Commit 66d64899 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2026-04-06-15-27' of... 

Merge tag 'mm-hotfixes-stable-2026-04-06-15-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "Eight hotfixes.  All are cc:stable and seven are for MM.

  All are singletons - please see the changelogs for details"

* tag 'mm-hotfixes-stable-2026-04-06-15-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
  mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
  mm/vma: fix memory leak in __mmap_region()
  mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug
  mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails
  mm: reinstate unconditional writeback start in balance_dirty_pages()
  liveupdate: propagate file deserialization failures
  mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()
parents bfe62a45 7bc5da48

fs/ocfs2/inode.c

+10 −0
Original line number Diff line number Diff line
@@ -1505,6 +1505,16 @@ int ocfs2_validate_inode_block(struct super_block *sb, 
			goto bail;

		}



		if (le16_to_cpu(data->id_count) >

		    ocfs2_max_inline_data_with_xattr(sb, di)) {

			rc = ocfs2_error(sb,

					 "Invalid dinode #%llu: inline data id_count %u exceeds max %d\n",

					 (unsigned long long)bh->b_blocknr,

					 le16_to_cpu(data->id_count),

					 ocfs2_max_inline_data_with_xattr(sb, di));

			goto bail;

		}



		if (le64_to_cpu(di->i_size) > le16_to_cpu(data->id_count)) {

			rc = ocfs2_error(sb,

					 "Invalid dinode #%llu: inline data i_size %llu exceeds id_count %u\n",

kernel/liveupdate/luo_session.c

+7 −2
Original line number Diff line number Diff line
@@ -558,9 +558,14 @@ int luo_session_deserialize(void) 
		}



		scoped_guard(mutex, &session->mutex) {

			luo_file_deserialize(&session->file_set,

			err = luo_file_deserialize(&session->file_set,

						   &sh->ser[i].file_set_ser);

		}

		if (err) {

			pr_warn("Failed to deserialize files for session [%s] %pe\n",

				session->name, ERR_PTR(err));

			return err;

		}

	}



	kho_restore_free(sh->header_ser);

mm/damon/stat.c

+7 −0
Original line number Diff line number Diff line
@@ -245,6 +245,12 @@ static int damon_stat_start(void) 
{

	int err;



	if (damon_stat_context) {

		if (damon_is_running(damon_stat_context))

			return -EAGAIN;

		damon_destroy_ctx(damon_stat_context);

	}



	damon_stat_context = damon_stat_build_ctx();

	if (!damon_stat_context)

		return -ENOMEM;
@@ -261,6 +267,7 @@ static void damon_stat_stop(void) 
{

	damon_stop(&damon_stat_context, 1);

	damon_destroy_ctx(damon_stat_context);

	damon_stat_context = NULL;

}



static int damon_stat_enabled_store(

mm/damon/sysfs.c

+2 −1
Original line number Diff line number Diff line
@@ -1670,7 +1670,8 @@ static int damon_sysfs_turn_damon_on(struct damon_sysfs_kdamond *kdamond) 
	repeat_call_control->data = kdamond;

	repeat_call_control->repeat = true;

	repeat_call_control->dealloc_on_cancel = true;

	damon_call(ctx, repeat_call_control);

	if (damon_call(ctx, repeat_call_control))

		kfree(repeat_call_control);

	return err;

}

mm/filemap.c

+8 −3
Original line number Diff line number Diff line
@@ -3883,14 +3883,19 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf, 
	unsigned int nr_pages = 0, folio_type;

	unsigned short mmap_miss = 0, mmap_miss_saved;



	/*

	 * Recalculate end_pgoff based on file_end before calling

	 * next_uptodate_folio() to avoid races with concurrent

	 * truncation.

	 */

	file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;

	end_pgoff = min(end_pgoff, file_end);



	rcu_read_lock();

	folio = next_uptodate_folio(&xas, mapping, end_pgoff);

	if (!folio)

		goto out;



	file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;

	end_pgoff = min(end_pgoff, file_end);



	/*

	 * Do not allow to map with PMD across i_size to preserve

	 * SIGBUS semantics.