Commit b467192e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 

Pull more hotfixes from Andrew Morton:
 "Seventeen hotfixes.  Mostly memory management things.

  Ten patches are cc:stable, addressing pre-6.0 issues"

* tag 'mm-hotfixes-stable-2022-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  .mailmap: update Luca Ceresoli's e-mail address
  mm/mprotect: only reference swap pfn page if type match
  squashfs: don't call kmalloc in decompressors
  mm/damon/dbgfs: avoid duplicate context directory creation
  mailmap: update email address for Colin King
  asm-generic: sections: refactor memory_intersects
  bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem
  ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
  Revert "memcg: cleanup racy sum avoidance code"
  mm/zsmalloc: do not attempt to free IS_ERR handle
  binder_alloc: add missing mmap_lock calls when using the VMA
  mm: re-allow pinning of zero pfns (again)
  vmcoreinfo: add kallsyms_num_syms symbol
  mailmap: update Guilherme G. Piccoli's email addresses
  writeback: avoid use-after-free after removing device
  shmem: update folio if shmem_replace_page() updates the page
  mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte
parents 373eff57 0ebafe2e

.mailmap

+4 −2
Original line number Diff line number Diff line
@@ -98,8 +98,7 @@ Christian Brauner <brauner@kernel.org> <christian.brauner@ubuntu.com> 
Christian Marangi <ansuelsmth@gmail.com>

Christophe Ricard <christophe.ricard@gmail.com>

Christoph Hellwig <hch@lst.de>

Colin Ian King <colin.king@intel.com> <colin.king@canonical.com>

Colin Ian King <colin.king@intel.com> <colin.i.king@gmail.com>

Colin Ian King <colin.i.king@gmail.com> <colin.king@canonical.com>

Corey Minyard <minyard@acm.org>

Damian Hobson-Garcia <dhobsong@igel.co.jp>

Daniel Borkmann <daniel@iogearbox.net> <danborkmann@googlemail.com>
@@ -150,6 +149,8 @@ Greg Kroah-Hartman <gregkh@suse.de> 
Greg Kroah-Hartman <greg@kroah.com>

Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>

Gregory CLEMENT <gregory.clement@bootlin.com> <gregory.clement@free-electrons.com>

Guilherme G. Piccoli <kernel@gpiccoli.net> <gpiccoli@linux.vnet.ibm.com>

Guilherme G. Piccoli <kernel@gpiccoli.net> <gpiccoli@canonical.com>

Guo Ren <guoren@kernel.org> <guoren@linux.alibaba.com>

Guo Ren <guoren@kernel.org> <ren_guo@c-sky.com>

Gustavo Padovan <gustavo@las.ic.unicamp.br>
@@ -253,6 +254,7 @@ Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@web.de> 
Li Yang <leoyang.li@nxp.com> <leoli@freescale.com>

Li Yang <leoyang.li@nxp.com> <leo@zh-kernel.org>

Lorenzo Pieralisi <lpieralisi@kernel.org> <lorenzo.pieralisi@arm.com>

Luca Ceresoli <luca.ceresoli@bootlin.com> <luca@lucaceresoli.net>

Lukasz Luba <lukasz.luba@arm.com> <l.luba@partner.samsung.com>

Maciej W. Rozycki <macro@mips.com> <macro@imgtec.com>

Maciej W. Rozycki <macro@orcam.me.uk> <macro@linux-mips.org>

drivers/android/binder_alloc.c

+21 −10
Original line number Diff line number Diff line
@@ -402,12 +402,15 @@ static struct binder_buffer *binder_alloc_new_buf_locked( 
	size_t size, data_offsets_size;

	int ret;



	mmap_read_lock(alloc->vma_vm_mm);

	if (!binder_alloc_get_vma(alloc)) {

		mmap_read_unlock(alloc->vma_vm_mm);

		binder_alloc_debug(BINDER_DEBUG_USER_ERROR,

				   "%d: binder_alloc_buf, no vma\n",

				   alloc->pid);

		return ERR_PTR(-ESRCH);

	}

	mmap_read_unlock(alloc->vma_vm_mm);



	data_offsets_size = ALIGN(data_size, sizeof(void *)) +

		ALIGN(offsets_size, sizeof(void *));
@@ -929,7 +932,14 @@ void binder_alloc_print_pages(struct seq_file *m, 
	 * Make sure the binder_alloc is fully initialized, otherwise we might

	 * read inconsistent state.

	 */

	if (binder_alloc_get_vma(alloc) != NULL) {



	mmap_read_lock(alloc->vma_vm_mm);

	if (binder_alloc_get_vma(alloc) == NULL) {

		mmap_read_unlock(alloc->vma_vm_mm);

		goto uninitialized;

	}



	mmap_read_unlock(alloc->vma_vm_mm);

	for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {

		page = &alloc->pages[i];

		if (!page->page_ptr)
@@ -939,7 +949,8 @@ void binder_alloc_print_pages(struct seq_file *m, 
		else

			lru++;

	}

	}



uninitialized:

	mutex_unlock(&alloc->mutex);

	seq_printf(m, "  pages: %d:%d:%d\n", active, lru, free);

	seq_printf(m, "  pages high watermark: %zu\n", alloc->pages_high);

fs/fs-writeback.c

+6 −6
Original line number Diff line number Diff line
@@ -134,10 +134,10 @@ static bool inode_io_list_move_locked(struct inode *inode, 


static void wb_wakeup(struct bdi_writeback *wb)

{

	spin_lock_bh(&wb->work_lock);

	spin_lock_irq(&wb->work_lock);

	if (test_bit(WB_registered, &wb->state))

		mod_delayed_work(bdi_wq, &wb->dwork, 0);

	spin_unlock_bh(&wb->work_lock);

	spin_unlock_irq(&wb->work_lock);

}



static void finish_writeback_work(struct bdi_writeback *wb,
@@ -164,7 +164,7 @@ static void wb_queue_work(struct bdi_writeback *wb, 
	if (work->done)

		atomic_inc(&work->done->cnt);



	spin_lock_bh(&wb->work_lock);

	spin_lock_irq(&wb->work_lock);



	if (test_bit(WB_registered, &wb->state)) {

		list_add_tail(&work->list, &wb->work_list);
@@ -172,7 +172,7 @@ static void wb_queue_work(struct bdi_writeback *wb, 
	} else

		finish_writeback_work(wb, work);



	spin_unlock_bh(&wb->work_lock);

	spin_unlock_irq(&wb->work_lock);

}



/**
@@ -2082,13 +2082,13 @@ static struct wb_writeback_work *get_next_work_item(struct bdi_writeback *wb) 
{

	struct wb_writeback_work *work = NULL;



	spin_lock_bh(&wb->work_lock);

	spin_lock_irq(&wb->work_lock);

	if (!list_empty(&wb->work_list)) {

		work = list_entry(wb->work_list.next,

				  struct wb_writeback_work, list);

		list_del_init(&work->list);

	}

	spin_unlock_bh(&wb->work_lock);

	spin_unlock_irq(&wb->work_lock);

	return work;

}

fs/ocfs2/dlmglue.c

+5 −3
Original line number Diff line number Diff line
@@ -3403,11 +3403,13 @@ void ocfs2_dlm_shutdown(struct ocfs2_super *osb, 
	ocfs2_lock_res_free(&osb->osb_nfs_sync_lockres);

	ocfs2_lock_res_free(&osb->osb_orphan_scan.os_lockres);



	if (osb->cconn) {

		ocfs2_cluster_disconnect(osb->cconn, hangup_pending);

		osb->cconn = NULL;



		ocfs2_dlm_shutdown_debug(osb);

	}

}



static int ocfs2_drop_lock(struct ocfs2_super *osb,

			   struct ocfs2_lock_res *lockres)

fs/ocfs2/super.c

+1 −2
Original line number Diff line number Diff line
@@ -1914,7 +1914,6 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err) 
	    !ocfs2_is_hard_readonly(osb))

		hangup_needed = 1;



	if (osb->cconn)

	ocfs2_dlm_shutdown(osb, hangup_needed);



	ocfs2_blockcheck_stats_debugfs_remove(&osb->osb_ecc_stats);