Patch "kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kernfs-fix-false-positive-warn-nr_mmapped-in-kernfs_.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3ae961f0c5130c4beb194ed5e2033253cfb0ae95
Author: Neel Natu <neelnatu@xxxxxxxxxx>
Date:   Sat Jan 27 15:46:36 2024 -0800

    kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
    
    [ Upstream commit 05d8f255867e3196565bb31a911a437697fab094 ]
    
    Prior to this change 'on->nr_mmapped' tracked the total number of
    mmaps across all of its associated open files via kernfs_fop_mmap().
    Thus if the file descriptor associated with a kernfs_open_file was
    mmapped 10 times then we would have: 'of->mmapped = true' and
    'of_on(of)->nr_mmapped = 10'.
    
    The problem is that closing or draining a 'of->mmapped' file would
    only decrement one from the 'of_on(of)->nr_mmapped' counter.
    
    For e.g. we have this from kernfs_unlink_open_file():
            if (of->mmapped)
                    on->nr_mmapped--;
    
    The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
    easy to reproduce by:
    1. opening a (mmap-able) kernfs file.
    2. mmap-ing that file more than once (mapping just once masks the issue).
    3. trigger a drain of that kernfs file.
    
    Modulo out-of-tree patches I was able to trigger this reliably by
    identifying pci device nodes in sysfs that have resource regions
    that are mmap-able and that don't have any driver attached to them
    (steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
    kernfs_drain.
    
    Signed-off-by: Neel Natu <neelnatu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240127234636.609265-1-neelnatu@xxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 180906c36f515..332d08d2fe0d5 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -532,9 +532,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
 		goto out_put;
 
 	rc = 0;
-	of->mmapped = true;
-	of_on(of)->nr_mmapped++;
-	of->vm_ops = vma->vm_ops;
+	if (!of->mmapped) {
+		of->mmapped = true;
+		of_on(of)->nr_mmapped++;
+		of->vm_ops = vma->vm_ops;
+	}
 	vma->vm_ops = &kernfs_vm_ops;
 out_put:
 	kernfs_put_active(of->kn);