[PATCH 0/2] mm,kernfs: Fix stale userspace mappings after sysfs file removal

["Krzysztof Wilczyński" <kwilczynski@kernel.org>]

Hello,

PCI resource sysfs files swap their f_mapping to iomem_get_mapping() at
open time so that revoke_iomem() can hole-punch userspace mappings when
a driver claims the BAR (636b21b50152, "PCI: Revoke mappings like
devmem").  Their VMAs therefore live on the shared iomem address_space,
which kernfs_drain_open_files() does not walk, unmapping the sysfs
inode's own i_mapping instead.  Userspace thus keeps live mappings of
PCI BARs across device removal and resizable-BAR resize, with stale
PTEs into physical address space the kernel may have reassigned.

After the device is removed, a read from a resource0 mapping returns
the previous register value instead of faulting.

The first patch adds unmap_mapping_file(), which zaps VMAs selected by
the originating struct file rather than by address space window, with
a stub for !CONFIG_MMU builds.  The second uses it in the kernfs
drain for files with a swapped f_mapping, keeping the existing
unmap_mapping_range() path for everything else.

Before 636b21b50152 these VMAs were attached to the sysfs inode and the
drain did zap them, so this restores the earlier teardown semantics
while keeping the driver-claim revocation intact.  Files without an
f_mapping swap (p2pdma, cgroup, everything else) see no change.  The
same access now raises SIGBUS.

BAR resize is covered by the same path, since resize removes the
resource groups.  /dev/mem and /proc/bus/pci mappings of the same
BAR are unaffected.

Krzysztof Wilczyński (2):
  mm: Add unmap_mapping_file() helper
  kernfs: Unmap mmaps of removed files via file->f_mapping

 fs/kernfs/file.c   |  5 ++++-
 include/linux/mm.h |  2 ++
 mm/memory.c        | 26 ++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)

-- 
2.55.0