Skip to content

Commit 8ba90f5

Browse files
torvaldstorvalds
committed
Merge tag 'mm-hotfixes-stable-2023-06-20-12-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull hotfixes from Andrew Morton: "19 hotfixes. 8 of these are cc:stable. This includes a wholesale reversion of the post-6.4 series 'make slab shrink lockless'. After input from Dave Chinner it has been decided that we should go a different way [1]" Link: https://lkml.kernel.org/r/[email protected] [1] * tag 'mm-hotfixes-stable-2023-06-20-12-31' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: selftests/mm: fix cross compilation with LLVM mailmap: add entries for Ben Dooks nilfs2: prevent general protection fault in nilfs_clear_dirty_page() Revert "mm: vmscan: make global slab shrink lockless" Revert "mm: vmscan: make memcg slab shrink lockless" Revert "mm: vmscan: add shrinker_srcu_generation" Revert "mm: shrinkers: make count and scan in shrinker debugfs lockless" Revert "mm: vmscan: hold write lock to reparent shrinker nr_deferred" Revert "mm: vmscan: remove shrinker_rwsem from synchronize_shrinkers()" Revert "mm: shrinkers: convert shrinker_rwsem to mutex" nilfs2: fix buffer corruption due to concurrent device reads scripts/gdb: fix SB_* constants parsing scripts: fix the gfp flags header path in gfp-translate udmabuf: revert 'Add support for mapping hugepages (v4)' mm/khugepaged: fix iteration in collapse_file memfd: check for non-NULL file_seals in memfd_create() syscall mm/vmalloc: do not output a spurious warning when huge vmalloc() fails mm/mprotect: fix do_mprotect_pkey() limit check writeback: fix dereferencing NULL mapping->host on writeback_page_template
2 parents e660abd + 0518dbe commit 8ba90f5

File tree

19 files changed

+172
-155
lines changed

19 files changed

+172
-155
lines changed

‎.mailmap

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ Baolin Wang <[email protected]> <[email protected]>
7070
Baolin Wang <[email protected]> <[email protected]>
7171
Bart Van Assche <[email protected]> <[email protected]>
7272
Bart Van Assche <[email protected]> <[email protected]>
73+
Ben Dooks <[email protected]> <[email protected]>
74+
Ben Dooks <[email protected]> <[email protected]>
7375
Ben Gardner <[email protected]>
7476
Ben M Cahill <[email protected]>
7577
Ben Widawsky <[email protected]> <[email protected]>

‎drivers/dma-buf/udmabuf.c

Lines changed: 6 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
#include <linux/shmem_fs.h>
1313
#include <linux/slab.h>
1414
#include <linux/udmabuf.h>
15-
#include <linux/hugetlb.h>
1615
#include <linux/vmalloc.h>
1716
#include <linux/iosys-map.h>
1817

@@ -207,9 +206,7 @@ static long udmabuf_create(struct miscdevice *device,
207206
struct udmabuf *ubuf;
208207
struct dma_buf *buf;
209208
pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit;
210-
struct page *page, *hpage = NULL;
211-
pgoff_t subpgoff, maxsubpgs;
212-
struct hstate *hpstate;
209+
struct page *page;
213210
int seals, ret = -EINVAL;
214211
u32 i, flags;
215212

@@ -245,7 +242,7 @@ static long udmabuf_create(struct miscdevice *device,
245242
if (!memfd)
246243
goto err;
247244
mapping = memfd->f_mapping;
248-
if (!shmem_mapping(mapping) && !is_file_hugepages(memfd))
245+
if (!shmem_mapping(mapping))
249246
goto err;
250247
seals = memfd_fcntl(memfd, F_GET_SEALS, 0);
251248
if (seals == -EINVAL)
@@ -256,48 +253,16 @@ static long udmabuf_create(struct miscdevice *device,
256253
goto err;
257254
pgoff = list[i].offset >> PAGE_SHIFT;
258255
pgcnt = list[i].size >> PAGE_SHIFT;
259-
if (is_file_hugepages(memfd)) {
260-
hpstate = hstate_file(memfd);
261-
pgoff = list[i].offset >> huge_page_shift(hpstate);
262-
subpgoff = (list[i].offset &
263-
~huge_page_mask(hpstate)) >> PAGE_SHIFT;
264-
maxsubpgs = huge_page_size(hpstate) >> PAGE_SHIFT;
265-
}
266256
for (pgidx = 0; pgidx < pgcnt; pgidx++) {
267-
if (is_file_hugepages(memfd)) {
268-
if (!hpage) {
269-
hpage = find_get_page_flags(mapping, pgoff,
270-
FGP_ACCESSED);
271-
if (!hpage) {
272-
ret = -EINVAL;
273-
goto err;
274-
}
275-
}
276-
page = hpage + subpgoff;
277-
get_page(page);
278-
subpgoff++;
279-
if (subpgoff == maxsubpgs) {
280-
put_page(hpage);
281-
hpage = NULL;
282-
subpgoff = 0;
283-
pgoff++;
284-
}
285-
} else {
286-
page = shmem_read_mapping_page(mapping,
287-
pgoff + pgidx);
288-
if (IS_ERR(page)) {
289-
ret = PTR_ERR(page);
290-
goto err;
291-
}
257+
page = shmem_read_mapping_page(mapping, pgoff + pgidx);
258+
if (IS_ERR(page)) {
259+
ret = PTR_ERR(page);
260+
goto err;
292261
}
293262
ubuf->pages[pgbuf++] = page;
294263
}
295264
fput(memfd);
296265
memfd = NULL;
297-
if (hpage) {
298-
put_page(hpage);
299-
hpage = NULL;
300-
}
301266
}
302267

303268
exp_info.ops = &udmabuf_ops;

‎drivers/md/dm-cache-metadata.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1828,7 +1828,7 @@ int dm_cache_metadata_abort(struct dm_cache_metadata *cmd)
18281828
* Replacement block manager (new_bm) is created and old_bm destroyed outside of
18291829
* cmd root_lock to avoid ABBA deadlock that would result (due to life-cycle of
18301830
* shrinker associated with the block manager's bufio client vs cmd root_lock).
1831-
* - must take shrinker_mutex without holding cmd->root_lock
1831+
* - must take shrinker_rwsem without holding cmd->root_lock
18321832
*/
18331833
new_bm = dm_block_manager_create(cmd->bdev, DM_CACHE_METADATA_BLOCK_SIZE << SECTOR_SHIFT,
18341834
CACHE_MAX_CONCURRENT_LOCKS);

‎drivers/md/dm-thin-metadata.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1891,7 +1891,7 @@ int dm_pool_abort_metadata(struct dm_pool_metadata *pmd)
18911891
* Replacement block manager (new_bm) is created and old_bm destroyed outside of
18921892
* pmd root_lock to avoid ABBA deadlock that would result (due to life-cycle of
18931893
* shrinker associated with the block manager's bufio client vs pmd root_lock).
1894-
* - must take shrinker_mutex without holding pmd->root_lock
1894+
* - must take shrinker_rwsem without holding pmd->root_lock
18951895
*/
18961896
new_bm = dm_block_manager_create(pmd->bdev, THIN_METADATA_BLOCK_SIZE << SECTOR_SHIFT,
18971897
THIN_MAX_CONCURRENT_LOCKS);

‎fs/nilfs2/page.c

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -370,7 +370,15 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent)
370370
struct folio *folio = fbatch.folios[i];
371371

372372
folio_lock(folio);
373-
nilfs_clear_dirty_page(&folio->page, silent);
373+
374+
/*
375+
* This folio may have been removed from the address
376+
* space by truncation or invalidation when the lock
377+
* was acquired. Skip processing in that case.
378+
*/
379+
if (likely(folio->mapping == mapping))
380+
nilfs_clear_dirty_page(&folio->page, silent);
381+
374382
folio_unlock(folio);
375383
}
376384
folio_batch_release(&fbatch);

‎fs/nilfs2/segbuf.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,12 @@ int nilfs_segbuf_extend_segsum(struct nilfs_segment_buffer *segbuf)
101101
if (unlikely(!bh))
102102
return -ENOMEM;
103103

104+
lock_buffer(bh);
105+
if (!buffer_uptodate(bh)) {
106+
memset(bh->b_data, 0, bh->b_size);
107+
set_buffer_uptodate(bh);
108+
}
109+
unlock_buffer(bh);
104110
nilfs_segbuf_add_segsum_buffer(segbuf, bh);
105111
return 0;
106112
}

‎fs/nilfs2/segment.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -981,10 +981,13 @@ static void nilfs_segctor_fill_in_super_root(struct nilfs_sc_info *sci,
981981
unsigned int isz, srsz;
982982

983983
bh_sr = NILFS_LAST_SEGBUF(&sci->sc_segbufs)->sb_super_root;
984+
985+
lock_buffer(bh_sr);
984986
raw_sr = (struct nilfs_super_root *)bh_sr->b_data;
985987
isz = nilfs->ns_inode_size;
986988
srsz = NILFS_SR_BYTES(isz);
987989

990+
raw_sr->sr_sum = 0; /* Ensure initialization within this update */
988991
raw_sr->sr_bytes = cpu_to_le16(srsz);
989992
raw_sr->sr_nongc_ctime
990993
= cpu_to_le64(nilfs_doing_gc() ?
@@ -998,6 +1001,8 @@ static void nilfs_segctor_fill_in_super_root(struct nilfs_sc_info *sci,
9981001
nilfs_write_inode_common(nilfs->ns_sufile, (void *)raw_sr +
9991002
NILFS_SR_SUFILE_OFFSET(isz), 1);
10001003
memset((void *)raw_sr + srsz, 0, nilfs->ns_blocksize - srsz);
1004+
set_buffer_uptodate(bh_sr);
1005+
unlock_buffer(bh_sr);
10011006
}
10021007

10031008
static void nilfs_redirty_inodes(struct list_head *head)
@@ -1780,6 +1785,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
17801785
list_for_each_entry(segbuf, logs, sb_list) {
17811786
list_for_each_entry(bh, &segbuf->sb_segsum_buffers,
17821787
b_assoc_buffers) {
1788+
clear_buffer_uptodate(bh);
17831789
if (bh->b_page != bd_page) {
17841790
if (bd_page)
17851791
end_page_writeback(bd_page);
@@ -1791,6 +1797,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
17911797
b_assoc_buffers) {
17921798
clear_buffer_async_write(bh);
17931799
if (bh == segbuf->sb_super_root) {
1800+
clear_buffer_uptodate(bh);
17941801
if (bh->b_page != bd_page) {
17951802
end_page_writeback(bd_page);
17961803
bd_page = bh->b_page;

‎fs/nilfs2/super.c

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -372,10 +372,31 @@ static int nilfs_move_2nd_super(struct super_block *sb, loff_t sb2off)
372372
goto out;
373373
}
374374
nsbp = (void *)nsbh->b_data + offset;
375-
memset(nsbp, 0, nilfs->ns_blocksize);
376375

376+
lock_buffer(nsbh);
377377
if (sb2i >= 0) {
378+
/*
379+
* The position of the second superblock only changes by 4KiB,
380+
* which is larger than the maximum superblock data size
381+
* (= 1KiB), so there is no need to use memmove() to allow
382+
* overlap between source and destination.
383+
*/
378384
memcpy(nsbp, nilfs->ns_sbp[sb2i], nilfs->ns_sbsize);
385+
386+
/*
387+
* Zero fill after copy to avoid overwriting in case of move
388+
* within the same block.
389+
*/
390+
memset(nsbh->b_data, 0, offset);
391+
memset((void *)nsbp + nilfs->ns_sbsize, 0,
392+
nsbh->b_size - offset - nilfs->ns_sbsize);
393+
} else {
394+
memset(nsbh->b_data, 0, nsbh->b_size);
395+
}
396+
set_buffer_uptodate(nsbh);
397+
unlock_buffer(nsbh);
398+
399+
if (sb2i >= 0) {
379400
brelse(nilfs->ns_sbh[sb2i]);
380401
nilfs->ns_sbh[sb2i] = nsbh;
381402
nilfs->ns_sbp[sb2i] = nsbp;

‎fs/super.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ static char *sb_writers_name[SB_FREEZE_LEVELS] = {
5454
* One thing we have to be careful of with a per-sb shrinker is that we don't
5555
* drop the last active reference to the superblock from within the shrinker.
5656
* If that happens we could trigger unregistering the shrinker from within the
57-
* shrinker path and that leads to deadlock on the shrinker_mutex. Hence we
57+
* shrinker path and that leads to deadlock on the shrinker_rwsem. Hence we
5858
* take a passive reference to the superblock to avoid this from occurring.
5959
*/
6060
static unsigned long super_cache_scan(struct shrinker *shrink,

‎include/trace/events/writeback.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ DECLARE_EVENT_CLASS(writeback_folio_template,
6868
strscpy_pad(__entry->name,
6969
bdi_dev_name(mapping ? inode_to_bdi(mapping->host) :
7070
NULL), 32);
71-
__entry->ino = mapping ? mapping->host->i_ino : 0;
71+
__entry->ino = (mapping && mapping->host) ? mapping->host->i_ino : 0;
7272
__entry->index = folio->index;
7373
),
7474

0 commit comments

Comments
 (0)