vmap_page_range() and __vmap_pages_range() call flush_cache_vmap() before they even look at the error code. A failed mapping is never used, so the flush is pointless at best.
According to the Sashiko review it is worse than pointless on UML: flush_cache_vmap() there is flush_tlb_kernel_range(), which syncs the PTEs into the host OS. Flushing a half-installed mapping therefore leaves host mappings behind for a range that was just freed again. Only flush when the mapping, and for vmap_page_range() also the KMSAN metadata, is fully set up. Reported-by: Sashiko <[email protected]> Signed-off-by: Hao Ge <[email protected]> --- mm/vmalloc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 4d74144dfaff..96e15d6cfc6d 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -359,11 +359,14 @@ int vmap_page_range(unsigned long addr, unsigned long end, err = vmap_range_noflush(addr, end, phys_addr, pgprot_nx(prot), ioremap_max_page_shift); - flush_cache_vmap(addr, end); if (!err) err = kmsan_ioremap_page_range(addr, end, phys_addr, prot, ioremap_max_page_shift); - return err; + if (err) + return err; + + flush_cache_vmap(addr, end); + return 0; } int ioremap_page_range(unsigned long addr, unsigned long end, @@ -745,8 +748,11 @@ static int __vmap_pages_range(unsigned long addr, unsigned long end, int err; err = vmap_pages_range_noflush(addr, end, prot, pages, page_shift, gfp_mask); + if (err) + return err; + flush_cache_vmap(addr, end); - return err; + return 0; } /** -- 2.25.1
