Skip to content

Commit 086ee11

Browse files
torvaldstorvalds
committed
Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton: "12 patches. Subsystems affected by this patch series: MAINTAINERS, mailmap, memfd, and mm (hugetlb, kasan, hugetlbfs, pagemap, selftests, memcg, and slab)" * emailed patches from Andrew Morton <[email protected]>: selftests/memfd: clean up mapping in mfd_fail_write mailmap: update Roman Gushchin's email MAINTAINERS, SLAB: add Roman as reviewer, git tree MAINTAINERS: add Shakeel as a memcg co-maintainer MAINTAINERS: remove Vladimir from memcg maintainers MAINTAINERS: add Roman as a memcg co-maintainer selftest/vm: fix map_fixed_noreplace test failure mm: fix use-after-free bug when mm->mmap is reused after being freed hugetlbfs: fix a truncation issue in hugepages parameter kasan: test: prevent cache merging in kmem_cache_double_destroy mm/hugetlb: fix kernel crash with hugetlb mremap MAINTAINERS: add sysctl-next git tree
2 parents 2c8c230 + fda153c commit 086ee11

File tree

7 files changed

+56
-20
lines changed

7 files changed

+56
-20
lines changed

‎.mailmap

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,9 @@ Rémi Denis-Courmont <[email protected]>
333333
Ricardo Ribalda <[email protected]> <[email protected]>
334334
Ricardo Ribalda <[email protected]> Ricardo Ribalda Delgado <[email protected]>
335335
Ricardo Ribalda <[email protected]> <[email protected]>
336+
Roman Gushchin <[email protected]> <[email protected]>
337+
Roman Gushchin <[email protected]> <[email protected]>
338+
Roman Gushchin <[email protected]> <[email protected]>
336339
Ross Zwisler <[email protected]> <[email protected]>
337340
Rudolf Marek <[email protected]>
338341
Rui Saraiva <[email protected]>

‎MAINTAINERS

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4913,7 +4913,8 @@ F: kernel/cgroup/cpuset.c
49134913
CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
49144914
M: Johannes Weiner <[email protected]>
49154915
M: Michal Hocko <[email protected]>
4916-
M: Vladimir Davydov <[email protected]>
4916+
M: Roman Gushchin <[email protected]>
4917+
M: Shakeel Butt <[email protected]>
49174918
L: [email protected]
49184919
L: [email protected]
49194920
S: Maintained
@@ -15567,6 +15568,7 @@ M: Iurii Zaikin <[email protected]>
1556715568
L: [email protected]
1556815569
L: [email protected]
1556915570
S: Maintained
15571+
T: git git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git sysctl-next
1557015572
F: fs/proc/proc_sysctl.c
1557115573
F: include/linux/sysctl.h
1557215574
F: kernel/sysctl-test.c
@@ -17760,8 +17762,10 @@ M: David Rientjes <[email protected]>
1776017762
M: Joonsoo Kim <[email protected]>
1776117763
M: Andrew Morton <[email protected]>
1776217764
M: Vlastimil Babka <[email protected]>
17765+
R: Roman Gushchin <[email protected]>
1776317766
L: [email protected]
1776417767
S: Maintained
17768+
T: git git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab.git
1776517769
F: include/linux/sl?b*.h
1776617770
F: mm/sl?b*
1776717771

‎lib/test_kasan.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -869,11 +869,14 @@ static void kmem_cache_invalid_free(struct kunit *test)
869869
kmem_cache_destroy(cache);
870870
}
871871

872+
static void empty_cache_ctor(void *object) { }
873+
872874
static void kmem_cache_double_destroy(struct kunit *test)
873875
{
874876
struct kmem_cache *cache;
875877

876-
cache = kmem_cache_create("test_cache", 200, 0, 0, NULL);
878+
/* Provide a constructor to prevent cache merging. */
879+
cache = kmem_cache_create("test_cache", 200, 0, 0, empty_cache_ctor);
877880
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
878881
kmem_cache_destroy(cache);
879882
KUNIT_EXPECT_KASAN_FAIL(test, kmem_cache_destroy(cache));

‎mm/hugetlb.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4159,10 +4159,10 @@ static int __init hugepages_setup(char *s)
41594159
pr_warn("HugeTLB: architecture can't support node specific alloc, ignoring!\n");
41604160
return 0;
41614161
}
4162+
if (tmp >= nr_online_nodes)
4163+
goto invalid;
41624164
node = tmp;
41634165
p += count + 1;
4164-
if (node < 0 || node >= nr_online_nodes)
4165-
goto invalid;
41664166
/* Parse hugepages */
41674167
if (sscanf(p, "%lu%n", &tmp, &count) != 1)
41684168
goto invalid;
@@ -4851,14 +4851,13 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
48514851
}
48524852

48534853
static void move_huge_pte(struct vm_area_struct *vma, unsigned long old_addr,
4854-
unsigned long new_addr, pte_t *src_pte)
4854+
unsigned long new_addr, pte_t *src_pte, pte_t *dst_pte)
48554855
{
48564856
struct hstate *h = hstate_vma(vma);
48574857
struct mm_struct *mm = vma->vm_mm;
4858-
pte_t *dst_pte, pte;
48594858
spinlock_t *src_ptl, *dst_ptl;
4859+
pte_t pte;
48604860

4861-
dst_pte = huge_pte_offset(mm, new_addr, huge_page_size(h));
48624861
dst_ptl = huge_pte_lock(h, mm, dst_pte);
48634862
src_ptl = huge_pte_lockptr(h, mm, src_pte);
48644863

@@ -4917,7 +4916,7 @@ int move_hugetlb_page_tables(struct vm_area_struct *vma,
49174916
if (!dst_pte)
49184917
break;
49194918

4920-
move_huge_pte(vma, old_addr, new_addr, src_pte);
4919+
move_huge_pte(vma, old_addr, new_addr, src_pte, dst_pte);
49214920
}
49224921
flush_tlb_range(vma, old_end - len, old_end);
49234922
mmu_notifier_invalidate_range_end(&range);

‎mm/mmap.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3186,6 +3186,7 @@ void exit_mmap(struct mm_struct *mm)
31863186
vma = remove_vma(vma);
31873187
cond_resched();
31883188
}
3189+
mm->mmap = NULL;
31893190
mmap_write_unlock(mm);
31903191
vm_unacct_memory(nr_accounted);
31913192
}

‎tools/testing/selftests/memfd/memfd_test.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,7 @@ static void mfd_fail_write(int fd)
455455
printf("mmap()+mprotect() didn't fail as expected\n");
456456
abort();
457457
}
458+
munmap(p, mfd_def_size);
458459
}
459460

460461
/* verify PUNCH_HOLE fails */

‎tools/testing/selftests/vm/map_fixed_noreplace.c

Lines changed: 37 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@
1717
#define MAP_FIXED_NOREPLACE 0x100000
1818
#endif
1919

20-
#define BASE_ADDRESS (256ul * 1024 * 1024)
21-
22-
2320
static void dump_maps(void)
2421
{
2522
char cmd[32];
@@ -28,18 +25,46 @@ static void dump_maps(void)
2825
system(cmd);
2926
}
3027

28+
static unsigned long find_base_addr(unsigned long size)
29+
{
30+
void *addr;
31+
unsigned long flags;
32+
33+
flags = MAP_PRIVATE | MAP_ANONYMOUS;
34+
addr = mmap(NULL, size, PROT_NONE, flags, -1, 0);
35+
if (addr == MAP_FAILED) {
36+
printf("Error: couldn't map the space we need for the test\n");
37+
return 0;
38+
}
39+
40+
if (munmap(addr, size) != 0) {
41+
printf("Error: couldn't map the space we need for the test\n");
42+
return 0;
43+
}
44+
return (unsigned long)addr;
45+
}
46+
3147
int main(void)
3248
{
49+
unsigned long base_addr;
3350
unsigned long flags, addr, size, page_size;
3451
char *p;
3552

3653
page_size = sysconf(_SC_PAGE_SIZE);
3754

55+
//let's find a base addr that is free before we start the tests
56+
size = 5 * page_size;
57+
base_addr = find_base_addr(size);
58+
if (!base_addr) {
59+
printf("Error: couldn't map the space we need for the test\n");
60+
return 1;
61+
}
62+
3863
flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE;
3964

4065
// Check we can map all the areas we need below
4166
errno = 0;
42-
addr = BASE_ADDRESS;
67+
addr = base_addr;
4368
size = 5 * page_size;
4469
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
4570

@@ -60,7 +85,7 @@ int main(void)
6085
printf("unmap() successful\n");
6186

6287
errno = 0;
63-
addr = BASE_ADDRESS + page_size;
88+
addr = base_addr + page_size;
6489
size = 3 * page_size;
6590
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
6691
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -80,7 +105,7 @@ int main(void)
80105
* +4 | free | new
81106
*/
82107
errno = 0;
83-
addr = BASE_ADDRESS;
108+
addr = base_addr;
84109
size = 5 * page_size;
85110
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
86111
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -101,7 +126,7 @@ int main(void)
101126
* +4 | free |
102127
*/
103128
errno = 0;
104-
addr = BASE_ADDRESS + (2 * page_size);
129+
addr = base_addr + (2 * page_size);
105130
size = page_size;
106131
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
107132
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -121,7 +146,7 @@ int main(void)
121146
* +4 | free | new
122147
*/
123148
errno = 0;
124-
addr = BASE_ADDRESS + (3 * page_size);
149+
addr = base_addr + (3 * page_size);
125150
size = 2 * page_size;
126151
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
127152
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -141,7 +166,7 @@ int main(void)
141166
* +4 | free |
142167
*/
143168
errno = 0;
144-
addr = BASE_ADDRESS;
169+
addr = base_addr;
145170
size = 2 * page_size;
146171
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
147172
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -161,7 +186,7 @@ int main(void)
161186
* +4 | free |
162187
*/
163188
errno = 0;
164-
addr = BASE_ADDRESS;
189+
addr = base_addr;
165190
size = page_size;
166191
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
167192
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -181,7 +206,7 @@ int main(void)
181206
* +4 | free | new
182207
*/
183208
errno = 0;
184-
addr = BASE_ADDRESS + (4 * page_size);
209+
addr = base_addr + (4 * page_size);
185210
size = page_size;
186211
p = mmap((void *)addr, size, PROT_NONE, flags, -1, 0);
187212
printf("mmap() @ 0x%lx-0x%lx p=%p result=%m\n", addr, addr + size, p);
@@ -192,7 +217,7 @@ int main(void)
192217
return 1;
193218
}
194219

195-
addr = BASE_ADDRESS;
220+
addr = base_addr;
196221
size = 5 * page_size;
197222
if (munmap((void *)addr, size) != 0) {
198223
dump_maps();

0 commit comments

Comments
 (0)