I botched the b67fbebd4cf9 (VM_PFNMAP TLB flush) stable backport, how do I have to fix it?

[Jann Horn <jannh@xxxxxxxxxx>]

Hi!

Hugh reached out to me and let me know (in nicer words) that I botched
my attempt to re-implement b67fbebd4cf9 for the stable backport; the
backport is an incomplete fix (because I forgot that in
unmap_region(), "vma" is just one of potentially several VMAs).

What should the commit message for fixing that look like? And should
we first revert the botched backport and then do a correct backport on
top of that, or should I write a single fix commit?

Sorry for causing you extra work, Greg...


Regarding how to actually fix it, one of the possible approaches
suggested by Hugh, and what I'd do, is something like this (not yet
tested) - unless someone thinks this is getting too far from upstream
and that we should backport the original fix instead, including the
refactoring?

diff --git a/mm/mmap.c b/mm/mmap.c
index 5ee3c91450de1..cee6593cbdbe3 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2566,6 +2566,7 @@ static void unmap_region(struct mm_struct *mm,
                unsigned long start, unsigned long end)
 {
        struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap;
+       struct vm_area_struct *cur_vma;
        struct mmu_gather tlb;

        lru_add_drain();
@@ -2581,8 +2582,12 @@ static void unmap_region(struct mm_struct *mm,
         * concurrent flush in this region has to be coming through the rmap,
         * and we synchronize against that using the rmap lock.
         */
-       if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0)
-               tlb_flush_mmu(&tlb);
+       for (cur_vma = vma; cur_vma; cur_vma = cur_vma->next) {
+               if ((cur_vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) {
+                       tlb_flush_mmu(&tlb);
+                       break;
+               }
+       }

        free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
                                 next ? next->vm_start : USER_PGTABLES_CEILING);