[PATCH] arch/s390/pci: fix fixup_user_fault() calls with NULL unlocked parameter

[Liu Dalin]

The s390 PCI MMIO functions call fixup_user_fault() with the 'unlocked'
parameter set to NULL. This means when handle_mm_fault() returns
VM_FAULT_COMPLETED or VM_FAULT_RETRY, the function re-acquires the
mmap_lock but cannot notify the caller about this state change.

This is problematic because the caller subsequently calls
mmap_read_unlock() at the end of the function. If the lock was
re-acquired inside fixup_user_fault(), the unlock happens correctly.
But passing NULL makes the code fragile and hard to reason about.

Fix this by providing a proper 'unlocked' variable to fixup_user_fault()
so the lock state is properly tracked.

This is a follow-up to the defensive NULL check added in fixup_user_fault()
by the previous patch in this series.

Fixes: 41a0926e82f4 ("s390/pci: Fix s390_mmio_read/write syscall page fault handling")
Signed-off-by: Liu Dalin <liudalin@xxxxxxxxxxxxxxx>
---
 arch/s390/pci/pci_mmio.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
index f3f79ba78410..5ef2d6436d4b 100644
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -182,7 +182,9 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
 	args.vma = vma;
 	ret = follow_pfnmap_start(&args);
 	if (ret) {
-		fixup_user_fault(current->mm, mmio_addr, FAULT_FLAG_WRITE, NULL);
+		bool unlocked = false;
+
+		fixup_user_fault(current->mm, mmio_addr, FAULT_FLAG_WRITE, &unlocked);
 		ret = follow_pfnmap_start(&args);
 		if (ret)
 			goto out_unlock_mmap;
@@ -335,7 +337,9 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
 	args.address = mmio_addr;
 	ret = follow_pfnmap_start(&args);
 	if (ret) {
-		fixup_user_fault(current->mm, mmio_addr, 0, NULL);
+		bool unlocked = false;
+
+		fixup_user_fault(current->mm, mmio_addr, 0, &unlocked);
 		ret = follow_pfnmap_start(&args);
 		if (ret)
 			goto out_unlock_mmap;
-- 
2.43.0