Patch "iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     iov_iter-fix-copy_page_from_iter_atomic-if-kmap_loca.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 42c16d9696004979bb2213d9208be27c1c867551
Author: Hugh Dickins <hughd@xxxxxxxxxx>
Date:   Sun Oct 27 15:23:23 2024 -0700

    iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP
    
    [ Upstream commit c749d9b7ebbc5716af7a95f7768634b30d9446ec ]
    
    generic/077 on x86_32 CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP=y with highmem,
    on huge=always tmpfs, issues a warning and then hangs (interruptibly):
    
    WARNING: CPU: 5 PID: 3517 at mm/highmem.c:622 kunmap_local_indexed+0x62/0xc9
    CPU: 5 UID: 0 PID: 3517 Comm: cp Not tainted 6.12.0-rc4 #2
    ...
    copy_page_from_iter_atomic+0xa6/0x5ec
    generic_perform_write+0xf6/0x1b4
    shmem_file_write_iter+0x54/0x67
    
    Fix copy_page_from_iter_atomic() by limiting it in that case
    (include/linux/skbuff.h skb_frag_must_loop() does similar).
    
    But going forward, perhaps CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is too
    surprising, has outlived its usefulness, and should just be removed?
    
    Fixes: 908a1ad89466 ("iov_iter: Handle compound highmem pages in copy_page_from_iter_atomic()")
    Signed-off-by: Hugh Dickins <hughd@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/dd5f0c89-186e-18e1-4f43-19a60f5a9774@xxxxxxxxxx
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Cc: stable@xxxxxxxxxxxxxxx
    Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 4a6a9f419bd7e..b892894228b03 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -461,6 +461,8 @@ size_t copy_page_from_iter_atomic(struct page *page, size_t offset,
 		size_t bytes, struct iov_iter *i)
 {
 	size_t n, copied = 0;
+	bool uses_kmap = IS_ENABLED(CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP) ||
+			 PageHighMem(page);
 
 	if (!page_copy_sane(page, offset, bytes))
 		return 0;
@@ -471,7 +473,7 @@ size_t copy_page_from_iter_atomic(struct page *page, size_t offset,
 		char *p;
 
 		n = bytes - copied;
-		if (PageHighMem(page)) {
+		if (uses_kmap) {
 			page += offset / PAGE_SIZE;
 			offset %= PAGE_SIZE;
 			n = min_t(size_t, n, PAGE_SIZE - offset);
@@ -482,7 +484,7 @@ size_t copy_page_from_iter_atomic(struct page *page, size_t offset,
 		kunmap_atomic(p);
 		copied += n;
 		offset += n;
-	} while (PageHighMem(page) && copied != bytes && n > 0);
+	} while (uses_kmap && copied != bytes && n > 0);
 
 	return copied;
 }