History

Merge tag 'mm-hotfixes-stable-2025-05-10-14-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc hotfixes from Andrew Morton: "22 hotfixes. 13 are cc:stable and the remainder address post-6.14 issues or aren't considered necessary for -stable kernels. About half are for MM. Five OCFS2 fixes and a few MAINTAINERS updates" * tag 'mm-hotfixes-stable-2025-05-10-14-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (22 commits) mm: fix folio_pte_batch() on XEN PV nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() mm/hugetlb: copy the CMA flag when demoting mm, swap: fix false warning for large allocation with !THP_SWAP selftests/mm: fix a build failure on powerpc selftests/mm: fix build break when compiling pkey_util.c mm: vmalloc: support more granular vrealloc() sizing tools/testing/selftests: fix guard region test tmpfs assumption ocfs2: stop quota recovery before disabling quotas ocfs2: implement handshaking with ocfs2 recovery thread ocfs2: switch osb->disable_recovery to enum mailmap: map Uwe's BayLibre addresses to a single one MAINTAINERS: add mm THP section mm/userfaultfd: fix uninitialized output field for -EAGAIN race selftests/mm: compaction_test: support platform with huge mount of memory MAINTAINERS: add core mm section ocfs2: fix panic in failed foilio allocation mm/huge_memory: fix dereferencing invalid pmd migration entry MAINTAINERS: add reverse mapping section x86: disable image size check for test builds ...

Linus Torvalds committed 1 year ago

Commit 3ce99252 parents 3450309 7b08b7423 files · +314 −95Browse files

Unified · Split

23 files
  1. .mailmap +3 −0
  2. MAINTAINERS +62 −4
  3. arch/x86/kernel/vmlinux.lds.S +9 −1
  4. fs/nilfs2/the_nilfs.c +0 −3
  5. fs/ocfs2/alloc.c +1 −0
  6. fs/ocfs2/journal.c +58 −22
  7. fs/ocfs2/journal.h +1 −0
  8. fs/ocfs2/ocfs2.h +16 −1
  9. fs/ocfs2/quota_local.c +2 −7
  10. fs/ocfs2/suballoc.c +32 −6
  11. fs/ocfs2/suballoc.h +1 −0
  12. fs/ocfs2/super.c +3 −0
  13. fs/userfaultfd.c +22 −6
  14. include/linux/vmalloc.h +1 −0
  15. mm/huge_memory.c +8 −3
  16. mm/hugetlb.c +6 −0
  17. mm/internal.h +11 −16
  18. mm/swapfile.c +16 −7
  19. mm/vmalloc.c +24 −7
  20. tools/testing/selftests/mm/compaction_test.c +14 −5
  21. tools/testing/selftests/mm/guard-regions.c +10 −6
  22. tools/testing/selftests/mm/pkey-powerpc.h +13 −1
  23. tools/testing/selftests/mm/pkey_util.c +1 −0
.mailmap+3−0
@@ -447,6 +447,8 @@ Luca Ceresoli <luca.ceresoli@bootlin.com> <luca@lucaceresoli.net> · 446 unmodified lines
447447 Luca Weiss <luca@lucaweiss.eu> <luca@z3ntu.xyz>
448448 Lukasz Luba <lukasz.luba@arm.com> <l.luba@partner.samsung.com>
449449 Luo Jie <quic_luoj@quicinc.com> <luoj@codeaurora.org>
450+Lance Yang <lance.yang@linux.dev> <ioworker0@gmail.com>
451+Lance Yang <lance.yang@linux.dev> <mingzhe.yang@ly.com>
450452 Maciej W. Rozycki <macro@mips.com> <macro@imgtec.com>
451453 Maciej W. Rozycki <macro@orcam.me.uk> <macro@linux-mips.org>
452454 Maharaja Kennadyrajan <quic_mkenna@quicinc.com> <mkenna@codeaurora.org>
@@ -749,6 +751,7 @@ Tvrtko Ursulin <tursulin@ursulin.net> <tvrtko@ursulin.net> · 296 unmodified lines
749751 Tycho Andersen <tycho@tycho.pizza> <tycho@tycho.ws>
750752 Tzung-Bi Shih <tzungbi@kernel.org> <tzungbi@google.com>
751753 Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
754+Uwe Kleine-König <u.kleine-koenig@baylibre.com> <ukleinek@baylibre.com>
752755 Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
753756 Uwe Kleine-König <ukleinek@strlen.de>
754757 Uwe Kleine-König <ukl@pengutronix.de>
MAINTAINERS+62−4
@@ -15495,24 +15495,45 @@ F: Documentation/mm/ · 15494 unmodified lines
1549515495 F: include/linux/gfp.h
1549615496 F: include/linux/gfp_types.h
1549715497 F: include/linux/memfd.h
15498−F: include/linux/memory.h
1549915498 F: include/linux/memory_hotplug.h
1550015499 F: include/linux/memory-tiers.h
1550115500 F: include/linux/mempolicy.h
1550215501 F: include/linux/mempool.h
1550315502 F: include/linux/memremap.h
15504−F: include/linux/mm.h
15505−F: include/linux/mm_*.h
1550615503 F: include/linux/mmzone.h
1550715504 F: include/linux/mmu_notifier.h
1550815505 F: include/linux/pagewalk.h
15509−F: include/linux/rmap.h
1551015506 F: include/trace/events/ksm.h
1551115507 F: mm/
1551215508 F: tools/mm/
1551315509 F: tools/testing/selftests/mm/
1551415510 N: include/linux/page[-_]*
1551515511
15512+MEMORY MANAGEMENT - CORE
15513+M: Andrew Morton <akpm@linux-foundation.org>
15514+M: David Hildenbrand <david@redhat.com>
15515+R: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
15516+R: Liam R. Howlett <Liam.Howlett@oracle.com>
15517+R: Vlastimil Babka <vbabka@suse.cz>
15518+R: Mike Rapoport <rppt@kernel.org>
15519+R: Suren Baghdasaryan <surenb@google.com>
15520+R: Michal Hocko <mhocko@suse.com>
15521+L: linux-mm@kvack.org
15522+S: Maintained
15523+W: http://www.linux-mm.org
15524+T: git git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
15525+F: include/linux/memory.h
15526+F: include/linux/mm.h
15527+F: include/linux/mm_*.h
15528+F: include/linux/mmdebug.h
15529+F: include/linux/pagewalk.h
15530+F: mm/Kconfig
15531+F: mm/debug.c
15532+F: mm/init-mm.c
15533+F: mm/memory.c
15534+F: mm/pagewalk.c
15535+F: mm/util.c
15536+
1551615537 MEMORY MANAGEMENT - EXECMEM
1551715538 M: Andrew Morton <akpm@linux-foundation.org>
1551815539 M: Mike Rapoport <rppt@kernel.org>
@@ -15546,6 +15567,19 @@ F: mm/page_alloc.c · 27 unmodified lines
1554615567 F: include/linux/gfp.h
1554715568 F: include/linux/compaction.h
1554815569
15570+MEMORY MANAGEMENT - RMAP (REVERSE MAPPING)
15571+M: Andrew Morton <akpm@linux-foundation.org>
15572+M: David Hildenbrand <david@redhat.com>
15573+M: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
15574+R: Rik van Riel <riel@surriel.com>
15575+R: Liam R. Howlett <Liam.Howlett@oracle.com>
15576+R: Vlastimil Babka <vbabka@suse.cz>
15577+R: Harry Yoo <harry.yoo@oracle.com>
15578+L: linux-mm@kvack.org
15579+S: Maintained
15580+F: include/linux/rmap.h
15581+F: mm/rmap.c
15582+
1554915583 MEMORY MANAGEMENT - SECRETMEM
1555015584 M: Andrew Morton <akpm@linux-foundation.org>
1555115585 M: Mike Rapoport <rppt@kernel.org>
@@ -15554,6 +15588,30 @@ S: Maintained · 2 unmodified lines
1555415588 F: include/linux/secretmem.h
1555515589 F: mm/secretmem.c
1555615590
15591+MEMORY MANAGEMENT - THP (TRANSPARENT HUGE PAGE)
15592+M: Andrew Morton <akpm@linux-foundation.org>
15593+M: David Hildenbrand <david@redhat.com>
15594+R: Zi Yan <ziy@nvidia.com>
15595+R: Baolin Wang <baolin.wang@linux.alibaba.com>
15596+R: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
15597+R: Liam R. Howlett <Liam.Howlett@oracle.com>
15598+R: Nico Pache <npache@redhat.com>
15599+R: Ryan Roberts <ryan.roberts@arm.com>
15600+R: Dev Jain <dev.jain@arm.com>
15601+L: linux-mm@kvack.org
15602+S: Maintained
15603+W: http://www.linux-mm.org
15604+T: git git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
15605+F: Documentation/admin-guide/mm/transhuge.rst
15606+F: include/linux/huge_mm.h
15607+F: include/linux/khugepaged.h
15608+F: include/trace/events/huge_memory.h
15609+F: mm/huge_memory.c
15610+F: mm/khugepaged.c
15611+F: tools/testing/selftests/mm/khugepaged.c
15612+F: tools/testing/selftests/mm/split_huge_page_test.c
15613+F: tools/testing/selftests/mm/transhuge-stress.c
15614+
1555715615 MEMORY MANAGEMENT - USERFAULTFD
1555815616 M: Andrew Morton <akpm@linux-foundation.org>
1555915617 R: Peter Xu <peterx@redhat.com>
arch/x86/kernel/vmlinux.lds.S+9−1
@@ -466,10 +466,18 @@ SECTIONS · 465 unmodified lines
466466 }
467467
468468 /*
469− * The ASSERT() sink to . is intentional, for binutils 2.14 compatibility:
469+ * COMPILE_TEST kernels can be large - CONFIG_KASAN, for example, can cause
470+ * this. Let's assume that nobody will be running a COMPILE_TEST kernel and
471+ * let's assert that fuller build coverage is more valuable than being able to
472+ * run a COMPILE_TEST kernel.
473+ */
474+#ifndef CONFIG_COMPILE_TEST
475+/*
476+ * The ASSERT() sync to . is intentional, for binutils 2.14 compatibility:
470477 */
471478 . = ASSERT((_end - LOAD_OFFSET <= KERNEL_IMAGE_SIZE),
472479 "kernel image bigger than KERNEL_IMAGE_SIZE");
480+#endif
473481
474482 /* needed for Clang - see arch/x86/entry/entry.S */
475483 PROVIDE(__ref_stack_chk_guard = __stack_chk_guard);
fs/nilfs2/the_nilfs.c+0−3
@@ -705,8 +705,6 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb) · 704 unmodified lines
705705 int blocksize;
706706 int err;
707707
708− down_write(&nilfs->ns_sem);
709−
710708 blocksize = sb_min_blocksize(sb, NILFS_MIN_BLOCK_SIZE);
711709 if (!blocksize) {
712710 nilfs_err(sb, "unable to set blocksize");
@@ -779,7 +777,6 @@ int init_nilfs(struct the_nilfs *nilfs, struct super_block *sb) · 66 unmodified lines
779777 set_nilfs_init(nilfs);
780778 err = 0;
781779 out:
782− up_write(&nilfs->ns_sem);
783780 return err;
784781
785782 failed_sbh:
fs/ocfs2/alloc.c+1−0
@@ -6918,6 +6918,7 @@ static int ocfs2_grab_folios(struct inode *inode, loff_t start, loff_t end, · 6917 unmodified lines
69186918 if (IS_ERR(folios[numfolios])) {
69196919 ret = PTR_ERR(folios[numfolios]);
69206920 mlog_errno(ret);
6921+ folios[numfolios] = NULL;
69216922 goto out;
69226923 }
69236924
fs/ocfs2/journal.c+58−22
@@ -174,7 +174,7 @@ int ocfs2_recovery_init(struct ocfs2_super *osb) · 173 unmodified lines
174174 struct ocfs2_recovery_map *rm;
175175
176176 mutex_init(&osb->recovery_lock);
177− osb->disable_recovery = 0;
177+ osb->recovery_state = OCFS2_REC_ENABLED;
178178 osb->recovery_thread_task = NULL;
179179 init_waitqueue_head(&osb->recovery_event);
180180
@@ -190,31 +190,53 @@ int ocfs2_recovery_init(struct ocfs2_super *osb) · 9 unmodified lines
190190 return 0;
191191 }
192192
193−/* we can't grab the goofy sem lock from inside wait_event, so we use
194− * memory barriers to make sure that we'll see the null task before
195− * being woken up */
196193 static int ocfs2_recovery_thread_running(struct ocfs2_super *osb)
197194 {
198− mb();
199195 return osb->recovery_thread_task != NULL;
200196 }
201197
202−void ocfs2_recovery_exit(struct ocfs2_super *osb)
198+static void ocfs2_recovery_disable(struct ocfs2_super *osb,
199+ enum ocfs2_recovery_state state)
203200 {
204− struct ocfs2_recovery_map *rm;
205−
206− /* disable any new recovery threads and wait for any currently
207− * running ones to exit. Do this before setting the vol_state. */
208201 mutex_lock(&osb->recovery_lock);
209− osb->disable_recovery = 1;
202+ /*
203+ * If recovery thread is not running, we can directly transition to
204+ * final state.
205+ */
206+ if (!ocfs2_recovery_thread_running(osb)) {
207+ osb->recovery_state = state + 1;
208+ goto out_lock;
209+ }
210+ osb->recovery_state = state;
211+ /* Wait for recovery thread to acknowledge state transition */
212+ wait_event_cmd(osb->recovery_event,
213+ !ocfs2_recovery_thread_running(osb) ||
214+ osb->recovery_state >= state + 1,
215+ mutex_unlock(&osb->recovery_lock),
216+ mutex_lock(&osb->recovery_lock));
217+out_lock:
210218 mutex_unlock(&osb->recovery_lock);
211− wait_event(osb->recovery_event, !ocfs2_recovery_thread_running(osb));
212219
213− /* At this point, we know that no more recovery threads can be
214− * launched, so wait for any recovery completion work to
215− * complete. */
220+ /*
221+ * At this point we know that no more recovery work can be queued so
222+ * wait for any recovery completion work to complete.
223+ */
216224 if (osb->ocfs2_wq)
217225 flush_workqueue(osb->ocfs2_wq);
226+}
227+
228+void ocfs2_recovery_disable_quota(struct ocfs2_super *osb)
229+{
230+ ocfs2_recovery_disable(osb, OCFS2_REC_QUOTA_WANT_DISABLE);
231+}
232+
233+void ocfs2_recovery_exit(struct ocfs2_super *osb)
234+{
235+ struct ocfs2_recovery_map *rm;
236+
237+ /* disable any new recovery threads and wait for any currently
238+ * running ones to exit. Do this before setting the vol_state. */
239+ ocfs2_recovery_disable(osb, OCFS2_REC_WANT_DISABLE);
218240
219241 /*
220242 * Now that recovery is shut down, and the osb is about to be
@@ -1472,6 +1494,18 @@ static int __ocfs2_recovery_thread(void *arg) · 1251 unmodified lines
14721494 }
14731495 }
14741496 restart:
1497+ if (quota_enabled) {
1498+ mutex_lock(&osb->recovery_lock);
1499+ /* Confirm that recovery thread will no longer recover quotas */
1500+ if (osb->recovery_state == OCFS2_REC_QUOTA_WANT_DISABLE) {
1501+ osb->recovery_state = OCFS2_REC_QUOTA_DISABLED;
1502+ wake_up(&osb->recovery_event);
1503+ }
1504+ if (osb->recovery_state >= OCFS2_REC_QUOTA_DISABLED)
1505+ quota_enabled = 0;
1506+ mutex_unlock(&osb->recovery_lock);
1507+ }
1508+
14751509 status = ocfs2_super_lock(osb, 1);
14761510 if (status < 0) {
14771511 mlog_errno(status);
@@ -1569,27 +1603,29 @@ bail: · 91 unmodified lines
15691603
15701604 ocfs2_free_replay_slots(osb);
15711605 osb->recovery_thread_task = NULL;
1572− mb(); /* sync with ocfs2_recovery_thread_running */
1606+ if (osb->recovery_state == OCFS2_REC_WANT_DISABLE)
1607+ osb->recovery_state = OCFS2_REC_DISABLED;
15731608 wake_up(&osb->recovery_event);
15741609
15751610 mutex_unlock(&osb->recovery_lock);
15761611
1577− if (quota_enabled)
1578− kfree(rm_quota);
1612+ kfree(rm_quota);
15791613
15801614 return status;
15811615 }
15821616
15831617 void ocfs2_recovery_thread(struct ocfs2_super *osb, int node_num)
15841618 {
1619+ int was_set = -1;
1620+
15851621 mutex_lock(&osb->recovery_lock);
1622+ if (osb->recovery_state < OCFS2_REC_WANT_DISABLE)
1623+ was_set = ocfs2_recovery_map_set(osb, node_num);
15861624
15871625 trace_ocfs2_recovery_thread(node_num, osb->node_num,
1588− osb->disable_recovery, osb->recovery_thread_task,
1589− osb->disable_recovery ?
1590− -1 : ocfs2_recovery_map_set(osb, node_num));
1626+ osb->recovery_state, osb->recovery_thread_task, was_set);
15911627
1592− if (osb->disable_recovery)
1628+ if (osb->recovery_state >= OCFS2_REC_WANT_DISABLE)
15931629 goto out;
15941630
15951631 if (osb->recovery_thread_task)
fs/ocfs2/journal.h+1−0
@@ -148,6 +148,7 @@ void ocfs2_wait_for_recovery(struct ocfs2_super *osb); · 147 unmodified lines
148148
149149 int ocfs2_recovery_init(struct ocfs2_super *osb);
150150 void ocfs2_recovery_exit(struct ocfs2_super *osb);
151+void ocfs2_recovery_disable_quota(struct ocfs2_super *osb);
151152
152153 int ocfs2_compute_replay_slots(struct ocfs2_super *osb);
153154 void ocfs2_free_replay_slots(struct ocfs2_super *osb);
fs/ocfs2/ocfs2.h+16−1
@@ -308,6 +308,21 @@ enum ocfs2_journal_trigger_type { · 307 unmodified lines
308308 void ocfs2_initialize_journal_triggers(struct super_block *sb,
309309 struct ocfs2_triggers triggers[]);
310310
311+enum ocfs2_recovery_state {
312+ OCFS2_REC_ENABLED = 0,
313+ OCFS2_REC_QUOTA_WANT_DISABLE,
314+ /*
315+ * Must be OCFS2_REC_QUOTA_WANT_DISABLE + 1 for
316+ * ocfs2_recovery_disable_quota() to work.
317+ */
318+ OCFS2_REC_QUOTA_DISABLED,
319+ OCFS2_REC_WANT_DISABLE,
320+ /*
321+ * Must be OCFS2_REC_WANT_DISABLE + 1 for ocfs2_recovery_exit() to work
322+ */
323+ OCFS2_REC_DISABLED,
324+};
325+
311326 struct ocfs2_journal;
312327 struct ocfs2_slot_info;
313328 struct ocfs2_recovery_map;
@@ -370,7 +385,7 @@ struct ocfs2_super · 56 unmodified lines
370385 struct ocfs2_recovery_map *recovery_map;
371386 struct ocfs2_replay_map *replay_map;
372387 struct task_struct *recovery_thread_task;
373− int disable_recovery;
388+ enum ocfs2_recovery_state recovery_state;
374389 wait_queue_head_t checkpoint_event;
375390 struct ocfs2_journal *journal;
376391 unsigned long osb_commit_interval;
fs/ocfs2/quota_local.c+2−7
@@ -453,8 +453,7 @@ out: · 452 unmodified lines
453453
454454 /* Sync changes in local quota file into global quota file and
455455 * reinitialize local quota file.
456− * The function expects local quota file to be already locked and
457− * s_umount locked in shared mode. */
456+ * The function expects local quota file to be already locked. */
458457 static int ocfs2_recover_local_quota_file(struct inode *lqinode,
459458 int type,
460459 struct ocfs2_quota_recovery *rec)
@@ -588,7 +587,6 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb, · 127 unmodified lines
588587 {
589588 unsigned int ino[OCFS2_MAXQUOTAS] = { LOCAL_USER_QUOTA_SYSTEM_INODE,
590589 LOCAL_GROUP_QUOTA_SYSTEM_INODE };
591− struct super_block *sb = osb->sb;
592590 struct ocfs2_local_disk_dqinfo *ldinfo;
593591 struct buffer_head *bh;
594592 handle_t *handle;
@@ -600,7 +598,6 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb, · 5 unmodified lines
600598 printk(KERN_NOTICE "ocfs2: Finishing quota recovery on device (%s) for "
601599 "slot %u\n", osb->dev_str, slot_num);
602600
603− down_read(&sb->s_umount);
604601 for (type = 0; type < OCFS2_MAXQUOTAS; type++) {
605602 if (list_empty(&(rec->r_list[type])))
606603 continue;
@@ -677,7 +674,6 @@ out_put: · 70 unmodified lines
677674 break;
678675 }
679676 out:
680− up_read(&sb->s_umount);
681677 kfree(rec);
682678 return status;
683679 }
@@ -843,8 +839,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) · 159 unmodified lines
843839 ocfs2_release_local_quota_bitmaps(&oinfo->dqi_chunk);
844840
845841 /*
846− * s_umount held in exclusive mode protects us against racing with
847− * recovery thread...
842+ * ocfs2_dismount_volume() has already aborted quota recovery...
848843 */
849844 if (oinfo->dqi_rec) {
850845 ocfs2_free_quota_recovery(oinfo->dqi_rec);
fs/ocfs2/suballoc.c+32−6
@@ -698,10 +698,12 @@ static int ocfs2_block_group_alloc(struct ocfs2_super *osb, · 697 unmodified lines
698698
699699 bg_bh = ocfs2_block_group_alloc_contig(osb, handle, alloc_inode,
700700 ac, cl);
701− if (PTR_ERR(bg_bh) == -ENOSPC)
701+ if (PTR_ERR(bg_bh) == -ENOSPC) {
702+ ac->ac_which = OCFS2_AC_USE_MAIN_DISCONTIG;
702703 bg_bh = ocfs2_block_group_alloc_discontig(handle,
703704 alloc_inode,
704705 ac, cl);
706+ }
705707 if (IS_ERR(bg_bh)) {
706708 status = PTR_ERR(bg_bh);
707709 bg_bh = NULL;
@@ -1794,6 +1796,7 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac, · 1086 unmodified lines
17941796 {
17951797 int status;
17961798 u16 chain;
1799+ u32 contig_bits;
17971800 u64 next_group;
17981801 struct inode *alloc_inode = ac->ac_inode;
17991802 struct buffer_head *group_bh = NULL;
@@ -1819,10 +1822,21 @@ static int ocfs2_search_chain(struct ocfs2_alloc_context *ac, · 19 unmodified lines
18191822 status = -ENOSPC;
18201823 /* for now, the chain search is a bit simplistic. We just use
18211824 * the 1st group with any empty bits. */
1822− while ((status = ac->ac_group_search(alloc_inode, group_bh,
1823− bits_wanted, min_bits,
1824− ac->ac_max_block,
1825− res)) == -ENOSPC) {
1825+ while (1) {
1826+ if (ac->ac_which == OCFS2_AC_USE_MAIN_DISCONTIG) {
1827+ contig_bits = le16_to_cpu(bg->bg_contig_free_bits);
1828+ if (!contig_bits)
1829+ contig_bits = ocfs2_find_max_contig_free_bits(bg->bg_bitmap,
1830+ le16_to_cpu(bg->bg_bits), 0);
1831+ if (bits_wanted > contig_bits && contig_bits >= min_bits)
1832+ bits_wanted = contig_bits;
1833+ }
1834+
1835+ status = ac->ac_group_search(alloc_inode, group_bh,
1836+ bits_wanted, min_bits,
1837+ ac->ac_max_block, res);
1838+ if (status != -ENOSPC)
1839+ break;
18261840 if (!bg->bg_next_group)
18271841 break;
18281842
@@ -1982,6 +1996,7 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac, · 153 unmodified lines
19821996 victim = ocfs2_find_victim_chain(cl);
19831997 ac->ac_chain = victim;
19841998
1999+search:
19852000 status = ocfs2_search_chain(ac, handle, bits_wanted, min_bits,
19862001 res, &bits_left);
19872002 if (!status) {
@@ -2022,6 +2037,16 @@ static int ocfs2_claim_suballoc_bits(struct ocfs2_alloc_context *ac, · 34 unmodified lines
20222037 }
20232038 }
20242039
2040+ /* Chains can't supply the bits_wanted contiguous space.
2041+ * We should switch to using every single bit when allocating
2042+ * from the global bitmap. */
2043+ if (i == le16_to_cpu(cl->cl_next_free_rec) &&
2044+ status == -ENOSPC && ac->ac_which == OCFS2_AC_USE_MAIN) {
2045+ ac->ac_which = OCFS2_AC_USE_MAIN_DISCONTIG;
2046+ ac->ac_chain = victim;
2047+ goto search;
2048+ }
2049+
20252050 set_hint:
20262051 if (status != -ENOSPC) {
20272052 /* If the next search of this group is not likely to
@@ -2365,7 +2390,8 @@ int __ocfs2_claim_clusters(handle_t *handle, · 337 unmodified lines
23652390 BUG_ON(ac->ac_bits_given >= ac->ac_bits_wanted);
23662391
23672392 BUG_ON(ac->ac_which != OCFS2_AC_USE_LOCAL
2368− && ac->ac_which != OCFS2_AC_USE_MAIN);
2393+ && ac->ac_which != OCFS2_AC_USE_MAIN
2394+ && ac->ac_which != OCFS2_AC_USE_MAIN_DISCONTIG);
23692395
23702396 if (ac->ac_which == OCFS2_AC_USE_LOCAL) {
23712397 WARN_ON(min_clusters > 1);
fs/ocfs2/suballoc.h+1−0
@@ -29,6 +29,7 @@ struct ocfs2_alloc_context { · 28 unmodified lines
2929 #define OCFS2_AC_USE_MAIN 2
3030 #define OCFS2_AC_USE_INODE 3
3131 #define OCFS2_AC_USE_META 4
32+#define OCFS2_AC_USE_MAIN_DISCONTIG 5
3233 u32 ac_which;
3334
3435 /* these are used by the chain search */
fs/ocfs2/super.c+3−0
@@ -1812,6 +1812,9 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err) · 1811 unmodified lines
18121812 /* Orphan scan should be stopped as early as possible */
18131813 ocfs2_orphan_scan_stop(osb);
18141814
1815+ /* Stop quota recovery so that we can disable quotas */
1816+ ocfs2_recovery_disable_quota(osb);
1817+
18151818 ocfs2_disable_quotas(osb);
18161819
18171820 /* All dquots should be freed by now */
fs/userfaultfd.c+22−6
@@ -1585,8 +1585,11 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx, · 1584 unmodified lines
15851585 user_uffdio_copy = (struct uffdio_copy __user *) arg;
15861586
15871587 ret = -EAGAIN;
1588− if (atomic_read(&ctx->mmap_changing))
1588+ if (unlikely(atomic_read(&ctx->mmap_changing))) {
1589+ if (unlikely(put_user(ret, &user_uffdio_copy->copy)))
1590+ return -EFAULT;
15891591 goto out;
1592+ }
15901593
15911594 ret = -EFAULT;
15921595 if (copy_from_user(&uffdio_copy, user_uffdio_copy,
@@ -1641,8 +1644,11 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx, · 48 unmodified lines
16411644 user_uffdio_zeropage = (struct uffdio_zeropage __user *) arg;
16421645
16431646 ret = -EAGAIN;
1644− if (atomic_read(&ctx->mmap_changing))
1647+ if (unlikely(atomic_read(&ctx->mmap_changing))) {
1648+ if (unlikely(put_user(ret, &user_uffdio_zeropage->zeropage)))
1649+ return -EFAULT;
16451650 goto out;
1651+ }
16461652
16471653 ret = -EFAULT;
16481654 if (copy_from_user(&uffdio_zeropage, user_uffdio_zeropage,
@@ -1744,8 +1750,11 @@ static int userfaultfd_continue(struct userfaultfd_ctx *ctx, unsigned long arg) · 95 unmodified lines
17441750 user_uffdio_continue = (struct uffdio_continue __user *)arg;
17451751
17461752 ret = -EAGAIN;
1747− if (atomic_read(&ctx->mmap_changing))
1753+ if (unlikely(atomic_read(&ctx->mmap_changing))) {
1754+ if (unlikely(put_user(ret, &user_uffdio_continue->mapped)))
1755+ return -EFAULT;
17481756 goto out;
1757+ }
17491758
17501759 ret = -EFAULT;
17511760 if (copy_from_user(&uffdio_continue, user_uffdio_continue,
@@ -1801,8 +1810,11 @@ static inline int userfaultfd_poison(struct userfaultfd_ctx *ctx, unsigned long · 49 unmodified lines
18011810 user_uffdio_poison = (struct uffdio_poison __user *)arg;
18021811
18031812 ret = -EAGAIN;
1804− if (atomic_read(&ctx->mmap_changing))
1813+ if (unlikely(atomic_read(&ctx->mmap_changing))) {
1814+ if (unlikely(put_user(ret, &user_uffdio_poison->updated)))
1815+ return -EFAULT;
18051816 goto out;
1817+ }
18061818
18071819 ret = -EFAULT;
18081820 if (copy_from_user(&uffdio_poison, user_uffdio_poison,
@@ -1870,8 +1882,12 @@ static int userfaultfd_move(struct userfaultfd_ctx *ctx, · 61 unmodified lines
18701882
18711883 user_uffdio_move = (struct uffdio_move __user *) arg;
18721884
1873− if (atomic_read(&ctx->mmap_changing))
1874− return -EAGAIN;
1885+ ret = -EAGAIN;
1886+ if (unlikely(atomic_read(&ctx->mmap_changing))) {
1887+ if (unlikely(put_user(ret, &user_uffdio_move->move)))
1888+ return -EFAULT;
1889+ goto out;
1890+ }
18751891
18761892 if (copy_from_user(&uffdio_move, user_uffdio_move,
18771893 /* don't copy "move" last field */
include/linux/vmalloc.h+1−0
@@ -61,6 +61,7 @@ struct vm_struct { · 60 unmodified lines
6161 unsigned int nr_pages;
6262 phys_addr_t phys_addr;
6363 const void *caller;
64+ unsigned long requested_size;
6465 };
6566
6667 struct vmap_area {
mm/huge_memory.c+8−3
@@ -3075,6 +3075,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, · 3074 unmodified lines
30753075 void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address,
30763076 pmd_t *pmd, bool freeze, struct folio *folio)
30773077 {
3078+ bool pmd_migration = is_pmd_migration_entry(*pmd);
3079+
30783080 VM_WARN_ON_ONCE(folio && !folio_test_pmd_mappable(folio));
30793081 VM_WARN_ON_ONCE(!IS_ALIGNED(address, HPAGE_PMD_SIZE));
30803082 VM_WARN_ON_ONCE(folio && !folio_test_locked(folio));
@@ -3085,9 +3087,12 @@ void split_huge_pmd_locked(struct vm_area_struct *vma, unsigned long address, · 4 unmodified lines
30853087 * require a folio to check the PMD against. Otherwise, there
30863088 * is a risk of replacing the wrong folio.
30873089 */
3088− if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd) ||
3089− is_pmd_migration_entry(*pmd)) {
3090− if (folio && folio != pmd_folio(*pmd))
3090+ if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd) || pmd_migration) {
3091+ /*
3092+ * Do not apply pmd_folio() to a migration entry; and folio lock
3093+ * guarantees that it must be of the wrong folio anyway.
3094+ */
3095+ if (folio && (pmd_migration || folio != pmd_folio(*pmd)))
30913096 return;
30923097 __split_huge_pmd_locked(vma, pmd, address, freeze);
30933098 }
mm/hugetlb.c+6−0
@@ -4034,10 +4034,13 @@ static long demote_free_hugetlb_folios(struct hstate *src, struct hstate *dst, · 4033 unmodified lines
40344034
40354035 list_for_each_entry_safe(folio, next, src_list, lru) {
40364036 int i;
4037+ bool cma;
40374038
40384039 if (folio_test_hugetlb_vmemmap_optimized(folio))
40394040 continue;
40404041
4042+ cma = folio_test_hugetlb_cma(folio);
4043+
40414044 list_del(&folio->lru);
40424045
40434046 split_page_owner(&folio->page, huge_page_order(src), huge_page_order(dst));
@@ -4053,6 +4056,9 @@ static long demote_free_hugetlb_folios(struct hstate *src, struct hstate *dst, · 9 unmodified lines
40534056
40544057 new_folio->mapping = NULL;
40554058 init_new_hugetlb_folio(dst, new_folio);
4059+ /* Copy the CMA flag so that it is freed correctly */
4060+ if (cma)
4061+ folio_set_hugetlb_cma(new_folio);
40564062 list_add(&new_folio->lru, &dst_list);
40574063 }
40584064 }
mm/internal.h+11−16
@@ -248,11 +248,9 @@ static inline int folio_pte_batch(struct folio *folio, unsigned long addr, · 247 unmodified lines
248248 pte_t *start_ptep, pte_t pte, int max_nr, fpb_t flags,
249249 bool *any_writable, bool *any_young, bool *any_dirty)
250250 {
251− unsigned long folio_end_pfn = folio_pfn(folio) + folio_nr_pages(folio);
252− const pte_t *end_ptep = start_ptep + max_nr;
253251 pte_t expected_pte, *ptep;
254252 bool writable, young, dirty;
255− int nr;
253+ int nr, cur_nr;
256254
257255 if (any_writable)
258256 *any_writable = false;
@@ -265,11 +263,15 @@ static inline int folio_pte_batch(struct folio *folio, unsigned long addr, · 6 unmodified lines
265263 VM_WARN_ON_FOLIO(!folio_test_large(folio) || max_nr < 1, folio);
266264 VM_WARN_ON_FOLIO(page_folio(pfn_to_page(pte_pfn(pte))) != folio, folio);
267265
266+ /* Limit max_nr to the actual remaining PFNs in the folio we could batch. */
267+ max_nr = min_t(unsigned long, max_nr,
268+ folio_pfn(folio) + folio_nr_pages(folio) - pte_pfn(pte));
269+
268270 nr = pte_batch_hint(start_ptep, pte);
269271 expected_pte = __pte_batch_clear_ignored(pte_advance_pfn(pte, nr), flags);
270272 ptep = start_ptep + nr;
271273
272− while (ptep < end_ptep) {
274+ while (nr < max_nr) {
273275 pte = ptep_get(ptep);
274276 if (any_writable)
275277 writable = !!pte_write(pte);
@@ -282,14 +284,6 @@ static inline int folio_pte_batch(struct folio *folio, unsigned long addr, · 6 unmodified lines
282284 if (!pte_same(pte, expected_pte))
283285 break;
284286
285− /*
286− * Stop immediately once we reached the end of the folio. In
287− * corner cases the next PFN might fall into a different
288− * folio.
289− */
290− if (pte_pfn(pte) >= folio_end_pfn)
291− break;
292−
293287 if (any_writable)
294288 *any_writable |= writable;
295289 if (any_young)
@@ -297,12 +291,13 @@ static inline int folio_pte_batch(struct folio *folio, unsigned long addr, · 1 unmodified line
297291 if (any_dirty)
298292 *any_dirty |= dirty;
299293
300− nr = pte_batch_hint(ptep, pte);
301− expected_pte = pte_advance_pfn(expected_pte, nr);
302− ptep += nr;
294+ cur_nr = pte_batch_hint(ptep, pte);
295+ expected_pte = pte_advance_pfn(expected_pte, cur_nr);
296+ ptep += cur_nr;
297+ nr += cur_nr;
303298 }
304299
305− return min(ptep - start_ptep, max_nr);
300+ return min(nr, max_nr);
306301 }
307302
308303 /**
mm/swapfile.c+16−7
@@ -1272,13 +1272,22 @@ int folio_alloc_swap(struct folio *folio, gfp_t gfp) · 1271 unmodified lines
12721272 VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
12731273 VM_BUG_ON_FOLIO(!folio_test_uptodate(folio), folio);
12741274
1275− /*
1276− * Should not even be attempting large allocations when huge
1277− * page swap is disabled. Warn and fail the allocation.
1278− */
1279− if (order && (!IS_ENABLED(CONFIG_THP_SWAP) || size > SWAPFILE_CLUSTER)) {
1280− VM_WARN_ON_ONCE(1);
1281− return -EINVAL;
1275+ if (order) {
1276+ /*
1277+ * Reject large allocation when THP_SWAP is disabled,
1278+ * the caller should split the folio and try again.
1279+ */
1280+ if (!IS_ENABLED(CONFIG_THP_SWAP))
1281+ return -EAGAIN;
1282+
1283+ /*
1284+ * Allocation size should never exceed cluster size
1285+ * (HPAGE_PMD_SIZE).
1286+ */
1287+ if (size > SWAPFILE_CLUSTER) {
1288+ VM_WARN_ON_ONCE(1);
1289+ return -EINVAL;
1290+ }
12821291 }
12831292
12841293 local_lock(&percpu_swap_cluster.lock);
mm/vmalloc.c+24−7
@@ -1940,7 +1940,7 @@ static inline void setup_vmalloc_vm(struct vm_struct *vm, · 1939 unmodified lines
19401940 {
19411941 vm->flags = flags;
19421942 vm->addr = (void *)va->va_start;
1943− vm->size = va_size(va);
1943+ vm->size = vm->requested_size = va_size(va);
19441944 vm->caller = caller;
19451945 va->vm = vm;
19461946 }
@@ -3133,6 +3133,7 @@ struct vm_struct *__get_vm_area_node(unsigned long size, · 1186 unmodified lines
31333133
31343134 area->flags = flags;
31353135 area->caller = caller;
3136+ area->requested_size = requested_size;
31363137
31373138 va = alloc_vmap_area(size, align, start, end, node, gfp_mask, 0, area);
31383139 if (IS_ERR(va)) {
@@ -4063,6 +4064,8 @@ EXPORT_SYMBOL(vzalloc_node_noprof); · 924 unmodified lines
40634064 */
40644065 void *vrealloc_noprof(const void *p, size_t size, gfp_t flags)
40654066 {
4067+ struct vm_struct *vm = NULL;
4068+ size_t alloced_size = 0;
40664069 size_t old_size = 0;
40674070 void *n;
40684071
@@ -4072,15 +4075,17 @@ void *vrealloc_noprof(const void *p, size_t size, gfp_t flags) · 3 unmodified lines
40724075 }
40734076
40744077 if (p) {
4075− struct vm_struct *vm;
4076−
40774078 vm = find_vm_area(p);
40784079 if (unlikely(!vm)) {
40794080 WARN(1, "Trying to vrealloc() nonexistent vm area (%p)\n", p);
40804081 return NULL;
40814082 }
40824083
4083− old_size = get_vm_area_size(vm);
4084+ alloced_size = get_vm_area_size(vm);
4085+ old_size = vm->requested_size;
4086+ if (WARN(alloced_size < old_size,
4087+ "vrealloc() has mismatched area vs requested sizes (%p)\n", p))
4088+ return NULL;
40844089 }
40854090
40864091 /*
@@ -4088,14 +4093,26 @@ void *vrealloc_noprof(const void *p, size_t size, gfp_t flags) · 1 unmodified line
40884093 * would be a good heuristic for when to shrink the vm_area?
40894094 */
40904095 if (size <= old_size) {
4091− /* Zero out spare memory. */
4092− if (want_init_on_alloc(flags))
4096+ /* Zero out "freed" memory. */
4097+ if (want_init_on_free())
40934098 memset((void *)p + size, 0, old_size - size);
4099+ vm->requested_size = size;
40944100 kasan_poison_vmalloc(p + size, old_size - size);
4095− kasan_unpoison_vmalloc(p, size, KASAN_VMALLOC_PROT_NORMAL);
40964101 return (void *)p;
40974102 }
40984103
4104+ /*
4105+ * We already have the bytes available in the allocation; use them.
4106+ */
4107+ if (size <= alloced_size) {
4108+ kasan_unpoison_vmalloc(p + old_size, size - old_size,
4109+ KASAN_VMALLOC_PROT_NORMAL);
4110+ /* Zero out "alloced" memory. */
4111+ if (want_init_on_alloc(flags))
4112+ memset((void *)p + old_size, 0, size - old_size);
4113+ vm->requested_size = size;
4114+ }
4115+
40994116 /* TODO: Grow the vm_area, i.e. allocate and map additional pages. */
41004117 n = __vmalloc_noprof(size, flags);
41014118 if (!n)
tools/testing/selftests/mm/compaction_test.c+14−5
@@ -90,6 +90,8 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size, · 89 unmodified lines
9090 int compaction_index = 0;
9191 char nr_hugepages[20] = {0};
9292 char init_nr_hugepages[24] = {0};
93+ char target_nr_hugepages[24] = {0};
94+ int slen;
9395
9496 snprintf(init_nr_hugepages, sizeof(init_nr_hugepages),
9597 "%lu", initial_nr_hugepages);
@@ -106,11 +108,18 @@ int check_compaction(unsigned long mem_free, unsigned long hugepage_size, · 10 unmodified lines
106108 goto out;
107109 }
108110
109− /* Request a large number of huge pages. The Kernel will allocate
110− as much as it can */
111− if (write(fd, "100000", (6*sizeof(char))) != (6*sizeof(char))) {
112− ksft_print_msg("Failed to write 100000 to /proc/sys/vm/nr_hugepages: %s\n",
113− strerror(errno));
111+ /*
112+ * Request huge pages for about half of the free memory. The Kernel
113+ * will allocate as much as it can, and we expect it will get at least 1/3
114+ */
115+ nr_hugepages_ul = mem_free / hugepage_size / 2;
116+ snprintf(target_nr_hugepages, sizeof(target_nr_hugepages),
117+ "%lu", nr_hugepages_ul);
118+
119+ slen = strlen(target_nr_hugepages);
120+ if (write(fd, target_nr_hugepages, slen) != slen) {
121+ ksft_print_msg("Failed to write %lu to /proc/sys/vm/nr_hugepages: %s\n",
122+ nr_hugepages_ul, strerror(errno));
114123 goto close_fd;
115124 }
116125
tools/testing/selftests/mm/guard-regions.c+10−6
@@ -271,12 +271,16 @@ FIXTURE_SETUP(guard_regions) · 270 unmodified lines
271271 self->page_size = (unsigned long)sysconf(_SC_PAGESIZE);
272272 setup_sighandler();
273273
274− if (variant->backing == ANON_BACKED)
274+ switch (variant->backing) {
275+ case ANON_BACKED:
275276 return;
276−
277− self->fd = open_file(
278− variant->backing == SHMEM_BACKED ? "/tmp/" : "",
279− self->path);
277+ case LOCAL_FILE_BACKED:
278+ self->fd = open_file("", self->path);
279+ break;
280+ case SHMEM_BACKED:
281+ self->fd = memfd_create(self->path, 0);
282+ break;
283+ }
280284
281285 /* We truncate file to at least 100 pages, tests can modify as needed. */
282286 ASSERT_EQ(ftruncate(self->fd, 100 * self->page_size), 0);
@@ -1696,7 +1700,7 @@ TEST_F(guard_regions, readonly_file) · 1413 unmodified lines
16961700 char *ptr;
16971701 int i;
16981702
1699− if (variant->backing == ANON_BACKED)
1703+ if (variant->backing != LOCAL_FILE_BACKED)
17001704 SKIP(return, "Read-only test specific to file-backed");
17011705
17021706 /* Map shared so we can populate with pattern, populate it, unmap. */
tools/testing/selftests/mm/pkey-powerpc.h+13−1
@@ -3,6 +3,8 @@ · 2 unmodified lines
33 #ifndef _PKEYS_POWERPC_H
44 #define _PKEYS_POWERPC_H
55
6+#include <sys/stat.h>
7+
68 #ifndef SYS_pkey_alloc
79 # define SYS_pkey_alloc 384
810 # define SYS_pkey_free 385
@@ -102,8 +104,18 @@ static inline void expect_fault_on_read_execonly_key(void *p1, int pkey) · 93 unmodified lines
102104 return;
103105 }
104106
107+#define REPEAT_8(s) s s s s s s s s
108+#define REPEAT_64(s) REPEAT_8(s) REPEAT_8(s) REPEAT_8(s) REPEAT_8(s) \
109+ REPEAT_8(s) REPEAT_8(s) REPEAT_8(s) REPEAT_8(s)
110+#define REPEAT_512(s) REPEAT_64(s) REPEAT_64(s) REPEAT_64(s) REPEAT_64(s) \
111+ REPEAT_64(s) REPEAT_64(s) REPEAT_64(s) REPEAT_64(s)
112+#define REPEAT_4096(s) REPEAT_512(s) REPEAT_512(s) REPEAT_512(s) REPEAT_512(s) \
113+ REPEAT_512(s) REPEAT_512(s) REPEAT_512(s) REPEAT_512(s)
114+#define REPEAT_16384(s) REPEAT_4096(s) REPEAT_4096(s) \
115+ REPEAT_4096(s) REPEAT_4096(s)
116+
105117 /* 4-byte instructions * 16384 = 64K page */
106−#define __page_o_noops() asm(".rept 16384 ; nop; .endr")
118+#define __page_o_noops() asm(REPEAT_16384("nop\n"))
107119
108120 static inline void *malloc_pkey_with_mprotect_subpage(long size, int prot, u16 pkey)
109121 {
tools/testing/selftests/mm/pkey_util.c+1−0
@@ -1,4 +1,5 @@
11 // SPDX-License-Identifier: GPL-2.0-only
2+#define __SANE_USERSPACE_TYPES__
23 #include <sys/syscall.h>
34 #include <unistd.h>
45