Commit 537d1961 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2025-11-10-19-30' of... 

Merge tag 'mm-hotfixes-stable-2025-11-10-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "26 hotfixes.  22(!) are cc:stable, 22 are MM.

   - address some Kexec Handover issues (Pasha Tatashin)

   - fix handling of large folios which are mapped outside i_size (Kiryl
     Shutsemau)

   - fix some DAMON time issues on 32-bit machines (Quanmin Yan)

  Plus the usual shower of singletons"

* tag 'mm-hotfixes-stable-2025-11-10-19-30' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (26 commits)
  kho: warn and exit when unpreserved page wasn't preserved
  kho: fix unpreservation of higher-order vmalloc preservations
  kho: fix out-of-bounds access of vmalloc chunk
  MAINTAINERS: add Chris and Kairui as the swap maintainer
  mm/secretmem: fix use-after-free race in fault handler
  mm/huge_memory: initialise the tags of the huge zero folio
  nilfs2: avoid having an active sc_timer before freeing sci
  scripts/decode_stacktrace.sh: fix build ID and PC source parsing
  mm/damon/sysfs: change next_update_jiffies to a global variable
  mm/damon/stat: change last_refresh_jiffies to a global variable
  maple_tree: fix tracepoint string pointers
  codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext
  mm/mremap: honour writable bit in mremap pte batching
  gcov: add support for GCC 15
  mm/mm_init: fix hash table order logging in alloc_large_system_hash()
  mm/truncate: unmap large folio on split failure
  mm/memory: do not populate page table entries beyond i_size
  fs/proc: fix uaf in proc_readdir_de()
  mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order
  ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
  ...
parents 4427259c b05addf6

MAINTAINERS

+2 −2
Original line number Diff line number Diff line
@@ -16498,12 +16498,12 @@ F: mm/secretmem.c 








MEMORY MANAGEMENT - SWAP









M:	Andrew Morton <akpm@linux-foundation.org>









M:	Chris Li <chrisl@kernel.org>









M:	Kairui Song <kasong@tencent.com>









R:	Kemeng Shi <shikemeng@huaweicloud.com>









R:	Kairui Song <kasong@tencent.com>









R:	Nhat Pham <nphamcs@gmail.com>









R:	Baoquan He <bhe@redhat.com>









R:	Barry Song <baohua@kernel.org>









R:	Chris Li <chrisl@kernel.org>









L:	linux-mm@kvack.org









S:	Maintained









F:	Documentation/mm/swap-table.rst
































arch/arm64/kernel/mte.c



+2
−1






























Original line number
Diff line number
Diff line







@@ -476,7 +476,8 @@ static int __access_remote_tags(struct mm_struct *mm, unsigned long addr,

















		folio = page_folio(page);









		if (folio_test_hugetlb(folio))









			WARN_ON_ONCE(!folio_test_hugetlb_mte_tagged(folio));









			WARN_ON_ONCE(!folio_test_hugetlb_mte_tagged(folio) &&









				     !is_huge_zero_folio(folio));









		else









			WARN_ON_ONCE(!page_mte_tagged(page) && !is_zero_page(page));










































arch/arm64/mm/fault.c



+10
−0






























Original line number
Diff line number
Diff line







@@ -969,6 +969,16 @@ struct folio *vma_alloc_zeroed_movable_folio(struct vm_area_struct *vma,

















void tag_clear_highpage(struct page *page)









{









	/*









	 * Check if MTE is supported and fall back to clear_highpage().









	 * get_huge_zero_folio() unconditionally passes __GFP_ZEROTAGS and









	 * post_alloc_hook() will invoke tag_clear_highpage().









	 */









	if (!system_supports_mte()) {









		clear_highpage(page);









		return;









	}



















	/* Newly allocated page, shouldn't have been tagged yet */









	WARN_ON_ONCE(!try_page_mte_tagging(page));









	mte_zero_clear_page_tags(page_address(page));
































fs/nilfs2/segment.c



+6
−1






























Original line number
Diff line number
Diff line







@@ -2768,7 +2768,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)

















	if (sci->sc_task) {









		wake_up(&sci->sc_wait_daemon);









		kthread_stop(sci->sc_task);









		if (kthread_stop(sci->sc_task)) {









			spin_lock(&sci->sc_state_lock);









			sci->sc_task = NULL;









			timer_shutdown_sync(&sci->sc_timer);









			spin_unlock(&sci->sc_state_lock);









		}









	}



















	spin_lock(&sci->sc_state_lock);
































fs/proc/generic.c



+9
−3






























Original line number
Diff line number
Diff line







@@ -698,6 +698,12 @@ void pde_put(struct proc_dir_entry *pde)







	}









}



















static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent)









{









	rb_erase(&pde->subdir_node, &parent->subdir);









	RB_CLEAR_NODE(&pde->subdir_node);









}



















/*









 * Remove a /proc entry and free it if it's not currently in use.









 */








@@ -720,7 +726,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent)







			WARN(1, "removing permanent /proc entry '%s'", de->name);









			de = NULL;









		} else {









			rb_erase(&de->subdir_node, &parent->subdir);









			pde_erase(de, parent);









			if (S_ISDIR(de->mode))









				parent->nlink--;









		}








@@ -764,7 +770,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)







			root->parent->name, root->name);









		return -EINVAL;









	}









	rb_erase(&root->subdir_node, &parent->subdir);









	pde_erase(root, parent);



















	de = root;









	while (1) {








@@ -776,7 +782,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent)







					next->parent->name, next->name);









				return -EINVAL;









			}









			rb_erase(&next->subdir_node, &de->subdir);









			pde_erase(next, de);









			de = next;









			continue;









		}