Commit f47edb59 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'akpm' (patches from Andrew) 

Mergr misc fixes from Andrew Morton:
 "11 fixes"

Mostly VM fixes, one psi polling fix, and one parisc build fix.

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm/kasan: fix false positive invalid-free reports with CONFIG_KASAN_SW_TAGS=y
  mm/zsmalloc.c: fix race condition in zs_destroy_pool
  mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
  mm, page_owner: handle THP splits correctly
  userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
  psi: get poll_work to run when calling poll syscall next time
  mm: memcontrol: flush percpu vmevents before releasing memcg
  mm: memcontrol: flush percpu vmstats before releasing memcg
  parisc: fix compilation errrors
  mm, page_alloc: move_freepages should not examine struct page of reserved memory
  mm/z3fold.c: fix race between migration and destruction
parents e67095fd 00fb24a4

arch/parisc/include/asm/pgtable.h

+1 −2
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
#ifndef _PARISC_PGTABLE_H

#define _PARISC_PGTABLE_H



#include <asm/page.h>

#include <asm-generic/4level-fixup.h>



#include <asm/fixmap.h>
@@ -98,8 +99,6 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr) 


#endif /* !__ASSEMBLY__ */



#include <asm/page.h>



#define pte_ERROR(e) \

	printk("%s:%d: bad pte %08lx.\n", __FILE__, __LINE__, pte_val(e))

#define pmd_ERROR(e) \

fs/userfaultfd.c

+13 −12
Original line number Diff line number Diff line
@@ -880,6 +880,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) 
	/* len == 0 means wake all */

	struct userfaultfd_wake_range range = { .len = 0, };

	unsigned long new_flags;

	bool still_valid;



	WRITE_ONCE(ctx->released, true);
@@ -895,8 +896,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) 
	 * taking the mmap_sem for writing.

	 */

	down_write(&mm->mmap_sem);

	if (!mmget_still_valid(mm))

		goto skip_mm;

	still_valid = mmget_still_valid(mm);

	prev = NULL;

	for (vma = mm->mmap; vma; vma = vma->vm_next) {

		cond_resched();
@@ -907,6 +907,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) 
			continue;

		}

		new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);

		if (still_valid) {

			prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,

					 new_flags, vma->anon_vma,

					 vma->vm_file, vma->vm_pgoff,
@@ -916,10 +917,10 @@ static int userfaultfd_release(struct inode *inode, struct file *file) 
				vma = prev;

			else

				prev = vma;

		}

		vma->vm_flags = new_flags;

		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;

	}

skip_mm:

	up_write(&mm->mmap_sem);

	mmput(mm);

wakeup:

kernel/sched/psi.c

+8 −0
Original line number Diff line number Diff line
@@ -1131,7 +1131,15 @@ static void psi_trigger_destroy(struct kref *ref) 
	 * deadlock while waiting for psi_poll_work to acquire trigger_lock

	 */

	if (kworker_to_destroy) {

		/*

		 * After the RCU grace period has expired, the worker

		 * can no longer be found through group->poll_kworker.

		 * But it might have been already scheduled before

		 * that - deschedule it cleanly before destroying it.

		 */

		kthread_cancel_delayed_work_sync(&group->poll_work);

		atomic_set(&group->poll_scheduled, 0);



		kthread_destroy_worker(kworker_to_destroy);

	}

	kfree(t);

mm/huge_memory.c

+4 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ 
#include <linux/shmem_fs.h>

#include <linux/oom.h>

#include <linux/numa.h>

#include <linux/page_owner.h>



#include <asm/tlb.h>

#include <asm/pgalloc.h>
@@ -2516,6 +2517,9 @@ static void __split_huge_page(struct page *page, struct list_head *list, 
	}



	ClearPageCompound(head);



	split_page_owner(head, HPAGE_PMD_ORDER);



	/* See comment in __split_huge_page_tail() */

	if (PageAnon(head)) {

		/* Additional pin to swap cache */

mm/kasan/common.c

+8 −2
Original line number Diff line number Diff line
@@ -407,8 +407,14 @@ static inline bool shadow_invalid(u8 tag, s8 shadow_byte) 
	if (IS_ENABLED(CONFIG_KASAN_GENERIC))

		return shadow_byte < 0 ||

			shadow_byte >= KASAN_SHADOW_SCALE_SIZE;

	else

		return tag != (u8)shadow_byte;



	/* else CONFIG_KASAN_SW_TAGS: */

	if ((u8)shadow_byte == KASAN_TAG_INVALID)

		return true;

	if ((tag != KASAN_TAG_KERNEL) && (tag != (u8)shadow_byte))

		return true;



	return false;

}



static bool __kasan_slab_free(struct kmem_cache *cache, void *object,

CRA Git | Maintained and supported by SUSTech CRA and CCSE