[PATCH] mm/vma: clear vm_file before unmap on mmap hook failure

[Oleg Keri]

Since commit 2ceb21171dd9 ("mm: consistently validate VMA state after
mmap[_prepare] hooks"), the mmap error path clears vma->vm_file only
after unmap_region(), so free_pgtables() unlinks the never-linked VMA
and drops i_mmap_writable. Once it goes negative, every later shared
writable mmap of that file fails with -EPERM until reboot.

Clear vm_file before unmap_region(), so that free_pgtables() does not
unlink a VMA that was never linked to the file.

Fixes: 2ceb21171dd9 ("mm: consistently validate VMA state after mmap[_prepare] hooks")
Signed-off-by: Oleg Keri <okerixx@xxxxxxxxx>
---
Seen on next-20261006: one refused PCM mmap probe from alsa-lib left the
device unmappable, so PipeWire could not play anything.

 mm/vma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vma.c b/mm/vma.c
index dfa45c64222c..8d62da16e076 100644
--- a/mm/vma.c
+++ b/mm/vma.c
@@ -2619,6 +2619,7 @@ static int __mmap_new_file_vma(struct mmap_state *map,
 		UNMAP_STATE(unmap, vmi, vma, vma->vm_start, vma->vm_end,
 			    map->prev, map->next);
 
+		vma->vm_file = NULL;
 		vma_iter_set(vmi, vma->vm_end);
 		/* Undo any partial mapping done by a device driver. */
 		unmap_region(&unmap);
@@ -2627,7 +2628,6 @@ static int __mmap_new_file_vma(struct mmap_state *map,
 
 		if (map_same_file(map))
 			fput(map->vm_file);
-		vma->vm_file = NULL;
 		return error;
 	}
 
-- 
2.55.0