Linux 6.3.11
Greg Kroah-Hartman
maintainerI'm announcing the release of the 6.3.11 kernel.
All users of the 6.3 kernel series must upgrade.
The updated 6.3.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.3.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 arch/alpha/Kconfig | 1 arch/alpha/mm/fault.c | 13 -- arch/arc/Kconfig | 1 arch/arc/mm/fault.c | 11 -- arch/arm/Kconfig | 1 arch/arm/mm/fault.c | 63 ++---------- arch/arm64/Kconfig | 1 arch/arm64/mm/fault.c | 46 +-------- arch/csky/Kconfig | 1 arch/csky/mm/fault.c | 22 ---- arch/hexagon/Kconfig | 1 arch/hexagon/mm/vm_fault.c | 18 --- arch/ia64/mm/fault.c | 36 +------ arch/loongarch/Kconfig | 1 arch/loongarch/mm/fault.c | 16 +-- arch/m68k/mm/fault.c | 9 + arch/microblaze/mm/fault.c | 5 arch/mips/Kconfig | 1 arch/mips/mm/fault.c | 12 -- arch/nios2/Kconfig | 1 arch/nios2/mm/fault.c | 17 --- arch/openrisc/mm/fault.c | 5 arch/parisc/mm/fault.c | 23 ++-- arch/powerpc/Kconfig | 1 arch/powerpc/mm/copro_fault.c | 14 -- arch/powerpc/mm/fault.c | 39 ------- arch/riscv/Kconfig | 1 arch/riscv/mm/fault.c | 31 ++---- arch/s390/mm/fault.c | 5 arch/sh/Kconfig | 1 arch/sh/mm/fault.c | 17 --- arch/sparc/Kconfig | 1 arch/sparc/mm/fault_32.c | 32 +----- arch/sparc/mm/fault_64.c | 8 - arch/um/kernel/trap.c | 11 +- arch/x86/Kconfig | 1 arch/x86/include/asm/cpu.h | 2 arch/x86/include/asm/smp.h | 2 arch/x86/kernel/cpu/microcode/amd.c | 2 arch/x86/kernel/process.c | 28 ++++- arch/x86/kernel/smp.c | 73 +++++++++----- arch/x86/kernel/smpboot.c | 81 ++++++++++++++- arch/x86/mm/fault.c | 52 ---------- arch/xtensa/Kconfig | 1 arch/xtensa/mm/fault.c | 14 -- drivers/cpufreq/amd-pstate.c | 2 drivers/hid/hid-logitech-hidpp.c | 2 drivers/hid/hidraw.c | 9 + drivers/hid/wacom_wac.c | 6 - drivers/hid/wacom_wac.h | 2 drivers/iommu/amd/iommu_v2.c | 4 drivers/iommu/iommu-sva.c | 2 drivers/thermal/mediatek/auxadc_thermal.c | 14 -- drivers/video/fbdev/core/sysimgblt.c | 2 fs/binfmt_elf.c | 6 - fs/exec.c | 38 ++++--- include/linux/mm.h | 17 +-- lib/maple_tree.c | 11 +- mm/Kconfig | 4 mm/gup.c | 14 ++ mm/memory.c | 127 ++++++++++++++++++++++++ mm/mmap.c | 153 +++++++++++++++++++++++------- mm/nommu.c | 18 ++- net/can/isotp.c | 5 65 files changed, 622 insertions(+), 538 deletions(-)
Ben Hutchings (3):
mips/mm: Convert to using lock_mm_and_find_vma() riscv/mm: Convert to using lock_mm_and_find_vma() arm/mm: Convert to using lock_mm_and_find_vma()
Borislav Petkov (AMD) (1):
x86/microcode/AMD: Load late on both threads too
David Woodhouse (1):
mm/mmap: Fix error return in do_vmi_align_munmap()
Greg Kroah-Hartman (1):
Linux 6.3.11
Jason Gerecke (1):
HID: wacom: Use ktime_t rather than int when dealing with timestamps
Liam R. Howlett (2):
mm/mmap: Fix error path in do_vmi_align_munmap()
mm: make find_extend_vma() fail if write lock not held
Linus Torvalds (12):
mm: introduce new 'lock_mm_and_find_vma()' page fault helper
mm: make the page fault mmap locking killable arm64/mm: Convert to using lock_mm_and_find_vma() mm/fault: convert remaining simple cases to lock_mm_and_find_vma() powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma()
execve: expand new process stack manually ahead of time
mm: always expand the stack with the mmap write lock held
gup: add warning if some caller would seem to want stack expansion
sparc32: fix lock_mm_and_find_vma() conversion
parisc: fix expand_stack() conversion
csky: fix up lock_mm_and_find_vma() conversion
xtensa: fix NOMMU build with lock_mm_and_find_vma() conversion
Ludvig Michaelsson (1):
HID: hidraw: fix data race on device refcount
Michael Ellerman (1):
powerpc/mm: Convert to using lock_mm_and_find_vma()
Mike Hommey (1):
HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
Oliver Hartkopp (1):
can: isotp: isotp_sendmsg(): fix return error fix on TX path
Peng Zhang (1):
maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
Ricardo Cañuelo (1):
Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"
Thomas Gleixner (4):
x86/smp: Make stop_other_cpus() more robust x86/smp: Remove pointless wmb()s from native_stop_other_cpus() x86/smp: Use dedicated cache-line for mwait_play_dead() x86/smp: Cure kexec() vs. mwait_play_dead() breakage
Tony Battersby (1):
x86/smp: Dont access non-existing CPUID leaf
Wyes Karny (1):
cpufreq: amd-pstate: Make amd-pstate EPP driver name hyphenated
Zhang Shurong (1):
fbdev: fix potential OOB read in fast_imageblit()
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 6 PATCHLEVEL = 3 -SUBLEVEL = 10 +SUBLEVEL = 11 EXTRAVERSION = NAME = Hurr durr I'ma ninja sloth
arch/alpha/Kconfig +1 -0
@@ -29,6 +29,7 @@ config ALPHA select GENERIC_SMP_IDLE_THREAD select HAVE_ARCH_AUDITSYSCALL select HAVE_MOD_ARCH_SPECIFIC + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select ODD_RT_SIGACTION select OLD_SIGSUSPEND
arch/alpha/mm/fault.c +3 -10
@@ -119,20 +119,12 @@ do_page_fault(unsigned long address, unsigned long mmcsr, flags |=FAULT_FLAG_USER ;perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; + goto bad_area_nosemaphore;/* Ok, we have a good vm_area for this memory access, so we can handle it. */ - good_area: si_code =SEGV_ACCERR ;if (cause <0 ) {if (!(vma->vm_flags &VM_EXEC ))
@@ -192,6 +184,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr, bad_area:mmap_read_unlock (mm); + bad_area_nosemaphore:if (user_mode (regs)) goto do_sigsegv;
arch/arc/Kconfig +1 -0
@@ -41,6 +41,7 @@ config ARC select HAVE_PERF_EVENTS select HAVE_SYSCALL_TRACEPOINTS select IRQ_DOMAIN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select OF select OF_EARLY_FLATTREE
arch/arc/mm/fault.c +3 -8
@@ -113,15 +113,9 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (!vma) - goto bad_area; -if (unlikely (address < vma->vm_start)) { -if (!(vma->vm_flags &VM_GROWSDOWN ) ||expand_stack (vma, address)) - goto bad_area; - } + goto bad_area_nosemaphore;/* * vm_area is good, now check permissions for this memory access
@@ -161,6 +155,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs) bad_area:mmap_read_unlock (mm); +bad_area_nosemaphore:/* * Major/minor page fault accounting * (in case of retry we only land here once)
arch/arm/Kconfig +1 -0
@@ -125,6 +125,7 @@ config ARM select HAVE_UID16 select HAVE_VIRT_CPU_ACCOUNTING_GEN select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_REL select NEED_DMA_MAP_STATE select OF_EARLY_FLATTREE if OF
arch/arm/mm/fault.c +14 -49
88 lines not on this page · raw message
arch/arm64/Kconfig +1 -0
@@ -219,6 +219,7 @@ config ARM64 select IRQ_DOMAIN select IRQ_FORCED_THREADING select KASAN_VMALLOC if KASAN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select NEED_DMA_MAP_STATE select NEED_SG_DMA_LENGTH
arch/arm64/mm/fault.c +9 -37
79 lines not on this page · raw message
arch/csky/Kconfig +1 -0
@@ -96,6 +96,7 @@ config CSKY select HAVE_REGS_AND_STACK_ACCESS_API select HAVE_STACKPROTECTOR select HAVE_SYSCALL_TRACEPOINTS + select LOCK_MM_AND_FIND_VMA select MAY_HAVE_SPARSE_IRQ select MODULES_USE_ELF_RELA if MODULES select OF
arch/csky/mm/fault.c +5 -17
@@ -97,13 +97,12 @@ static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_fBUG (); } -static inline void bad_area (struct pt_regs *regs,struct mm_struct *mm,int code,unsigned long addr) +static inline void bad_area_nosemaphore (struct pt_regs *regs,struct mm_struct *mm,int code,unsigned long addr) {/* * Something tried to access memory that isn't in our memory map. * Fix it, but check if it's kernel or user first. */ -mmap_read_unlock (mm);/* User mode accesses just cause a SIGSEGV */ if (user_mode (regs)) {do_trap (regs,SIGSEGV , code, addr);
@@ -238,20 +237,9 @@ asmlinkage void do_page_fault(struct pt_regs *regs)if (is_write (regs)) flags |=FAULT_FLAG_WRITE ; retry: -mmap_read_lock (mm); - vma =find_vma (mm, addr); + vma =lock_mm_and_find_vma (mm, addr, regs);if (unlikely (!vma)) { -bad_area (regs, mm, code, addr); -return ; - } -if (likely (vma->vm_start <= addr)) - goto good_area; -if (unlikely (!(vma->vm_flags &VM_GROWSDOWN ))) { -bad_area (regs, mm, code, addr); -return ; - } -if (unlikely (expand_stack (vma, addr))) { -bad_area (regs, mm, code, addr); +bad_area_nosemaphore (regs, mm, code, addr);return ; }
@@ -259,11 +247,11 @@ asmlinkage void do_page_fault(struct pt_regs *regs)* Ok, we have a good vm_area for this memory access, so * we can handle it. */ -good_area: code =SEGV_ACCERR ;if (unlikely (access_error (regs, vma))) { -bad_area (regs, mm, code, addr); +mmap_read_unlock (mm); +bad_area_nosemaphore (regs, mm, code, addr);return ; }
arch/hexagon/Kconfig +1 -0
@@ -28,6 +28,7 @@ config HEXAGON select GENERIC_SMP_IDLE_THREAD select STACKTRACE_SUPPORT select GENERIC_CLOCKEVENTS_BROADCAST + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select GENERIC_CPU_DEVICES select ARCH_WANT_LD_ORPHAN_WARN
arch/hexagon/mm/vm_fault.c +4 -14
@@ -57,21 +57,10 @@ void do_page_fault(unsigned long address, long cause, struct pt_regs *regs)perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - vma =find_vma (mm, address); -if (!vma) - goto bad_area; + vma =lock_mm_and_find_vma (mm, address, regs); +if (unlikely (!vma)) + goto bad_area_nosemaphore; -if (vma->vm_start <= address) - goto good_area; - -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; - -if (expand_stack (vma, address)) - goto bad_area; - -good_area:/* Address space is OK. Now check access rights. */ si_code =SEGV_ACCERR ;
@@ -143,6 +132,7 @@ void do_page_fault(unsigned long address, long cause, struct pt_regs *regs) bad_area:mmap_read_unlock (mm); +bad_area_nosemaphore:if (user_mode (regs)) {force_sig_fault (SIGSEGV , si_code, (void __user *)address);return ;
arch/ia64/mm/fault.c +6 -30
@@ -110,10 +110,12 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re* register backing store that needs to expand upwards, in * this case vma will be null, but prev_vma will ne non-null */ -if (( !vma && prev_vma ) || (address < vma->vm_start) ) - goto check_expansion; +if (( !vma && prev_vma ) || (address < vma->vm_start) ) { + vma =expand_stack (mm, address); +if (!vma) + goto bad_area_nosemaphore; + } - good_area: code =SEGV_ACCERR ;/* OK, we've got a good vm_area for this memory area. Check the access permissions: */
@@ -177,35 +179,9 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *remmap_read_unlock (mm);return ; - check_expansion: -if (!(prev_vma && (prev_vma->vm_flags &VM_GROWSUP ) && (address == prev_vma->vm_end))) { -if (!vma) - goto bad_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (REGION_NUMBER (address) !=REGION_NUMBER (vma->vm_start) - ||REGION_OFFSET (address) >=RGN_MAP_LIMIT ) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; - }else { - vma = prev_vma; -if (REGION_NUMBER (address) !=REGION_NUMBER (vma->vm_start) - ||REGION_OFFSET (address) >=RGN_MAP_LIMIT ) - goto bad_area; -/* -* Since the register backing store is accessed sequentially, -* we disallow growing it by more than a page at a time. -*/ -if (address > vma->vm_end +PAGE_SIZE -sizeof (long )) - goto bad_area; -if (expand_upwards (vma, address)) - goto bad_area; - } - goto good_area; - bad_area:mmap_read_unlock (mm); + bad_area_nosemaphore:if ((isr &IA64_ISR_SP ) || ((isr &IA64_ISR_NA ) && (isr &IA64_ISR_CODE_MASK ) ==IA64_ISR_CODE_LFETCH )) {
arch/loongarch/Kconfig +1 -0
@@ -125,6 +125,7 @@ config LOONGARCH select HAVE_VIRT_CPU_ACCOUNTING_GEN if !SMP select IRQ_FORCED_THREADING select IRQ_LOONGARCH_CPU + select LOCK_MM_AND_FIND_VMA select MMU_GATHER_MERGE_VMAS if MMU select MODULES_USE_ELF_RELA if MODULES select NEED_PER_CPU_EMBED_FIRST_CHUNK
arch/loongarch/mm/fault.c +6 -10
@@ -169,22 +169,18 @@ static void __kprobes __do_page_fault(struct pt_regs *regs,perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - vma =find_vma (mm, address); -if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (!expand_stack (vma, address)) - goto good_area; + vma =lock_mm_and_find_vma (mm, address, regs); +if (unlikely (!vma)) + goto bad_area_nosemaphore; + goto good_area; +/* * Something tried to access memory that isn't in our memory map.. * Fix it, but check if it's kernel or user first.. */ bad_area:mmap_read_unlock (mm); +bad_area_nosemaphore:do_sigsegv (regs, write, address, si_code);return ;
arch/m68k/mm/fault.c +6 -3
@@ -105,8 +105,9 @@ int do_page_fault(struct pt_regs *regs, unsigned long address,if (address +256 <rdusp ()) goto map_err; } -if (expand_stack (vma, address)) - goto map_err; + vma =expand_stack (mm, address); +if (!vma) + goto map_err_nosemaphore;/* * Ok, we have a good vm_area for this memory access, so
@@ -196,10 +197,12 @@ int do_page_fault(struct pt_regs *regs, unsigned long address, goto send_sig; map_err: +mmap_read_unlock (mm); +map_err_nosemaphore: current->thread.signo =SIGSEGV ; current->thread.code =SEGV_MAPERR ; current->thread.faddr = address; - goto send_sig; +return send_fault_sig (regs); acc_err: current->thread.signo =SIGSEGV ;
arch/microblaze/mm/fault.c +3 -2
@@ -192,8 +192,9 @@ void do_page_fault(struct pt_regs *regs, unsigned long address, && (kernel_mode(regs) || !store_updates_sp(regs))) goto bad_area; } -if (expand_stack (vma, address)) - goto bad_area; + vma =expand_stack (mm, address); +if (!vma) + goto bad_area_nosemaphore; good_area: code =SEGV_ACCERR ;
arch/mips/Kconfig +1 -0
@@ -94,6 +94,7 @@ config MIPS select HAVE_VIRT_CPU_ACCOUNTING_GEN if 64BIT || !SMP select IRQ_FORCED_THREADING select ISA if EISA + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_REL if MODULES select MODULES_USE_ELF_RELA if MODULES && 64BIT select PERF_USE_VMALLOC
arch/mips/mm/fault.c +2 -10
@@ -99,21 +99,13 @@ static void __do_page_fault(struct pt_regs *regs, unsigned long write,perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; + goto bad_area_nosemaphore;/* * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: si_code =SEGV_ACCERR ;if (write) {
arch/nios2/Kconfig +1 -0
@@ -16,6 +16,7 @@ config NIOS2 select HAVE_ARCH_TRACEHOOK select HAVE_ARCH_KGDB select IRQ_DOMAIN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select OF select OF_EARLY_FLATTREE
arch/nios2/mm/fault.c +2 -15
@@ -86,27 +86,14 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long cause,perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); -if (!mmap_read_trylock (mm)) { -if (!user_mode (regs) && !search_exception_tables (regs->ea)) - goto bad_area_nosemaphore; retry: -mmap_read_lock (mm); - } - - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; + goto bad_area_nosemaphore;/* * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: code =SEGV_ACCERR ;switch (cause) {
arch/openrisc/mm/fault.c +3 -2
@@ -127,8 +127,9 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long address,if (address +PAGE_SIZE < regs->sp) goto bad_area; } -if (expand_stack (vma, address)) - goto bad_area; + vma =expand_stack (mm, address); +if (!vma) + goto bad_area_nosemaphore;/* * Ok, we have a good vm_area for this memory access, so
arch/parisc/mm/fault.c +11 -12
@@ -288,15 +288,19 @@ void do_page_fault(struct pt_regs *regs, unsigned long code, retry:mmap_read_lock (mm); vma =find_vma_prev (mm, address, &prev_vma); -if (!vma || address < vma->vm_start) - goto check_expansion; +if (!vma || address < vma->vm_start) { +if (!prev_vma || !(prev_vma->vm_flags &VM_GROWSUP )) + goto bad_area; + vma =expand_stack (mm, address); +if (!vma) + goto bad_area_nosemaphore; + } +/* * Ok, we have a good vm_area for this memory access. We still need to * check the access permissions. */ -good_area: -if ((vma->vm_flags & acc_type) != acc_type) goto bad_area;
@@ -347,17 +351,13 @@ void do_page_fault(struct pt_regs *regs, unsigned long code,mmap_read_unlock (mm);return ; -check_expansion: - vma = prev_vma; -if (vma && (expand_stack (vma, address) ==0 )) - goto good_area; -/* * Something tried to access memory that isn't in our memory map.. */ bad_area:mmap_read_unlock (mm); +bad_area_nosemaphore:if (user_mode (regs)) {int signo, si_code;
@@ -449,7 +449,7 @@ handle_nadtlb_fault(struct pt_regs *regs) {unsigned long insn = regs->iir;int breg, treg, xreg, val =0 ; -struct vm_area_struct *vma, *prev_vma; +struct vm_area_struct *vma;struct task_struct *tsk;struct mm_struct *mm;unsigned long address;
@@ -485,7 +485,7 @@ handle_nadtlb_fault(struct pt_regs *regs)/* Search for VMA */ address = regs->ior;mmap_read_lock (mm); - vma =find_vma_prev (mm, address, &prev_vma); + vma =vma_lookup (mm, address);mmap_read_unlock (mm);/*
@@ -494,7 +494,6 @@ handle_nadtlb_fault(struct pt_regs *regs)*/ acc_type = (insn &0x40 ) ?VM_WRITE :VM_READ ;if (vma - && address >= vma->vm_start && (vma->vm_flags & acc_type) == acc_type) val =1 ; }
arch/powerpc/Kconfig +1 -0
@@ -263,6 +263,7 @@ config PPC select IRQ_DOMAIN select IRQ_FORCED_THREADING select KASAN_VMALLOC if KASAN && MODULES + select LOCK_MM_AND_FIND_VMA select MMU_GATHER_PAGE_SIZE select MMU_GATHER_RCU_TABLE_FREE select MMU_GATHER_MERGE_VMAS
arch/powerpc/mm/copro_fault.c +3 -11
@@ -33,19 +33,11 @@ int copro_handle_mm_fault(struct mm_struct *mm, unsigned long ea,if (mm->pgd ==NULL )return -EFAULT ; -mmap_read_lock (mm); - ret = -EFAULT ; - vma =find_vma (mm, ea); + vma =lock_mm_and_find_vma (mm, ea,NULL );if (!vma) - goto out_unlock; - -if (ea < vma->vm_start) { -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto out_unlock; -if (expand_stack (vma, ea)) - goto out_unlock; - } +return -EFAULT ; + ret = -EFAULT ; is_write = dsisr &DSISR_ISSTORE ;if (is_write) {if (!(vma->vm_flags &VM_WRITE ))
arch/powerpc/mm/fault.c +3 -36
@@ -84,11 +84,6 @@ static int __bad_area(struct pt_regs *regs, unsigned long address, int si_code)return __bad_area_nosemaphore (regs, address, si_code); } -static noinline int bad_area(struct pt_regs *regs, unsigned long address) -{ -return __bad_area (regs, address,SEGV_MAPERR ); -} - static noinline int bad_access_pkey(struct pt_regs *regs, unsigned long address,struct vm_area_struct *vma) {
@@ -481,40 +476,12 @@ static int ___do_page_fault(struct pt_regs *regs, unsigned long address,* we will deadlock attempting to validate the fault against the * address space. Luckily the kernel only validly references user * space from well defined areas of code, which are listed in the -* exceptions table. -* -* As the vast majority of faults will be valid we will only perform -* the source reference check when there is a possibility of a deadlock. -* Attempt to lock the address space, if we cannot we then validate the -* source. If this is invalid we can skip the address space check, -* thus avoiding the deadlock. +* exceptions table. lock_mm_and_find_vma() handles that logic. */ -if (unlikely (!mmap_read_trylock (mm))) { -if (!is_user && !search_exception_tables (regs->nip)) -return bad_area_nosemaphore (regs, address); - retry: -mmap_read_lock (mm); - }else { -/* -* The above down_read_trylock() might have succeeded in -* which case we'll have missed the might_sleep() from -* down_read(): -*/ -might_sleep (); - } - - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (unlikely (!vma)) -return bad_area (regs, address); - -if (unlikely (vma->vm_start > address)) { -if (unlikely (!(vma->vm_flags &VM_GROWSDOWN ))) -return bad_area (regs, address); - -if (unlikely (expand_stack (vma, address))) -return bad_area (regs, address); - } +return bad_area_nosemaphore (regs, address);if (unlikely (access_pkey_error (is_write, is_exec, (error_code &DSISR_KEYFAULT ), vma)))
arch/riscv/Kconfig +1 -0
@@ -119,6 +119,7 @@ config RISCV select HAVE_SYSCALL_TRACEPOINTS select IRQ_DOMAIN select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA if MODULES select MODULE_SECTIONS if MODULES select OF
arch/riscv/mm/fault.c +13 -18
@@ -83,13 +83,13 @@ static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_fBUG (); } -static inline void bad_area (struct pt_regs *regs,struct mm_struct *mm,int code,unsigned long addr) +static inline void +bad_area_nosemaphore (struct pt_regs *regs,int code,unsigned long addr) {/* * Something tried to access memory that isn't in our memory map. * Fix it, but check if it's kernel or user first. */ -mmap_read_unlock (mm);/* User mode accesses just cause a SIGSEGV */ if (user_mode (regs)) {do_trap (regs,SIGSEGV , code, addr);
@@ -99,6 +99,15 @@ static inline void bad_area(struct pt_regs *regs, struct mm_struct *mm, int codeno_context (regs, addr); } +static inline void +bad_area (struct pt_regs *regs,struct mm_struct *mm,int code, +unsigned long addr) +{ +mmap_read_unlock (mm); + +bad_area_nosemaphore (regs, code, addr); +} +static inline void vmalloc_fault (struct pt_regs *regs,int code,unsigned long addr) {pgd_t *pgd, *pgd_k;
@@ -286,23 +295,10 @@ asmlinkage void do_page_fault(struct pt_regs *regs)else if (cause ==EXC_INST_PAGE_FAULT ) flags |=FAULT_FLAG_INSTRUCTION ; retry: -mmap_read_lock (mm); - vma =find_vma (mm, addr); + vma =lock_mm_and_find_vma (mm, addr, regs);if (unlikely (!vma)) { tsk->thread.bad_cause = cause; -bad_area (regs, mm, code, addr); -return ; - } -if (likely (vma->vm_start <= addr)) - goto good_area; -if (unlikely (!(vma->vm_flags &VM_GROWSDOWN ))) { - tsk->thread.bad_cause = cause; -bad_area (regs, mm, code, addr); -return ; - } -if (unlikely (expand_stack (vma, addr))) { - tsk->thread.bad_cause = cause; -bad_area (regs, mm, code, addr); +bad_area_nosemaphore (regs, code, addr);return ; }
@@ -310,7 +306,6 @@ asmlinkage void do_page_fault(struct pt_regs *regs)* Ok, we have a good vm_area for this memory access, so * we can handle it. */ -good_area: code =SEGV_ACCERR ;if (unlikely (access_error (cause, vma))) {
arch/s390/mm/fault.c +3 -2
@@ -433,8 +433,9 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)if (unlikely (vma->vm_start > address)) {if (!(vma->vm_flags &VM_GROWSDOWN )) goto out_up; -if (expand_stack (vma, address)) - goto out_up; + vma =expand_stack (mm, address); +if (!vma) + goto out; }/*
arch/sh/Kconfig +1 -0
@@ -56,6 +56,7 @@ config SUPERH select HAVE_STACKPROTECTOR select HAVE_SYSCALL_TRACEPOINTS select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select NEED_SG_DMA_LENGTH select NO_DMA if !MMU && !DMA_COHERENT
arch/sh/mm/fault.c +2 -15
@@ -439,21 +439,9 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, } retry: -mmap_read_lock (mm); - - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (unlikely (!vma)) { -bad_area (regs, error_code, address); -return ; - } -if (likely (vma->vm_start <= address)) - goto good_area; -if (unlikely (!(vma->vm_flags &VM_GROWSDOWN ))) { -bad_area (regs, error_code, address); -return ; - } -if (unlikely (expand_stack (vma, address))) { -bad_area (regs, error_code, address); +bad_area_nosemaphore (regs, error_code, address);return ; }
@@ -461,7 +449,6 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,* Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area:if (unlikely (access_error (error_code, vma))) {bad_area_access_error (regs, error_code, address);return ;
arch/sparc/Kconfig +1 -0
@@ -56,6 +56,7 @@ config SPARC32 select DMA_DIRECT_REMAP select GENERIC_ATOMIC64 select HAVE_UID16 + select LOCK_MM_AND_FIND_VMA select OLD_SIGACTION select ZONE_DMA
arch/sparc/mm/fault_32.c +8 -24
@@ -143,28 +143,19 @@ asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,if (pagefault_disabled () || !mm) goto no_context; +if (!from_user && address >=PAGE_OFFSET ) + goto no_context; +perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - -if (!from_user && address >=PAGE_OFFSET ) - goto bad_area; - - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address, regs);if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; + goto bad_area_nosemaphore;/* * Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: code =SEGV_ACCERR ;if (write) {if (!(vma->vm_flags &VM_WRITE ))
@@ -321,17 +312,9 @@ static void force_user_fault(unsigned long address, int write) code =SEGV_MAPERR ; -mmap_read_lock (mm); - vma =find_vma (mm, address); + vma =lock_mm_and_find_vma (mm, address,NULL );if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; -good_area: + goto bad_area_nosemaphore; code =SEGV_ACCERR ;if (write) {if (!(vma->vm_flags &VM_WRITE ))
@@ -350,6 +333,7 @@ static void force_user_fault(unsigned long address, int write)return ; bad_area:mmap_read_unlock (mm); +bad_area_nosemaphore:__do_fault_siginfo (code,SIGSEGV , tsk->thread.kregs, address);return ;
arch/sparc/mm/fault_64.c +5 -3
@@ -383,8 +383,9 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) goto bad_area; } } -if (expand_stack (vma, address)) - goto bad_area; + vma =expand_stack (mm, address); +if (!vma) + goto bad_area_nosemaphore;/* * Ok, we have a good vm_area for this memory access, so * we can handle it..
@@ -487,8 +488,9 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)* Fix it, but check if it's kernel or user first.. */ bad_area: - insn =get_fault_insn (regs, insn);mmap_read_unlock (mm); +bad_area_nosemaphore: + insn =get_fault_insn (regs, insn); handle_kernel_fault:do_kernel_fault (regs, si_code, fault_code, insn, address);
arch/um/kernel/trap.c +6 -5
@@ -47,14 +47,15 @@ int handle_page_fault(unsigned long address, unsigned long ip, vma =find_vma (mm, address);if (!vma) goto out; -else if (vma->vm_start <= address) +if (vma->vm_start <= address) goto good_area; -else if (!(vma->vm_flags &VM_GROWSDOWN )) +if (!(vma->vm_flags &VM_GROWSDOWN )) goto out; -else if (is_user && !ARCH_IS_STACKGROW (address)) - goto out; -else if (expand_stack (vma, address)) +if (is_user && !ARCH_IS_STACKGROW (address)) goto out; + vma =expand_stack (mm, address); +if (!vma) + goto out_nosemaphore; good_area: *code_out =SEGV_ACCERR ;
arch/x86/Kconfig +1 -0
@@ -274,6 +274,7 @@ config X86 select HAVE_GENERIC_VDSO select HOTPLUG_SMT if SMP select IRQ_FORCED_THREADING + select LOCK_MM_AND_FIND_VMA select NEED_PER_CPU_EMBED_FIRST_CHUNK select NEED_PER_CPU_PAGE_FIRST_CHUNK select NEED_SG_DMA_LENGTH
arch/x86/include/asm/cpu.h +2 -0
@@ -98,4 +98,6 @@ extern u64 x86_read_arch_cap_msr(void);int intel_find_matching_signature (void *mc,unsigned int csig,int cpf);int intel_microcode_sanity_check (void *mc,bool print_err,int hdr_type); +extern struct cpumask cpus_stop_mask; +#endif /* _ASM_X86_CPU_H */
arch/x86/include/asm/smp.h +2 -0
@@ -131,6 +131,8 @@ void wbinvd_on_cpu(int cpu);int wbinvd_on_all_cpus (void );void cond_wakeup_cpu0 (void ); +void smp_kick_mwait_play_dead (void ); +void native_smp_send_reschedule (int cpu);void native_send_call_func_ipi (const struct cpumask *mask);void native_send_call_func_single_ipi (int cpu);
arch/x86/kernel/cpu/microcode/amd.c +1 -1
@@ -705,7 +705,7 @@ static enum ucode_state apply_microcode_amd(int cpu)rdmsr (MSR_AMD64_PATCH_LEVEL , rev, dummy);/* need to apply patch? */ -if (rev >= mc_amd->hdr.patch_id) { +if (rev > mc_amd->hdr.patch_id) { ret =UCODE_OK ; goto out; }
arch/x86/kernel/process.c +24 -4
@@ -752,15 +752,26 @@ bool xen_set_default_idle(void) }#endif +struct cpumask cpus_stop_mask; +void __noreturn stop_this_cpu (void *dummy) { +struct cpuinfo_x86 *c =this_cpu_ptr (&cpu_info); +unsigned int cpu =smp_processor_id (); +local_irq_disable (); +/* -* Remove this CPU: +* Remove this CPU from the online mask and disable it +* unconditionally. This might be redundant in case that the reboot +* vector was handled late and stop_other_cpus() sent an NMI. +* +* According to SDM and APM NMIs can be accepted even after soft +* disabling the local APIC. */ -set_cpu_online (smp_processor_id (), false); +set_cpu_online (cpu, false);disable_local_APIC (); -mcheck_cpu_clear (this_cpu_ptr (&cpu_info)); +mcheck_cpu_clear (c);/* * Use wbinvd on processors that support SME. This provides support
@@ -774,8 +785,17 @@ void __noreturn stop_this_cpu(void *dummy)* Test the CPUID bit directly because the machine might've cleared * X86_FEATURE_SME due to cmdline options. */ -if (cpuid_eax (0x8000001f ) &BIT (0 )) +if (c->extended_cpuid_level >=0x8000001f && (cpuid_eax (0x8000001f ) &BIT (0 )))native_wbinvd (); + +/* +* This brings a cache line back and dirties it, but +* native_stop_other_cpus() will overwrite cpus_stop_mask after it +* observed that all CPUs reported stop. This write will invalidate +* the related cache line on this CPU. +*/ +cpumask_clear_cpu (cpu, &cpus_stop_mask); +for (;;) {/* * Use native_halt() so that memory contents don't change
arch/x86/kernel/smp.c +46 -27
129 lines not on this page · raw message
arch/x86/kernel/smpboot.c +72 -9
128 lines not on this page · raw message
arch/x86/mm/fault.c +2 -50
72 lines not on this page · raw message
arch/xtensa/Kconfig +1 -0
@@ -49,6 +49,7 @@ config XTENSA select HAVE_SYSCALL_TRACEPOINTS select HAVE_VIRT_CPU_ACCOUNTING_GEN select IRQ_DOMAIN + select LOCK_MM_AND_FIND_VMA select MODULES_USE_ELF_RELA select PERF_USE_VMALLOC select TRACE_IRQFLAGS_SUPPORT
arch/xtensa/mm/fault.c +3 -11
@@ -130,23 +130,14 @@ void do_page_fault(struct pt_regs *regs)perf_sw_event (PERF_COUNT_SW_PAGE_FAULTS ,1 , regs, address); retry: -mmap_read_lock (mm); - vma =find_vma (mm, address); - + vma =lock_mm_and_find_vma (mm, address, regs);if (!vma) - goto bad_area; -if (vma->vm_start <= address) - goto good_area; -if (!(vma->vm_flags &VM_GROWSDOWN )) - goto bad_area; -if (expand_stack (vma, address)) - goto bad_area; + goto bad_area_nosemaphore;/* Ok, we have a good vm_area for this memory access, so * we can handle it.. */ -good_area: code =SEGV_ACCERR ;if (is_write) {
@@ -205,6 +196,7 @@ void do_page_fault(struct pt_regs *regs)*/ bad_area:mmap_read_unlock (mm); +bad_area_nosemaphore:if (user_mode (regs)) {force_sig_fault (SIGSEGV , code, (void *) address);return ;
drivers/cpufreq/amd-pstate.c +1 -1
@@ -1272,7 +1272,7 @@ static struct cpufreq_driver amd_pstate_epp_driver = { .online = amd_pstate_epp_cpu_online, .suspend = amd_pstate_epp_suspend, .resume = amd_pstate_epp_resume, - .name = "amd_pstate_epp", + .name = "amd-pstate-epp", .attr = amd_pstate_epp_attr, };
drivers/hid/hid-logitech-hidpp.c +1 -1
@@ -4364,7 +4364,7 @@ static const struct hid_device_id hidpp_devices[] = { {/* wireless touchpad T651 */ HID_BLUETOOTH_DEVICE (USB_VENDOR_ID_LOGITECH , USB_DEVICE_ID_LOGITECH_T651), - .driver_data = HIDPP_QUIRK_CLASS_WTP }, + .driver_data = HIDPP_QUIRK_CLASS_WTP | HIDPP_QUIRK_DELAYED_INIT }, { /* Mouse Logitech Anywhere MX */ LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, { /* Mouse logitech M560 */
drivers/hid/hidraw.c +7 -2
@@ -272,7 +272,12 @@ static int hidraw_open(struct inode *inode, struct file *file) goto out; } -down_read (&minors_rwsem); +/* +* Technically not writing to the hidraw_table but a write lock is +* required to protect the device refcount. This is symmetrical to +* hidraw_release(). +*/ +down_write (&minors_rwsem);if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { err = -ENODEV ; goto out_unlock;
@@ -301,7 +306,7 @@ static int hidraw_open(struct inode *inode, struct file *file)spin_unlock_irqrestore (&hidraw_table[minor]->list_lock, flags); file->private_data = list; out_unlock: -up_read (&minors_rwsem); +up_write (&minors_rwsem); out:if (err <0 )kfree (list);
drivers/hid/wacom_wac.c +3 -3
@@ -1309,7 +1309,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)struct input_dev *pen_input = wacom->pen_input;unsigned char *data = wacom->data;int number_of_valid_frames =0 ; -int time_interval =15000000 ; +ktime_t time_interval =15000000 ;ktime_t time_packet_received =ktime_get ();int i;
@@ -1343,7 +1343,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)if (number_of_valid_frames) {if (wacom->hid_data.time_delayed) time_interval =ktime_get () - wacom->hid_data.time_delayed; - time_interval /= number_of_valid_frames; + time_interval =div_u64 (time_interval, number_of_valid_frames); wacom->hid_data.time_delayed = time_packet_received; }
@@ -1354,7 +1354,7 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)bool range = frame[0 ] &0x20 ;bool invert = frame[0 ] &0x10 ;int frames_number_reversed = number_of_valid_frames - i -1 ; -int event_timestamp = time_packet_received - frames_number_reversed * time_interval; +ktime_t event_timestamp = time_packet_received - frames_number_reversed * time_interval;if (!valid)continue ;
drivers/hid/wacom_wac.h +1 -1
@@ -324,7 +324,7 @@ struct hid_data {int ps_connected;bool pad_input_event_flag;unsigned short sequence_number; -int time_delayed; +ktime_t time_delayed; };struct wacom_remote_data {
drivers/iommu/amd/iommu_v2.c +2 -2
@@ -485,8 +485,8 @@ static void do_fault(struct work_struct *work) flags |=FAULT_FLAG_REMOTE ;mmap_read_lock (mm); - vma =find_extend_vma (mm, address); -if (!vma || address < vma->vm_start) + vma =vma_lookup (mm, address); +if (!vma)/* failed to get a vma in the right range */ goto out;
drivers/iommu/iommu-sva.c +1 -1
@@ -203,7 +203,7 @@ iommu_sva_handle_iopf(struct iommu_fault *fault, void *data)mmap_read_lock (mm); - vma =find_extend_vma (mm, prm->addr); + vma =vma_lookup (mm, prm->addr);if (!vma)/* Unmapped area */ goto out_put_mm;
drivers/thermal/mediatek/auxadc_thermal.c +2 -12
@@ -1142,12 +1142,7 @@ static int mtk_thermal_probe(struct platform_device *pdev)return -ENODEV ; } - auxadc_base =devm_of_iomap (&pdev->dev, auxadc,0 ,NULL ); -if (IS_ERR (auxadc_base)) { -of_node_put (auxadc); -return PTR_ERR (auxadc_base); - } - + auxadc_base =of_iomap (auxadc,0 ); auxadc_phys_base =of_get_phys_base (auxadc);of_node_put (auxadc);
@@ -1163,12 +1158,7 @@ static int mtk_thermal_probe(struct platform_device *pdev)return -ENODEV ; } - apmixed_base =devm_of_iomap (&pdev->dev, apmixedsys,0 ,NULL ); -if (IS_ERR (apmixed_base)) { -of_node_put (apmixedsys); -return PTR_ERR (apmixed_base); - } - + apmixed_base =of_iomap (apmixedsys,0 ); apmixed_phys_base =of_get_phys_base (apmixedsys);of_node_put (apmixedsys);
drivers/video/fbdev/core/sysimgblt.c +1 -1
@@ -189,7 +189,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;u32 ppw =32 /bpp, spitch = (image->width +7 )/8 ;u32 bit_mask, eorx, shift; -const char *s = image->data, *src; +const u8 *s = image->data, *src;u32 *dst;const u32 *tab;size_t tablen;
fs/binfmt_elf.c +3 -3
@@ -320,10 +320,10 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,* Grow the stack manually; some architectures have a limit on how * far ahead a user-space access may be in order to grow the stack. */ -if (mmap_read_lock_killable (mm)) +if (mmap_write_lock_killable (mm))return -EINTR ; - vma =find_extend_vma (mm, bprm->p); -mmap_read_unlock (mm); + vma =find_extend_vma_locked (mm, bprm->p); +mmap_write_unlock (mm);if (!vma)return -EFAULT ;
fs/exec.c +22 -16
@@ -199,33 +199,39 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, int write) {struct page *page; +struct vm_area_struct *vma = bprm->vma; +struct mm_struct *mm = bprm->mm;int ret; -unsigned int gup_flags =0 ; -#ifdef CONFIG_STACK_GROWSUP -if (write) { - ret =expand_downwards (bprm->vma, pos); -if (ret <0 ) +/* +* Avoid relying on expanding the stack down in GUP (which +* does not work for STACK_GROWSUP anyway), and just do it +* by hand ahead of time. +*/ +if (write && pos < vma->vm_start) { +mmap_write_lock (mm); + ret =expand_downwards (vma, pos); +if (unlikely (ret <0 )) { +mmap_write_unlock (mm);return NULL ; - } -#endif - -if (write) - gup_flags |=FOLL_WRITE ; + } +mmap_write_downgrade (mm); + }else +mmap_read_lock (mm);/* * We are doing an exec(). 'current' is the process -* doing the exec and bprm->mm is the new process's mm. +* doing the exec and 'mm' is the new process's mm. */ -mmap_read_lock (bprm->mm); - ret =get_user_pages_remote (bprm->mm, pos,1 , gup_flags, + ret =get_user_pages_remote (mm, pos,1 , + write ?FOLL_WRITE :0 , &page,NULL ,NULL ); -mmap_read_unlock (bprm->mm); +mmap_read_unlock (mm);if (ret <=0 )return NULL ;if (write) -acct_arg_size (bprm,vma_pages (bprm->vma)); +acct_arg_size (bprm,vma_pages (vma));return page; }
@@ -852,7 +858,7 @@ int setup_arg_pages(struct linux_binprm *bprm, stack_base = vma->vm_end - stack_expand;#endif current->mm->start_stack = bprm->p; - ret =expand_stack (vma, stack_base); + ret =expand_stack_locked (vma, stack_base);if (ret) ret = -EFAULT ;
include/linux/mm.h +8 -9
@@ -2179,6 +2179,9 @@ void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to);void truncate_pagecache_range (struct inode *inode,loff_t offset,loff_t end);int generic_error_remove_page (struct address_space *mapping,struct page *page); +struct vm_area_struct *lock_mm_and_find_vma (struct mm_struct *mm, +unsigned long address,struct pt_regs *regs); +#ifdef CONFIG_MMU extern vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address, unsigned int flags,
@@ -3063,16 +3066,11 @@ extern vm_fault_t filemap_page_mkwrite(struct vm_fault *vmf);extern unsigned long stack_guard_gap;/* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */ -extern int expand_stack (struct vm_area_struct *vma,unsigned long address); +int expand_stack_locked (struct vm_area_struct *vma,unsigned long address); +struct vm_area_struct *expand_stack (struct mm_struct * mm,unsigned long addr);/* CONFIG_STACK_GROWSUP still needs to grow downwards at some places */ -extern int expand_downwards (struct vm_area_struct *vma, -unsigned long address); -#if VM_GROWSUP -extern int expand_upwards (struct vm_area_struct *vma,unsigned long address); -#else -#define expand_upwards (vma, address) (0) -#endif +int expand_downwards (struct vm_area_struct *vma,unsigned long address);/* Look up the first VMA which satisfies addr < vm_end, NULL if none. */ extern struct vm_area_struct *find_vma (struct mm_struct * mm,unsigned long addr);
@@ -3167,7 +3165,8 @@ unsigned long change_prot_numa(struct vm_area_struct *vma, unsigned long start, unsigned long end);#endif -struct vm_area_struct *find_extend_vma (struct mm_struct *,unsigned long addr); +struct vm_area_struct *find_extend_vma_locked (struct mm_struct *, +unsigned long addr);int remap_pfn_range (struct vm_area_struct *,unsigned long addr,unsigned long pfn,unsigned long size,pgprot_t ); int remap_pfn_range_notrack(struct vm_area_struct *vma, unsigned long addr,
lib/maple_tree.c +6 -5
@@ -4287,11 +4287,13 @@ static inline bool mas_wr_slot_store(struct ma_wr_state *wr_mas)static inline void mas_wr_end_piv (struct ma_wr_state *wr_mas) { -while ((wr_mas->mas->last > wr_mas->end_piv) && - (wr_mas->offset_end < wr_mas->node_end)) - wr_mas->end_piv = wr_mas->pivots[++wr_mas->offset_end]; +while ((wr_mas->offset_end < wr_mas->node_end) && + (wr_mas->mas->last > wr_mas->pivots[wr_mas->offset_end])) + wr_mas->offset_end++; -if (wr_mas->mas->last > wr_mas->end_piv) +if (wr_mas->offset_end < wr_mas->node_end) + wr_mas->end_piv = wr_mas->pivots[wr_mas->offset_end]; +else wr_mas->end_piv = wr_mas->mas->max; }
@@ -4448,7 +4450,6 @@ static inline void *mas_wr_store_entry(struct ma_wr_state *wr_mas) }/* At this point, we are at the leaf node that needs to be altered. */ - wr_mas->end_piv = wr_mas->r_max;mas_wr_end_piv (wr_mas);if (!wr_mas->entry)
mm/Kconfig +4 -0
@@ -1202,6 +1202,10 @@ config LRU_GEN_STATS This option has a per-memcg and per-node memory overhead. # } +config LOCK_MM_AND_FIND_VMA + bool + depends on !STACK_GROWSUP + source "mm/damon/Kconfig" endmenu
mm/gup.c +11 -3
@@ -1096,7 +1096,11 @@ static long __get_user_pages(struct mm_struct *mm,/* first iteration or cross vma bound */ if (!vma || start >= vma->vm_end) { - vma =find_extend_vma (mm, start); + vma =find_vma (mm, start); +if (vma && (start < vma->vm_start)) { +WARN_ON_ONCE (vma->vm_flags &VM_GROWSDOWN ); + vma =NULL ; + }if (!vma &&in_gate_area (mm, start)) { ret = get_gate_page(mm, start & PAGE_MASK, gup_flags, &vma,
@@ -1265,9 +1269,13 @@ int fixup_user_fault(struct mm_struct *mm, fault_flags |=FAULT_FLAG_ALLOW_RETRY |FAULT_FLAG_KILLABLE ; retry: - vma =find_extend_vma (mm, address); -if (!vma || address < vma->vm_start) + vma =find_vma (mm, address); +if (!vma) +return -EFAULT ; +if (address < vma->vm_start ) { +WARN_ON_ONCE (vma->vm_flags &VM_GROWSDOWN );return -EFAULT ; + }if (!vma_permits_fault (vma, fault_flags))return -EFAULT ;
mm/memory.c +127 -0
139 lines not on this page · raw message
mm/mmap.c +118 -35
250 lines not on this page · raw message
mm/nommu.c +13 -5
@@ -631,23 +631,31 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)EXPORT_SYMBOL (find_vma);/* -* find a VMA -* - we don't extend stack VMAs under NOMMU conditions +* At least xtensa ends up having protection faults even with no +* MMU.. No stack expansion, at least. */ -struct vm_area_struct *find_extend_vma (struct mm_struct *mm,unsigned long addr) +struct vm_area_struct *lock_mm_and_find_vma (struct mm_struct *mm, +unsigned long addr,struct pt_regs *regs) { -return find_vma (mm, addr); +mmap_read_lock (mm); +return vma_lookup (mm, addr); }/* * expand a stack to a given address * - not supported under NOMMU conditions */ -int expand_stack (struct vm_area_struct *vma,unsigned long address) +int expand_stack_locked (struct vm_area_struct *vma,unsigned long addr) {return -ENOMEM ; } +struct vm_area_struct *expand_stack (struct mm_struct *mm,unsigned long addr) +{ +mmap_read_unlock (mm); +return NULL ; +} +/* * look up the first VMA exactly that exactly matches addr * - should be called with mm->mmap_lock at least held readlocked
net/can/isotp.c +3 -2
@@ -1079,8 +1079,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)if (err) goto err_event_drop; -if (sk->sk_err) -return -sk->sk_err; + err =sock_error (sk); +if (err) +return err; }return size;