mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn

JIRA: https://issues.redhat.com/browse/RHEL-104908

This patch is a backport of the following upstream commit:
commit 2e6053f
Author: Jinjiang Tu <[email protected]>
Date:   Fri Aug 15 15:32:09 2025 +0800

    mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn

    When memory_failure() is called for a already hwpoisoned pfn,
    kill_accessing_process() will be called to kill current task.  However, if
    the vma of the accessing vaddr is VM_PFNMAP, walk_page_range() will skip
    the vma in walk_page_test() and return 0.

    Before commit aaf99ac ("mm/hwpoison: do not send SIGBUS to processes
    with recovered clean pages"), kill_accessing_process() will return EFAULT.
    For x86, the current task will be killed in kill_me_maybe().

    However, after this commit, kill_accessing_process() simplies return 0,
    that means UCE is handled properly, but it doesn't actually.  In such
    case, the user task will trigger UCE infinitely.

    To fix it, add .test_walk callback for hwpoison_walk_ops to scan all vmas.

    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: aaf99ac ("mm/hwpoison: do not send SIGBUS to processes with recovered clean pages")
    Signed-off-by: Jinjiang Tu <[email protected]>
    Acked-by: David Hildenbrand <[email protected]>
    Acked-by: Miaohe Lin <[email protected]>
    Reviewed-by: Jane Chu <[email protected]>
    Cc: Kefeng Wang <[email protected]>
    Cc: Naoya Horiguchi <[email protected]>
    Cc: Oscar Salvador <[email protected]>
    Cc: Shuai Xue <[email protected]>
    Cc: Zi Yan <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>

Signed-off-by: Audra Mitchell <[email protected]>

Author: Audra Mitchell

mm/memory-failure.c

@@ -842,9 +842,17 @@ static int hwpoison_hugetlb_range(pte_t *ptep, unsigned long hmask,
 #define hwpoison_hugetlb_range	NULL
 #endif
 
+static int hwpoison_test_walk(unsigned long start, unsigned long end,
+			     struct mm_walk *walk)
+{
+	/* We also want to consider pages mapped into VM_PFNMAP. */
+	return 0;
+}
+
 static const struct mm_walk_ops hwpoison_walk_ops = {
 	.pmd_entry = hwpoison_pte_range,
 	.hugetlb_entry = hwpoison_hugetlb_range,
+	.test_walk = hwpoison_test_walk,
 	.walk_lock = PGWALK_RDLOCK,
 };