Commit 4cee37b3 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2022-12-10-1' of... 

Merge tag 'mm-hotfixes-stable-2022-12-10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "Nine hotfixes.

  Six for MM, three for other areas. Four of these patches address
  post-6.0 issues"

* tag 'mm-hotfixes-stable-2022-12-10-1' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  memcg: fix possible use-after-free in memcg_write_event_control()
  MAINTAINERS: update Muchun Song's email
  mm/gup: fix gup_pud_range() for dax
  mmap: fix do_brk_flags() modifying obviously incorrect VMAs
  mm/swap: fix SWP_PFN_BITS with CONFIG_PHYS_ADDR_T_64BIT on 32bit
  tmpfs: fix data loss from failed fallocate
  kselftests: cgroup: update kmem test precision tolerance
  mm: do not BUG_ON missing brk mapping, because userspace can unmap it
  mailmap: update Matti Vaittinen's email address
parents 296a7b7e 4a7ba45b

.mailmap

+3 −0
Original line number Diff line number Diff line
@@ -287,6 +287,7 @@ Matthew Wilcox <willy@infradead.org> <willy@linux.intel.com> 
Matthew Wilcox <willy@infradead.org> <willy@parisc-linux.org>

Matthias Fuchs <socketcan@esd.eu> <matthias.fuchs@esd.eu>

Matthieu CASTET <castet.matthieu@free.fr>

Matti Vaittinen <mazziesaccount@gmail.com> <matti.vaittinen@fi.rohmeurope.com>

Matt Ranostay <matt.ranostay@konsulko.com> <matt@ranostay.consulting>

Matt Ranostay <mranostay@gmail.com> Matthew Ranostay <mranostay@embeddedalley.com>

Matt Ranostay <mranostay@gmail.com> <matt.ranostay@intel.com>
@@ -372,6 +373,8 @@ Ricardo Ribalda <ribalda@kernel.org> <ricardo.ribalda@gmail.com> 
Roman Gushchin <roman.gushchin@linux.dev> <guro@fb.com>

Roman Gushchin <roman.gushchin@linux.dev> <guroan@gmail.com>

Roman Gushchin <roman.gushchin@linux.dev> <klamm@yandex-team.ru>

Muchun Song <muchun.song@linux.dev> <songmuchun@bytedance.com>

Muchun Song <muchun.song@linux.dev> <smuchun@gmail.com>

Ross Zwisler <zwisler@kernel.org> <ross.zwisler@linux.intel.com>

Rudolf Marek <R.Marek@sh.cvut.cz>

Rui Saraiva <rmps@joel.ist.utl.pt>

MAINTAINERS

+2 −2
Original line number Diff line number Diff line
@@ -5299,7 +5299,7 @@ M: Johannes Weiner <hannes@cmpxchg.org> 
M:	Michal Hocko <mhocko@kernel.org>

M:	Roman Gushchin <roman.gushchin@linux.dev>

M:	Shakeel Butt <shakeelb@google.com>

R:	Muchun Song <songmuchun@bytedance.com>

R:	Muchun Song <muchun.song@linux.dev>

L:	cgroups@vger.kernel.org

L:	linux-mm@kvack.org

S:	Maintained
@@ -9439,7 +9439,7 @@ F: drivers/net/ethernet/huawei/hinic/ 








HUGETLB SUBSYSTEM









M:	Mike Kravetz <mike.kravetz@oracle.com>









M:	Muchun Song <songmuchun@bytedance.com>









M:	Muchun Song <muchun.song@linux.dev>









L:	linux-mm@kvack.org









S:	Maintained









F:	Documentation/ABI/testing/sysfs-kernel-mm-hugepages
































include/linux/swapops.h



+5
−3






























Original line number
Diff line number
Diff line







@@ -35,7 +35,9 @@







#ifdef MAX_PHYSMEM_BITS









#define SWP_PFN_BITS		(MAX_PHYSMEM_BITS - PAGE_SHIFT)









#else  /* MAX_PHYSMEM_BITS */









#define SWP_PFN_BITS			(BITS_PER_LONG - PAGE_SHIFT)









#define SWP_PFN_BITS		min_t(int, \









				      sizeof(phys_addr_t) * 8 - PAGE_SHIFT, \









				      SWP_TYPE_SHIFT)









#endif	/* MAX_PHYSMEM_BITS */









#define SWP_PFN_MASK		(BIT(SWP_PFN_BITS) - 1)










































mm/gup.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -2852,7 +2852,7 @@ static int gup_pud_range(p4d_t *p4dp, p4d_t p4d, unsigned long addr, unsigned lo







		next = pud_addr_end(addr, end);









		if (unlikely(!pud_present(pud)))









			return 0;









		if (unlikely(pud_huge(pud))) {









		if (unlikely(pud_huge(pud) || pud_devmap(pud))) {









			if (!gup_huge_pud(pud, pudp, addr, next, flags,









					  pages, nr))









				return 0;
































mm/mmap.c



+4
−10






























Original line number
Diff line number
Diff line







@@ -226,8 +226,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)







		/* Search one past newbrk */









		mas_set(&mas, newbrk);









		brkvma = mas_find(&mas, oldbrk);









		BUG_ON(brkvma == NULL);









		if (brkvma->vm_start >= oldbrk)









		if (!brkvma || brkvma->vm_start >= oldbrk)









			goto out; /* mapping intersects with an existing non-brk vma. */









		/*









		 * mm->brk must be protected by write mmap_lock.








@@ -2946,9 +2945,9 @@ static int do_brk_flags(struct ma_state *mas, struct vm_area_struct *vma,







	 * Expand the existing vma if possible; Note that singular lists do not









	 * occur after forking, so the expand will only happen on new VMAs.









	 */









	if (vma &&









	    (!vma->anon_vma || list_is_singular(&vma->anon_vma_chain)) &&









	    ((vma->vm_flags & ~VM_SOFTDIRTY) == flags)) {









	if (vma && vma->vm_end == addr && !vma_policy(vma) &&









	    can_vma_merge_after(vma, flags, NULL, NULL,









				addr >> PAGE_SHIFT, NULL_VM_UFFD_CTX, NULL)) {









		mas_set_range(mas, vma->vm_start, addr + len - 1);









		if (mas_preallocate(mas, vma, GFP_KERNEL))









			return -ENOMEM;








@@ -3035,11 +3034,6 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags)







		goto munmap_failed;



















	vma = mas_prev(&mas, 0);









	if (!vma || vma->vm_end != addr || vma_policy(vma) ||









	    !can_vma_merge_after(vma, flags, NULL, NULL,









				 addr >> PAGE_SHIFT, NULL_VM_UFFD_CTX, NULL))









		vma = NULL;



















	ret = do_brk_flags(&mas, vma, addr, len, flags);









	populate = ((mm->def_flags & VM_LOCKED) != 0);









	mmap_write_unlock(mm);