On 3/20/26 23:39, Lorenzo Stoakes (Oracle) wrote:
> Partially reverts commit 9d5403b1036c ("fs: convert most other
> generic_file_*mmap() users to .mmap_prepare()").
>
> This is because the .mmap invocation establishes a refcount, but
> .mmap_prepare is called at a point where a merge or an allocation failure
> might happen after the call, which would leak the refcount increment.
>
> Functionality is being added to permit the use of .mmap_prepare in this
> case, but in the interim, we need to fix this.
>
> Fixes: 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
> ---
> fs/afs/file.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/fs/afs/file.c b/fs/afs/file.c
> index f609366fd2ac..74d04af51ff4 100644
> --- a/fs/afs/file.c
> +++ b/fs/afs/file.c
> @@ -19,7 +19,7 @@
> #include <trace/events/netfs.h>
> #include "internal.h"
>
> -static int afs_file_mmap_prepare(struct vm_area_desc *desc);
> +static int afs_file_mmap(struct file *file, struct vm_area_struct *vma);
>
> static ssize_t afs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter);
> static ssize_t afs_file_splice_read(struct file *in, loff_t *ppos,
> @@ -35,7 +35,7 @@ const struct file_operations afs_file_operations = {
> .llseek = generic_file_llseek,
> .read_iter = afs_file_read_iter,
> .write_iter = netfs_file_write_iter,
> - .mmap_prepare = afs_file_mmap_prepare,
> + .mmap = afs_file_mmap,
> .splice_read = afs_file_splice_read,
> .splice_write = iter_file_splice_write,
> .fsync = afs_fsync,
> @@ -492,16 +492,16 @@ static void afs_drop_open_mmap(struct afs_vnode *vnode)
> /*
> * Handle setting up a memory mapping on an AFS file.
> */
> -static int afs_file_mmap_prepare(struct vm_area_desc *desc)
> +static int afs_file_mmap(struct file *file, struct vm_area_struct *vma)
> {
> - struct afs_vnode *vnode = AFS_FS_I(file_inode(desc->file));
> + struct afs_vnode *vnode = AFS_FS_I(file_inode(file));
> int ret;
>
> afs_add_open_mmap(vnode);
>
> - ret = generic_file_mmap_prepare(desc);
> + ret = generic_file_mmap(file, vma);
> if (ret == 0)
> - desc->vm_ops = &afs_vm_ops;
> + vma->vm_ops = &afs_vm_ops;
> else
> afs_drop_open_mmap(vnode);
> return ret;