Skip to content

Commit f6feea5

Browse files
torvaldstorvalds
committed
Merge tag 'mm-hotfixes-stable-2023-02-13-13-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton: "Twelve hotfixes, mostly against mm/. Five of these fixes are cc:stable" * tag 'mm-hotfixes-stable-2023-02-13-13-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem scripts/gdb: fix 'lx-current' for x86 lib: parser: optimize match_NUMBER apis to use local array mm: shrinkers: fix deadlock in shrinker debugfs mm: hwpoison: support recovery from ksm_might_need_to_copy() kasan: fix Oops due to missing calls to kasan_arch_is_ready() revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" fsdax: dax_unshare_iter() should return a valid length mm/gup: add folio to list when folio_isolate_lru() succeed aio: fix mremap after fork null-deref mailmap: add entry for Alexander Mikhalitsyn mm: extend max struct page size for kmsan
2 parents b408817 + ce4d9a1 commit f6feea5

File tree

18 files changed

+102
-45
lines changed

18 files changed

+102
-45
lines changed

‎.mailmap

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ Aleksey Gorelov <[email protected]>
2525
Alexander Lobakin <[email protected]> <[email protected]>
2626
Alexander Lobakin <[email protected]> <[email protected]>
2727
Alexander Lobakin <[email protected]> <[email protected]>
28+
Alexander Mikhalitsyn <[email protected]> <[email protected]>
29+
Alexander Mikhalitsyn <[email protected]> <[email protected]>
2830
Alexandre Belloni <[email protected]> <[email protected]>
2931
Alexei Starovoitov <[email protected]> <[email protected]>
3032
Alexei Starovoitov <[email protected]> <[email protected]>

‎drivers/of/of_reserved_mem.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,10 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
4848
err = memblock_mark_nomap(base, size);
4949
if (err)
5050
memblock_phys_free(base, size);
51-
kmemleak_ignore_phys(base);
5251
}
5352

53+
kmemleak_ignore_phys(base);
54+
5455
return err;
5556
}
5657

‎fs/aio.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,9 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
361361
spin_lock(&mm->ioctx_lock);
362362
rcu_read_lock();
363363
table = rcu_dereference(mm->ioctx_table);
364+
if (!table)
365+
goto out_unlock;
366+
364367
for (i = 0; i < table->nr; i++) {
365368
struct kioctx *ctx;
366369

@@ -374,6 +377,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma)
374377
}
375378
}
376379

380+
out_unlock:
377381
rcu_read_unlock();
378382
spin_unlock(&mm->ioctx_lock);
379383
return res;

‎fs/dax.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1271,8 +1271,9 @@ static s64 dax_unshare_iter(struct iomap_iter *iter)
12711271
if (ret < 0)
12721272
goto out_unlock;
12731273

1274-
ret = copy_mc_to_kernel(daddr, saddr, length);
1275-
if (ret)
1274+
if (copy_mc_to_kernel(daddr, saddr, length) == 0)
1275+
ret = length;
1276+
else
12761277
ret = -EIO;
12771278

12781279
out_unlock:

‎fs/squashfs/xattr_id.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
7676
/* Sanity check values */
7777

7878
/* there is always at least one xattr id */
79-
if (*xattr_ids <= 0)
79+
if (*xattr_ids == 0)
8080
return ERR_PTR(-EINVAL);
8181

8282
len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);

‎include/linux/mm.h

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ extern int mmap_rnd_compat_bits __read_mostly;
137137
* define their own version of this macro in <asm/pgtable.h>
138138
*/
139139
#if BITS_PER_LONG == 64
140-
/* This function must be updated when the size of struct page grows above 80
140+
/* This function must be updated when the size of struct page grows above 96
141141
* or reduces below 56. The idea that compiler optimizes out switch()
142142
* statement, and only leaves move/store instructions. Also the compiler can
143143
* combine write statements if they are both assignments and can be reordered,
@@ -148,12 +148,18 @@ static inline void __mm_zero_struct_page(struct page *page)
148148
{
149149
unsigned long *_pp = (void *)page;
150150

151-
/* Check that struct page is either 56, 64, 72, or 80 bytes */
151+
/* Check that struct page is either 56, 64, 72, 80, 88 or 96 bytes */
152152
BUILD_BUG_ON(sizeof(struct page) & 7);
153153
BUILD_BUG_ON(sizeof(struct page) < 56);
154-
BUILD_BUG_ON(sizeof(struct page) > 80);
154+
BUILD_BUG_ON(sizeof(struct page) > 96);
155155

156156
switch (sizeof(struct page)) {
157+
case 96:
158+
_pp[11] = 0;
159+
fallthrough;
160+
case 88:
161+
_pp[10] = 0;
162+
fallthrough;
157163
case 80:
158164
_pp[9] = 0;
159165
fallthrough;

‎include/linux/shrinker.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,16 +107,17 @@ extern void synchronize_shrinkers(void);
107107

108108
#ifdef CONFIG_SHRINKER_DEBUG
109109
extern int shrinker_debugfs_add(struct shrinker *shrinker);
110-
extern void shrinker_debugfs_remove(struct shrinker *shrinker);
110+
extern struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker);
111111
extern int __printf(2, 3) shrinker_debugfs_rename(struct shrinker *shrinker,
112112
const char *fmt, ...);
113113
#else /* CONFIG_SHRINKER_DEBUG */
114114
static inline int shrinker_debugfs_add(struct shrinker *shrinker)
115115
{
116116
return 0;
117117
}
118-
static inline void shrinker_debugfs_remove(struct shrinker *shrinker)
118+
static inline struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker)
119119
{
120+
return NULL;
120121
}
121122
static inline __printf(2, 3)
122123
int shrinker_debugfs_rename(struct shrinker *shrinker, const char *fmt, ...)

‎lib/parser.c

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,15 @@
1111
#include <linux/slab.h>
1212
#include <linux/string.h>
1313

14+
/*
15+
* max size needed by different bases to express U64
16+
* HEX: "0xFFFFFFFFFFFFFFFF" --> 18
17+
* DEC: "18446744073709551615" --> 20
18+
* OCT: "01777777777777777777777" --> 23
19+
* pick the max one to define NUMBER_BUF_LEN
20+
*/
21+
#define NUMBER_BUF_LEN 24
22+
1423
/**
1524
* match_one - Determines if a string matches a simple pattern
1625
* @s: the string to examine for presence of the pattern
@@ -129,14 +138,12 @@ EXPORT_SYMBOL(match_token);
129138
static int match_number(substring_t *s, int *result, int base)
130139
{
131140
char *endp;
132-
char *buf;
141+
char buf[NUMBER_BUF_LEN];
133142
int ret;
134143
long val;
135144

136-
buf = match_strdup(s);
137-
if (!buf)
138-
return -ENOMEM;
139-
145+
if (match_strlcpy(buf, s, NUMBER_BUF_LEN) >= NUMBER_BUF_LEN)
146+
return -ERANGE;
140147
ret = 0;
141148
val = simple_strtol(buf, &endp, base);
142149
if (endp == buf)
@@ -145,7 +152,6 @@ static int match_number(substring_t *s, int *result, int base)
145152
ret = -ERANGE;
146153
else
147154
*result = (int) val;
148-
kfree(buf);
149155
return ret;
150156
}
151157

@@ -163,18 +169,15 @@ static int match_number(substring_t *s, int *result, int base)
163169
*/
164170
static int match_u64int(substring_t *s, u64 *result, int base)
165171
{
166-
char *buf;
172+
char buf[NUMBER_BUF_LEN];
167173
int ret;
168174
u64 val;
169175

170-
buf = match_strdup(s);
171-
if (!buf)
172-
return -ENOMEM;
173-
176+
if (match_strlcpy(buf, s, NUMBER_BUF_LEN) >= NUMBER_BUF_LEN)
177+
return -ERANGE;
174178
ret = kstrtoull(buf, base, &val);
175179
if (!ret)
176180
*result = val;
177-
kfree(buf);
178181
return ret;
179182
}
180183

@@ -206,14 +209,12 @@ EXPORT_SYMBOL(match_int);
206209
*/
207210
int match_uint(substring_t *s, unsigned int *result)
208211
{
209-
int err = -ENOMEM;
210-
char *buf = match_strdup(s);
212+
char buf[NUMBER_BUF_LEN];
211213

212-
if (buf) {
213-
err = kstrtouint(buf, 10, result);
214-
kfree(buf);
215-
}
216-
return err;
214+
if (match_strlcpy(buf, s, NUMBER_BUF_LEN) >= NUMBER_BUF_LEN)
215+
return -ERANGE;
216+
217+
return kstrtouint(buf, 10, result);
217218
}
218219
EXPORT_SYMBOL(match_uint);
219220

‎mm/gup.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1914,7 +1914,7 @@ static unsigned long collect_longterm_unpinnable_pages(
19141914
drain_allow = false;
19151915
}
19161916

1917-
if (!folio_isolate_lru(folio))
1917+
if (folio_isolate_lru(folio))
19181918
continue;
19191919

19201920
list_add_tail(&folio->lru, movable_page_list);

‎mm/kasan/common.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,9 @@ bool __kasan_slab_free(struct kmem_cache *cache, void *object,
246246

247247
static inline bool ____kasan_kfree_large(void *ptr, unsigned long ip)
248248
{
249+
if (!kasan_arch_is_ready())
250+
return false;
251+
249252
if (ptr != page_address(virt_to_head_page(ptr))) {
250253
kasan_report_invalid_free(ptr, ip, KASAN_REPORT_INVALID_FREE);
251254
return true;

0 commit comments

Comments
 (0)