From: Alexei Starovoitov The user range of an arena must not cross a 4 GiB boundary. Thus arena_get_unmapped_area() asks the mm for 2 * len bytes and rounds the result up if necessary. If user_vm_start is not 0, addr must be equal to it. A WARN_ON_ONCE() assumes that the mm returns addr. But addr is only a hint without MAP_FIXED, and the mm can return a different range that crosses a boundary. This is not a kernel bug. Remove the WARN_ON_ONCE() and its -EFAULT. arena_map_mmap() already compares vm_start with user_vm_start under arena->lock. If the rounded result is user_vm_start, mmap() succeeds. If not, it returns -EBUSY. Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Signed-off-by: Alexei Starovoitov --- kernel/bpf/arena.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c index c35b82f44f66..0b1ec3306ea4 100644 --- a/kernel/bpf/arena.c +++ b/kernel/bpf/arena.c @@ -655,9 +655,6 @@ static unsigned long arena_get_unmapped_area(struct file *filp, unsigned long ad return -EINVAL; if ((ret >> 32) == ((ret + len - 1) >> 32)) return ret; - if (WARN_ON_ONCE(arena->user_vm_start)) - /* checks at map creation time should prevent this */ - return -EFAULT; return round_up(ret, SZ_4G); } -- 2.55.0