[PATCH 2/2] kernfs: Unmap mmaps of removed files via file->f_mapping

Currently, kernfs_drain_open_files() unmaps file_inode(of->file)->i_mapping
when a node with mmapped open files is removed.  Since commit 636b21b50152
("PCI: Revoke mappings like devmem"), PCI resource and legacy sysfs files
swap their f_mapping to iomem_get_mapping() at open time, so their VMAs
are attached to the shared iomem address space, and the drain walks the
empty sysfs inode interval tree instead.

As a result, userspace mappings of PCI BARs survive device removal
and BAR resize, keeping stale PTEs into physical address space that
the kernel may have reassigned since.

Thus, use unmap_mapping_file() when the file's f_mapping no longer
points at its own inode mapping, so the drain zaps exactly the VMAs
created through the removed file, while unrelated mappings on the
shared address space are left intact.  Files with an unmodified inode
mapping keep the existing unmap_mapping_range() behaviour, and the
driver-claim revocation through revoke_iomem() is unaffected because
the VMAs stay on the shared mapping.

This restores the teardown behaviour these files had before the
f_mapping swap was introduced.  A read through a stale mapping
after removal now raises SIGBUS instead of returning stale data.

Fixes: 636b21b50152 ("PCI: Revoke mappings like devmem")
Signed-off-by: Krzysztof Wilczyński <[email protected]>
---
 fs/kernfs/file.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 8e0e90c93372..8d1e4acc6716 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -818,7 +818,10 @@ void kernfs_drain_open_files(struct kernfs_node *kn)
 		struct inode *inode = file_inode(of->file);
 
 		if (of->mmapped) {
-			unmap_mapping_range(inode->i_mapping, 0, 0, 1);
+			if (of->file->f_mapping != inode->i_mapping)
+				unmap_mapping_file(of->file);
+			else
+				unmap_mapping_range(inode->i_mapping, 0, 0, 1);
 			of->mmapped = false;
 			on->nr_mmapped--;
 		}
-- 
2.55.0