Commit 0014404f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'akpm' (patches from Andrew) 

Merge misc fixes from Andrew Morton:
 "8 patches.

  Subsystems affected by this patch series: mm (hugetlb, pagemap, and
  userfaultfd), memfd, selftests, and kconfig"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  configs/debug: set CONFIG_DEBUG_INFO=y properly
  proc: fix documentation and description of pagemap
  kselftest/vm: fix tests build with old libc
  memfd: fix F_SEAL_WRITE after shmem huge page allocated
  mm: fix use-after-free when anon vma name is used after vma is freed
  mm: prevent vm_area_struct::anon_name refcount saturation
  mm: refactor vm_area_struct::anon_vma_name usage code
  selftests/vm: cleanup hugetlb file after mremap test
parents f9026e19 d1eff16d

Documentation/admin-guide/mm/pagemap.rst

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ There are four components to pagemap: 
    * Bit  56    page exclusively mapped (since 4.2)

    * Bit  57    pte is uffd-wp write-protected (since 5.13) (see

      :ref:`Documentation/admin-guide/mm/userfaultfd.rst <userfaultfd>`)

    * Bits 57-60 zero

    * Bits 58-60 zero

    * Bit  61    page is file-page or shared-anon (since 3.5)

    * Bit  62    page swapped

    * Bit  63    page present

fs/proc/task_mmu.c

+5 −4
Original line number Diff line number Diff line
@@ -309,7 +309,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma) 


	name = arch_vma_name(vma);

	if (!name) {

		const char *anon_name;

		struct anon_vma_name *anon_name;



		if (!mm) {

			name = "[vdso]";
@@ -327,10 +327,10 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma) 
			goto done;

		}



		anon_name = vma_anon_name(vma);

		anon_name = anon_vma_name(vma);

		if (anon_name) {

			seq_pad(m, ' ');

			seq_printf(m, "[anon:%s]", anon_name);

			seq_printf(m, "[anon:%s]", anon_name->name);

		}

	}
@@ -1597,7 +1597,8 @@ static const struct mm_walk_ops pagemap_ops = { 
 * Bits 5-54  swap offset if swapped

 * Bit  55    pte is soft-dirty (see Documentation/admin-guide/mm/soft-dirty.rst)

 * Bit  56    page exclusively mapped

 * Bits 57-60 zero

 * Bit  57    pte is uffd-wp write-protected

 * Bits 58-60 zero

 * Bit  61    page is file-page or shared-anon

 * Bit  62    page swapped

 * Bit  63    page present

fs/userfaultfd.c

+3 −3
Original line number Diff line number Diff line
@@ -878,7 +878,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) 
				 new_flags, vma->anon_vma,

				 vma->vm_file, vma->vm_pgoff,

				 vma_policy(vma),

				 NULL_VM_UFFD_CTX, vma_anon_name(vma));

				 NULL_VM_UFFD_CTX, anon_vma_name(vma));

		if (prev)

			vma = prev;

		else
@@ -1438,7 +1438,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, 
				 vma->anon_vma, vma->vm_file, vma->vm_pgoff,

				 vma_policy(vma),

				 ((struct vm_userfaultfd_ctx){ ctx }),

				 vma_anon_name(vma));

				 anon_vma_name(vma));

		if (prev) {

			vma = prev;

			goto next;
@@ -1615,7 +1615,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, 
		prev = vma_merge(mm, prev, start, vma_end, new_flags,

				 vma->anon_vma, vma->vm_file, vma->vm_pgoff,

				 vma_policy(vma),

				 NULL_VM_UFFD_CTX, vma_anon_name(vma));

				 NULL_VM_UFFD_CTX, anon_vma_name(vma));

		if (prev) {

			vma = prev;

			goto next;

include/linux/mm.h

+4 −3
Original line number Diff line number Diff line
@@ -2626,7 +2626,7 @@ static inline int vma_adjust(struct vm_area_struct *vma, unsigned long start, 
extern struct vm_area_struct *vma_merge(struct mm_struct *,

	struct vm_area_struct *prev, unsigned long addr, unsigned long end,

	unsigned long vm_flags, struct anon_vma *, struct file *, pgoff_t,

	struct mempolicy *, struct vm_userfaultfd_ctx, const char *);

	struct mempolicy *, struct vm_userfaultfd_ctx, struct anon_vma_name *);

extern struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *);

extern int __split_vma(struct mm_struct *, struct vm_area_struct *,

	unsigned long addr, int new_below);
@@ -3372,11 +3372,12 @@ static inline int seal_check_future_write(int seals, struct vm_area_struct *vma) 


#ifdef CONFIG_ANON_VMA_NAME

int madvise_set_anon_name(struct mm_struct *mm, unsigned long start,

			  unsigned long len_in, const char *name);

			  unsigned long len_in,

			  struct anon_vma_name *anon_name);

#else

static inline int

madvise_set_anon_name(struct mm_struct *mm, unsigned long start,

		      unsigned long len_in, const char *name) {

		      unsigned long len_in, struct anon_vma_name *anon_name) {

	return 0;

}

#endif

include/linux/mm_inline.h

+69 −28
Original line number Diff line number Diff line
@@ -140,50 +140,91 @@ static __always_inline void del_page_from_lru_list(struct page *page, 


#ifdef CONFIG_ANON_VMA_NAME

/*

 * mmap_lock should be read-locked when calling vma_anon_name() and while using

 * the returned pointer.

 * mmap_lock should be read-locked when calling anon_vma_name(). Caller should

 * either keep holding the lock while using the returned pointer or it should

 * raise anon_vma_name refcount before releasing the lock.

 */

extern const char *vma_anon_name(struct vm_area_struct *vma);

extern struct anon_vma_name *anon_vma_name(struct vm_area_struct *vma);

extern struct anon_vma_name *anon_vma_name_alloc(const char *name);

extern void anon_vma_name_free(struct kref *kref);



/*

 * mmap_lock should be read-locked for orig_vma->vm_mm.

 * mmap_lock should be write-locked for new_vma->vm_mm or new_vma should be

 * isolated.

 */

extern void dup_vma_anon_name(struct vm_area_struct *orig_vma,

			      struct vm_area_struct *new_vma);

/* mmap_lock should be read-locked */

static inline void anon_vma_name_get(struct anon_vma_name *anon_name)

{

	if (anon_name)

		kref_get(&anon_name->kref);

}



static inline void anon_vma_name_put(struct anon_vma_name *anon_name)

{

	if (anon_name)

		kref_put(&anon_name->kref, anon_vma_name_free);

}



static inline

struct anon_vma_name *anon_vma_name_reuse(struct anon_vma_name *anon_name)

{

	/* Prevent anon_name refcount saturation early on */

	if (kref_read(&anon_name->kref) < REFCOUNT_MAX) {

		anon_vma_name_get(anon_name);

		return anon_name;



	}

	return anon_vma_name_alloc(anon_name->name);

}



static inline void dup_anon_vma_name(struct vm_area_struct *orig_vma,

				     struct vm_area_struct *new_vma)

{

	struct anon_vma_name *anon_name = anon_vma_name(orig_vma);



	if (anon_name)

		new_vma->anon_name = anon_vma_name_reuse(anon_name);

}



static inline void free_anon_vma_name(struct vm_area_struct *vma)

{

	/*

 * mmap_lock should be write-locked or vma should have been isolated under

 * write-locked mmap_lock protection.

	 * Not using anon_vma_name because it generates a warning if mmap_lock

	 * is not held, which might be the case here.

	 */

extern void free_vma_anon_name(struct vm_area_struct *vma);

	if (!vma->vm_file)

		anon_vma_name_put(vma->anon_name);

}



/* mmap_lock should be read-locked */

static inline bool is_same_vma_anon_name(struct vm_area_struct *vma,

					 const char *name)

static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1,

				    struct anon_vma_name *anon_name2)

{

	const char *vma_name = vma_anon_name(vma);



	/* either both NULL, or pointers to same string */

	if (vma_name == name)

	if (anon_name1 == anon_name2)

		return true;



	return name && vma_name && !strcmp(name, vma_name);

	return anon_name1 && anon_name2 &&

		!strcmp(anon_name1->name, anon_name2->name);

}



#else /* CONFIG_ANON_VMA_NAME */

static inline const char *vma_anon_name(struct vm_area_struct *vma)

static inline struct anon_vma_name *anon_vma_name(struct vm_area_struct *vma)

{

	return NULL;

}

static inline void dup_vma_anon_name(struct vm_area_struct *orig_vma,



static inline struct anon_vma_name *anon_vma_name_alloc(const char *name)

{

	return NULL;

}



static inline void anon_vma_name_get(struct anon_vma_name *anon_name) {}

static inline void anon_vma_name_put(struct anon_vma_name *anon_name) {}

static inline void dup_anon_vma_name(struct vm_area_struct *orig_vma,

				     struct vm_area_struct *new_vma) {}

static inline void free_vma_anon_name(struct vm_area_struct *vma) {}

static inline bool is_same_vma_anon_name(struct vm_area_struct *vma,

					 const char *name)

static inline void free_anon_vma_name(struct vm_area_struct *vma) {}



static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1,

				    struct anon_vma_name *anon_name2)

{

	return true;

}



#endif  /* CONFIG_ANON_VMA_NAME */



static inline void init_tlb_flush_pending(struct mm_struct *mm)