tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'mm-hotfixes-stable-2023-12-27-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
"11 hotfixes. 7 are cc:stable and the other 4 address post-6.6 issues
or are not considered backporting material"

* tag 'mm-hotfixes-stable-2023-12-27-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mailmap: add an old address for Naoya Horiguchi
mm/memory-failure: cast index to loff_t before shifting it
mm/memory-failure: check the mapcount of the precise page
mm/memory-failure: pass the folio and the page to collect_procs()
selftests: secretmem: floor the memory size to the multiple of page_size
mm: migrate high-order folios in swap cache correctly
maple_tree: do not preallocate nodes for slot stores
mm/filemap: avoid buffered read/write race to read inconsistent data
kunit: kasan_test: disable fortify string checker on kmalloc_oob_memset
kexec: select CRYPTO from KEXEC_FILE instead of depending on it
kexec: fix KEXEC_FILE dependencies

Linus Torvalds f5837722 1997b3cb

+74 -32
+1
.mailmap
··· 436 436 Murali Nalajala <quic_mnalajal@quicinc.com> <mnalajal@codeaurora.org> 437 437 Mythri P K <mythripk@ti.com> 438 438 Nadia Yvette Chambers <nyc@holomorphy.com> William Lee Irwin III <wli@holomorphy.com> 439 + Naoya Horiguchi <naoya.horiguchi@nec.com> <n-horiguchi@ah.jp.nec.com> 439 440 Nathan Chancellor <nathan@kernel.org> <natechancellor@gmail.com> 440 441 Neeraj Upadhyay <quic_neeraju@quicinc.com> <neeraju@codeaurora.org> 441 442 Neil Armstrong <neil.armstrong@linaro.org> <narmstrong@baylibre.com>
+2 -2
arch/powerpc/Kconfig
··· 608 608 def_bool PPC_BOOK3S || PPC_E500 || (44x && !SMP) 609 609 610 610 config ARCH_SUPPORTS_KEXEC_FILE 611 - def_bool PPC64 && CRYPTO=y && CRYPTO_SHA256=y 611 + def_bool PPC64 612 612 613 613 config ARCH_SUPPORTS_KEXEC_PURGATORY 614 - def_bool KEXEC_FILE 614 + def_bool y 615 615 616 616 config ARCH_SELECTS_KEXEC_FILE 617 617 def_bool y
+1 -3
arch/riscv/Kconfig
··· 702 702 select KEXEC_ELF 703 703 704 704 config ARCH_SUPPORTS_KEXEC_PURGATORY 705 - def_bool KEXEC_FILE 706 - depends on CRYPTO=y 707 - depends on CRYPTO_SHA256=y 705 + def_bool ARCH_SUPPORTS_KEXEC_FILE 708 706 709 707 config ARCH_SUPPORTS_CRASH_DUMP 710 708 def_bool y
+2 -2
arch/s390/Kconfig
··· 254 254 def_bool y 255 255 256 256 config ARCH_SUPPORTS_KEXEC_FILE 257 - def_bool CRYPTO && CRYPTO_SHA256 && CRYPTO_SHA256_S390 257 + def_bool y 258 258 259 259 config ARCH_SUPPORTS_KEXEC_SIG 260 260 def_bool MODULE_SIG_FORMAT 261 261 262 262 config ARCH_SUPPORTS_KEXEC_PURGATORY 263 - def_bool KEXEC_FILE 263 + def_bool y 264 264 265 265 config ARCH_SUPPORTS_CRASH_DUMP 266 266 def_bool y
+2 -2
arch/x86/Kconfig
··· 2072 2072 def_bool y 2073 2073 2074 2074 config ARCH_SUPPORTS_KEXEC_FILE 2075 - def_bool X86_64 && CRYPTO && CRYPTO_SHA256 2075 + def_bool X86_64 2076 2076 2077 2077 config ARCH_SELECTS_KEXEC_FILE 2078 2078 def_bool y ··· 2080 2080 select HAVE_IMA_KEXEC if IMA 2081 2081 2082 2082 config ARCH_SUPPORTS_KEXEC_PURGATORY 2083 - def_bool KEXEC_FILE 2083 + def_bool y 2084 2084 2085 2085 config ARCH_SUPPORTS_KEXEC_SIG 2086 2086 def_bool y
+2
kernel/Kconfig.kexec
··· 36 36 config KEXEC_FILE 37 37 bool "Enable kexec file based system call" 38 38 depends on ARCH_SUPPORTS_KEXEC_FILE 39 + select CRYPTO 40 + select CRYPTO_SHA256 39 41 select KEXEC_CORE 40 42 help 41 43 This is new version of kexec system call. This system call is
+11
lib/maple_tree.c
··· 5501 5501 5502 5502 mas_wr_end_piv(&wr_mas); 5503 5503 node_size = mas_wr_new_end(&wr_mas); 5504 + 5505 + /* Slot store, does not require additional nodes */ 5506 + if (node_size == wr_mas.node_end) { 5507 + /* reuse node */ 5508 + if (!mt_in_rcu(mas->tree)) 5509 + return 0; 5510 + /* shifting boundary */ 5511 + if (wr_mas.offset_end - mas->offset == 1) 5512 + return 0; 5513 + } 5514 + 5504 5515 if (node_size >= mt_slots[wr_mas.type]) { 5505 5516 /* Split, worst case for now. */ 5506 5517 request = 1 + mas_mt_height(mas) * 2;
+9
mm/filemap.c
··· 2608 2608 end_offset = min_t(loff_t, isize, iocb->ki_pos + iter->count); 2609 2609 2610 2610 /* 2611 + * Pairs with a barrier in 2612 + * block_write_end()->mark_buffer_dirty() or other page 2613 + * dirtying routines like iomap_write_end() to ensure 2614 + * changes to page contents are visible before we see 2615 + * increased inode size. 2616 + */ 2617 + smp_rmb(); 2618 + 2619 + /* 2611 2620 * Once we start copying data, we don't want to be touching any 2612 2621 * cachelines that might be contended: 2613 2622 */
+16 -4
mm/kasan/kasan_test.c
··· 493 493 { 494 494 char *ptr; 495 495 size_t size = 128 - KASAN_GRANULE_SIZE; 496 + size_t memset_size = 2; 496 497 497 498 KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); 498 499 499 500 ptr = kmalloc(size, GFP_KERNEL); 500 501 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 501 502 503 + OPTIMIZER_HIDE_VAR(ptr); 502 504 OPTIMIZER_HIDE_VAR(size); 503 - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); 505 + OPTIMIZER_HIDE_VAR(memset_size); 506 + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, memset_size)); 504 507 kfree(ptr); 505 508 } 506 509 ··· 511 508 { 512 509 char *ptr; 513 510 size_t size = 128 - KASAN_GRANULE_SIZE; 511 + size_t memset_size = 4; 514 512 515 513 KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); 516 514 517 515 ptr = kmalloc(size, GFP_KERNEL); 518 516 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 519 517 518 + OPTIMIZER_HIDE_VAR(ptr); 520 519 OPTIMIZER_HIDE_VAR(size); 521 - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); 520 + OPTIMIZER_HIDE_VAR(memset_size); 521 + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, memset_size)); 522 522 kfree(ptr); 523 523 } 524 524 ··· 529 523 { 530 524 char *ptr; 531 525 size_t size = 128 - KASAN_GRANULE_SIZE; 526 + size_t memset_size = 8; 532 527 533 528 KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); 534 529 535 530 ptr = kmalloc(size, GFP_KERNEL); 536 531 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 537 532 533 + OPTIMIZER_HIDE_VAR(ptr); 538 534 OPTIMIZER_HIDE_VAR(size); 539 - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); 535 + OPTIMIZER_HIDE_VAR(memset_size); 536 + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, memset_size)); 540 537 kfree(ptr); 541 538 } 542 539 ··· 547 538 { 548 539 char *ptr; 549 540 size_t size = 128 - KASAN_GRANULE_SIZE; 541 + size_t memset_size = 16; 550 542 551 543 KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); 552 544 553 545 ptr = kmalloc(size, GFP_KERNEL); 554 546 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); 555 547 548 + OPTIMIZER_HIDE_VAR(ptr); 556 549 OPTIMIZER_HIDE_VAR(size); 557 - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); 550 + OPTIMIZER_HIDE_VAR(memset_size); 551 + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, memset_size)); 558 552 kfree(ptr); 559 553 } 560 554
+16 -17
mm/memory-failure.c
··· 595 595 /* 596 596 * Collect processes when the error hit an anonymous page. 597 597 */ 598 - static void collect_procs_anon(struct page *page, struct list_head *to_kill, 599 - int force_early) 598 + static void collect_procs_anon(struct folio *folio, struct page *page, 599 + struct list_head *to_kill, int force_early) 600 600 { 601 - struct folio *folio = page_folio(page); 602 601 struct vm_area_struct *vma; 603 602 struct task_struct *tsk; 604 603 struct anon_vma *av; ··· 632 633 /* 633 634 * Collect processes when the error hit a file mapped page. 634 635 */ 635 - static void collect_procs_file(struct page *page, struct list_head *to_kill, 636 - int force_early) 636 + static void collect_procs_file(struct folio *folio, struct page *page, 637 + struct list_head *to_kill, int force_early) 637 638 { 638 639 struct vm_area_struct *vma; 639 640 struct task_struct *tsk; 640 - struct address_space *mapping = page->mapping; 641 + struct address_space *mapping = folio->mapping; 641 642 pgoff_t pgoff; 642 643 643 644 i_mmap_lock_read(mapping); ··· 703 704 /* 704 705 * Collect the processes who have the corrupted page mapped to kill. 705 706 */ 706 - static void collect_procs(struct page *page, struct list_head *tokill, 707 - int force_early) 707 + static void collect_procs(struct folio *folio, struct page *page, 708 + struct list_head *tokill, int force_early) 708 709 { 709 - if (!page->mapping) 710 + if (!folio->mapping) 710 711 return; 711 712 if (unlikely(PageKsm(page))) 712 713 collect_procs_ksm(page, tokill, force_early); 713 714 else if (PageAnon(page)) 714 - collect_procs_anon(page, tokill, force_early); 715 + collect_procs_anon(folio, page, tokill, force_early); 715 716 else 716 - collect_procs_file(page, tokill, force_early); 717 + collect_procs_file(folio, page, tokill, force_early); 717 718 } 718 719 719 720 struct hwpoison_walk { ··· 1570 1571 * This check implies we don't kill processes if their pages 1571 1572 * are in the swap cache early. Those are always late kills. 1572 1573 */ 1573 - if (!page_mapped(hpage)) 1574 + if (!page_mapped(p)) 1574 1575 return true; 1575 1576 1576 1577 if (PageSwapCache(p)) { ··· 1601 1602 * mapped in dirty form. This has to be done before try_to_unmap, 1602 1603 * because ttu takes the rmap data structures down. 1603 1604 */ 1604 - collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED); 1605 + collect_procs(folio, p, &tokill, flags & MF_ACTION_REQUIRED); 1605 1606 1606 1607 if (PageHuge(hpage) && !PageAnon(hpage)) { 1607 1608 /* ··· 1621 1622 try_to_unmap(folio, ttu); 1622 1623 } 1623 1624 1624 - unmap_success = !page_mapped(hpage); 1625 + unmap_success = !page_mapped(p); 1625 1626 if (!unmap_success) 1626 1627 pr_err("%#lx: failed to unmap page (mapcount=%d)\n", 1627 - pfn, page_mapcount(hpage)); 1628 + pfn, page_mapcount(p)); 1628 1629 1629 1630 /* 1630 1631 * try_to_unmap() might put mlocked page in lru cache, so call ··· 1704 1705 * mapping being torn down is communicated in siginfo, see 1705 1706 * kill_proc() 1706 1707 */ 1707 - loff_t start = (index << PAGE_SHIFT) & ~(size - 1); 1708 + loff_t start = ((loff_t)index << PAGE_SHIFT) & ~(size - 1); 1708 1709 1709 1710 unmap_mapping_range(mapping, start, size, 0); 1710 1711 } ··· 1771 1772 * SIGBUS (i.e. MF_MUST_KILL) 1772 1773 */ 1773 1774 flags |= MF_ACTION_REQUIRED | MF_MUST_KILL; 1774 - collect_procs(&folio->page, &to_kill, true); 1775 + collect_procs(folio, &folio->page, &to_kill, true); 1775 1776 1776 1777 unmap_and_kill(&to_kill, pfn, folio->mapping, folio->index, flags); 1777 1778 unlock:
+8 -1
mm/migrate.c
··· 405 405 int dirty; 406 406 int expected_count = folio_expected_refs(mapping, folio) + extra_count; 407 407 long nr = folio_nr_pages(folio); 408 + long entries, i; 408 409 409 410 if (!mapping) { 410 411 /* Anonymous page without mapping */ ··· 443 442 folio_set_swapcache(newfolio); 444 443 newfolio->private = folio_get_private(folio); 445 444 } 445 + entries = nr; 446 446 } else { 447 447 VM_BUG_ON_FOLIO(folio_test_swapcache(folio), folio); 448 + entries = 1; 448 449 } 449 450 450 451 /* Move dirty while page refs frozen and newpage not yet exposed */ ··· 456 453 folio_set_dirty(newfolio); 457 454 } 458 455 459 - xas_store(&xas, newfolio); 456 + /* Swap cache still stores N entries instead of a high-order entry */ 457 + for (i = 0; i < entries; i++) { 458 + xas_store(&xas, newfolio); 459 + xas_next(&xas); 460 + } 460 461 461 462 /* 462 463 * Drop cache reference from old page by unfreezing
+1 -1
tools/testing/radix-tree/maple.c
··· 35538 35538 MT_BUG_ON(mt, mas_preallocate(&mas, ptr, GFP_KERNEL) != 0); 35539 35539 allocated = mas_allocated(&mas); 35540 35540 height = mas_mt_height(&mas); 35541 - MT_BUG_ON(mt, allocated != 1); 35541 + MT_BUG_ON(mt, allocated != 0); 35542 35542 mas_store_prealloc(&mas, ptr); 35543 35543 MT_BUG_ON(mt, mas_allocated(&mas) != 0); 35544 35544
+3
tools/testing/selftests/mm/memfd_secret.c
··· 62 62 char *mem; 63 63 64 64 len = mlock_limit_cur; 65 + if (len % page_size != 0) 66 + len = (len/page_size) * page_size; 67 + 65 68 mem = mmap(NULL, len, prot, mode, fd, 0); 66 69 if (mem == MAP_FAILED) { 67 70 fail("unable to mmap secret memory\n");