Commit 76b6905c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2025-03-17-20-09' of... 

Merge tag 'mm-hotfixes-stable-2025-03-17-20-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc hotfixes from Andrew Morton:
 "15 hotfixes. 7 are cc:stable and the remainder address post-6.13
  issues or aren't considered necessary for -stable kernels.

  13 are for MM and the other two are for squashfs and procfs.

  All are singletons. Please see the individual changelogs for details"

* tag 'mm-hotfixes-stable-2025-03-17-20-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/page_alloc: fix memory accept before watermarks gets initialized
  mm: decline to manipulate the refcount on a slab page
  memcg: drain obj stock on cpu hotplug teardown
  mm/huge_memory: drop beyond-EOF folios with the right number of refs
  selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation
  mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT
  mm: memcontrol: fix swap counter leak from offline cgroup
  mm/vma: do not register private-anon mappings with khugepaged during mmap
  squashfs: fix invalid pointer dereference in squashfs_cache_delete
  mm/migrate: fix shmem xarray update during migration
  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
  mm/damon/core: initialize damos->walk_completed in damon_new_scheme()
  mm/damon: respect core layer filters' allowance decision on ops layer
  filemap: move prefaulting out of hot write path
  proc: fix UAF in proc_get_inode()
parents 9130945f 800f1059

fs/proc/generic.c

+9 −1
Original line number Diff line number Diff line
@@ -559,10 +559,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, 
	return p;

}



static inline void pde_set_flags(struct proc_dir_entry *pde)

static void pde_set_flags(struct proc_dir_entry *pde)

{

	if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)

		pde->flags |= PROC_ENTRY_PERMANENT;

	if (pde->proc_ops->proc_read_iter)

		pde->flags |= PROC_ENTRY_proc_read_iter;

#ifdef CONFIG_COMPAT

	if (pde->proc_ops->proc_compat_ioctl)

		pde->flags |= PROC_ENTRY_proc_compat_ioctl;

#endif

}



struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
@@ -626,6 +632,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, 
	p->proc_ops = &proc_seq_ops;

	p->seq_ops = ops;

	p->state_size = state_size;

	pde_set_flags(p);

	return proc_register(parent, p);

}

EXPORT_SYMBOL(proc_create_seq_private);
@@ -656,6 +663,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, 
		return NULL;

	p->proc_ops = &proc_single_ops;

	p->single_show = show;

	pde_set_flags(p);

	return proc_register(parent, p);

}

EXPORT_SYMBOL(proc_create_single_data);

fs/proc/inode.c

+3 −3
Original line number Diff line number Diff line
@@ -656,13 +656,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) 


	if (S_ISREG(inode->i_mode)) {

		inode->i_op = de->proc_iops;

		if (de->proc_ops->proc_read_iter)

		if (pde_has_proc_read_iter(de))

			inode->i_fop = &proc_iter_file_ops;

		else

			inode->i_fop = &proc_reg_file_ops;

#ifdef CONFIG_COMPAT

		if (de->proc_ops->proc_compat_ioctl) {

			if (de->proc_ops->proc_read_iter)

		if (pde_has_proc_compat_ioctl(de)) {

			if (pde_has_proc_read_iter(de))

				inode->i_fop = &proc_iter_file_ops_compat;

			else

				inode->i_fop = &proc_reg_file_ops_compat;

fs/proc/internal.h

+14 −0
Original line number Diff line number Diff line
@@ -85,6 +85,20 @@ static inline void pde_make_permanent(struct proc_dir_entry *pde) 
	pde->flags |= PROC_ENTRY_PERMANENT;

}



static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde)

{

	return pde->flags & PROC_ENTRY_proc_read_iter;

}



static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde)

{

#ifdef CONFIG_COMPAT

	return pde->flags & PROC_ENTRY_proc_compat_ioctl;

#else

	return false;

#endif

}



extern struct kmem_cache *proc_dir_entry_cache;

void pde_free(struct proc_dir_entry *pde);

fs/squashfs/cache.c

+1 −1
Original line number Diff line number Diff line
@@ -198,7 +198,7 @@ void squashfs_cache_delete(struct squashfs_cache *cache) 
{

	int i, j;



	if (cache == NULL)

	if (IS_ERR(cache) || cache == NULL)

		return;



	for (i = 0; i < cache->entries; i++) {

include/linux/damon.h

+5 −0
Original line number Diff line number Diff line
@@ -470,6 +470,11 @@ struct damos { 
	unsigned long next_apply_sis;

	/* informs if ongoing DAMOS walk for this scheme is finished */

	bool walk_completed;

	/*

	 * If the current region in the filtering stage is allowed by core

	 * layer-handled filters.  If true, operations layer allows it, too.

	 */

	bool core_filters_allowed;

/* public: */

	struct damos_quota quota;

	struct damos_watermarks wmarks;