This is a note to let you know that I've just added the patch titled mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: mm-fix-tlb-flush-for-not-first-pfnmap-mappings-in-unmap_region.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From jannh@xxxxxxxxxx Fri Sep 16 11:29:18 2022 From: Jann Horn <jannh@xxxxxxxxxx> Date: Thu, 15 Sep 2022 16:25:19 +0200 Subject: mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() To: stable@xxxxxxxxxxxxxxx, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: Hugh Dickins <hughd@xxxxxxxxxx>, Peter Zijlstra <peterz@xxxxxxxxxxxxx> Message-ID: <20220915142519.2941949-1-jannh@xxxxxxxxxx> From: Jann Horn <jannh@xxxxxxxxxx> This is a stable-specific patch. I botched the stable-specific rewrite of commit b67fbebd4cf98 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"): As Hugh pointed out, unmap_region() actually operates on a list of VMAs, and the variable "vma" merely points to the first VMA in that list. So if we want to check whether any of the VMAs we're operating on is PFNMAP or MIXEDMAP, we have to iterate through the list and check each VMA. Signed-off-by: Jann Horn <jannh@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- mm/mmap.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2524,6 +2524,7 @@ static void unmap_region(struct mm_struc { struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap; struct mmu_gather tlb; + struct vm_area_struct *cur_vma; lru_add_drain(); tlb_gather_mmu(&tlb, mm, start, end); @@ -2538,8 +2539,12 @@ static void unmap_region(struct mm_struc * concurrent flush in this region has to be coming through the rmap, * and we synchronize against that using the rmap lock. */ - if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) - tlb_flush_mmu(&tlb); + for (cur_vma = vma; cur_vma; cur_vma = cur_vma->vm_next) { + if ((cur_vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) { + tlb_flush_mmu(&tlb); + break; + } + } free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); Patches currently in stable-queue which might be from jannh@xxxxxxxxxx are queue-4.9/mm-fix-tlb-flush-for-not-first-pfnmap-mappings-in-unmap_region.patch