From c9e9ecb94f09aadc813c9640512495ba0c314726 Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Tue, 29 Sep 2026 12:48:46 +0300 Subject: [PATCH] vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap vfio_fsl_mc_mmap_mmio() overwrites vma->vm_pgoff with the physical frame number of the MMIO region and passes it to remap_pfn_range(). The VMA is inserted into the device file's mapping->i_mmap interval tree keyed by vm_pgoff, which VFIO expects to be the logical file offset: the core links every device mmap to the device inode's i_mapping precisely so that unmap_mapping_range() can revoke all mappings associated with a device (see vfio_device_cdev_open()). With a raw PFN in vm_pgoff the interval tree entry lands in the wrong coordinate space and unmap_mapping_range() cannot find the VMA, leaving stale MMIO mappings behind any revocation attempt. Keep vm_pgoff in the logical VFIO offset space, as vfio-pci does, and pass the physical PFN to remap_pfn_range() explicitly. This is defensive hygiene: none of vfio-platform, vfio/fsl-mc and vfio/cdx call unmap_mapping_range() today, so no reachable stale-mapping issue exists. Keeping vm_pgoff logical preserves the VFIO core contract for any future revocation path. Reviewed-by: Ioana Ciornei Signed-off-by: Abdifatah Suruur Link: https://lore.kernel.org/r/20260929094848.7439-6-suruurism@gmail.com Signed-off-by: Alex Williamson --- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c index 5a6cd78dcc06..15b05b8c0c90 100644 --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -369,9 +369,8 @@ static int vfio_fsl_mc_mmap_mmio(struct vfio_fsl_mc_region region, if (!region_cacheable) vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); - vma->vm_pgoff = (region.addr >> PAGE_SHIFT) + pgoff; - - return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, + return remap_pfn_range(vma, vma->vm_start, + (region.addr >> PAGE_SHIFT) + pgoff, size, vma->vm_page_prot); }