kmsan: unpoison only the created pages in get_user_pages_fast()

gup_pgd_range() may return less pages than requested. In that case
we must unpoison only the created pages.

mm/gup.c

@@ -1820,12 +1820,12 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
 		gup_pgd_range(addr, end, write, pages, &nr);
 		// TODO(glider): there might be other places where user memory is pinned
 		// to kernel memory.
-		// gup_pgd_range() has just created a bunch of new pages that KMSAN
-		// treats as uninitialized.
+		// gup_pgd_range() has just created a number (less or equal to nr_pages)
+		// of new pages that KMSAN treats as uninitialized.
 		// In the case the [addr, end) range belongs to the userspace memory,
 		// unpoison the corresponding kernel pages.
 		if ((addr < TASK_SIZE) && (end < TASK_SIZE)) {
-			kmsan_unpoison_shadow(page_address(pages[0]), len);
+			kmsan_unpoison_shadow(page_address(pages[0]), (unsigned long)nr << PAGE_SHIFT);
 		}
 		local_irq_enable();
 		ret = nr;