On Tue, Nov 10, 2026 at 07:25:43PM +0800, Hao Ge wrote: > vmap_page_range() and __vmap_pages_range() call flush_cache_vmap() > before they even look at the error code. A failed mapping is never > used, so the flush is pointless at best. > > According to the Sashiko review it is worse than pointless on UML: > flush_cache_vmap() there is flush_tlb_kernel_range(), which syncs the > PTEs into the host OS. Flushing a half-installed mapping therefore > leaves host mappings behind for a range that was just freed again. > > Only flush when the mapping, and for vmap_page_range() also the KMSAN > metadata, is fully set up. > > Reported-by: Sashiko <[email protected]> > Signed-off-by: Hao Ge <[email protected]> > --- > mm/vmalloc.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > index 0565cbfe325c..3f98056f8c7e 100644 > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -369,10 +369,12 @@ int vmap_page_range(unsigned long addr, unsigned long > end, > > err = vmap_range_noflush(addr, end, phys_addr, pgprot_nx(prot), > ioremap_max_page_shift); > - flush_cache_vmap(addr, end); > if (!err) > err = kmsan_ioremap_page_range(addr, end, phys_addr, prot, > ioremap_max_page_shift); > + if (!err) > + flush_cache_vmap(addr, end); > + > return err; > } > > @@ -758,7 +760,9 @@ static int __vmap_pages_range(unsigned long addr, > unsigned long end, > int err; > > err = vmap_pages_range_noflush(addr, end, prot, pages, page_shift, > gfp_mask); > - flush_cache_vmap(addr, end); > + if (!err) > + flush_cache_vmap(addr, end); > + > return err; > } > > -- > 2.25.1 > Like Suren noted, vmap_pages_range_batched() should be fixed also.
-- Uladzislau Rezki
