mm: Fix devm_memremap_pages() collision handling

commit 77dd66a3c67c93ab401ccc15efff25578be281fd upstream.

If devm_memremap_pages() detects a collision while adding entries
to the radix-tree, we call pgmap_radix_release(). Unfortunately,
the function removes *all* entries for the range -- including the
entries that caused the collision in the first place.

Modify pgmap_radix_release() to take an additional argument to
indicate where to stop, so that only newly added entries are removed
from the tree.

Cc: <stable@vger.kernel.org>
Fixes: 9476df7d80df ("mm: introduce find_dev_pagemap()")
Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/memremap.c b/kernel/memremap.c
index 4712ce646e04b5690c59232a947a733143980e32..2b136d4988f78a481566ac4ce37213517e2c60f8 100644 (file)
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -248,13 +248,16 @@ int device_private_entry_fault(struct vm_area_struct *vma,
 EXPORT_SYMBOL(device_private_entry_fault);
 #endif /* CONFIG_DEVICE_PRIVATE */
 
-static void pgmap_radix_release(struct resource *res)
+static void pgmap_radix_release(struct resource *res, unsigned long end_pgoff)
 {
        unsigned long pgoff, order;
 
        mutex_lock(&pgmap_lock);
-       foreach_order_pgoff(res, order, pgoff)
+       foreach_order_pgoff(res, order, pgoff) {
+               if (pgoff >= end_pgoff)
+                       break;
                radix_tree_delete(&pgmap_radix, PHYS_PFN(res->start) + pgoff);
+       }
        mutex_unlock(&pgmap_lock);
 
        synchronize_rcu();
@@ -309,7 +312,7 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
        mem_hotplug_done();
 
        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
-       pgmap_radix_release(res);
+       pgmap_radix_release(res, -1);
        dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
                        "%s: failed to free all reserved pages\n", __func__);
 }
@@ -459,7 +462,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
  err_pfn_remap:
  err_radix:
-       pgmap_radix_release(res);
+       pgmap_radix_release(res, pgoff);
        devres_free(page_map);
        return ERR_PTR(error);
 }