Q: Given the following code slice:
```
1 struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
2 			struct vm_area_struct *prev, unsigned long addr,
3 			unsigned long end, unsigned long vm_flags,
4 			struct anon_vma *anon_vma, struct file *file,
5 			pgoff_t pgoff, struct mempolicy *policy,
6 			struct vm_userfaultfd_ctx vm_userfaultfd_ctx,
7 			struct anon_vma_name *anon_name)
8 {
9 	struct vm_area_struct *curr, *next, *res;
10 	struct vm_area_struct *vma, *adjust, *remove, *remove2;
11 	struct vm_area_struct *anon_dup = NULL;
12 	struct vma_prepare vp;
13 	pgoff_t vma_pgoff;
14 	int err = 0;
15 	bool merge_prev = false;
16 	bool merge_next = false;
17 	bool vma_expanded = false;
18 	unsigned long vma_start = addr;
19 	unsigned long vma_end = end;
20 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
21 	long adj_start = 0;
22 
23 	/*
24 	 * We later require that vma->vm_flags == vm_flags,
25 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
26 	 */
27 	if (vm_flags & VM_SPECIAL)
28 		return NULL;
29 
30 	/* Does the input range span an existing VMA? (cases 5 - 8) */
31 	curr = find_vma_intersection(mm, prev ? prev->vm_end : 0, end);
32 
33 	if (!curr ||			/* cases 1 - 4 */
34 	    end == curr->vm_end)	/* cases 6 - 8, adjacent VMA */
35 		next = vma_lookup(mm, end);
36 	else
37 		next = NULL;		/* case 5 */
38 
39 	if (prev) {
40 		vma_start = prev->vm_start;
41 		vma_pgoff = prev->vm_pgoff;
42 
43 		/* Can we merge the predecessor? */
44 		if (addr == prev->vm_end && mpol_equal(vma_policy(prev), policy)
45 		    && can_vma_merge_after(prev, vm_flags, anon_vma, file,
46 					   pgoff, vm_userfaultfd_ctx, anon_name)) {
47 			merge_prev = true;
48 			vma_prev(vmi);
49 		}
50 	}
51 
52 	/* Can we merge the successor? */
53 	if (next && mpol_equal(policy, vma_policy(next)) &&
54 	    can_vma_merge_before(next, vm_flags, anon_vma, file, pgoff+pglen,
55 				 vm_userfaultfd_ctx, anon_name)) {
56 		merge_next = true;
57 	}
58 
59 	/* Verify some invariant that must be enforced by the caller. */
60 	VM_WARN_ON(prev && addr <= prev->vm_start);
61 	VM_WARN_ON(curr && (addr != curr->vm_start || end > curr->vm_end));
62 	VM_WARN_ON(addr >= end);
63 
64 	if (!merge_prev && !merge_next)
65 		return NULL; /* Not mergeable. */
66 
67 	if (merge_prev)
68 		vma_start_write(prev);
69 
70 	res = vma = prev;
71 	remove = remove2 = adjust = NULL;
72 
73 	/* Can we merge both the predecessor and the successor? */
74 	if (merge_prev && merge_next &&
75 	    is_mergeable_anon_vma(prev->anon_vma, next->anon_vma, NULL)) {
76 		vma_start_write(next);
77 		remove = next;				/* case 1 */
78 		vma_end = next->vm_end;
79 		err = dup_anon_vma(prev, next, &anon_dup);
80 		if (curr) {				/* case 6 */
81 			vma_start_write(curr);
82 			remove = curr;
83 			remove2 = next;
84 			if (!next->anon_vma)
85 				err = dup_anon_vma(prev, curr, &anon_dup);
86 		}
87 	} else if (merge_prev) {			/* case 2 */
88 		if (curr) {
89 			vma_start_write(curr);
90 			if (end == curr->vm_end) {	/* case 7 */
91 				/*
92 				 * can_vma_merge_after() assumed we would not be
93 				 * removing prev vma, so it skipped the check
94 				 * for vm_ops->close, but we are removing curr
95 				 */
96 				if (curr->vm_ops && curr->vm_ops->close)
97 					err = -EINVAL;
98 				remove = curr;
99 			} else {			/* case 5 */
100 				adjust = curr;
101 				adj_start = (end - curr->vm_start);
102 			}
103 			if (!err)
104 				err = dup_anon_vma(prev, curr, &anon_dup);
105 		}
106 	} else { /* merge_next */
107 		vma_start_write(next);
108 		res = next;
109 		if (prev && addr < prev->vm_end) {	/* case 4 */
110 			vma_start_write(prev);
111 			vma_end = addr;
112 			adjust = next;
113 			adj_start = -(prev->vm_end - addr);
114 			err = dup_anon_vma(next, prev, &anon_dup);
115 		} else {
116 			/*
117 			 * Note that cases 3 and 8 are the ONLY ones where prev
118 			 * is permitted to be (but is not necessarily) NULL.
119 			 */
120 			vma = next;			/* case 3 */
121 			vma_start = addr;
122 			vma_end = next->vm_end;
123 			vma_pgoff = next->vm_pgoff - pglen;
124 			if (curr) {			/* case 8 */
125 				vma_pgoff = curr->vm_pgoff;
126 				vma_start_write(curr);
127 				remove = curr;
128 				err = dup_anon_vma(next, curr, &anon_dup);
129 			}
130 		}
131 	}
132 
133 	/* Error in anon_vma clone. */
134 	if (err)
135 		goto anon_vma_fail;
136 
137 	if (vma_start < vma->vm_start || vma_end > vma->vm_end)
138 		vma_expanded = true;
139 
140 	if (vma_expanded) {
141 		vma_iter_config(vmi, vma_start, vma_end);
142 	} else {
143 		vma_iter_config(vmi, adjust->vm_start + adj_start,
144 				adjust->vm_end);
145 	}
146 
147 	if (vma_iter_prealloc(vmi, vma))
148 		goto prealloc_fail;
149 
150 	init_multi_vma_prep(&vp, vma, adjust, remove, remove2);
151 	VM_WARN_ON(vp.anon_vma && adjust && adjust->anon_vma &&
152 		   vp.anon_vma != adjust->anon_vma);
153 
154 	vma_prepare(&vp);
155 	vma_adjust_trans_huge(vma, vma_start, vma_end, adj_start);
156 
157 	vma->vm_start = vma_start;
158 	vma->vm_end = vma_end;
159 	vma->vm_pgoff = vma_pgoff;
160 
161 	if (vma_expanded)
162 		vma_iter_store(vmi, vma);
163 
164 	if (adj_start) {
165 		adjust->vm_start += adj_start;
166 		adjust->vm_pgoff += adj_start >> PAGE_SHIFT;
167 		if (adj_start < 0) {
168 			WARN_ON(vma_expanded);
169 			vma_iter_store(vmi, next);
170 		}
171 	}
172 
173 	vma_complete(&vp, vmi, mm);
174 	khugepaged_enter_vma(res, vm_flags);
175 	return res;
176 
177 prealloc_fail:
178 	if (anon_dup)
179 		unlink_anon_vmas(anon_dup);
180 
181 anon_vma_fail:
182 	vma_iter_set(vmi, addr);
183 	vma_iter_load(vmi);
184 	return NULL;
185 }
186 void anon_vma_interval_tree_remove(struct anon_vma_chain *node,
187 				   struct rb_root_cached *root)
188 {
189 	__anon_vma_interval_tree_remove(node, root);
190 }
191 static inline void init_multi_vma_prep(struct vma_prepare *vp,
192 		struct vm_area_struct *vma, struct vm_area_struct *next,
193 		struct vm_area_struct *remove, struct vm_area_struct *remove2)
194 {
195 	memset(vp, 0, sizeof(struct vma_prepare));
196 	vp->vma = vma;
197 	vp->anon_vma = vma->anon_vma;
198 	vp->remove = remove;
199 	vp->remove2 = remove2;
200 	vp->adj_next = next;
201 	if (!vp->anon_vma && next)
202 		vp->anon_vma = next->anon_vma;
203 
204 	vp->file = vma->vm_file;
205 	if (vp->file)
206 		vp->mapping = vma->vm_file->f_mapping;
207 
208 }
209 static inline bool mas_is_start(const struct ma_state *mas)
210 {
211 	return mas->node == MAS_START;
212 }
213 void unlink_anon_vmas(struct vm_area_struct *vma)
214 {
215 	struct anon_vma_chain *avc, *next;
216 	struct anon_vma *root = NULL;
217 
218 	/*
219 	 * Unlink each anon_vma chained to the VMA.  This list is ordered
220 	 * from newest to oldest, ensuring the root anon_vma gets freed last.
221 	 */
222 	list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
223 		struct anon_vma *anon_vma = avc->anon_vma;
224 
225 		root = lock_anon_vma_root(root, anon_vma);
226 		anon_vma_interval_tree_remove(avc, &anon_vma->rb_root);
227 
228 		/*
229 		 * Leave empty anon_vmas on the list - we'll need
230 		 * to free them outside the lock.
231 		 */
232 		if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) {
233 			anon_vma->parent->num_children--;
234 			continue;
235 		}
236 
237 		list_del(&avc->same_vma);
238 		anon_vma_chain_free(avc);
239 	}
240 	if (vma->anon_vma) {
241 		vma->anon_vma->num_active_vmas--;
242 
243 		/*
244 		 * vma would still be needed after unlink, and anon_vma will be prepared
245 		 * when handle fault.
246 		 */
247 		vma->anon_vma = NULL;
248 	}
249 	unlock_anon_vma_root(root);
250 
251 	/*
252 	 * Iterate the list once more, it now only contains empty and unlinked
253 	 * anon_vmas, destroy them. Could not do before due to __put_anon_vma()
254 	 * needing to write-acquire the anon_vma->root->rwsem.
255 	 */
256 	list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
257 		struct anon_vma *anon_vma = avc->anon_vma;
258 
259 		VM_WARN_ON(anon_vma->num_children);
260 		VM_WARN_ON(anon_vma->num_active_vmas);
261 		put_anon_vma(anon_vma);
262 
263 		list_del(&avc->same_vma);
264 		anon_vma_chain_free(avc);
265 	}
266 }
267 static inline void mmap_write_lock(struct mm_struct *mm)
268 {
269 	__mmap_lock_trace_start_locking(mm, true);
270 	down_write(&mm->mmap_lock);
271 	__mmap_lock_trace_acquire_returned(mm, true, true);
272 }
273 static inline void __mas_set_range(struct ma_state *mas, unsigned long start,
274 		unsigned long last)
275 {
276 	mas->index = start;
277 	mas->last = last;
278 }
279 static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1,
280 				    struct anon_vma_name *anon_name2)
281 {
282 	if (anon_name1 == anon_name2)
283 		return true;
284 
285 	return anon_name1 && anon_name2 &&
286 		!strcmp(anon_name1->name, anon_name2->name);
287 }
288 static inline void init_multi_vma_prep(struct vma_prepare *vp,
289 		struct vm_area_struct *vma, struct vm_area_struct *next,
290 		struct vm_area_struct *remove, struct vm_area_struct *remove2)
291 {
292 	memset(vp, 0, sizeof(struct vma_prepare));
293 	vp->vma = vma;
294 	vp->anon_vma = vma->anon_vma;
295 	vp->remove = remove;
296 	vp->remove2 = remove2;
297 	vp->adj_next = next;
298 	if (!vp->anon_vma && next)
299 		vp->anon_vma = next->anon_vma;
300 
301 	vp->file = vma->vm_file;
302 	if (vp->file)
303 		vp->mapping = vma->vm_file->f_mapping;
304 
305 }
306 static void *mas_prev_slot(struct ma_state *mas, unsigned long min, bool empty,
307 			   bool set_underflow)
308 {
309 	void *entry;
310 	void __rcu **slots;
311 	unsigned long pivot;
312 	enum maple_type type;
313 	unsigned long *pivots;
314 	struct maple_node *node;
315 	unsigned long save_point = mas->index;
316 
317 retry:
318 	node = mas_mn(mas);
319 	type = mte_node_type(mas->node);
320 	pivots = ma_pivots(node, type);
321 	if (unlikely(mas_rewalk_if_dead(mas, node, save_point)))
322 		goto retry;
323 
324 	if (mas->min <= min) {
325 		pivot = mas_safe_min(mas, pivots, mas->offset);
326 
327 		if (unlikely(mas_rewalk_if_dead(mas, node, save_point)))
328 			goto retry;
329 
330 		if (pivot <= min)
331 			goto underflow;
332 	}
333 
334 again:
335 	if (likely(mas->offset)) {
336 		mas->offset--;
337 		mas->last = mas->index - 1;
338 		mas->index = mas_safe_min(mas, pivots, mas->offset);
339 	} else  {
340 		if (mas_prev_node(mas, min)) {
341 			mas_rewalk(mas, save_point);
342 			goto retry;
343 		}
344 
345 		if (mas_is_none(mas))
346 			goto underflow;
347 
348 		mas->last = mas->max;
349 		node = mas_mn(mas);
350 		type = mte_node_type(mas->node);
351 		pivots = ma_pivots(node, type);
352 		mas->index = pivots[mas->offset - 1] + 1;
353 	}
354 
355 	slots = ma_slots(node, type);
356 	entry = mas_slot(mas, slots, mas->offset);
357 	if (unlikely(mas_rewalk_if_dead(mas, node, save_point)))
358 		goto retry;
359 
360 	if (likely(entry))
361 		return entry;
362 
363 	if (!empty) {
364 		if (mas->index <= min)
365 			goto underflow;
366 
367 		goto again;
368 	}
369 
370 	return entry;
371 
372 underflow:
373 	if (set_underflow)
374 		mas->node = MAS_UNDERFLOW;
375 	return NULL;
376 }
377 static inline void flush_dcache_mmap_unlock(struct address_space *mapping)
378 {
379 }
380 struct vm_area_struct *vma_lookup(struct mm_struct *mm, unsigned long addr)
381 {
382 	return mtree_load(&mm->mm_mt, addr);
383 }
384 bool hugepage_vma_check(struct vm_area_struct *vma, unsigned long vm_flags,
385 			bool smaps, bool in_pf, bool enforce_sysfs)
386 {
387 	if (!vma->vm_mm)		/* vdso */
388 		return false;
389 
390 	/*
391 	 * Explicitly disabled through madvise or prctl, or some
392 	 * architectures may disable THP for some mappings, for
393 	 * example, s390 kvm.
394 	 * */
395 	if ((vm_flags & VM_NOHUGEPAGE) ||
396 	    test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags))
397 		return false;
398 	/*
399 	 * If the hardware/firmware marked hugepage support disabled.
400 	 */
401 	if (transparent_hugepage_flags & (1 << TRANSPARENT_HUGEPAGE_UNSUPPORTED))
402 		return false;
403 
404 	/* khugepaged doesn't collapse DAX vma, but page fault is fine. */
405 	if (vma_is_dax(vma))
406 		return in_pf;
407 
408 	/*
409 	 * Special VMA and hugetlb VMA.
410 	 * Must be checked after dax since some dax mappings may have
411 	 * VM_MIXEDMAP set.
412 	 */
413 	if (vm_flags & VM_NO_KHUGEPAGED)
414 		return false;
415 
416 	/*
417 	 * Check alignment for file vma and size for both file and anon vma.
418 	 *
419 	 * Skip the check for page fault. Huge fault does the check in fault
420 	 * handlers. And this check is not suitable for huge PUD fault.
421 	 */
422 	if (!in_pf &&
423 	    !transhuge_vma_suitable(vma, (vma->vm_end - HPAGE_PMD_SIZE)))
424 		return false;
425 
426 	/*
427 	 * Enabled via shmem mount options or sysfs settings.
428 	 * Must be done before hugepage flags check since shmem has its
429 	 * own flags.
430 	 */
431 	if (!in_pf && shmem_file(vma->vm_file))
432 		return shmem_is_huge(file_inode(vma->vm_file), vma->vm_pgoff,
433 				     !enforce_sysfs, vma->vm_mm, vm_flags);
434 
435 	/* Enforce sysfs THP requirements as necessary */
436 	if (enforce_sysfs &&
437 	    (!hugepage_flags_enabled() || (!(vm_flags & VM_HUGEPAGE) &&
438 					   !hugepage_flags_always())))
439 		return false;
440 
441 	/* Only regular file is valid */
442 	if (!in_pf && file_thp_enabled(vma))
443 		return true;
444 
445 	if (!vma_is_anonymous(vma))
446 		return false;
447 
448 	if (vma_is_temporary_stack(vma))
449 		return false;
450 
451 	/*
452 	 * THPeligible bit of smaps should show 1 for proper VMAs even
453 	 * though anon_vma is not initialized yet.
454 	 *
455 	 * Allow page fault since anon_vma may be not initialized until
456 	 * the first page fault.
457 	 */
458 	if (!vma->anon_vma)
459 		return (smaps || in_pf);
460 
461 	return true;
462 }
463 static inline bool mmget_not_zero(struct mm_struct *mm)
464 {
465 	return atomic_inc_not_zero(&mm->mm_users);
466 }
467 static inline void rcu_read_unlock(void)
468 {
469 	RCU_LOCKDEP_WARN(!rcu_is_watching(),
470 			 "rcu_read_unlock() used illegally while idle");
471 	__release(RCU);
472 	__rcu_read_unlock();
473 	rcu_lock_release(&rcu_lock_map); /* Keep acq info for rls diags. */
474 }
475 static inline bool mas_is_ptr(const struct ma_state *mas)
476 {
477 	return mas->node == MAS_ROOT;
478 }
479 static inline int rwsem_is_locked(struct rw_semaphore *sem)
480 {
481 	return atomic_long_read(&sem->count) != 0;
482 }
483 static inline void mas_set(struct ma_state *mas, unsigned long index)
484 {
485 
486 	mas_set_range(mas, index, index);
487 }
488 static __always_inline void instrument_atomic_read_write(const volatile void *v, size_t size)
489 {
490 	kasan_check_write(v, size);
491 	kcsan_check_atomic_read_write(v, size);
492 }
493 void* memset(void* s, int c, size_t n)
494 {
495 	int i;
496 	char *ss = (char*)s;
497 
498 	for (i=0;i<n;i++) ss[i] = c;
499 	return s;
500 }
501 void fput(struct file *file)
502 {
503 	if (atomic_long_dec_and_test(&file->f_count)) {
504 		struct task_struct *task = current;
505 
506 		if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) {
507 			init_task_work(&file->f_rcuhead, ____fput);
508 			if (!task_work_add(task, &file->f_rcuhead, TWA_RESUME))
509 				return;
510 			/*
511 			 * After this task has run exit_task_work(),
512 			 * task_work_add() will fail.  Fall through to delayed
513 			 * fput to avoid leaking *file.
514 			 */
515 		}
516 
517 		if (llist_add(&file->f_llist, &delayed_fput_list))
518 			schedule_delayed_work(&delayed_fput_work, 1);
519 	}
520 }
521 void vma_adjust_trans_huge(struct vm_area_struct *vma,
522 			     unsigned long start,
523 			     unsigned long end,
524 			     long adjust_next)
525 {
526 	/* Check if we need to split start first. */
527 	split_huge_pmd_if_needed(vma, start);
528 
529 	/* Check if we need to split end next. */
530 	split_huge_pmd_if_needed(vma, end);
531 
532 	/*
533 	 * If we're also updating the next vma vm_start,
534 	 * check if we need to split it.
535 	 */
536 	if (adjust_next > 0) {
537 		struct vm_area_struct *next = find_vma(vma->vm_mm, vma->vm_end);
538 		unsigned long nstart = next->vm_start;
539 		nstart += adjust_next;
540 		split_huge_pmd_if_needed(next, nstart);
541 	}
542 }
543 int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp)
544 {
545 	MA_WR_STATE(wr_mas, mas, entry);
546 	unsigned char node_size;
547 	int request = 1;
548 	int ret;
549 
550 
551 	if (unlikely(!mas->index && mas->last == ULONG_MAX))
552 		goto ask_now;
553 
554 	mas_wr_store_setup(&wr_mas);
555 	wr_mas.content = mas_start(mas);
556 	/* Root expand */
557 	if (unlikely(mas_is_none(mas) || mas_is_ptr(mas)))
558 		goto ask_now;
559 
560 	if (unlikely(!mas_wr_walk(&wr_mas))) {
561 		/* Spanning store, use worst case for now */
562 		request = 1 + mas_mt_height(mas) * 3;
563 		goto ask_now;
564 	}
565 
566 	/* At this point, we are at the leaf node that needs to be altered. */
567 	/* Exact fit, no nodes needed. */
568 	if (wr_mas.r_min == mas->index && wr_mas.r_max == mas->last)
569 		return 0;
570 
571 	mas_wr_end_piv(&wr_mas);
572 	node_size = mas_wr_new_end(&wr_mas);
573 
574 	/* Slot store, does not require additional nodes */
575 	if (node_size == wr_mas.node_end) {
576 		/* reuse node */
577 		if (!mt_in_rcu(mas->tree))
578 			return 0;
579 		/* shifting boundary */
580 		if (wr_mas.offset_end - mas->offset == 1)
581 			return 0;
582 	}
583 
584 	if (node_size >= mt_slots[wr_mas.type]) {
585 		/* Split, worst case for now. */
586 		request = 1 + mas_mt_height(mas) * 2;
587 		goto ask_now;
588 	}
589 
590 	/* New root needs a singe node */
591 	if (unlikely(mte_is_root(mas->node)))
592 		goto ask_now;
593 
594 	/* Potential spanning rebalance collapsing a node, use worst-case */
595 	if (node_size  - 1 <= mt_min_slots[wr_mas.type])
596 		request = mas_mt_height(mas) * 2 - 1;
597 
598 	/* node store, slot store needs one node */
599 ask_now:
600 	mas_node_count_gfp(mas, request, gfp);
601 	mas->mas_flags |= MA_STATE_PREALLOC;
602 	if (likely(!mas_is_err(mas)))
603 		return 0;
604 
605 	mas_set_alloc_req(mas, 0);
606 	ret = xa_err(mas->node);
607 	mas_reset(mas);
608 	mas_destroy(mas);
609 	mas_reset(mas);
610 	return ret;
611 }
612 bool __mpol_equal(struct mempolicy *a, struct mempolicy *b)
613 {
614 	if (!a || !b)
615 		return false;
616 	if (a->mode != b->mode)
617 		return false;
618 	if (a->flags != b->flags)
619 		return false;
620 	if (a->home_node != b->home_node)
621 		return false;
622 	if (mpol_store_user_nodemask(a))
623 		if (!nodes_equal(a->w.user_nodemask, b->w.user_nodemask))
624 			return false;
625 
626 	switch (a->mode) {
627 	case MPOL_BIND:
628 	case MPOL_INTERLEAVE:
629 	case MPOL_PREFERRED:
630 	case MPOL_PREFERRED_MANY:
631 		return !!nodes_equal(a->nodes, b->nodes);
632 	case MPOL_LOCAL:
633 		return true;
634 	default:
635 		BUG();
636 		return false;
637 	}
638 }
639 static inline bool xa_is_zero(const void *entry)
640 {
641 	return unlikely(entry == XA_ZERO_ENTRY);
642 }
643 static bool
644 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
645 		struct anon_vma *anon_vma, struct file *file,
646 		pgoff_t vm_pgoff, struct vm_userfaultfd_ctx vm_userfaultfd_ctx,
647 		struct anon_vma_name *anon_name)
648 {
649 	if (is_mergeable_vma(vma, file, vm_flags, vm_userfaultfd_ctx, anon_name, true) &&
650 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
651 		if (vma->vm_pgoff == vm_pgoff)
652 			return true;
653 	}
654 	return false;
655 }
656 struct anon_vma_name *anon_vma_name_alloc(const char *name)
657 {
658 	struct anon_vma_name *anon_name;
659 	size_t count;
660 
661 	/* Add 1 for NUL terminator at the end of the anon_name->name */
662 	count = strlen(name) + 1;
663 	anon_name = kmalloc(struct_size(anon_name, name, count), GFP_KERNEL);
664 	if (anon_name) {
665 		kref_init(&anon_name->kref);
666 		memcpy(anon_name->name, name, count);
667 	}
668 
669 	return anon_name;
670 }
671 static inline bool mas_prev_setup(struct ma_state *mas, unsigned long min,
672 		void **entry)
673 {
674 	if (unlikely(mas->index <= min)) {
675 		mas->node = MAS_UNDERFLOW;
676 		return true;
677 	}
678 
679 	if (mas_is_active(mas))
680 		return false;
681 
682 	if (mas_is_overflow(mas)) {
683 		mas->node = MAS_START;
684 		*entry = mas_walk(mas);
685 		if (*entry)
686 			return true;
687 	}
688 
689 	if (mas_is_none(mas) || mas_is_paused(mas)) {
690 		mas->node = MAS_START;
691 	} else if (mas_is_underflow(mas)) {
692 		/* underflowed before but the min changed */
693 		mas->node = MAS_START;
694 	}
695 
696 	if (mas_is_start(mas))
697 		mas_walk(mas);
698 
699 	if (unlikely(mas_is_ptr(mas))) {
700 		if (!mas->index)
701 			goto none;
702 		mas->index = mas->last = 0;
703 		*entry = mas_root(mas);
704 		return true;
705 	}
706 
707 	if (mas_is_none(mas)) {
708 		if (mas->index) {
709 			/* Walked to out-of-range pointer? */
710 			mas->index = mas->last = 0;
711 			mas->node = MAS_ROOT;
712 			*entry = mas_root(mas);
713 			return true;
714 		}
715 		return true;
716 	}
717 
718 	return false;
719 
720 none:
721 	mas->node = MAS_NONE;
722 	return true;
723 }
724 static inline struct vm_area_struct *vma_iter_load(struct vma_iterator *vmi)
725 {
726 	return mas_walk(&vmi->mas);
727 }
728 void *mas_walk(struct ma_state *mas)
729 {
730 	void *entry;
731 
732 	if (!mas_is_active(mas) || !mas_is_start(mas))
733 		mas->node = MAS_START;
734 retry:
735 	entry = mas_state_walk(mas);
736 	if (mas_is_start(mas)) {
737 		goto retry;
738 	} else if (mas_is_none(mas)) {
739 		mas->index = 0;
740 		mas->last = ULONG_MAX;
741 	} else if (mas_is_ptr(mas)) {
742 		if (!mas->index) {
743 			mas->last = 0;
744 			return entry;
745 		}
746 
747 		mas->index = 1;
748 		mas->last = ULONG_MAX;
749 		mas->node = MAS_NONE;
750 		return NULL;
751 	}
752 
753 	return entry;
754 }
755 static inline int dup_anon_vma(struct vm_area_struct *dst,
756 		struct vm_area_struct *src, struct vm_area_struct **dup)
757 {
758 	/*
759 	 * Easily overlooked: when mprotect shifts the boundary, make sure the
760 	 * expanding vma has anon_vma set if the shrinking vma had, to cover any
761 	 * anon pages imported.
762 	 */
763 	if (src->anon_vma && !dst->anon_vma) {
764 		int ret;
765 
766 		vma_assert_write_locked(dst);
767 		dst->anon_vma = src->anon_vma;
768 		ret = anon_vma_clone(dst, src);
769 		if (ret)
770 			return ret;
771 
772 		*dup = dst;
773 	}
774 
775 	return 0;
776 }
777 static inline bool is_mergeable_anon_vma(struct anon_vma *anon_vma1,
778 		 struct anon_vma *anon_vma2, struct vm_area_struct *vma)
779 {
780 	/*
781 	 * The list_is_singular() test is to avoid merging VMA cloned from
782 	 * parents. This can improve scalability caused by anon_vma lock.
783 	 */
784 	if ((!anon_vma1 || !anon_vma2) && (!vma ||
785 		list_is_singular(&vma->anon_vma_chain)))
786 		return true;
787 	return anon_vma1 == anon_vma2;
788 }
789 static inline void i_mmap_unlock_write(struct address_space *mapping)
790 {
791 	up_write(&mapping->i_mmap_rwsem);
792 }
793 static __always_inline void rcu_read_lock(void)
794 {
795 	__rcu_read_lock();
796 	__acquire(RCU);
797 	rcu_lock_acquire(&rcu_lock_map);
798 	RCU_LOCKDEP_WARN(!rcu_is_watching(),
799 			 "rcu_read_lock() used illegally while idle");
800 }
801 static inline void
802 anon_vma_interval_tree_post_update_vma(struct vm_area_struct *vma)
803 {
804 	struct anon_vma_chain *avc;
805 
806 	list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
807 		anon_vma_interval_tree_insert(avc, &avc->anon_vma->rb_root);
808 }
809 static inline int list_is_singular(const struct list_head *head)
810 {
811 	return !list_empty(head) && (head->next == head->prev);
812 }
813 static inline void unlock_anon_vma_root(struct anon_vma *root)
814 {
815 	if (root)
816 		up_write(&root->rwsem);
817 }
818 static inline void vma_iter_config(struct vma_iterator *vmi,
819 		unsigned long index, unsigned long last)
820 {
821 	MAS_BUG_ON(&vmi->mas, vmi->mas.node != MAS_START &&
822 		   (vmi->mas.index > index || vmi->mas.last < index));
823 	__mas_set_range(&vmi->mas, index, last - 1);
824 }
825 struct vm_area_struct *find_vma_intersection(struct mm_struct *mm,
826 					     unsigned long start_addr,
827 					     unsigned long end_addr)
828 {
829 	unsigned long index = start_addr;
830 
831 	mmap_assert_locked(mm);
832 	return mt_find(&mm->mm_mt, &index, end_addr - 1);
833 }
834 static inline void vma_iter_set(struct vma_iterator *vmi, unsigned long addr)
835 {
836 	mas_set(&vmi->mas, addr);
837 }
838 void *mas_prev(struct ma_state *mas, unsigned long min)
839 {
840 	void *entry = NULL;
841 
842 	if (mas_prev_setup(mas, min, &entry))
843 		return entry;
844 
845 	return mas_prev_slot(mas, min, false, true);
846 }
847 static inline unsigned long vma_pages(struct vm_area_struct *vma)
848 {
849 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
850 }
851 static inline void mpol_put(struct mempolicy *pol)
852 {
853 	if (pol)
854 		__mpol_put(pol);
855 }
856 static void __remove_shared_vm_struct(struct vm_area_struct *vma,
857 		struct file *file, struct address_space *mapping)
858 {
859 	if (vma->vm_flags & VM_SHARED)
860 		mapping_unmap_writable(mapping);
861 
862 	flush_dcache_mmap_lock(mapping);
863 	vma_interval_tree_remove(vma, &mapping->i_mmap);
864 	flush_dcache_mmap_unlock(mapping);
865 }
866 static inline struct vm_area_struct *vma_prev(struct vma_iterator *vmi)
867 {
868 	return mas_prev(&vmi->mas, 0);
869 }
870 void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned long end)
871 {
872 	if (no_uprobe_events() || !valid_vma(vma, false))
873 		return;
874 
875 	if (!atomic_read(&vma->vm_mm->mm_users)) /* called by mmput() ? */
876 		return;
877 
878 	if (!test_bit(MMF_HAS_UPROBES, &vma->vm_mm->flags) ||
879 	     test_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags))
880 		return;
881 
882 	if (vma_has_uprobes(vma, start, end))
883 		set_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags);
884 }
885 static inline void vma_mark_detached(struct vm_area_struct *vma, bool detached)
886 {
887 	/* When detaching vma should be write-locked */
888 	if (detached)
889 		vma_assert_write_locked(vma);
890 	vma->detached = detached;
891 }
892 void khugepaged_enter_vma(struct vm_area_struct *vma,
893 			  unsigned long vm_flags)
894 {
895 	if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags) &&
896 	    hugepage_flags_enabled()) {
897 		if (hugepage_vma_check(vma, vm_flags, false, false, true))
898 			__khugepaged_enter(vma->vm_mm);
899 	}
900 }
901 static inline int mpol_store_user_nodemask(const struct mempolicy *pol)
902 {
903 	return pol->flags & MPOL_MODE_FLAGS;
904 }
905 static inline bool is_mergeable_vma(struct vm_area_struct *vma,
906 		struct file *file, unsigned long vm_flags,
907 		struct vm_userfaultfd_ctx vm_userfaultfd_ctx,
908 		struct anon_vma_name *anon_name, bool may_remove_vma)
909 {
910 	/*
911 	 * VM_SOFTDIRTY should not prevent from VMA merging, if we
912 	 * match the flags but dirty bit -- the caller should mark
913 	 * merged VMA as dirty. If dirty bit won't be excluded from
914 	 * comparison, we increase pressure on the memory system forcing
915 	 * the kernel to generate new VMAs when old one could be
916 	 * extended instead.
917 	 */
918 	if ((vma->vm_flags ^ vm_flags) & ~VM_SOFTDIRTY)
919 		return false;
920 	if (vma->vm_file != file)
921 		return false;
922 	if (may_remove_vma && vma->vm_ops && vma->vm_ops->close)
923 		return false;
924 	if (!is_mergeable_vm_userfaultfd_ctx(vma, vm_userfaultfd_ctx))
925 		return false;
926 	if (!anon_vma_name_eq(anon_vma_name(vma), anon_name))
927 		return false;
928 	return true;
929 }
930 static inline void list_del(struct list_head *entry)
931 {
932 	__list_del_entry(entry);
933 	entry->next = LIST_POISON1;
934 	entry->prev = LIST_POISON2;
935 }
936 static inline struct maple_enode *mas_start(struct ma_state *mas)
937 {
938 	if (likely(mas_is_start(mas))) {
939 		struct maple_enode *root;
940 
941 		mas->min = 0;
942 		mas->max = ULONG_MAX;
943 
944 retry:
945 		mas->depth = 0;
946 		root = mas_root(mas);
947 		/* Tree with nodes */
948 		if (likely(xa_is_node(root))) {
949 			mas->depth = 1;
950 			mas->node = mte_safe_root(root);
951 			mas->offset = 0;
952 			if (mte_dead_node(mas->node))
953 				goto retry;
954 
955 			return NULL;
956 		}
957 
958 		/* empty tree */
959 		if (unlikely(!root)) {
960 			mas->node = MAS_NONE;
961 			mas->offset = MAPLE_NODE_SLOTS;
962 			return NULL;
963 		}
964 
965 		/* Single entry tree */
966 		mas->node = MAS_ROOT;
967 		mas->offset = MAPLE_NODE_SLOTS;
968 
969 		/* Single entry tree. */
970 		if (mas->index > 0)
971 			return NULL;
972 
973 		return root;
974 	}
975 
976 	return NULL;
977 }
978 static inline void vma_complete(struct vma_prepare *vp,
979 				struct vma_iterator *vmi, struct mm_struct *mm)
980 {
981 	if (vp->file) {
982 		if (vp->adj_next)
983 			vma_interval_tree_insert(vp->adj_next,
984 						 &vp->mapping->i_mmap);
985 		vma_interval_tree_insert(vp->vma, &vp->mapping->i_mmap);
986 		flush_dcache_mmap_unlock(vp->mapping);
987 	}
988 
989 	if (vp->remove && vp->file) {
990 		__remove_shared_vm_struct(vp->remove, vp->file, vp->mapping);
991 		if (vp->remove2)
992 			__remove_shared_vm_struct(vp->remove2, vp->file,
993 						  vp->mapping);
994 	} else if (vp->insert) {
995 		/*
996 		 * split_vma has split insert from vma, and needs
997 		 * us to insert it before dropping the locks
998 		 * (it may either follow vma or precede it).
999 		 */
1000 		vma_iter_store(vmi, vp->insert);
1001 		mm->map_count++;
1002 	}
1003 
1004 	if (vp->anon_vma) {
1005 		anon_vma_interval_tree_post_update_vma(vp->vma);
1006 		if (vp->adj_next)
1007 			anon_vma_interval_tree_post_update_vma(vp->adj_next);
1008 		anon_vma_unlock_write(vp->anon_vma);
1009 	}
1010 
1011 	if (vp->file) {
1012 		i_mmap_unlock_write(vp->mapping);
1013 		uprobe_mmap(vp->vma);
1014 
1015 		if (vp->adj_next)
1016 			uprobe_mmap(vp->adj_next);
1017 	}
1018 
1019 	if (vp->remove) {
1020 again:
1021 		vma_mark_detached(vp->remove, true);
1022 		if (vp->file) {
1023 			uprobe_munmap(vp->remove, vp->remove->vm_start,
1024 				      vp->remove->vm_end);
1025 			fput(vp->file);
1026 		}
1027 		if (vp->remove->anon_vma)
1028 			anon_vma_merge(vp->vma, vp->remove);
1029 		mm->map_count--;
1030 		mpol_put(vma_policy(vp->remove));
1031 		if (!vp->remove2)
1032 			WARN_ON_ONCE(vp->vma->vm_end < vp->remove->vm_end);
1033 		vm_area_free(vp->remove);
1034 
1035 		/*
1036 		 * In mprotect's case 6 (see comments on vma_merge),
1037 		 * we are removing both mid and next vmas
1038 		 */
1039 		if (vp->remove2) {
1040 			vp->remove = vp->remove2;
1041 			vp->remove2 = NULL;
1042 			goto again;
1043 		}
1044 	}
1045 	if (vp->insert && vp->file)
1046 		uprobe_mmap(vp->insert);
1047 	validate_mm(mm);
1048 }
1049 static inline void *mtree_lookup_walk(struct ma_state *mas)
1050 {
1051 	unsigned long *pivots;
1052 	unsigned char offset;
1053 	struct maple_node *node;
1054 	struct maple_enode *next;
1055 	enum maple_type type;
1056 	void __rcu **slots;
1057 	unsigned char end;
1058 	unsigned long max;
1059 
1060 	next = mas->node;
1061 	max = ULONG_MAX;
1062 	do {
1063 		offset = 0;
1064 		node = mte_to_node(next);
1065 		type = mte_node_type(next);
1066 		pivots = ma_pivots(node, type);
1067 		end = ma_data_end(node, type, pivots, max);
1068 		if (unlikely(ma_dead_node(node)))
1069 			goto dead_node;
1070 		do {
1071 			if (pivots[offset] >= mas->index) {
1072 				max = pivots[offset];
1073 				break;
1074 			}
1075 		} while (++offset < end);
1076 
1077 		slots = ma_slots(node, type);
1078 		next = mt_slot(mas->tree, slots, offset);
1079 		if (unlikely(ma_dead_node(node)))
1080 			goto dead_node;
1081 	} while (!ma_is_leaf(type));
1082 
1083 	return (void *)next;
1084 
1085 dead_node:
1086 	mas_reset(mas);
1087 	return NULL;
1088 }
1089 static inline void mmap_assert_locked(struct mm_struct *mm)
1090 {
1091 	lockdep_assert_held(&mm->mmap_lock);
1092 	VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm);
1093 }
1094 int uprobe_mmap(struct vm_area_struct *vma)
1095 {
1096 	struct list_head tmp_list;
1097 	struct uprobe *uprobe, *u;
1098 	struct inode *inode;
1099 
1100 	if (no_uprobe_events())
1101 		return 0;
1102 
1103 	if (vma->vm_file &&
1104 	    (vma->vm_flags & (VM_WRITE|VM_SHARED)) == VM_WRITE &&
1105 	    test_bit(MMF_HAS_UPROBES, &vma->vm_mm->flags))
1106 		delayed_ref_ctr_inc(vma);
1107 
1108 	if (!valid_vma(vma, true))
1109 		return 0;
1110 
1111 	inode = file_inode(vma->vm_file);
1112 	if (!inode)
1113 		return 0;
1114 
1115 	mutex_lock(uprobes_mmap_hash(inode));
1116 	build_probe_list(inode, vma, vma->vm_start, vma->vm_end, &tmp_list);
1117 	/*
1118 	 * We can race with uprobe_unregister(), this uprobe can be already
1119 	 * removed. But in this case filter_chain() must return false, all
1120 	 * consumers have gone away.
1121 	 */
1122 	list_for_each_entry_safe(uprobe, u, &tmp_list, pending_list) {
1123 		if (!fatal_signal_pending(current) &&
1124 		    filter_chain(uprobe, UPROBE_FILTER_MMAP, vma->vm_mm)) {
1125 			unsigned long vaddr = offset_to_vaddr(vma, uprobe->offset);
1126 			install_breakpoint(uprobe, vma->vm_mm, vma, vaddr);
1127 		}
1128 		put_uprobe(uprobe);
1129 	}
1130 	mutex_unlock(uprobes_mmap_hash(inode));
1131 
1132 	return 0;
1133 }
1134 void __khugepaged_enter(struct mm_struct *mm)
1135 {
1136 	struct khugepaged_mm_slot *mm_slot;
1137 	struct mm_slot *slot;
1138 	int wakeup;
1139 
1140 	/* __khugepaged_exit() must not run from under us */
1141 	VM_BUG_ON_MM(hpage_collapse_test_exit(mm), mm);
1142 	if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags)))
1143 		return;
1144 
1145 	mm_slot = mm_slot_alloc(mm_slot_cache);
1146 	if (!mm_slot)
1147 		return;
1148 
1149 	slot = &mm_slot->slot;
1150 
1151 	spin_lock(&khugepaged_mm_lock);
1152 	mm_slot_insert(mm_slots_hash, mm, slot);
1153 	/*
1154 	 * Insert just behind the scanning cursor, to let the area settle
1155 	 * down a little.
1156 	 */
1157 	wakeup = list_empty(&khugepaged_scan.mm_head);
1158 	list_add_tail(&slot->mm_node, &khugepaged_scan.mm_head);
1159 	spin_unlock(&khugepaged_mm_lock);
1160 
1161 	mmgrab(mm);
1162 	if (wakeup)
1163 		wake_up_interruptible(&khugepaged_wait);
1164 }
1165 static inline void vma_assert_write_locked(struct vm_area_struct *vma)
1166 {
1167 	int mm_lock_seq;
1168 
1169 	VM_BUG_ON_VMA(!__is_vma_write_locked(vma, &mm_lock_seq), vma);
1170 }
1171 static inline void anon_vma_merge(struct vm_area_struct *vma,
1172 				  struct vm_area_struct *next)
1173 {
1174 	VM_BUG_ON_VMA(vma->anon_vma != next->anon_vma, vma);
1175 	unlink_anon_vmas(next);
1176 }
1177 static bool __is_vma_write_locked(struct vm_area_struct *vma, int *mm_lock_seq)
1178 {
1179 	mmap_assert_write_locked(vma->vm_mm);
1180 
1181 	/*
1182 	 * current task is holding mmap_write_lock, both vma->vm_lock_seq and
1183 	 * mm->mm_lock_seq can't be concurrently modified.
1184 	 */
1185 	*mm_lock_seq = vma->vm_mm->mm_lock_seq;
1186 	return (vma->vm_lock_seq == *mm_lock_seq);
1187 }
1188 static __always_inline bool
1189 atomic_inc_not_zero(atomic_t *v)
1190 {
1191 	kcsan_mb();
1192 	instrument_atomic_read_write(v, sizeof(*v));
1193 	return raw_atomic_inc_not_zero(v);
1194 }
1195 static inline void split_huge_pmd_if_needed(struct vm_area_struct *vma, unsigned long address)
1196 {
1197 	/*
1198 	 * If the new address isn't hpage aligned and it could previously
1199 	 * contain an hugepage: check if we need to split an huge pmd.
1200 	 */
1201 	if (!IS_ALIGNED(address, HPAGE_PMD_SIZE) &&
1202 	    range_in_vma(vma, ALIGN_DOWN(address, HPAGE_PMD_SIZE),
1203 			 ALIGN(address, HPAGE_PMD_SIZE)))
1204 		split_huge_pmd_address(vma, address, false, NULL);
1205 }
1206 void __mmap_lock_do_trace_start_locking(struct mm_struct *mm, bool write)
1207 {
1208 	TRACE_MMAP_LOCK_EVENT(start_locking, mm, write);
1209 }
1210 static inline void vma_start_write(struct vm_area_struct *vma)
1211 {
1212 	int mm_lock_seq;
1213 
1214 	if (__is_vma_write_locked(vma, &mm_lock_seq))
1215 		return;
1216 
1217 	down_write(&vma->vm_lock->lock);
1218 	/*
1219 	 * We should use WRITE_ONCE() here because we can have concurrent reads
1220 	 * from the early lockless pessimistic check in vma_start_read().
1221 	 * We don't really care about the correctness of that early check, but
1222 	 * we should use WRITE_ONCE() for cleanliness and to keep KCSAN happy.
1223 	 */
1224 	WRITE_ONCE(vma->vm_lock_seq, mm_lock_seq);
1225 	up_write(&vma->vm_lock->lock);
1226 }
1227 static inline bool mpol_equal(struct mempolicy *a, struct mempolicy *b)
1228 {
1229 	if (a == b)
1230 		return true;
1231 	return __mpol_equal(a, b);
1232 }
1233 static inline int vma_iter_prealloc(struct vma_iterator *vmi,
1234 		struct vm_area_struct *vma)
1235 {
1236 	return mas_preallocate(&vmi->mas, vma, GFP_KERNEL);
1237 }
1238 struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
1239 			struct vm_area_struct *prev, unsigned long addr,
1240 			unsigned long end, unsigned long vm_flags,
1241 			struct anon_vma *anon_vma, struct file *file,
1242 			pgoff_t pgoff, struct mempolicy *policy,
1243 			struct vm_userfaultfd_ctx vm_userfaultfd_ctx,
1244 			struct anon_vma_name *anon_name)
1245 {
1246 	struct vm_area_struct *curr, *next, *res;
1247 	struct vm_area_struct *vma, *adjust, *remove, *remove2;
1248 	struct vm_area_struct *anon_dup = NULL;
1249 	struct vma_prepare vp;
1250 	pgoff_t vma_pgoff;
1251 	int err = 0;
1252 	bool merge_prev = false;
1253 	bool merge_next = false;
1254 	bool vma_expanded = false;
1255 	unsigned long vma_start = addr;
1256 	unsigned long vma_end = end;
1257 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
1258 	long adj_start = 0;
1259 
1260 	/*
1261 	 * We later require that vma->vm_flags == vm_flags,
1262 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
1263 	 */
1264 	if (vm_flags & VM_SPECIAL)
1265 		return NULL;
1266 
1267 	/* Does the input range span an existing VMA? (cases 5 - 8) */
1268 	curr = find_vma_intersection(mm, prev ? prev->vm_end : 0, end);
1269 
1270 	if (!curr ||			/* cases 1 - 4 */
1271 	    end == curr->vm_end)	/* cases 6 - 8, adjacent VMA */
1272 		next = vma_lookup(mm, end);
1273 	else
1274 		next = NULL;		/* case 5 */
1275 
1276 	if (prev) {
1277 		vma_start = prev->vm_start;
1278 		vma_pgoff = prev->vm_pgoff;
1279 
1280 		/* Can we merge the predecessor? */
1281 		if (addr == prev->vm_end && mpol_equal(vma_policy(prev), policy)
1282 		    && can_vma_merge_after(prev, vm_flags, anon_vma, file,
1283 					   pgoff, vm_userfaultfd_ctx, anon_name)) {
1284 			merge_prev = true;
1285 			vma_prev(vmi);
1286 		}
1287 	}
1288 
1289 	/* Can we merge the successor? */
1290 	if (next && mpol_equal(policy, vma_policy(next)) &&
1291 	    can_vma_merge_before(next, vm_flags, anon_vma, file, pgoff+pglen,
1292 				 vm_userfaultfd_ctx, anon_name)) {
1293 		merge_next = true;
1294 	}
1295 
1296 	/* Verify some invariant that must be enforced by the caller. */
1297 	VM_WARN_ON(prev && addr <= prev->vm_start);
1298 	VM_WARN_ON(curr && (addr != curr->vm_start || end > curr->vm_end));
1299 	VM_WARN_ON(addr >= end);
1300 
1301 	if (!merge_prev && !merge_next)
1302 		return NULL; /* Not mergeable. */
1303 
1304 	if (merge_prev)
1305 		vma_start_write(prev);
1306 
1307 	res = vma = prev;
1308 	remove = remove2 = adjust = NULL;
1309 
1310 	/* Can we merge both the predecessor and the successor? */
1311 	if (merge_prev && merge_next &&
1312 	    is_mergeable_anon_vma(prev->anon_vma, next->anon_vma, NULL)) {
1313 		vma_start_write(next);
1314 		remove = next;				/* case 1 */
1315 		vma_end = next->vm_end;
1316 		err = dup_anon_vma(prev, next, &anon_dup);
1317 		if (curr) {				/* case 6 */
1318 			vma_start_write(curr);
1319 			remove = curr;
1320 			remove2 = next;
1321 			if (!next->anon_vma)
1322 				err = dup_anon_vma(prev, curr, &anon_dup);
1323 		}
1324 	} else if (merge_prev) {			/* case 2 */
1325 		if (curr) {
1326 			vma_start_write(curr);
1327 			if (end == curr->vm_end) {	/* case 7 */
1328 				/*
1329 				 * can_vma_merge_after() assumed we would not be
1330 				 * removing prev vma, so it skipped the check
1331 				 * for vm_ops->close, but we are removing curr
1332 				 */
1333 				if (curr->vm_ops && curr->vm_ops->close)
1334 					err = -EINVAL;
1335 				remove = curr;
1336 			} else {			/* case 5 */
1337 				adjust = curr;
1338 				adj_start = (end - curr->vm_start);
1339 			}
1340 			if (!err)
1341 				err = dup_anon_vma(prev, curr, &anon_dup);
1342 		}
1343 	} else { /* merge_next */
1344 		vma_start_write(next);
1345 		res = next;
1346 		if (prev && addr < prev->vm_end) {	/* case 4 */
1347 			vma_start_write(prev);
1348 			vma_end = addr;
1349 			adjust = next;
1350 			adj_start = -(prev->vm_end - addr);
1351 			err = dup_anon_vma(next, prev, &anon_dup);
1352 		} else {
1353 			/*
1354 			 * Note that cases 3 and 8 are the ONLY ones where prev
1355 			 * is permitted to be (but is not necessarily) NULL.
1356 			 */
1357 			vma = next;			/* case 3 */
1358 			vma_start = addr;
1359 			vma_end = next->vm_end;
1360 			vma_pgoff = next->vm_pgoff - pglen;
1361 			if (curr) {			/* case 8 */
1362 				vma_pgoff = curr->vm_pgoff;
1363 				vma_start_write(curr);
1364 				remove = curr;
1365 				err = dup_anon_vma(next, curr, &anon_dup);
1366 			}
1367 		}
1368 	}
1369 
1370 	/* Error in anon_vma clone. */
1371 	if (err)
1372 		goto anon_vma_fail;
1373 
1374 	if (vma_start < vma->vm_start || vma_end > vma->vm_end)
1375 		vma_expanded = true;
1376 
1377 	if (vma_expanded) {
1378 		vma_iter_config(vmi, vma_start, vma_end);
1379 	} else {
1380 		vma_iter_config(vmi, adjust->vm_start + adj_start,
1381 				adjust->vm_end);
1382 	}
1383 
1384 	if (vma_iter_prealloc(vmi, vma))
1385 		goto prealloc_fail;
1386 
1387 	init_multi_vma_prep(&vp, vma, adjust, remove, remove2);
1388 	VM_WARN_ON(vp.anon_vma && adjust && adjust->anon_vma &&
1389 		   vp.anon_vma != adjust->anon_vma);
1390 
1391 	vma_prepare(&vp);
1392 	vma_adjust_trans_huge(vma, vma_start, vma_end, adj_start);
1393 
1394 	vma->vm_start = vma_start;
1395 	vma->vm_end = vma_end;
1396 	vma->vm_pgoff = vma_pgoff;
1397 
1398 	if (vma_expanded)
1399 		vma_iter_store(vmi, vma);
1400 
1401 	if (adj_start) {
1402 		adjust->vm_start += adj_start;
1403 		adjust->vm_pgoff += adj_start >> PAGE_SHIFT;
1404 		if (adj_start < 0) {
1405 			WARN_ON(vma_expanded);
1406 			vma_iter_store(vmi, next);
1407 		}
1408 	}
1409 
1410 	vma_complete(&vp, vmi, mm);
1411 	khugepaged_enter_vma(res, vm_flags);
1412 	return res;
1413 
1414 prealloc_fail:
1415 	if (anon_dup)
1416 		unlink_anon_vmas(anon_dup);
1417 
1418 anon_vma_fail:
1419 	vma_iter_set(vmi, addr);
1420 	vma_iter_load(vmi);
1421 	return NULL;
1422 }
1423 static void anon_vma_chain_free(struct anon_vma_chain *anon_vma_chain)
1424 {
1425 	kmem_cache_free(anon_vma_chain_cachep, anon_vma_chain);
1426 }
1427 void __sched down_write(struct rw_semaphore *sem)
1428 {
1429 	might_sleep();
1430 	rwsem_acquire(&sem->dep_map, 0, 0, _RET_IP_);
1431 	LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
1432 }
1433 void up_write(struct rw_semaphore *sem)
1434 {
1435 	rwsem_release(&sem->dep_map, _RET_IP_);
1436 	__up_write(sem);
1437 }
1438 static inline void put_anon_vma(struct anon_vma *anon_vma)
1439 {
1440 	if (atomic_dec_and_test(&anon_vma->refcount))
1441 		__put_anon_vma(anon_vma);
1442 }
1443 static inline void anon_vma_unlock_write(struct anon_vma *anon_vma)
1444 {
1445 	up_write(&anon_vma->root->rwsem);
1446 }
1447 static inline void __mmap_lock_trace_start_locking(struct mm_struct *mm,
1448 						   bool write)
1449 {
1450 	if (tracepoint_enabled(mmap_lock_start_locking))
1451 		__mmap_lock_do_trace_start_locking(mm, write);
1452 }
1453 static inline bool mas_is_none(const struct ma_state *mas)
1454 {
1455 	return mas->node == MAS_NONE;
1456 }
1457 static void test_and_reset_skel(struct find_vma *skel, int expected_find_zero_ret, bool need_test)
1458 {
1459 	if (need_test) {
1460 		ASSERT_EQ(skel->bss->found_vm_exec, 1, "found_vm_exec");
1461 		ASSERT_EQ(skel->data->find_addr_ret, 0, "find_addr_ret");
1462 		ASSERT_EQ(skel->data->find_zero_ret, expected_find_zero_ret, "find_zero_ret");
1463 		ASSERT_OK_PTR(strstr(skel->bss->d_iname, "test_progs"), "find_test_progs");
1464 	}
1465 
1466 	skel->bss->found_vm_exec = 0;
1467 	skel->data->find_addr_ret = -1;
1468 	skel->data->find_zero_ret = -1;
1469 	skel->bss->d_iname[0] = 0;
1470 }
1471 static int userfaultfd_release(struct inode *inode, struct file *file)
1472 {
1473 	struct userfaultfd_ctx *ctx = file->private_data;
1474 	struct mm_struct *mm = ctx->mm;
1475 	struct vm_area_struct *vma, *prev;
1476 	/* len == 0 means wake all */
1477 	struct userfaultfd_wake_range range = { .len = 0, };
1478 	unsigned long new_flags;
1479 	VMA_ITERATOR(vmi, mm, 0);
1480 
1481 	WRITE_ONCE(ctx->released, true);
1482 
1483 	if (!mmget_not_zero(mm))
1484 		goto wakeup;
1485 
1486 	/*
1487 	 * Flush page faults out of all CPUs. NOTE: all page faults
1488 	 * must be retried without returning VM_FAULT_SIGBUS if
1489 	 * userfaultfd_ctx_get() succeeds but vma->vma_userfault_ctx
1490 	 * changes while handle_userfault released the mmap_lock. So
1491 	 * it's critical that released is set to true (above), before
1492 	 * taking the mmap_lock for writing.
1493 	 */
1494 	mmap_write_lock(mm);
1495 	prev = NULL;
1496 	for_each_vma(vmi, vma) {
1497 		cond_resched();
1498 		BUG_ON(!!vma->vm_userfaultfd_ctx.ctx ^
1499 		       !!(vma->vm_flags & __VM_UFFD_FLAGS));
1500 		if (vma->vm_userfaultfd_ctx.ctx != ctx) {
1501 			prev = vma;
1502 			continue;
1503 		}
1504 		new_flags = vma->vm_flags & ~__VM_UFFD_FLAGS;
1505 		prev = vma_merge(&vmi, mm, prev, vma->vm_start, vma->vm_end,
1506 				 new_flags, vma->anon_vma,
1507 				 vma->vm_file, vma->vm_pgoff,
1508 				 vma_policy(vma),
1509 				 NULL_VM_UFFD_CTX, anon_vma_name(vma));
1510 		if (prev) {
1511 			vma = prev;
1512 		} else {
1513 			prev = vma;
1514 		}
1515 
1516 		vma_start_write(vma);
1517 		userfaultfd_set_vm_flags(vma, new_flags);
1518 		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
1519 	}
1520 	mmap_write_unlock(mm);
1521 	mmput(mm);
1522 wakeup:
1523 	/*
1524 	 * After no new page faults can wait on this fault_*wqh, flush
1525 	 * the last page faults that may have been already waiting on
1526 	 * the fault_*wqh.
1527 	 */
1528 	spin_lock_irq(&ctx->fault_pending_wqh.lock);
1529 	__wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL, &range);
1530 	__wake_up(&ctx->fault_wqh, TASK_NORMAL, 1, &range);
1531 	spin_unlock_irq(&ctx->fault_pending_wqh.lock);
1532 
1533 	/* Flush pending events that may still wait on event_wqh */
1534 	wake_up_all(&ctx->event_wqh);
1535 
1536 	wake_up_poll(&ctx->fd_wqh, EPOLLHUP);
1537 	userfaultfd_ctx_put(ctx);
1538 	return 0;
1539 }
1540 static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
1541 					struct vm_userfaultfd_ctx vm_ctx)
1542 {
1543 	return vma->vm_userfaultfd_ctx.ctx == vm_ctx.ctx;
1544 }
1545 void *mtree_load(struct maple_tree *mt, unsigned long index)
1546 {
1547 	MA_STATE(mas, mt, index, index);
1548 	void *entry;
1549 
1550 	trace_ma_read(__func__, &mas);
1551 	rcu_read_lock();
1552 retry:
1553 	entry = mas_start(&mas);
1554 	if (unlikely(mas_is_none(&mas)))
1555 		goto unlock;
1556 
1557 	if (unlikely(mas_is_ptr(&mas))) {
1558 		if (index)
1559 			entry = NULL;
1560 
1561 		goto unlock;
1562 	}
1563 
1564 	entry = mtree_lookup_walk(&mas);
1565 	if (!entry && unlikely(mas_is_start(&mas)))
1566 		goto retry;
1567 unlock:
1568 	rcu_read_unlock();
1569 	if (xa_is_zero(entry))
1570 		return NULL;
1571 
1572 	return entry;
1573 }
1574 static inline struct anon_vma *lock_anon_vma_root(struct anon_vma *root, struct anon_vma *anon_vma)
1575 {
1576 	struct anon_vma *new_root = anon_vma->root;
1577 	if (new_root != root) {
1578 		if (WARN_ON_ONCE(root))
1579 			up_write(&root->rwsem);
1580 		root = new_root;
1581 		down_write(&root->rwsem);
1582 	}
1583 	return root;
1584 }
1585 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
1586 {
1587 	struct anon_vma_chain *avc, *pavc;
1588 	struct anon_vma *root = NULL;
1589 
1590 	list_for_each_entry_reverse(pavc, &src->anon_vma_chain, same_vma) {
1591 		struct anon_vma *anon_vma;
1592 
1593 		avc = anon_vma_chain_alloc(GFP_NOWAIT | __GFP_NOWARN);
1594 		if (unlikely(!avc)) {
1595 			unlock_anon_vma_root(root);
1596 			root = NULL;
1597 			avc = anon_vma_chain_alloc(GFP_KERNEL);
1598 			if (!avc)
1599 				goto enomem_failure;
1600 		}
1601 		anon_vma = pavc->anon_vma;
1602 		root = lock_anon_vma_root(root, anon_vma);
1603 		anon_vma_chain_link(dst, avc, anon_vma);
1604 
1605 		/*
1606 		 * Reuse existing anon_vma if it has no vma and only one
1607 		 * anon_vma child.
1608 		 *
1609 		 * Root anon_vma is never reused:
1610 		 * it has self-parent reference and at least one child.
1611 		 */
1612 		if (!dst->anon_vma && src->anon_vma &&
1613 		    anon_vma->num_children < 2 &&
1614 		    anon_vma->num_active_vmas == 0)
1615 			dst->anon_vma = anon_vma;
1616 	}
1617 	if (dst->anon_vma)
1618 		dst->anon_vma->num_active_vmas++;
1619 	unlock_anon_vma_root(root);
1620 	return 0;
1621 
1622  enomem_failure:
1623 	/*
1624 	 * dst->anon_vma is dropped here otherwise its num_active_vmas can
1625 	 * be incorrectly decremented in unlink_anon_vmas().
1626 	 * We can safely do this because callers of anon_vma_clone() don't care
1627 	 * about dst->anon_vma if anon_vma_clone() failed.
1628 	 */
1629 	dst->anon_vma = NULL;
1630 	unlink_anon_vmas(dst);
1631 	return -ENOMEM;
1632 }
1633 static bool
1634 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
1635 		struct anon_vma *anon_vma, struct file *file,
1636 		pgoff_t vm_pgoff, struct vm_userfaultfd_ctx vm_userfaultfd_ctx,
1637 		struct anon_vma_name *anon_name)
1638 {
1639 	if (is_mergeable_vma(vma, file, vm_flags, vm_userfaultfd_ctx, anon_name, false) &&
1640 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
1641 		pgoff_t vm_pglen;
1642 		vm_pglen = vma_pages(vma);
1643 		if (vma->vm_pgoff + vm_pglen == vm_pgoff)
1644 			return true;
1645 	}
1646 	return false;
1647 }
```
which has a vulnerability among CWE-476,CWE-787,CWE-125 and among lines:
```
60 	VM_WARN_ON(prev && addr <= prev->vm_start);
61 	VM_WARN_ON(curr && (addr != curr->vm_start || end > curr->vm_end));
62 	VM_WARN_ON(addr >= end);
68 		vma_start_write(prev);
76 		vma_start_write(next);
81 			vma_start_write(curr);
89 			vma_start_write(curr);
107 		vma_start_write(next);
110 			vma_start_write(prev);
126 				vma_start_write(curr);
150 	init_multi_vma_prep(&vp, vma, adjust, remove, remove2);
151 	VM_WARN_ON(vp.anon_vma && adjust && adjust->anon_vma &&
168 			WARN_ON(vma_expanded);
199 	vp->remove2 = remove2;
210 {
```
Please generate five possible patches for the vulnerability.