kmsan_vmalloc_to_page_or_null() rejects addresses outside the regular
vmalloc and module ranges, including the shadow and origin addresses
passed by its callers. As a result, iounmap does not free the metadata
backing pages. Also, the first iteration of the teardown loop unmaps the
entire metadata range, preventing subsequent iterations from finding their
pages even if the address lookup is fixed.
Factor the page-table walk out of vmalloc_to_page() into
__vmalloc_to_page(), keeping the address check in the public wrapper. Use
the unchecked helper in kmsan_vmalloc_to_page_or_null() and check for NULL
before converting the returned page to a PFN. Mark __vmalloc_to_page() as
__always_inline to avoid an additional function call in vmalloc_to_page().
Move metadata teardown into kmsan_iounmap_pages(). Free the backing
blocks while their mappings are still available, then unmap each metadata
range once and flush its TLB entries.
Link: https://lore.kernel.org/[email protected]
Fixes: b073d7f8ae ("mm: kmsan: maintain KMSAN metadata for page operations")
Signed-off-by: Dima Koziuk <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Suggested-by: Alexander Potapenko <[email protected]>
Link: https://lkml.iu.edu/2609.3/12748.html
Cc: Marco Elver <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Uladzislau Rezki (Sony) <[email protected]>
Dima Koziuk