284e1c737874966b3a96de' '06dba254de95b16e7793224d29daa5195de2e581' '1696fad8b259a2d46e51cd6e17e4bcdbe02279fa' '17c6bf433742e0c1ff5ce175145877c0194e4a7a' '2974aa42e6696a1d95b727d677dc01a71af5b998' '501efdcb3b3ab099fc0ce2f6e668b1c4095dd476' 'd90c0f78379454d51a428e312ac6db573060185c' '5c74a008ffc62fc57a041602b4517519c8bf9436' '260c3fff1fefc570d8f23e87953e181d7d248861' '7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4' '37983fad7f3ef296fa0504c8e945987459dc5487' 'e02902dd493bf9c9b05353c761737ac514ad7a5c' 'ada32396f90951e12465224c04742607ca56a982' '507a071d9868cb60e4e76f8a06fc8eb014f59ae4' '5ebc20921b7fff9feb44de465448e17a382c9965' 'fed6e5084894373d76270cad4a32eb6479ad8247' 'c2bcf62ca75c541ec4297e6ff02a68ddc2e02029' '171b3663f33e1efdc97f5112f49be10b47b20fa8' 'bf122191473e26a8f195308b1ba924c98424c8e1' 'fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7' '0556bb42a84ee391a2145ddba86756f9747bc27f' 'd075cef4af6327a5de4bee7bf77591e3201e54f4' '78dfbd4ad0be9f51de7b9a19388809254aeccd26'
# test job: [9be71d462c33b1a00acfa4ab8f0f5332ed592817] https://lava.sirena.org.uk/scheduler/job/2548958
# test job: [7b3f8db159f710d432c4edc024fcefa9e62e8b4b] https://lava.sirena.org.uk/scheduler/job/2548203
# test job: [8fc5c7895185d1119ae76b509892a1d14e0bd483] https://lava.sirena.org.uk/scheduler/job/2548813
# test job: [981b080a79724738882b0af1c5bb7ade30d94f24] https://lava.sirena.org.uk/scheduler/job/2545034
# test job: [ed0313223ce6514dbd39c049e25f702980d7e3cc] https://lava.sirena.org.uk/scheduler/job/2544912
# test job: [97af961568c8682c44506c9ad4b26c8a5455ec1d] https://lava.sirena.org.uk/scheduler/job/2543844
# test job: [0a208adefecb287d22321054470d4619cb303839] https://lava.sirena.org.uk/scheduler/job/2542900
# test job: [a8075ada4a341ce58ebf8bef0188cefe6c2f6487] https://lava.sirena.org.uk/scheduler/job/2541074
# test job: [aa3d0c93a333182e887426366a4f3e5f06ee0d83] https://lava.sirena.org.uk/scheduler/job/2531465
# test job: [b1ef855c62601ed4de2c4b0ff75a075877e3dac8] https://lava.sirena.org.uk/scheduler/job/2531932
# test job: [e7662bced2e98ffa2c572126677deb9cf55d43b3] https://lava.sirena.org.uk/scheduler/job/2530760
# test job: [ef0b4783afc211a4b120e72b5a57f3d0340a9981] https://lava.sirena.org.uk/scheduler/job/2530588
# test job: [96f06d055ca03d1dfb5830fd07ff6eadbd66264c] https://lava.sirena.org.uk/scheduler/job/2523395
# test job: [2adac914c72b6cb5aba2612f49050c82aecd498e] https://lava.sirena.org.uk/scheduler/job/2523858
# test job: [f48e7a246a567e3764112e2463274c479d95cd96] https://lava.sirena.org.uk/scheduler/job/2522175
# test job: [9891b52ba12e9d5fed5901b6b5f6e0cdcd424390] https://lava.sirena.org.uk/scheduler/job/2522227
# test job: [e84141846decb77d2826e553318a608b256804e5] https://lava.sirena.org.uk/scheduler/job/2516954
# test job: [9ab637ac5d3826606947f4e861107da958eda324] https://lava.sirena.org.uk/scheduler/job/2516270
# test job: [34b4fc44e4f904fbb81335d53163ffdcb0180000] https://lava.sirena.org.uk/scheduler/job/2513176
# test job: [da37bfe76b5b4ccc01ed8132215098e20d78e5f3] https://lava.sirena.org.uk/scheduler/job/2511945
# test job: [d3b693a13b39bce16e284e1c737874966b3a96de] https://lava.sirena.org.uk/scheduler/job/2511939
# test job: [06dba254de95b16e7793224d29daa5195de2e581] https://lava.sirena.org.uk/scheduler/job/2513148
# test job: [1696fad8b259a2d46e51cd6e17e4bcdbe02279fa] https://lava.sirena.org.uk/scheduler/job/2513461
# test job: [17c6bf433742e0c1ff5ce175145877c0194e4a7a] https://lava.sirena.org.uk/scheduler/job/2513372
# test job: [2974aa42e6696a1d95b727d677dc01a71af5b998] https://lava.sirena.org.uk/scheduler/job/2502064
# test job: [501efdcb3b3ab099fc0ce2f6e668b1c4095dd476] https://lava.sirena.org.uk/scheduler/job/2500515
# test job: [d90c0f78379454d51a428e312ac6db573060185c] https://lava.sirena.org.uk/scheduler/job/2500276
# test job: [5c74a008ffc62fc57a041602b4517519c8bf9436] https://lava.sirena.org.uk/scheduler/job/2496475
# test job: [260c3fff1fefc570d8f23e87953e181d7d248861] https://lava.sirena.org.uk/scheduler/job/2494070
# test job: [7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4] https://lava.sirena.org.uk/scheduler/job/2488642
# test job: [37983fad7f3ef296fa0504c8e945987459dc5487] https://lava.sirena.org.uk/scheduler/job/2489226
# test job: [e02902dd493bf9c9b05353c761737ac514ad7a5c] https://lava.sirena.org.uk/scheduler/job/2489635
# test job: [ada32396f90951e12465224c04742607ca56a982] https://lava.sirena.org.uk/scheduler/job/2489222
# test job: [507a071d9868cb60e4e76f8a06fc8eb014f59ae4] https://lava.sirena.org.uk/scheduler/job/2486412
# test job: [5ebc20921b7fff9feb44de465448e17a382c9965] https://lava.sirena.org.uk/scheduler/job/2485223
# test job: [fed6e5084894373d76270cad4a32eb6479ad8247] https://lava.sirena.org.uk/scheduler/job/2484612
# test job: [c2bcf62ca75c541ec4297e6ff02a68ddc2e02029] https://lava.sirena.org.uk/scheduler/job/2482354
# test job: [171b3663f33e1efdc97f5112f49be10b47b20fa8] https://lava.sirena.org.uk/scheduler/job/2483216
# test job: [bf122191473e26a8f195308b1ba924c98424c8e1] https://lava.sirena.org.uk/scheduler/job/2483327
# test job: [fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7] https://lava.sirena.org.uk/scheduler/job/2482378
# test job: [0556bb42a84ee391a2145ddba86756f9747bc27f] https://lava.sirena.org.uk/scheduler/job/2482373
# test job: [d075cef4af6327a5de4bee7bf77591e3201e54f4] https://lava.sirena.org.uk/scheduler/job/2482695
# test job: [78dfbd4ad0be9f51de7b9a19388809254aeccd26] https://lava.sirena.org.uk/scheduler/job/2482880
# test job: [cf7c3c02fdd0dfccf4d6611714273dcb538af2cb] https://lava.sirena.org.uk/scheduler/job/2617389
# bad: [cf7c3c02fdd0dfccf4d6611714273dcb538af2cb] Add linux-next specific files for 20260330
git bisect bad cf7c3c02fdd0dfccf4d6611714273dcb538af2cb
# test job: [38b3953f6750a4200d3b37a5bfbee8370fdbd504] https://lava.sirena.org.uk/scheduler/job/2617530
# bad: [38b3953f6750a4200d3b37a5bfbee8370fdbd504] Merge branch 'main' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
git bisect bad 38b3953f6750a4200d3b37a5bfbee8370fdbd504
# test job: [a4fb128b640bfc9a123150836109eba580ad1209] https://lava.sirena.org.uk/scheduler/job/2617626
# bad: [a4fb128b640bfc9a123150836109eba580ad1209] Merge branch 'xtensa-for-next' of https://github.com/jcmvbkbc/linux-xtensa.git
git bisect bad a4fb128b640bfc9a123150836109eba580ad1209
# test job: [1da8729e2823f81c215a5e08191f3bbc64da48a7] https://lava.sirena.org.uk/scheduler/job/2617703
# bad: [1da8729e2823f81c215a5e08191f3bbc64da48a7] Merge branch 'soc_fsl' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux.git
git bisect bad 1da8729e2823f81c215a5e08191f3bbc64da48a7
# test job: [fd706c02d6ce8331b3979ab082653aa2dda6f820] https://lava.sirena.org.uk/scheduler/job/2617851
# bad: [fd706c02d6ce8331b3979ab082653aa2dda6f820] Merge branch 'mm-unstable' of https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
git bisect bad fd706c02d6ce8331b3979ab082653aa2dda6f820
# test job: [d1bebf23909c97a1d31422b62493c7c70cfafa06] https://lava.sirena.org.uk/scheduler/job/2617901
# bad: [d1bebf23909c97a1d31422b62493c7c70cfafa06] mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c
git bisect bad d1bebf23909c97a1d31422b62493c7c70cfafa06
# test job: [4bcefc23862b988ce7a9fe7dcba2f6ab0c9b5fa7] https://lava.sirena.org.uk/scheduler/job/2618076
# good: [4bcefc23862b988ce7a9fe7dcba2f6ab0c9b5fa7] mm/vmalloc: fix incorrect size reporting on allocation failure
git bisect good 4bcefc23862b988ce7a9fe7dcba2f6ab0c9b5fa7
# test job: [798a6c72ebedf11da7b46e21b458f39d7787aba7] https://lava.sirena.org.uk/scheduler/job/2618272
# good: [798a6c72ebedf11da7b46e21b458f39d7787aba7] Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name
git bisect good 798a6c72ebedf11da7b46e21b458f39d7787aba7
# test job: [75af4a7b19c295127790e42469e1863148795c26] https://lava.sirena.org.uk/scheduler/job/2618319
# bad: [75af4a7b19c295127790e42469e1863148795c26] selftests/mm: pagemap_ioctl: remove hungarian notation
git bisect bad 75af4a7b19c295127790e42469e1863148795c26
# test job: [6235dbcce97f5b164efe6725dc6002b646943e1d] https://lava.sirena.org.uk/scheduler/job/2618397
# bad: [6235dbcce97f5b164efe6725dc6002b646943e1d] selftests/mm: verify droppable mappings cannot be locked
git bisect bad 6235dbcce97f5b164efe6725dc6002b646943e1d
# test job: [c0fbc73a20da662edc4d603ed3d4b80503b55478] https://lava.sirena.org.uk/scheduler/job/2618493
# good: [c0fbc73a20da662edc4d603ed3d4b80503b55478] kho: make sure preservations do not span multiple NUMA nodes
git bisect good c0fbc73a20da662edc4d603ed3d4b80503b55478
# test job: [e2b717936d1a3f6b1f179fd03ce8e6a8f4ebc6ee] https://lava.sirena.org.uk/scheduler/job/2618533
# good: [e2b717936d1a3f6b1f179fd03ce8e6a8f4ebc6ee] zram: drop ->num_active_comps
git bisect good e2b717936d1a3f6b1f179fd03ce8e6a8f4ebc6ee
# test job: [4fd453f1644669bdd79177da31c29d32353d57f7] https://lava.sirena.org.uk/scheduler/job/2618566
# good: [4fd453f1644669bdd79177da31c29d32353d57f7] zram: remove chained recompression
git bisect good 4fd453f1644669bdd79177da31c29d32353d57f7
# test job: [5435ba164b0dd162e1a2fb47ab2d3f5cd70905f9] https://lava.sirena.org.uk/scheduler/job/2618612
# good: [5435ba164b0dd162e1a2fb47ab2d3f5cd70905f9] mm: prevent droppable mappings from being locked
git bisect good 5435ba164b0dd162e1a2fb47ab2d3f5cd70905f9
# first bad commit: [6235dbcce97f5b164efe6725dc6002b646943e1d] selftests/mm: verify droppable mappings cannot be locked

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Andrew Morton]

On Tue, 31 Mar 2026 14:17:50 +0100 Mark Brown <broonie@kernel.org> wrote:

> On Tue, Mar 10, 2026 at 08:58:21AM -0700, Anthony Yznaga wrote:
> 
> > Verify that a mapping created with MAP_DROPPABLE cannot be locked
> > via mlock(), and that it will not be locked if it's created after
> > mlockall(MCL_FUTURE).
> 
> I'm seeing a regression in -next on 32 bit arm which bisects to this
> patch:

Cool, thanks.

> ...
>
> All these failures which cause the entire test program to immediately
> die seem exceessively strong...

Well, is the test code incorrect, or is the patch which it's testing
incorrect?  That's 5435ba164b0d ("mm: prevent droppable mappings from
being locked")?

5435ba164b0d is presently in mm-stable, cc:stable@vger.kernel.org.

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[anthony.yznaga]

On 3/31/26 6:17 AM, Mark Brown wrote:
> On Tue, Mar 10, 2026 at 08:58:21AM -0700, Anthony Yznaga wrote:
>
>> Verify that a mapping created with MAP_DROPPABLE cannot be locked
>> via mlock(), and that it will not be locked if it's created after
>> mlockall(MCL_FUTURE).
> I'm seeing a regression in -next on 32 bit arm which bisects to this
> patch:
>
> # # ----------------------
> # # running ./mlock2-tests
> # # ----------------------
> # # TAP version 13
> # # 1..15
> # # ok 1 test_mlock_lock: Locked
> # # ok 2 test_mlock_lock: Unlocked
> # # ok 3 test_mlock_onfault: VMA marked for lock on fault
> # # ok 4 VMA open lock after fault
> # # ok 5 test_munlockall0: Locked memory area
> # # ok 6 test_munlockall0: No locked memory
> # # ok 7 test_munlockall1: VMA marked for lock on fault
> # # ok 8 test_munlockall1: Unlocked
> # # ok 9 test_munlockall1: Locked
> # # ok 10 test_munlockall1: No locked memory
> # # ok 11 VMA with present pages is not marked lock on fault
> # # ok 12 test_vma_management call_mlock 1
> # # ok 13 test_vma_management call_mlock 0
> # # Bail out! mmap error: Unknown error 524

524 is ENOTSUPP. It's unfortunate that strerror reports it as unknown.

This is a problem with the tests as written and not with the fix they 
test. mmap() failed because MAP_DROPPABLE is not supported on 32 bit 
arm. I'll determine the best way to skip these tests.

Anthony

> # Planned tests != run tests (15 != 13)
> # # # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0
> # # [FAIL]
> # not ok 2 mlock2-tests # exit=1
>
> Full log:
>
>     https://lava.sirena.org.uk/scheduler/job/2617389#L2426
>
> Previously the end of that test looked like:
>
> # # ok 12 test_vma_management call_mlock 1
> # # ok 13 test_vma_management call_mlock 0
> # # # Totals: pass:13 fail:0 xfail:0 xpass:0 skip:0 error:0
>
> The new tests do:
>
>> +/*
>> + * Droppable memory should not be lockable.
>> + */
>> +static void test_mlock_droppable(void)
>> +{
>> +	char *map;
>> +	unsigned long page_size = getpagesize();
>> +
>> +	/*
>> +	 * Ensure MCL_FUTURE is not set.
>> +	 */
>> +	if (mlockall(MCL_CURRENT))
>> +		ksft_exit_fail_msg("mlockall(MCL_CURRENT): %s\n", strerror(errno));
>> +	if (munlockall())
>> +		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
>> +
>> +	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
>> +		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
>> +	if (map == MAP_FAILED)
>> +		ksft_exit_fail_msg("mmap error: %s", strerror(errno));
> All these failures which cause the entire test program to immediately
> die seem exceessively strong...
>
> Full bisect log:
>
> # bad: [cf7c3c02fdd0dfccf4d6611714273dcb538af2cb] Add linux-next specific files for 20260330
> # good: [a010730e610019b6d010ec43ce737cb59a37809d] Merge branch 'for-linux-next-fixes' of https://gitlab.freedesktop.org/drm/misc/kernel.git
> # good: [9be71d462c33b1a00acfa4ab8f0f5332ed592817] firmware: cs_dsp: Simplify suppressing log messages during KUnit testing
> # good: [7b3f8db159f710d432c4edc024fcefa9e62e8b4b] ASoC: fsl_xcvr: add bitcount and timestamp controls
> # good: [8fc5c7895185d1119ae76b509892a1d14e0bd483] ASoC: wm_adsp: Combine some similar code in firmware file search
> # good: [981b080a79724738882b0af1c5bb7ade30d94f24] spi: fsl-qspi: Use reinit_completion() for repeated operations
> # good: [ed0313223ce6514dbd39c049e25f702980d7e3cc] ASoC: codecs: wcd9335: Remove potential undefined behavior in wcd9335_slimbus_irq()
> # good: [97af961568c8682c44506c9ad4b26c8a5455ec1d] ASoC: cs35l56: Put OTP register defines in correct address order
> # good: [0a208adefecb287d22321054470d4619cb303839] ASoC: cs42l43: Add support for the B variant
> # good: [a8075ada4a341ce58ebf8bef0188cefe6c2f6487] ASoC: ti: davinci-mcasp: improve aux_div selection for mid-range dividers
> # good: [aa3d0c93a333182e887426366a4f3e5f06ee0d83] regulator: max20411: show failure on register
> # good: [b1ef855c62601ed4de2c4b0ff75a075877e3dac8] regmap: Simplify devres handling
> # good: [e7662bced2e98ffa2c572126677deb9cf55d43b3] regcache: Move HW readback after cache initialisation
> # good: [ef0b4783afc211a4b120e72b5a57f3d0340a9981] ASoC: cs35l56: KUnit tests for reading speaker ID from host GPIOs
> # good: [96f06d055ca03d1dfb5830fd07ff6eadbd66264c] spi: dt-bindings: mpfs-spi: remove clock-names
> # good: [2adac914c72b6cb5aba2612f49050c82aecd498e] ASoC: cs35l56-test: Add test cases without onchip pulls defined
> # good: [f48e7a246a567e3764112e2463274c479d95cd96] ASoC: soc-core: Use guard()/scoped_guard() for mutex lock
> # good: [9891b52ba12e9d5fed5901b6b5f6e0cdcd424390] regcache: Factor out regcache_hw_exit() helper
> # good: [e84141846decb77d2826e553318a608b256804e5] regulator: pf9453: Allow shared IRQ
> # good: [9ab637ac5d3826606947f4e861107da958eda324] regcache: Amend printf() specifiers when printing registers
> # good: [34b4fc44e4f904fbb81335d53163ffdcb0180000] ASoC: soc_sdw_utils: remove index from sdca codec name
> # good: [da37bfe76b5b4ccc01ed8132215098e20d78e5f3] ASoC: cs42xx8: add error checks for constraints in TDM mode
> # good: [d3b693a13b39bce16e284e1c737874966b3a96de] spi: spi-mem: clean up kernel-doc in spi-mem.h
> # good: [06dba254de95b16e7793224d29daa5195de2e581] ASoC: dt-bindings: nvidia,tegra-audio-max9808x: document additional board pins
> # good: [1696fad8b259a2d46e51cd6e17e4bcdbe02279fa] ASoC: sti: use managed regmap_field allocations
> # good: [17c6bf433742e0c1ff5ce175145877c0194e4a7a] ASoC: cs35l45: Hibernate wm_adsp on runtime suspend
> # good: [2974aa42e6696a1d95b727d677dc01a71af5b998] ASoC: remove snd_soc_pcm_subclass
> # good: [501efdcb3b3ab099fc0ce2f6e668b1c4095dd476] ASoC: SDCA: Pull the Q7.8 volume helpers out of soc-ops
> # good: [d90c0f78379454d51a428e312ac6db573060185c] regulator: cpcap-regulator: add support for Mot regulators
> # good: [5c74a008ffc62fc57a041602b4517519c8bf9436] firmware: cs_dsp: Mark KUnit test suites KUNIT_SPEED_SLOW
> # good: [260c3fff1fefc570d8f23e87953e181d7d248861] ASoC: cs-amp-lib-test: Stop including platform_device.h
> # good: [7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4] spi: tegra210-quad: Add runtime autosuspend support
> # good: [37983fad7f3ef296fa0504c8e945987459dc5487] regmap: define cleanup helper for regmap_field
> # good: [e02902dd493bf9c9b05353c761737ac514ad7a5c] spi: add devm_spi_new_ancillary_device()
> # good: [ada32396f90951e12465224c04742607ca56a982] ASoC: SDCA: Add CS47L47 to class driver
> # good: [507a071d9868cb60e4e76f8a06fc8eb014f59ae4] spi: pxa2xx: use min() instead of min_t()
> # good: [5ebc20921b7fff9feb44de465448e17a382c9965] ASoC: tas2552: Allow audio enable GPIO to sleep
> # good: [fed6e5084894373d76270cad4a32eb6479ad8247] spi: atcspi200: Remove redundant assignment to .owner
> # good: [c2bcf62ca75c541ec4297e6ff02a68ddc2e02029] regcache: Split regcache_count_cacheable_registers() helper
> # good: [171b3663f33e1efdc97f5112f49be10b47b20fa8] ASoC: codecs: aw88261: Add firmware-name support
> # good: [bf122191473e26a8f195308b1ba924c98424c8e1] ASoC: rt5677-spi: Add SPI device ID matching table
> # good: [fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7] regulator: spacemit-p1: Update supply names
> # good: [0556bb42a84ee391a2145ddba86756f9747bc27f] regulator: pf0900: Make regu_irqs variable static const
> # good: [d075cef4af6327a5de4bee7bf77591e3201e54f4] ASoC: simple-card-utils: add sysclk ordering support
> # good: [78dfbd4ad0be9f51de7b9a19388809254aeccd26] ASoC: Add quirk for Lecoo Bellator N176
> git bisect start 'cf7c3c02fdd0dfccf4d6611714273dcb538af2cb' 'a010730e610019b6d010ec43ce737cb59a37809d' '9be71d462c33b1a00acfa4ab8f0f5332ed592817' '7b3f8db159f710d432c4edc024fcefa9e62e8b4b' '8fc5c7895185d1119ae76b509892a1d14e0bd483' '981b080a79724738882b0af1c5bb7ade30d94f24' 'ed0313223ce6514dbd39c049e25f702980d7e3cc' '97af961568c8682c44506c9ad4b26c8a5455ec1d' '0a208adefecb287d22321054470d4619cb303839' 'a8075ada4a341ce58ebf8bef0188cefe6c2f6487' 'aa3d0c93a333182e887426366a4f3e5f06ee0d83' 'b1ef855c62601ed4de2c4b0ff75a075877e3dac8' 'e7662bced2e98ffa2c572126677deb9cf55d43b3' 'ef0b4783afc211a4b120e72b5a57f3d0340a9981' '96f06d055ca03d1dfb5830fd07ff6eadbd66264c' '2adac914c72b6cb5aba2612f49050c82aecd498e' 'f48e7a246a567e3764112e2463274c479d95cd96' '9891b52ba12e9d5fed5901b6b5f6e0cdcd424390' 'e84141846decb77d2826e553318a608b256804e5' '9ab637ac5d3826606947f4e861107da958eda324' '34b4fc44e4f904fbb81335d53163ffdcb0180000' 'da37bfe76b5b4ccc01ed8132215098e20d78e5f3' 'd3b693a13b39bce16e284e1c737874966b3a96de' '06dba254de95b16e7793224d29daa5195de2e581' '1696fad8b259a2d46e51cd6e17e4bcdbe02279fa' '17c6bf433742e0c1ff5ce175145877c0194e4a7a' '2974aa42e6696a1d95b727d677dc01a71af5b998' '501efdcb3b3ab099fc0ce2f6e668b1c4095dd476' 'd90c0f78379454d51a428e312ac6db573060185c' '5c74a008ffc62fc57a041602b4517519c8bf9436' '260c3fff1fefc570d8f23e87953e181d7d248861' '7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4' '37983fad7f3ef296fa0504c8e945987459dc5487' 'e02902dd493bf9c9b05353c761737ac514ad7a5c' 'ada32396f90951e12465224c04742607ca56a982' '507a071d9868cb60e4e76f8a06fc8eb014f59ae4' '5ebc20921b7fff9feb44de465448e17a382c9965' 'fed6e5084894373d76270cad4a32eb6479ad8247' 'c2bcf62ca75c541ec4297e6ff02a68ddc2e02029' '171b3663f33e1efdc97f5112f49be10b47b20fa8' 'bf122191473e26a8f195308b1ba924c98424c8e1' 'fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7' '0556bb42a84ee391a2145ddba86756f9747bc27f' 'd075cef4af6327a5de4bee7bf77591e3201e54f4' '78dfbd4ad0be9f51de7b9a19388809254aeccd26'
> # test job: [9be71d462c33b1a00acfa4ab8f0f5332ed592817] https://lava.sirena.org.uk/scheduler/job/2548958
> # test job: [7b3f8db159f710d432c4edc024fcefa9e62e8b4b] https://lava.sirena.org.uk/scheduler/job/2548203
> # test job: [8fc5c7895185d1119ae76b509892a1d14e0bd483] https://lava.sirena.org.uk/scheduler/job/2548813
> # test job: [981b080a79724738882b0af1c5bb7ade30d94f24] https://lava.sirena.org.uk/scheduler/job/2545034
> # test job: [ed0313223ce6514dbd39c049e25f702980d7e3cc] https://lava.sirena.org.uk/scheduler/job/2544912
> # test job: [97af961568c8682c44506c9ad4b26c8a5455ec1d] https://lava.sirena.org.uk/scheduler/job/2543844
> # test job: [0a208adefecb287d22321054470d4619cb303839] https://lava.sirena.org.uk/scheduler/job/2542900
> # test job: [a8075ada4a341ce58ebf8bef0188cefe6c2f6487] https://lava.sirena.org.uk/scheduler/job/2541074
> # test job: [aa3d0c93a333182e887426366a4f3e5f06ee0d83] https://lava.sirena.org.uk/scheduler/job/2531465
> # test job: [b1ef855c62601ed4de2c4b0ff75a075877e3dac8] https://lava.sirena.org.uk/scheduler/job/2531932
> # test job: [e7662bced2e98ffa2c572126677deb9cf55d43b3] https://lava.sirena.org.uk/scheduler/job/2530760
> # test job: [ef0b4783afc211a4b120e72b5a57f3d0340a9981] https://lava.sirena.org.uk/scheduler/job/2530588
> # test job: [96f06d055ca03d1dfb5830fd07ff6eadbd66264c] https://lava.sirena.org.uk/scheduler/job/2523395
> # test job: [2adac914c72b6cb5aba2612f49050c82aecd498e] https://lava.sirena.org.uk/scheduler/job/2523858
> # test job: [f48e7a246a567e3764112e2463274c479d95cd96] https://lava.sirena.org.uk/scheduler/job/2522175
> # test job: [9891b52ba12e9d5fed5901b6b5f6e0cdcd424390] https://lava.sirena.org.uk/scheduler/job/2522227
> # test job: [e84141846decb77d2826e553318a608b256804e5] https://lava.sirena.org.uk/scheduler/job/2516954
> # test job: [9ab637ac5d3826606947f4e861107da958eda324] https://lava.sirena.org.uk/scheduler/job/2516270
> # test job: [34b4fc44e4f904fbb81335d53163ffdcb0180000] https://lava.sirena.org.uk/scheduler/job/2513176
> # test job: [da37bfe76b5b4ccc01ed8132215098e20d78e5f3] https://lava.sirena.org.uk/scheduler/job/2511945
> # test job: [d3b693a13b39bce16e284e1c737874966b3a96de] https://lava.sirena.org.uk/scheduler/job/2511939
> # test job: [06dba254de95b16e7793224d29daa5195de2e581] https://lava.sirena.org.uk/scheduler/job/2513148
> # test job: [1696fad8b259a2d46e51cd6e17e4bcdbe02279fa] https://lava.sirena.org.uk/scheduler/job/2513461
> # test job: [17c6bf433742e0c1ff5ce175145877c0194e4a7a] https://lava.sirena.org.uk/scheduler/job/2513372
> # test job: [2974aa42e6696a1d95b727d677dc01a71af5b998] https://lava.sirena.org.uk/scheduler/job/2502064
> # test job: [501efdcb3b3ab099fc0ce2f6e668b1c4095dd476] https://lava.sirena.org.uk/scheduler/job/2500515
> # test job: [d90c0f78379454d51a428e312ac6db573060185c] https://lava.sirena.org.uk/scheduler/job/2500276
> # test job: [5c74a008ffc62fc57a041602b4517519c8bf9436] https://lava.sirena.org.uk/scheduler/job/2496475
> # test job: [260c3fff1fefc570d8f23e87953e181d7d248861] https://lava.sirena.org.uk/scheduler/job/2494070
> # test job: [7c12f6ead4672cb08b74e6f6115eb04dca8ccfa4] https://lava.sirena.org.uk/scheduler/job/2488642
> # test job: [37983fad7f3ef296fa0504c8e945987459dc5487] https://lava.sirena.org.uk/scheduler/job/2489226
> # test job: [e02902dd493bf9c9b05353c761737ac514ad7a5c] https://lava.sirena.org.uk/scheduler/job/2489635
> # test job: [ada32396f90951e12465224c04742607ca56a982] https://lava.sirena.org.uk/scheduler/job/2489222
> # test job: [507a071d9868cb60e4e76f8a06fc8eb014f59ae4] https://lava.sirena.org.uk/scheduler/job/2486412
> # test job: [5ebc20921b7fff9feb44de465448e17a382c9965] https://lava.sirena.org.uk/scheduler/job/2485223
> # test job: [fed6e5084894373d76270cad4a32eb6479ad8247] https://lava.sirena.org.uk/scheduler/job/2484612
> # test job: [c2bcf62ca75c541ec4297e6ff02a68ddc2e02029] https://lava.sirena.org.uk/scheduler/job/2482354
> # test job: [171b3663f33e1efdc97f5112f49be10b47b20fa8] https://lava.sirena.org.uk/scheduler/job/2483216
> # test job: [bf122191473e26a8f195308b1ba924c98424c8e1] https://lava.sirena.org.uk/scheduler/job/2483327
> # test job: [fbb4c52ccdcb4a612d2b7f800aa57090eeee16d7] https://lava.sirena.org.uk/scheduler/job/2482378
> # test job: [0556bb42a84ee391a2145ddba86756f9747bc27f] https://lava.sirena.org.uk/scheduler/job/2482373
> # test job: [d075cef4af6327a5de4bee7bf77591e3201e54f4] https://lava.sirena.org.uk/scheduler/job/2482695
> # test job: [78dfbd4ad0be9f51de7b9a19388809254aeccd26] https://lava.sirena.org.uk/scheduler/job/2482880
> # test job: [cf7c3c02fdd0dfccf4d6611714273dcb538af2cb] https://lava.sirena.org.uk/scheduler/job/2617389
> # bad: [cf7c3c02fdd0dfccf4d6611714273dcb538af2cb] Add linux-next specific files for 20260330
> git bisect bad cf7c3c02fdd0dfccf4d6611714273dcb538af2cb
> # test job: [38b3953f6750a4200d3b37a5bfbee8370fdbd504] https://lava.sirena.org.uk/scheduler/job/2617530
> # bad: [38b3953f6750a4200d3b37a5bfbee8370fdbd504] Merge branch 'main' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
> git bisect bad 38b3953f6750a4200d3b37a5bfbee8370fdbd504
> # test job: [a4fb128b640bfc9a123150836109eba580ad1209] https://lava.sirena.org.uk/scheduler/job/2617626
> # bad: [a4fb128b640bfc9a123150836109eba580ad1209] Merge branch 'xtensa-for-next' of https://github.com/jcmvbkbc/linux-xtensa.git
> git bisect bad a4fb128b640bfc9a123150836109eba580ad1209
> # test job: [1da8729e2823f81c215a5e08191f3bbc64da48a7] https://lava.sirena.org.uk/scheduler/job/2617703
> # bad: [1da8729e2823f81c215a5e08191f3bbc64da48a7] Merge branch 'soc_fsl' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux.git
> git bisect bad 1da8729e2823f81c215a5e08191f3bbc64da48a7
> # test job: [fd706c02d6ce8331b3979ab082653aa2dda6f820] https://lava.sirena.org.uk/scheduler/job/2617851
> # bad: [fd706c02d6ce8331b3979ab082653aa2dda6f820] Merge branch 'mm-unstable' of https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> git bisect bad fd706c02d6ce8331b3979ab082653aa2dda6f820
> # test job: [d1bebf23909c97a1d31422b62493c7c70cfafa06] https://lava.sirena.org.uk/scheduler/job/2617901
> # bad: [d1bebf23909c97a1d31422b62493c7c70cfafa06] mm: prepare to move subsection_map_init() to mm/sparse-vmemmap.c
> git bisect bad d1bebf23909c97a1d31422b62493c7c70cfafa06
> # test job: [4bcefc23862b988ce7a9fe7dcba2f6ab0c9b5fa7] https://lava.sirena.org.uk/scheduler/job/2618076
> # good: [4bcefc23862b988ce7a9fe7dcba2f6ab0c9b5fa7] mm/vmalloc: fix incorrect size reporting on allocation failure
> git bisect good 4bcefc23862b988ce7a9fe7dcba2f6ab0c9b5fa7
> # test job: [798a6c72ebedf11da7b46e21b458f39d7787aba7] https://lava.sirena.org.uk/scheduler/job/2618272
> # good: [798a6c72ebedf11da7b46e21b458f39d7787aba7] Docs/admin-guide/mm/damn/lru_sort: fix intervals autotune parameter name
> git bisect good 798a6c72ebedf11da7b46e21b458f39d7787aba7
> # test job: [75af4a7b19c295127790e42469e1863148795c26] https://lava.sirena.org.uk/scheduler/job/2618319
> # bad: [75af4a7b19c295127790e42469e1863148795c26] selftests/mm: pagemap_ioctl: remove hungarian notation
> git bisect bad 75af4a7b19c295127790e42469e1863148795c26
> # test job: [6235dbcce97f5b164efe6725dc6002b646943e1d] https://lava.sirena.org.uk/scheduler/job/2618397
> # bad: [6235dbcce97f5b164efe6725dc6002b646943e1d] selftests/mm: verify droppable mappings cannot be locked
> git bisect bad 6235dbcce97f5b164efe6725dc6002b646943e1d
> # test job: [c0fbc73a20da662edc4d603ed3d4b80503b55478] https://lava.sirena.org.uk/scheduler/job/2618493
> # good: [c0fbc73a20da662edc4d603ed3d4b80503b55478] kho: make sure preservations do not span multiple NUMA nodes
> git bisect good c0fbc73a20da662edc4d603ed3d4b80503b55478
> # test job: [e2b717936d1a3f6b1f179fd03ce8e6a8f4ebc6ee] https://lava.sirena.org.uk/scheduler/job/2618533
> # good: [e2b717936d1a3f6b1f179fd03ce8e6a8f4ebc6ee] zram: drop ->num_active_comps
> git bisect good e2b717936d1a3f6b1f179fd03ce8e6a8f4ebc6ee
> # test job: [4fd453f1644669bdd79177da31c29d32353d57f7] https://lava.sirena.org.uk/scheduler/job/2618566
> # good: [4fd453f1644669bdd79177da31c29d32353d57f7] zram: remove chained recompression
> git bisect good 4fd453f1644669bdd79177da31c29d32353d57f7
> # test job: [5435ba164b0dd162e1a2fb47ab2d3f5cd70905f9] https://lava.sirena.org.uk/scheduler/job/2618612
> # good: [5435ba164b0dd162e1a2fb47ab2d3f5cd70905f9] mm: prevent droppable mappings from being locked
> git bisect good 5435ba164b0dd162e1a2fb47ab2d3f5cd70905f9
> # first bad commit: [6235dbcce97f5b164efe6725dc6002b646943e1d] selftests/mm: verify droppable mappings cannot be locked

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 542 bytes --]

On Tue, Mar 31, 2026 at 02:17:14PM -0700, Andrew Morton wrote:
> On Tue, 31 Mar 2026 14:17:50 +0100 Mark Brown <broonie@kernel.org> wrote:

> > All these failures which cause the entire test program to immediately
> > die seem exceessively strong...

> Well, is the test code incorrect, or is the patch which it's testing
> incorrect?  That's 5435ba164b0d ("mm: prevent droppable mappings from
> being locked")?

I've done no investigation on the actual failure, sorry - the comment
above is a stylistic/usability one about the test program.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Andrew Morton]

On Wed, 1 Apr 2026 12:17:30 +0100 Mark Brown <broonie@kernel.org> wrote:

> On Tue, Mar 31, 2026 at 02:17:14PM -0700, Andrew Morton wrote:
> > On Tue, 31 Mar 2026 14:17:50 +0100 Mark Brown <broonie@kernel.org> wrote:
> 
> > > All these failures which cause the entire test program to immediately
> > > die seem exceessively strong...
> 
> > Well, is the test code incorrect, or is the patch which it's testing
> > incorrect?  That's 5435ba164b0d ("mm: prevent droppable mappings from
> > being locked")?
> 
> I've done no investigation on the actual failure, sorry - the comment
> above is a stylistic/usability one about the test program.

Thanks.

Anthony believes this is a problem in the test code, not in the kernel
code which is being tested.  He's working on the test code so I shall
drop the current test code from mm.git't mm-stable tree. 

That's 6235dbcce97f ("selftests/mm: verify droppable mappings cannot be
locked")

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[anthony.yznaga]

On 4/8/26 2:02 PM, Andrew Morton wrote:
> On Wed, 8 Apr 2026 13:35:42 -0700 anthony.yznaga@oracle.com wrote:
>
>> On 4/3/26 12:31 PM, Andrew Morton wrote:
>>> On Thu,  2 Apr 2026 16:59:33 -0700 Anthony Yznaga <anthony.yznaga@oracle.com> wrote:
>>>
>>>> For configs that support MAP_DROPPABLE verify that a mapping created
>>>> with MAP_DROPPABLE cannot be locked via mlock(), and that it will not
>>>> be locked if it's created after mlockall(MCL_FUTURE).
>>> There are a few queries from the AI reviewbot;
>>> 	https://sashiko.dev/#/patchset/20260402235933.10588-1-anthony.yznaga@oracle.com
>> Interesting. Of the two issues, one is certainly legit. I need to add an
>> munlockall() on early return from test_mlockall_future_droppable().
> Cool.
>
>> For the other, the question posed was whether the tests should handle
>> possibly being run on an older kernel that doesn't implement
>> MAP_DROPPABLE. It seems to me to that a selftest should not be expected
>> to work (or even necessarily compile) on kernels older than when the
>> selftest was introduced, but I don't want to assume.
> I don't know that there's any policy on that.  My attitude is that
> selftests are not intended to be forward- or backward-compatible.
> That's why we ship them with the kernel source!
>
> If we get a selftests fixup then I do like to backport that into
> earlier kernels if appropriate, to keep those in good shape.  And that
> has the effect of reducing people's motivation to run a later kernel's
> selftests on their current kernel.
>
That makes sense. It's trivial to skip the tests if MAP_DROPPABLE is not 
defined so I'll do that.

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Andrew Morton]

On Wed, 8 Apr 2026 13:35:42 -0700 anthony.yznaga@oracle.com wrote:

> 
> On 4/3/26 12:31 PM, Andrew Morton wrote:
> > On Thu,  2 Apr 2026 16:59:33 -0700 Anthony Yznaga <anthony.yznaga@oracle.com> wrote:
> >
> >> For configs that support MAP_DROPPABLE verify that a mapping created
> >> with MAP_DROPPABLE cannot be locked via mlock(), and that it will not
> >> be locked if it's created after mlockall(MCL_FUTURE).
> > There are a few queries from the AI reviewbot;
> > 	https://sashiko.dev/#/patchset/20260402235933.10588-1-anthony.yznaga@oracle.com
> 
> Interesting. Of the two issues, one is certainly legit. I need to add an 
> munlockall() on early return from test_mlockall_future_droppable().

Cool.

> For the other, the question posed was whether the tests should handle 
> possibly being run on an older kernel that doesn't implement 
> MAP_DROPPABLE. It seems to me to that a selftest should not be expected 
> to work (or even necessarily compile) on kernels older than when the 
> selftest was introduced, but I don't want to assume.

I don't know that there's any policy on that.  My attitude is that
selftests are not intended to be forward- or backward-compatible. 
That's why we ship them with the kernel source!

If we get a selftests fixup then I do like to backport that into
earlier kernels if appropriate, to keep those in good shape.  And that
has the effect of reducing people's motivation to run a later kernel's
selftests on their current kernel.

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[anthony.yznaga]

On 4/3/26 12:31 PM, Andrew Morton wrote:
> On Thu,  2 Apr 2026 16:59:33 -0700 Anthony Yznaga <anthony.yznaga@oracle.com> wrote:
>
>> For configs that support MAP_DROPPABLE verify that a mapping created
>> with MAP_DROPPABLE cannot be locked via mlock(), and that it will not
>> be locked if it's created after mlockall(MCL_FUTURE).
> There are a few queries from the AI reviewbot;
> 	https://sashiko.dev/#/patchset/20260402235933.10588-1-anthony.yznaga@oracle.com

Interesting. Of the two issues, one is certainly legit. I need to add an 
munlockall() on early return from test_mlockall_future_droppable().
For the other, the question posed was whether the tests should handle 
possibly being run on an older kernel that doesn't implement 
MAP_DROPPABLE. It seems to me to that a selftest should not be expected 
to work (or even necessarily compile) on kernels older than when the 
selftest was introduced, but I don't want to assume.

Re: [PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Andrew Morton]

On Thu,  2 Apr 2026 16:59:33 -0700 Anthony Yznaga <anthony.yznaga@oracle.com> wrote:

> For configs that support MAP_DROPPABLE verify that a mapping created
> with MAP_DROPPABLE cannot be locked via mlock(), and that it will not
> be locked if it's created after mlockall(MCL_FUTURE).

There are a few queries from the AI reviewbot;
	https://sashiko.dev/#/patchset/20260402235933.10588-1-anthony.yznaga@oracle.com

[PATCH v2 2/2] selftests/mm: verify droppable mappings cannot be locked

[Anthony Yznaga]

For configs that support MAP_DROPPABLE verify that a mapping created
with MAP_DROPPABLE cannot be locked via mlock(), and that it will not
be locked if it's created after mlockall(MCL_FUTURE).

Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
---
 tools/testing/selftests/mm/mlock2-tests.c | 87 ++++++++++++++++++++---
 1 file changed, 78 insertions(+), 9 deletions(-)

diff --git a/tools/testing/selftests/mm/mlock2-tests.c b/tools/testing/selftests/mm/mlock2-tests.c
index b474f2b20def..353d0e5daa44 100644
--- a/tools/testing/selftests/mm/mlock2-tests.c
+++ b/tools/testing/selftests/mm/mlock2-tests.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #define _GNU_SOURCE
 #include <sys/mman.h>
+#include <linux/mman.h>
 #include <stdint.h>
 #include <unistd.h>
 #include <string.h>
@@ -163,14 +164,17 @@ static int lock_check(unsigned long addr)
 	return (vma_rss == vma_size);
 }
 
-static int unlock_lock_check(char *map)
+static int unlock_lock_check(char *map, bool mlock_supported)
 {
-	if (is_vmflag_set((unsigned long)map, LOCKED)) {
+	if (!is_vmflag_set((unsigned long)map, LOCKED))
+		return 0;
+
+	if (mlock_supported)
 		ksft_print_msg("VMA flag %s is present on page 1 after unlock\n", LOCKED);
-		return 1;
-	}
+	else
+		ksft_print_msg("VMA flag %s is present on an unsupported VMA\n", LOCKED);
 
-	return 0;
+	return 1;
 }
 
 static void test_mlock_lock(void)
@@ -196,7 +200,7 @@ static void test_mlock_lock(void)
 		ksft_exit_fail_msg("munlock(): %s\n", strerror(errno));
 	}
 
-	ksft_test_result(!unlock_lock_check(map), "%s: Unlocked\n", __func__);
+	ksft_test_result(!unlock_lock_check(map, true), "%s: Unlocked\n", __func__);
 	munmap(map, 2 * page_size);
 }
 
@@ -296,7 +300,7 @@ static void test_munlockall0(void)
 		ksft_exit_fail_msg("munlockall(): %s\n", strerror(errno));
 	}
 
-	ksft_test_result(!unlock_lock_check(map), "%s: No locked memory\n", __func__);
+	ksft_test_result(!unlock_lock_check(map, true), "%s: No locked memory\n", __func__);
 	munmap(map, 2 * page_size);
 }
 
@@ -336,7 +340,70 @@ static void test_munlockall1(void)
 		ksft_exit_fail_msg("munlockall() %s\n", strerror(errno));
 	}
 
-	ksft_test_result(!unlock_lock_check(map), "%s: No locked memory\n", __func__);
+	ksft_test_result(!unlock_lock_check(map, true), "%s: No locked memory\n", __func__);
+	munmap(map, 2 * page_size);
+}
+
+/*
+ * Droppable memory should not be lockable.
+ */
+static void test_mlock_droppable(void)
+{
+	char *map;
+	unsigned long page_size = getpagesize();
+
+	/*
+	 * Ensure MCL_FUTURE is not set.
+	 */
+	if (munlockall()) {
+		ksft_test_result_fail("munlockall() %s\n", strerror(errno));
+		return;
+	}
+
+	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
+		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
+	if (map == MAP_FAILED) {
+		if (errno == EOPNOTSUPP)
+			ksft_test_result_skip("%s: MAP_DROPPABLE not supported\n", __func__);
+		else
+			ksft_test_result_fail("mmap error: %s\n", strerror(errno));
+		return;
+	}
+
+	if (mlock2_(map, 2 * page_size, 0))
+		ksft_test_result_fail("mlock2(0): %s\n", strerror(errno));
+	else
+		ksft_test_result(!unlock_lock_check(map, false),
+				"%s: droppable memory not locked\n", __func__);
+
+	munmap(map, 2 * page_size);
+}
+
+static void test_mlockall_future_droppable(void)
+{
+	char *map;
+	unsigned long page_size = getpagesize();
+
+	if (mlockall(MCL_CURRENT | MCL_FUTURE)) {
+		ksft_test_result_fail("mlockall(MCL_CURRENT | MCL_FUTURE): %s\n", strerror(errno));
+		return;
+	}
+
+	map = mmap(NULL, 2 * page_size, PROT_READ | PROT_WRITE,
+		   MAP_ANONYMOUS | MAP_DROPPABLE, -1, 0);
+
+	if (map == MAP_FAILED) {
+		if (errno == EOPNOTSUPP)
+			ksft_test_result_skip("%s: MAP_DROPPABLE not supported\n", __func__);
+		else
+			ksft_test_result_fail("mmap error: %s\n", strerror(errno));
+		return;
+	}
+
+	ksft_test_result(!unlock_lock_check(map, false), "%s: droppable memory not locked\n",
+			__func__);
+
+	munlockall();
 	munmap(map, 2 * page_size);
 }
 
@@ -442,7 +509,7 @@ int main(int argc, char **argv)
 
 	munmap(map, size);
 
-	ksft_set_plan(13);
+	ksft_set_plan(15);
 
 	test_mlock_lock();
 	test_mlock_onfault();
@@ -451,6 +518,8 @@ int main(int argc, char **argv)
 	test_lock_onfault_of_present();
 	test_vma_management(true);
 	test_mlockall();
+	test_mlock_droppable();
+	test_mlockall_future_droppable();
 
 	ksft_finished();
 }
-- 
2.47.3