Currently, kernfs_drain_open_files() unmaps file_inode(of->file)->i_mapping when a node with mmapped open files is removed. Since commit 636b21b50152 ("PCI: Revoke mappings like devmem"), PCI resource and legacy sysfs files swap their f_mapping to iomem_get_mapping() at open time, so their VMAs are attached to the shared iomem address space, and the drain walks the empty sysfs inode interval tree instead. As a result, userspace mappings of PCI BARs survive device removal and BAR resize, keeping stale PTEs into physical address space that the kernel may have reassigned since. Thus, use unmap_mapping_file() when the file's f_mapping no longer points at its own inode mapping, so the drain zaps exactly the VMAs created through the removed file, while unrelated mappings on the shared address space are left intact. Files with an unmodified inode mapping keep the existing unmap_mapping_range() behaviour, and the driver-claim revocation through revoke_iomem() is unaffected because the VMAs stay on the shared mapping. This restores the teardown behaviour these files had before the f_mapping swap was introduced. A read through a stale mapping after removal now raises SIGBUS instead of returning stale data. Fixes: 636b21b50152 ("PCI: Revoke mappings like devmem") Signed-off-by: Krzysztof Wilczyński --- fs/kernfs/file.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c index 8e0e90c93372..8d1e4acc6716 100644 --- a/fs/kernfs/file.c +++ b/fs/kernfs/file.c @@ -818,7 +818,10 @@ void kernfs_drain_open_files(struct kernfs_node *kn) struct inode *inode = file_inode(of->file); if (of->mmapped) { - unmap_mapping_range(inode->i_mapping, 0, 0, 1); + if (of->file->f_mapping != inode->i_mapping) + unmap_mapping_file(of->file); + else + unmap_mapping_range(inode->i_mapping, 0, 0, 1); of->mmapped = false; on->nr_mmapped--; } -- 2.55.0