Merge tag 'mm-hotfixes-stable-2025-06-27-16-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton: "16 hotfixes. 6 are cc:stable and the remainder address post-6.15 issues or aren't considered necessary for -stable kernels. 5 are for MM" * tag 'mm-hotfixes-stable-2025-06-27-16-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: add Lorenzo as THP co-maintainer mailmap: update Duje Mihanović's email address selftests/mm: fix validate_addr() helper crashdump: add CONFIG_KEYS dependency mailmap: correct name for a historical account of Zijun Hu mailmap: add entries for Zijun Hu fuse: fix runtime warning on truncate_folio_batch_exceptionals() scripts/gdb: fix dentry_name() lookup mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write mm/alloc_tag: fix the kmemleak false positive issue in the allocation of the percpu variable tag->counters lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() mm/hugetlb: remove unnecessary holding of hugetlb_lock MAINTAINERS: add missing files to mm page alloc section MAINTAINERS: add tree entry to mm init block mm: add OOM killer maintainer structure fs/proc/task_mmu: fix PAGE_IS_PFNZERO detection for the huge zero folio

Linus Torvalds committed 1 year ago

Commit 0fd39af2 parents 867b998 c0cb21013 files · +90 −44Browse files

Unified · Split

13 files

.mailmap +4 −0
MAINTAINERS +23 −1
fs/fuse/inode.c +4 −0
fs/proc/task_mmu.c +1 −1
include/linux/kmemleak.h +4 −0
kernel/Kconfig.kexec +1 −0
lib/alloc_tag.c +7 −1
lib/group_cpus.c +8 −1
mm/damon/sysfs-schemes.c +1 −0
mm/hugetlb.c +17 −37
mm/kmemleak.c +14 −0
scripts/gdb/linux/vfs.py +1 −1
tools/testing/selftests/mm/virtual_address_range.c +5 −2

.mailmap+4−0

 Domen Puncer <domen@coderock.org>
 Douglas Gilbert <dougg@torque.net>
 Drew Fustini <fustini@kernel.org> <drew@pdp7.com>
+<duje@dujemihanovic.xyz> <duje.mihanovic@skole.hr>
 Ed L. Cashin <ecashin@coraid.com>
 Elliot Berman <quic_eberman@quicinc.com> <eberman@codeaurora.org>
 Enric Balletbo i Serra <eballetbo@kernel.org> <enric.balletbo@collabora.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Zack Rusin <zack.rusin@broadcom.com> <zackr@vmware.com>
 Zhu Yanjun <zyjzyj2000@gmail.com> <yanjunz@nvidia.com>
+Zijun Hu <zijun.hu@oss.qualcomm.com> <quic_zijuhu@quicinc.com>
+Zijun Hu <zijun.hu@oss.qualcomm.com> <zijuhu@codeaurora.org>
+Zijun Hu <zijun_hu@htc.com>

MAINTAINERS+23−1

 M:	Mike Rapoport <rppt@kernel.org>
 L:	linux-mm@kvack.org
 S:	Maintained
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock.git for-next
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock.git fixes
 F:	Documentation/core-api/boot-time-mm.rst
 F:	Documentation/core-api/kho/bindings/memblock/*
 F:	include/linux/memblock.h
 F:	mm/numa_emulation.c
 F:	mm/numa_memblks.c
+MEMORY MANAGEMENT - OOM KILLER
+M:	Michal Hocko <mhocko@suse.com>
+R:	David Rientjes <rientjes@google.com>
+R:	Shakeel Butt <shakeel.butt@linux.dev>
+L:	linux-mm@kvack.org
+S:	Maintained
+F:	include/linux/oom.h
+F:	include/trace/events/oom.h
+F:	include/uapi/linux/oom.h
+F:	mm/oom_kill.c
 MEMORY MANAGEMENT - PAGE ALLOCATOR
 M:	Andrew Morton <akpm@linux-foundation.org>
 M:	Vlastimil Babka <vbabka@suse.cz>
 F:	include/linux/gfp.h
 F:	include/linux/page-isolation.h
 F:	mm/compaction.c
+F:	mm/debug_page_alloc.c
+F:	mm/fail_page_alloc.c
 F:	mm/page_alloc.c
+F:	mm/page_ext.c
+F:	mm/page_frag_cache.c
 F:	mm/page_isolation.c
+F:	mm/page_owner.c
+F:	mm/page_poison.c
+F:	mm/page_reporting.c
+F:	mm/show_mem.c
+F:	mm/shuffle.c
 MEMORY MANAGEMENT - RECLAIM
 M:	Andrew Morton <akpm@linux-foundation.org>
 MEMORY MANAGEMENT - THP (TRANSPARENT HUGE PAGE)
 M:	Andrew Morton <akpm@linux-foundation.org>
 M:	David Hildenbrand <david@redhat.com>
+M:	Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
 R:	Zi Yan <ziy@nvidia.com>
 R:	Baolin Wang <baolin.wang@linux.alibaba.com>
-R:	Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
 R:	Liam R. Howlett <Liam.Howlett@oracle.com>
 R:	Nico Pache <npache@redhat.com>
 R:	Ryan Roberts <ryan.roberts@arm.com>

fs/fuse/inode.c+4−0

 #include "fuse_i.h"
 #include "dev_uring_i.h"
+#include <linux/dax.h>
 #include <linux/pagemap.h>
 #include <linux/slab.h>
 #include <linux/file.h>
 	/* Will write inode on close/munmap and in all other dirtiers */
 	WARN_ON(inode->i_state & I_DIRTY_INODE);
+	if (FUSE_IS_DAX(inode))
+		dax_break_layout_final(inode);
 	truncate_inode_pages_final(&inode->i_data);
 	clear_inode(inode);
 	if (inode->i_sb->s_flags & SB_ACTIVE) {

fs/proc/task_mmu.c+1−1

@@ -2182,7 +2182,7 @@ static unsigned long pagemap_thp_category(struct pagemap_scan_private *p, · 2181 unmodified lines
2182	categories \|= PAGE_IS_FILE;	2182	categories \|= PAGE_IS_FILE;
2183	}	2183	}
2184		2184
2185	if (is_zero_pfn(pmd_pfn(pmd)))	2185	if (is_huge_zero_pmd(pmd))
2186	categories \|= PAGE_IS_PFNZERO;	2186	categories \|= PAGE_IS_PFNZERO;
2187	if (pmd_soft_dirty(pmd))	2187	if (pmd_soft_dirty(pmd))
2188	categories \|= PAGE_IS_SOFT_DIRTY;	2188	categories \|= PAGE_IS_SOFT_DIRTY;

include/linux/kmemleak.h+4−0

 extern void kmemleak_not_leak(const void *ptr) __ref;
 extern void kmemleak_transient_leak(const void *ptr) __ref;
 extern void kmemleak_ignore(const void *ptr) __ref;
+extern void kmemleak_ignore_percpu(const void __percpu *ptr) __ref;
 extern void kmemleak_scan_area(const void *ptr, size_t size, gfp_t gfp) __ref;
 extern void kmemleak_no_scan(const void *ptr) __ref;
 extern void kmemleak_alloc_phys(phys_addr_t phys, size_t size,
 static inline void kmemleak_transient_leak(const void *ptr)
 {
 }
+static inline void kmemleak_ignore_percpu(const void __percpu *ptr)
+{
+}
 static inline void kmemleak_ignore(const void *ptr)
 {
 }

kernel/Kconfig.kexec+1−0

@@ -134,6 +134,7 @@ config CRASH_DM_CRYPT · 133 unmodified lines
134	depends on KEXEC_FILE	134	depends on KEXEC_FILE
135	depends on CRASH_DUMP	135	depends on CRASH_DUMP
136	depends on DM_CRYPT	136	depends on DM_CRYPT
		137	depends on KEYS
137	help	138	help
138	With this option enabled, user space can intereact with	139	With this option enabled, user space can intereact with
139	/sys/kernel/config/crash_dm_crypt_keys to make the dm crypt keys	140	/sys/kernel/config/crash_dm_crypt_keys to make the dm crypt keys

lib/alloc_tag.c+7−1

 #include <linux/seq_buf.h>
 #include <linux/seq_file.h>
 #include <linux/vmalloc.h>
+#include <linux/kmemleak.h>
 #define ALLOCINFO_FILE_NAME		"allocinfo"
 #define MODULE_ALLOC_TAG_VMAP_SIZE	(100000UL * sizeof(struct alloc_tag))
 			       mod->name);
 			return -ENOMEM;
 		}
-	}
+		/*
+		 * Avoid a kmemleak false positive. The pointer to the counters is stored
+		 * in the alloc_tag section of the module and cannot be directly accessed.
+		 */
+		kmemleak_ignore_percpu(tag->counters);
+	}
 	return 0;
 }

lib/group_cpus.c+8−1

 	int ret = -ENOMEM;
 	struct cpumask *masks = NULL;
+	if (numgrps == 0)
+		return NULL;
 	if (!zalloc_cpumask_var(&nmsk, GFP_KERNEL))
 		return NULL;
 #else /* CONFIG_SMP */
 struct cpumask *group_cpus_evenly(unsigned int numgrps)
 {
-	struct cpumask *masks = kcalloc(numgrps, sizeof(*masks), GFP_KERNEL);
+	struct cpumask *masks;
+	if (numgrps == 0)
+		return NULL;
+	masks = kcalloc(numgrps, sizeof(*masks), GFP_KERNEL);
 	if (!masks)
 		return NULL;

mm/damon/sysfs-schemes.c+1−0

@@ -472,6 +472,7 @@ static ssize_t memcg_path_store(struct kobject *kobj, · 471 unmodified lines
472	return -ENOMEM;	472	return -ENOMEM;
473		473
474	strscpy(path, buf, count + 1);	474	strscpy(path, buf, count + 1);
		475	kfree(filter->memcg_path);
475	filter->memcg_path = path;	476	filter->memcg_path = path;
476	return count;	477	return count;
477	}	478	}

mm/hugetlb.c+17−37

 /*
  * alloc_and_dissolve_hugetlb_folio - Allocate a new folio and dissolve
  * the old one
- * @h: struct hstate old page belongs to
  * @old_folio: Old folio to dissolve
  * @list: List to isolate the page in case we need to
  * Returns 0 on success, otherwise negated error.
  */
-static int alloc_and_dissolve_hugetlb_folio(struct hstate *h,
+static int alloc_and_dissolve_hugetlb_folio(struct folio *old_folio,
-			struct folio *old_folio, struct list_head *list)
+			struct list_head *list)
 {
-	gfp_t gfp_mask = htlb_alloc_mask(h) | __GFP_THISNODE;
+	gfp_t gfp_mask;
+	struct hstate *h;
 	int nid = folio_nid(old_folio);
 	struct folio *new_folio = NULL;
 	int ret = 0;
 retry:
+	/*
+	 * The old_folio might have been dissolved from under our feet, so make sure
+	 * to carefully check the state under the lock.
+	 */
 	spin_lock_irq(&hugetlb_lock);
 	if (!folio_test_hugetlb(old_folio)) {
 		/*
 		cond_resched();
 		goto retry;
 	} else {
+		h = folio_hstate(old_folio);
 		if (!new_folio) {
 			spin_unlock_irq(&hugetlb_lock);
+			gfp_mask = htlb_alloc_mask(h) | __GFP_THISNODE;
 			new_folio = alloc_buddy_hugetlb_folio(h, gfp_mask, nid,
 							      NULL, NULL);
 			if (!new_folio)
 int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list)
 {
-	struct hstate *h;
 	int ret = -EBUSY;
-	/*
+	/* Not to disrupt normal path by vainly holding hugetlb_lock */
-	 * The page might have been dissolved from under our feet, so make sure
+	if (!folio_test_hugetlb(folio))
-	 * to carefully check the state under the lock.
-	 * Return success when racing as if we dissolved the page ourselves.
-	 */
-	spin_lock_irq(&hugetlb_lock);
-	if (folio_test_hugetlb(folio)) {
-		h = folio_hstate(folio);
-	} else {
-		spin_unlock_irq(&hugetlb_lock);
 		return 0;
-	}
-	spin_unlock_irq(&hugetlb_lock);
 	/*
 	 * Fence off gigantic pages as there is a cyclic dependency between
 	 * alloc_contig_range and them. Return -ENOMEM as this has the effect
 	 * of bailing out right away without further retrying.
 	 */
-	if (hstate_is_gigantic(h))
+	if (folio_order(folio) > MAX_PAGE_ORDER)
 		return -ENOMEM;
 	if (folio_ref_count(folio) && folio_isolate_hugetlb(folio, list))
 		ret = 0;
 	else if (!folio_ref_count(folio))
-		ret = alloc_and_dissolve_hugetlb_folio(h, folio, list);
+		ret = alloc_and_dissolve_hugetlb_folio(folio, list);
 	return ret;
 }
  */
 int replace_free_hugepage_folios(unsigned long start_pfn, unsigned long end_pfn)
 {
-	struct hstate *h;
 	struct folio *folio;
 	int ret = 0;
 	while (start_pfn < end_pfn) {
 		folio = pfn_folio(start_pfn);
-		/*
+		/* Not to disrupt normal path by vainly holding hugetlb_lock */
-		 * The folio might have been dissolved from under our feet, so make sure
+		if (folio_test_hugetlb(folio) && !folio_ref_count(folio)) {
-		 * to carefully check the state under the lock.
+			ret = alloc_and_dissolve_hugetlb_folio(folio, &isolate_list);
-		 */
-		spin_lock_irq(&hugetlb_lock);
-		if (folio_test_hugetlb(folio)) {
-			h = folio_hstate(folio);
-		} else {
-			spin_unlock_irq(&hugetlb_lock);
-			start_pfn++;
-			continue;
-		}
-		spin_unlock_irq(&hugetlb_lock);
-		if (!folio_ref_count(folio)) {
-			ret = alloc_and_dissolve_hugetlb_folio(h, folio,
-							       &isolate_list);
 			if (ret)
 				break;

mm/kmemleak.c+14−0

@@ -1246,6 +1246,20 @@ void __ref kmemleak_transient_leak(const void *ptr) · 1245 unmodified lines
1246	}	1246	}
1247	EXPORT_SYMBOL(kmemleak_transient_leak);	1247	EXPORT_SYMBOL(kmemleak_transient_leak);
1248		1248
		1249	/**
		1250	* kmemleak_ignore_percpu - similar to kmemleak_ignore but taking a percpu
		1251	* address argument
		1252	* @ptr: percpu address of the object
		1253	*/
		1254	void __ref kmemleak_ignore_percpu(const void __percpu *ptr)
		1255	{
		1256	pr_debug("%s(0x%px)\n", __func__, ptr);
		1257
		1258	if (kmemleak_enabled && ptr && !IS_ERR_PCPU(ptr))
		1259	make_black_object((unsigned long)ptr, OBJECT_PERCPU);
		1260	}
		1261	EXPORT_SYMBOL_GPL(kmemleak_ignore_percpu);
		1262
1249	/**	1263	/**
1250	* kmemleak_ignore - ignore an allocated object	1264	* kmemleak_ignore - ignore an allocated object
1251	* @ptr: pointer to beginning of the object	1265	* @ptr: pointer to beginning of the object

scripts/gdb/linux/vfs.py+1−1

@@ -22,7 +22,7 @@ def dentry_name(d): · 21 unmodified lines
22	if parent == d or parent == 0:	22	if parent == d or parent == 0:
23	return ""	23	return ""
24	p = dentry_name(d['d_parent']) + "/"	24	p = dentry_name(d['d_parent']) + "/"
25	return p + d['d_iname'].string()	25	return p + d['d_shortname']['string'].string()
26		26
27	class DentryName(gdb.Function):	27	class DentryName(gdb.Function):
28	"""Return string of the full path of a dentry.	28	"""Return string of the full path of a dentry.

tools/testing/selftests/mm/virtual_address_range.c+5−2

 {
 	unsigned long addr = (unsigned long) ptr;
-	if (high_addr && addr < HIGH_ADDR_MARK)
+	if (high_addr) {
-		ksft_exit_fail_msg("Bad address %lx\n", addr);
+		if (addr < HIGH_ADDR_MARK)
+			ksft_exit_fail_msg("Bad address %lx\n", addr);
+		return;
+	}
 	if (addr > HIGH_ADDR_MARK)
 		ksft_exit_fail_msg("Bad address %lx\n", addr);