Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'mm-hotfixes-stable-2022-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morron:
"Seventeen hotfixes, mainly for MM.
Five are cc:stable and the remainder address post-6.0 issues"
* tag 'mm-hotfixes-stable-2022-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
nouveau: fix migrate_to_ram() for faulting page
mm/huge_memory: do not clobber swp_entry_t during THP split
hugetlb: fix memory leak associated with vma_lock structure
mm/page_alloc: reduce potential fragmentation in make_alloc_exact()
mm: /proc/pid/smaps_rollup: fix maple tree search
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
mm/mmap: fix MAP_FIXED address return on VMA merge
mm/mmap.c: __vma_adjust(): suppress uninitialized var warning
mm/mmap: undo ->mmap() when mas_preallocate() fails
init: Kconfig: fix spelling mistake "satify" -> "satisfy"
ocfs2: clear dinode links count in case of error
ocfs2: fix BUG when iput after ocfs2_mknod fails
gcov: support GCC 12.1 and newer compilers
zsmalloc: zs_destroy_pool: add size_class NULL check
mm/mempolicy: fix mbind_range() arguments to vma_merge()
mailmap: update email for Qais Yousef
mailmap: update Dan Carpenter's email address
+106
-50
+3
-1
.mailmap
+3
-1
.mailmap
···
104
104
Colin Ian King <colin.i.king@gmail.com> <colin.king@canonical.com>
105
105
Corey Minyard <minyard@acm.org>
106
106
Damian Hobson-Garcia <dhobsong@igel.co.jp>
107
+
Dan Carpenter <error27@gmail.com> <dan.carpenter@oracle.com>
107
108
Daniel Borkmann <daniel@iogearbox.net> <danborkmann@googlemail.com>
108
109
Daniel Borkmann <daniel@iogearbox.net> <danborkmann@iogearbox.net>
109
110
Daniel Borkmann <daniel@iogearbox.net> <daniel.borkmann@tik.ee.ethz.ch>
···
354
353
Pratyush Anand <pratyush.anand@gmail.com> <pratyush.anand@st.com>
355
354
Praveen BP <praveenbp@ti.com>
356
355
Punit Agrawal <punitagrawal@gmail.com> <punit.agrawal@arm.com>
357
-
Qais Yousef <qsyousef@gmail.com> <qais.yousef@imgtec.com>
356
+
Qais Yousef <qyousef@layalina.io> <qais.yousef@imgtec.com>
357
+
Qais Yousef <qyousef@layalina.io> <qais.yousef@arm.com>
358
358
Quentin Monnet <quentin@isovalent.com> <quentin.monnet@netronome.com>
359
359
Quentin Perret <qperret@qperret.net> <quentin.perret@arm.com>
360
360
Rafael J. Wysocki <rjw@rjwysocki.net> <rjw@sisk.pl>
+1
drivers/gpu/drm/nouveau/nouveau_dmem.c
+1
drivers/gpu/drm/nouveau/nouveau_dmem.c
+11
-12
fs/ocfs2/namei.c
+11
-12
fs/ocfs2/namei.c
···
232
232
handle_t *handle = NULL;
233
233
struct ocfs2_super *osb;
234
234
struct ocfs2_dinode *dirfe;
235
+
struct ocfs2_dinode *fe = NULL;
235
236
struct buffer_head *new_fe_bh = NULL;
236
237
struct inode *inode = NULL;
237
238
struct ocfs2_alloc_context *inode_ac = NULL;
···
383
382
goto leave;
384
383
}
385
384
385
+
fe = (struct ocfs2_dinode *) new_fe_bh->b_data;
386
386
if (S_ISDIR(mode)) {
387
387
status = ocfs2_fill_new_dir(osb, handle, dir, inode,
388
388
new_fe_bh, data_ac, meta_ac);
···
456
454
leave:
457
455
if (status < 0 && did_quota_inode)
458
456
dquot_free_inode(inode);
459
-
if (handle)
457
+
if (handle) {
458
+
if (status < 0 && fe)
459
+
ocfs2_set_links_count(fe, 0);
460
460
ocfs2_commit_trans(osb, handle);
461
+
}
461
462
462
463
ocfs2_inode_unlock(dir, 1);
463
464
if (did_block_signals)
···
637
632
return status;
638
633
}
639
634
640
-
status = __ocfs2_mknod_locked(dir, inode, dev, new_fe_bh,
635
+
return __ocfs2_mknod_locked(dir, inode, dev, new_fe_bh,
641
636
parent_fe_bh, handle, inode_ac,
642
637
fe_blkno, suballoc_loc, suballoc_bit);
643
-
if (status < 0) {
644
-
u64 bg_blkno = ocfs2_which_suballoc_group(fe_blkno, suballoc_bit);
645
-
int tmp = ocfs2_free_suballoc_bits(handle, inode_ac->ac_inode,
646
-
inode_ac->ac_bh, suballoc_bit, bg_blkno, 1);
647
-
if (tmp)
648
-
mlog_errno(tmp);
649
-
}
650
-
651
-
return status;
652
638
}
653
639
654
640
static int ocfs2_mkdir(struct user_namespace *mnt_userns,
···
2024
2028
ocfs2_clusters_to_bytes(osb->sb, 1));
2025
2029
if (status < 0 && did_quota_inode)
2026
2030
dquot_free_inode(inode);
2027
-
if (handle)
2031
+
if (handle) {
2032
+
if (status < 0 && fe)
2033
+
ocfs2_set_links_count(fe, 0);
2028
2034
ocfs2_commit_trans(osb, handle);
2035
+
}
2029
2036
2030
2037
ocfs2_inode_unlock(dir, 1);
2031
2038
if (did_block_signals)
+1
-1
fs/proc/task_mmu.c
+1
-1
fs/proc/task_mmu.c
+1
-1
init/Kconfig
+1
-1
init/Kconfig
···
66
66
This shows whether a suitable Rust toolchain is available (found).
67
67
68
68
Please see Documentation/rust/quick-start.rst for instructions on how
69
-
to satify the build requirements of Rust support.
69
+
to satisfy the build requirements of Rust support.
70
70
71
71
In particular, the Makefile target 'rustavailable' is useful to check
72
72
why the Rust toolchain is not being detected.
+16
-2
kernel/gcov/gcc_4_7.c
+16
-2
kernel/gcov/gcc_4_7.c
···
30
30
31
31
#define GCOV_TAG_FUNCTION_LENGTH 3
32
32
33
+
/* Since GCC 12.1 sizes are in BYTES and not in WORDS (4B). */
34
+
#if (__GNUC__ >= 12)
35
+
#define GCOV_UNIT_SIZE 4
36
+
#else
37
+
#define GCOV_UNIT_SIZE 1
38
+
#endif
39
+
33
40
static struct gcov_info *gcov_info_head;
34
41
35
42
/**
···
390
383
pos += store_gcov_u32(buffer, pos, info->version);
391
384
pos += store_gcov_u32(buffer, pos, info->stamp);
392
385
386
+
#if (__GNUC__ >= 12)
387
+
/* Use zero as checksum of the compilation unit. */
388
+
pos += store_gcov_u32(buffer, pos, 0);
389
+
#endif
390
+
393
391
for (fi_idx = 0; fi_idx < info->n_functions; fi_idx++) {
394
392
fi_ptr = info->functions[fi_idx];
395
393
396
394
/* Function record. */
397
395
pos += store_gcov_u32(buffer, pos, GCOV_TAG_FUNCTION);
398
-
pos += store_gcov_u32(buffer, pos, GCOV_TAG_FUNCTION_LENGTH);
396
+
pos += store_gcov_u32(buffer, pos,
397
+
GCOV_TAG_FUNCTION_LENGTH * GCOV_UNIT_SIZE);
399
398
pos += store_gcov_u32(buffer, pos, fi_ptr->ident);
400
399
pos += store_gcov_u32(buffer, pos, fi_ptr->lineno_checksum);
401
400
pos += store_gcov_u32(buffer, pos, fi_ptr->cfg_checksum);
···
415
402
/* Counter record. */
416
403
pos += store_gcov_u32(buffer, pos,
417
404
GCOV_TAG_FOR_COUNTER(ct_idx));
418
-
pos += store_gcov_u32(buffer, pos, ci_ptr->num * 2);
405
+
pos += store_gcov_u32(buffer, pos,
406
+
ci_ptr->num * 2 * GCOV_UNIT_SIZE);
419
407
420
408
for (cv_idx = 0; cv_idx < ci_ptr->num; cv_idx++) {
421
409
pos += store_gcov_u64(buffer, pos,
+10
-1
mm/huge_memory.c
+10
-1
mm/huge_memory.c
···
2455
2455
page_tail);
2456
2456
page_tail->mapping = head->mapping;
2457
2457
page_tail->index = head->index + tail;
2458
-
page_tail->private = 0;
2458
+
2459
+
/*
2460
+
* page->private should not be set in tail pages with the exception
2461
+
* of swap cache pages that store the swp_entry_t in tail pages.
2462
+
* Fix up and warn once if private is unexpectedly set.
2463
+
*/
2464
+
if (!folio_test_swapcache(page_folio(head))) {
2465
+
VM_WARN_ON_ONCE_PAGE(page_tail->private != 0, head);
2466
+
page_tail->private = 0;
2467
+
}
2459
2468
2460
2469
/* Page flags must be visible before we make the page non-compound. */
2461
2470
smp_wmb();
+28
-9
mm/hugetlb.c
+28
-9
mm/hugetlb.c
···
1014
1014
VM_BUG_ON_VMA(!is_vm_hugetlb_page(vma), vma);
1015
1015
/*
1016
1016
* Clear vm_private_data
1017
+
* - For shared mappings this is a per-vma semaphore that may be
1018
+
* allocated in a subsequent call to hugetlb_vm_op_open.
1019
+
* Before clearing, make sure pointer is not associated with vma
1020
+
* as this will leak the structure. This is the case when called
1021
+
* via clear_vma_resv_huge_pages() and hugetlb_vm_op_open has already
1022
+
* been called to allocate a new structure.
1017
1023
* - For MAP_PRIVATE mappings, this is the reserve map which does
1018
1024
* not apply to children. Faults generated by the children are
1019
1025
* not guaranteed to succeed, even if read-only.
1020
-
* - For shared mappings this is a per-vma semaphore that may be
1021
-
* allocated in a subsequent call to hugetlb_vm_op_open.
1022
1026
*/
1023
-
vma->vm_private_data = (void *)0;
1024
-
if (!(vma->vm_flags & VM_MAYSHARE))
1025
-
return;
1027
+
if (vma->vm_flags & VM_MAYSHARE) {
1028
+
struct hugetlb_vma_lock *vma_lock = vma->vm_private_data;
1029
+
1030
+
if (vma_lock && vma_lock->vma != vma)
1031
+
vma->vm_private_data = NULL;
1032
+
} else
1033
+
vma->vm_private_data = NULL;
1026
1034
}
1027
1035
1028
1036
/*
···
2932
2924
page = alloc_buddy_huge_page_with_mpol(h, vma, addr);
2933
2925
if (!page)
2934
2926
goto out_uncharge_cgroup;
2927
+
spin_lock_irq(&hugetlb_lock);
2935
2928
if (!avoid_reserve && vma_has_reserves(vma, gbl_chg)) {
2936
2929
SetHPageRestoreReserve(page);
2937
2930
h->resv_huge_pages--;
2938
2931
}
2939
-
spin_lock_irq(&hugetlb_lock);
2940
2932
list_add(&page->lru, &h->hugepage_activelist);
2941
2933
set_page_refcounted(page);
2942
2934
/* Fall through */
···
4609
4601
struct resv_map *resv = vma_resv_map(vma);
4610
4602
4611
4603
/*
4604
+
* HPAGE_RESV_OWNER indicates a private mapping.
4612
4605
* This new VMA should share its siblings reservation map if present.
4613
4606
* The VMA will only ever have a valid reservation map pointer where
4614
4607
* it is being copied for another still existing VMA. As that VMA
···
4624
4615
4625
4616
/*
4626
4617
* vma_lock structure for sharable mappings is vma specific.
4627
-
* Clear old pointer (if copied via vm_area_dup) and create new.
4618
+
* Clear old pointer (if copied via vm_area_dup) and allocate
4619
+
* new structure. Before clearing, make sure vma_lock is not
4620
+
* for this vma.
4628
4621
*/
4629
4622
if (vma->vm_flags & VM_MAYSHARE) {
4630
-
vma->vm_private_data = NULL;
4631
-
hugetlb_vma_lock_alloc(vma);
4623
+
struct hugetlb_vma_lock *vma_lock = vma->vm_private_data;
4624
+
4625
+
if (vma_lock) {
4626
+
if (vma_lock->vma != vma) {
4627
+
vma->vm_private_data = NULL;
4628
+
hugetlb_vma_lock_alloc(vma);
4629
+
} else
4630
+
pr_warn("HugeTLB: vma_lock already exists in %s.\n", __func__);
4631
+
} else
4632
+
hugetlb_vma_lock_alloc(vma);
4632
4633
}
4633
4634
}
4634
4635
+11
-6
mm/mempolicy.c
+11
-6
mm/mempolicy.c
···
787
787
static int mbind_range(struct mm_struct *mm, unsigned long start,
788
788
unsigned long end, struct mempolicy *new_pol)
789
789
{
790
-
MA_STATE(mas, &mm->mm_mt, start - 1, start - 1);
790
+
MA_STATE(mas, &mm->mm_mt, start, start);
791
791
struct vm_area_struct *prev;
792
792
struct vm_area_struct *vma;
793
793
int err = 0;
794
794
pgoff_t pgoff;
795
795
796
-
prev = mas_find_rev(&mas, 0);
797
-
if (prev && (start < prev->vm_end))
798
-
vma = prev;
799
-
else
800
-
vma = mas_next(&mas, end - 1);
796
+
prev = mas_prev(&mas, 0);
797
+
if (unlikely(!prev))
798
+
mas_set(&mas, start);
799
+
800
+
vma = mas_find(&mas, end - 1);
801
+
if (WARN_ON(!vma))
802
+
return 0;
803
+
804
+
if (start > vma->vm_start)
805
+
prev = vma;
801
806
802
807
for (; vma; vma = mas_next(&mas, end - 1)) {
803
808
unsigned long vmstart = max(start, vma->vm_start);
+10
-10
mm/mmap.c
+10
-10
mm/mmap.c
···
618
618
struct vm_area_struct *expand)
619
619
{
620
620
struct mm_struct *mm = vma->vm_mm;
621
-
struct vm_area_struct *next_next, *next = find_vma(mm, vma->vm_end);
621
+
struct vm_area_struct *next_next = NULL; /* uninit var warning */
622
+
struct vm_area_struct *next = find_vma(mm, vma->vm_end);
622
623
struct vm_area_struct *orig_vma = vma;
623
624
struct address_space *mapping = NULL;
624
625
struct rb_root_cached *root = NULL;
···
2626
2625
if (error)
2627
2626
goto unmap_and_free_vma;
2628
2627
2629
-
/* Can addr have changed??
2630
-
*
2631
-
* Answer: Yes, several device drivers can do it in their
2632
-
* f_op->mmap method. -DaveM
2628
+
/*
2629
+
* Expansion is handled above, merging is handled below.
2630
+
* Drivers should not alter the address of the VMA.
2633
2631
*/
2634
-
WARN_ON_ONCE(addr != vma->vm_start);
2635
-
2636
-
addr = vma->vm_start;
2632
+
if (WARN_ON((addr != vma->vm_start))) {
2633
+
error = -EINVAL;
2634
+
goto close_and_free_vma;
2635
+
}
2637
2636
mas_reset(&mas);
2638
2637
2639
2638
/*
···
2655
2654
vm_area_free(vma);
2656
2655
vma = merge;
2657
2656
/* Update vm_flags to pick up the change. */
2658
-
addr = vma->vm_start;
2659
2657
vm_flags = vma->vm_flags;
2660
2658
goto unmap_writable;
2661
2659
}
···
2681
2681
if (mas_preallocate(&mas, vma, GFP_KERNEL)) {
2682
2682
error = -ENOMEM;
2683
2683
if (file)
2684
-
goto unmap_and_free_vma;
2684
+
goto close_and_free_vma;
2685
2685
else
2686
2686
goto free_vma;
2687
2687
}
+11
-7
mm/page_alloc.c
+11
-7
mm/page_alloc.c
···
5784
5784
size_t size)
5785
5785
{
5786
5786
if (addr) {
5787
-
unsigned long alloc_end = addr + (PAGE_SIZE << order);
5788
-
unsigned long used = addr + PAGE_ALIGN(size);
5787
+
unsigned long nr = DIV_ROUND_UP(size, PAGE_SIZE);
5788
+
struct page *page = virt_to_page((void *)addr);
5789
+
struct page *last = page + nr;
5789
5790
5790
-
split_page(virt_to_page((void *)addr), order);
5791
-
while (used < alloc_end) {
5792
-
free_page(used);
5793
-
used += PAGE_SIZE;
5794
-
}
5791
+
split_page_owner(page, 1 << order);
5792
+
split_page_memcg(page, 1 << order);
5793
+
while (page < --last)
5794
+
set_page_refcounted(last);
5795
+
5796
+
last = page + (1UL << order);
5797
+
for (page += nr; page < last; page++)
5798
+
__free_pages_ok(page, 0, FPI_TO_TAIL);
5795
5799
}
5796
5800
return (void *)addr;
5797
5801
}