Commit 971370a8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2025-10-10-15-00' of... 

Merge tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "7 hotfixes.  All 7 are cc:stable and all 7 are for MM.

  All singletons, please see the changelogs for details"

* tag 'mm-hotfixes-stable-2025-10-10-15-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm: hugetlb: avoid soft lockup when mprotect to large memory area
  fsnotify: pass correct offset to fsnotify_mmap_perm()
  mm/ksm: fix flag-dropping behavior in ksm_madvise
  mm/damon/vaddr: do not repeat pte_offset_map_lock() until success
  mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage
  mm/thp: fix MTE tag mismatch when replacing zero-filled subpages
  memcg: skip cgroup_file_notify if spinning is not allowed
parents 07394736 f52ce0ea

include/linux/memcontrol.h

+19 −7
Original line number Diff line number Diff line
@@ -1001,22 +1001,28 @@ static inline void count_memcg_event_mm(struct mm_struct *mm, 
	count_memcg_events_mm(mm, idx, 1);

}



static inline void memcg_memory_event(struct mem_cgroup *memcg,

				      enum memcg_memory_event event)

static inline void __memcg_memory_event(struct mem_cgroup *memcg,

					enum memcg_memory_event event,

					bool allow_spinning)

{

	bool swap_event = event == MEMCG_SWAP_HIGH || event == MEMCG_SWAP_MAX ||

			  event == MEMCG_SWAP_FAIL;



	/* For now only MEMCG_MAX can happen with !allow_spinning context. */

	VM_WARN_ON_ONCE(!allow_spinning && event != MEMCG_MAX);



	atomic_long_inc(&memcg->memory_events_local[event]);

	if (!swap_event)

	if (!swap_event && allow_spinning)

		cgroup_file_notify(&memcg->events_local_file);



	do {

		atomic_long_inc(&memcg->memory_events[event]);

		if (allow_spinning) {

			if (swap_event)

				cgroup_file_notify(&memcg->swap_events_file);

			else

				cgroup_file_notify(&memcg->events_file);

		}



		if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))

			break;
@@ -1026,6 +1032,12 @@ static inline void memcg_memory_event(struct mem_cgroup *memcg, 
		 !mem_cgroup_is_root(memcg));

}



static inline void memcg_memory_event(struct mem_cgroup *memcg,

				      enum memcg_memory_event event)

{

	__memcg_memory_event(memcg, event, true);

}



static inline void memcg_memory_event_mm(struct mm_struct *mm,

					 enum memcg_memory_event event)

{

include/linux/mm.h

+1 −1
Original line number Diff line number Diff line
@@ -323,7 +323,7 @@ extern unsigned int kobjsize(const void *objp); 
#define VM_MIXEDMAP	0x10000000	/* Can contain "struct page" and pure PFN pages */

#define VM_HUGEPAGE	0x20000000	/* MADV_HUGEPAGE marked this vma */

#define VM_NOHUGEPAGE	0x40000000	/* MADV_NOHUGEPAGE marked this vma */

#define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */

#define VM_MERGEABLE	BIT(31)		/* KSM may merge identical pages */



#ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS

#define VM_HIGH_ARCH_BIT_0	32	/* bit only usable on 64-bit architectures */

mm/damon/vaddr.c

+2 −6
Original line number Diff line number Diff line
@@ -328,10 +328,8 @@ static int damon_mkold_pmd_entry(pmd_t *pmd, unsigned long addr, 
	}



	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);

	if (!pte) {

		walk->action = ACTION_AGAIN;

	if (!pte)

		return 0;

	}

	if (!pte_present(ptep_get(pte)))

		goto out;

	damon_ptep_mkold(pte, walk->vma, addr);
@@ -481,10 +479,8 @@ static int damon_young_pmd_entry(pmd_t *pmd, unsigned long addr, 
#endif	/* CONFIG_TRANSPARENT_HUGEPAGE */



	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);

	if (!pte) {

		walk->action = ACTION_AGAIN;

	if (!pte)

		return 0;

	}

	ptent = ptep_get(pte);

	if (!pte_present(ptent))

		goto out;

mm/huge_memory.c

+3 −12
Original line number Diff line number Diff line
@@ -4104,33 +4104,24 @@ static unsigned long deferred_split_count(struct shrinker *shrink, 
static bool thp_underused(struct folio *folio)

{

	int num_zero_pages = 0, num_filled_pages = 0;

	void *kaddr;

	int i;



	if (khugepaged_max_ptes_none == HPAGE_PMD_NR - 1)

		return false;



	for (i = 0; i < folio_nr_pages(folio); i++) {

		kaddr = kmap_local_folio(folio, i * PAGE_SIZE);

		if (!memchr_inv(kaddr, 0, PAGE_SIZE)) {

			num_zero_pages++;

			if (num_zero_pages > khugepaged_max_ptes_none) {

				kunmap_local(kaddr);

		if (pages_identical(folio_page(folio, i), ZERO_PAGE(0))) {

			if (++num_zero_pages > khugepaged_max_ptes_none)

				return true;

			}

		} else {

			/*

			 * Another path for early exit once the number

			 * of non-zero filled pages exceeds threshold.

			 */

			num_filled_pages++;

			if (num_filled_pages >= HPAGE_PMD_NR - khugepaged_max_ptes_none) {

				kunmap_local(kaddr);

			if (++num_filled_pages >= HPAGE_PMD_NR - khugepaged_max_ptes_none)

				return false;

		}

	}

		kunmap_local(kaddr);

	}

	return false;

}

mm/hugetlb.c

+2 −0
Original line number Diff line number Diff line
@@ -7222,6 +7222,8 @@ long hugetlb_change_protection(struct vm_area_struct *vma, 
						psize);

		}

		spin_unlock(ptl);



		cond_resched();

	}

	/*

	 * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare