Commit d60ec36c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'mm-hotfixes-stable-2026-05-25-16-22' of... 

Merge tag 'mm-hotfixes-stable-2026-05-25-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "13 hotfixes. 9 are for MM. 9 are cc:stable and the remaining 4 address
  post-7.1 issues or aren't considered suitable for backporting.

  All patches are singletons - please see the individual changelogs for
  details"

* tag 'mm-hotfixes-stable-2026-05-25-16-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  Revert "mm: introduce a new page type for page pool in page type"
  mm/vmalloc: do not trigger BUG() on BH disabled context
  MAINTAINERS, mailmap: change email for Eugen Hristev
  mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page
  kernel/fork: validate exit_signal in kernel_clone()
  mm: memcontrol: propagate NMI slab stats to memcg vmstats
  mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()
  mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one
  zram: fix use-after-free in zram_writeback_endio
  memfd: deny writeable mappings when implying SEAL_WRITE
  ipc: limit next_id allocation to the valid ID range
  Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"
  MAINTAINERS: .mailmap: update after GEHC spin-off
parents e8c2f9fd 54cf41c9

.mailmap

+4 −2
Original line number Diff line number Diff line
@@ -263,8 +263,9 @@ Enric Balletbo i Serra <eballetbo@kernel.org> <enric.balletbo@collabora.com> 
Enric Balletbo i Serra <eballetbo@kernel.org> <eballetbo@iseebcn.com>

Erik Kaneda <erik.kaneda@intel.com> <erik.schmauss@intel.com>

Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>

Eugen Hristev <eugen.hristev@linaro.org> <eugen.hristev@microchip.com>

Eugen Hristev <eugen.hristev@linaro.org> <eugen.hristev@collabora.com>

Eugen Hristev <ehristev@kernel.org> <eugen.hristev@microchip.com>

Eugen Hristev <ehristev@kernel.org> <eugen.hristev@linaro.org>

Eugen Hristev <ehristev@kernel.org> <eugen.hristev@collabora.com>

Evgeniy Polyakov <johnpol@2ka.mipt.ru>

Ezequiel Garcia <ezequiel@vanguardiasur.com.ar> <ezequiel@collabora.com>

Faith Ekstrand <faith.ekstrand@collabora.com> <jason@jlekstrand.net>
@@ -339,6 +340,7 @@ Henrik Rydberg <rydberg@bitmath.org> 
Herbert Xu <herbert@gondor.apana.org.au>

Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>

Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>

Ian Ray <ian.ray@gehealthcare.com> <ian.ray@ge.com>

Ignat Korchagin <ignat@linux.win> <ignat@cloudflare.com>

Igor Korotin <igor.korotin@linux.dev> <igor.korotin.linux@gmail.com>

Ike Panhc <ikepanhc@gmail.com> <ike.pan@canonical.com>

MAINTAINERS

+7 −7
Original line number Diff line number Diff line
@@ -10835,7 +10835,7 @@ F: include/linux/generic-radix-tree.h 
F:	lib/generic-radix-tree.c









GENERIC RESISTIVE TOUCHSCREEN ADC DRIVER









M:	Eugen Hristev <eugen.hristev@microchip.com>









M:	Eugen Hristev <ehristev@kernel.org>









L:	linux-input@vger.kernel.org









S:	Maintained









F:	drivers/input/touchscreen/resistive-adc-touch.c








@@ -16506,7 +16506,7 @@ F:	drivers/usb/mtu3/















MEGACHIPS STDPXXXX-GE-B850V3-FW LVDS/DP++ BRIDGES









M:	Peter Senna Tschudin <peter.senna@gmail.com>









M:	Ian Ray <ian.ray@ge.com>









M:	Ian Ray <ian.ray@gehealthcare.com>









M:	Martyn Welch <martyn.welch@collabora.co.uk>









S:	Maintained









F:	Documentation/devicetree/bindings/display/bridge/megachips-stdpxxxx-ge-b850v3-fw.txt








@@ -17345,7 +17345,7 @@ F:	Documentation/devicetree/bindings/sound/mikroe,mikroe-proto.txt







F:	sound/soc/atmel

















MICROCHIP CSI2DC DRIVER









M:	Eugen Hristev <eugen.hristev@microchip.com>









M:	Eugen Hristev <ehristev@kernel.org>









L:	linux-media@vger.kernel.org









S:	Supported









F:	Documentation/devicetree/bindings/media/microchip,csi2dc.yaml








@@ -17372,7 +17372,7 @@ F:	drivers/i2c/busses/i2c-at91-*.c







F:	drivers/i2c/busses/i2c-at91.h

















MICROCHIP ISC DRIVER









M:	Eugen Hristev <eugen.hristev@microchip.com>









M:	Eugen Hristev <ehristev@kernel.org>









L:	linux-media@vger.kernel.org









S:	Supported









F:	Documentation/devicetree/bindings/media/atmel,isc.yaml








@@ -17384,7 +17384,7 @@ F:	drivers/staging/media/deprecated/atmel/atmel-sama*-isc*







F:	include/linux/atmel-isc-media.h

















MICROCHIP ISI DRIVER









M:	Eugen Hristev <eugen.hristev@microchip.com>









M:	Eugen Hristev <ehristev@kernel.org>









L:	linux-media@vger.kernel.org









S:	Supported









F:	drivers/media/platform/atmel/atmel-isi.c








@@ -17574,7 +17574,7 @@ F:	Documentation/devicetree/bindings/display/bridge/microchip,sam9x75-lvds.yaml







F:	drivers/gpu/drm/bridge/microchip-lvds.c

















MICROCHIP SAMA5D2-COMPATIBLE ADC DRIVER









M:	Eugen Hristev <eugen.hristev@microchip.com>









M:	Eugen Hristev <ehristev@kernel.org>









L:	linux-iio@vger.kernel.org









S:	Supported









F:	Documentation/devicetree/bindings/iio/adc/atmel,sama5d2-adc.yaml








@@ -24124,7 +24124,7 @@ F:	drivers/mmc/host/sdhci*















SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) MICROCHIP DRIVER









M:	Aubin Constans <aubin.constans@microchip.com>









R:	Eugen Hristev <eugen.hristev@collabora.com>









R:	Eugen Hristev <ehristev@kernel.org>









L:	linux-mmc@vger.kernel.org









S:	Supported









F:	drivers/mmc/host/sdhci-of-at91.c

























drivers/block/zram/zram_drv.c



+5
−1






























Original line number
Diff line number
Diff line







@@ -33,6 +33,7 @@







#include <linux/cpuhotplug.h>









#include <linux/part_stat.h>









#include <linux/kernel_read_file.h>









#include <linux/rcupdate.h>



















#include "zram_drv.h"


















@@ -504,6 +505,7 @@ struct zram_wb_ctl {







	wait_queue_head_t done_wait;









	spinlock_t done_lock;









	atomic_t num_inflight;









	struct rcu_head rcu;









};



















struct zram_wb_req {








@@ -847,7 +849,7 @@ static void release_wb_ctl(struct zram_wb_ctl *wb_ctl)







		release_wb_req(req);









	}



















	kfree(wb_ctl);









	kfree_rcu(wb_ctl, rcu);









}



















static struct zram_wb_ctl *init_wb_ctl(struct zram *zram)








@@ -964,11 +966,13 @@ static void zram_writeback_endio(struct bio *bio)







	struct zram_wb_ctl *wb_ctl = bio->bi_private;









	unsigned long flags;



















	rcu_read_lock();









	spin_lock_irqsave(&wb_ctl->done_lock, flags);









	list_add(&req->entry, &wb_ctl->done_reqs);









	spin_unlock_irqrestore(&wb_ctl->done_lock, flags);



















	wake_up(&wb_ctl->done_wait);









	rcu_read_unlock();









}



















static void zram_submit_wb_request(struct zram *zram,
































drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c



+1
−1






























Original line number
Diff line number
Diff line







@@ -708,7 +708,7 @@ static void mlx5e_free_xdpsq_desc(struct mlx5e_xdpsq *sq,







				xdpi = mlx5e_xdpi_fifo_pop(xdpi_fifo);









				page = xdpi.page.page;



















				/* No need to check PageNetpp() as we









				/* No need to check page_pool_page_is_pp() as we









				 * know this is a page_pool page.









				 */









				page_pool_recycle_direct(pp_page_to_nmdesc(page)->pp,
































fs/hugetlbfs/inode.c



+13
−33






























Original line number
Diff line number
Diff line







@@ -96,15 +96,8 @@ static const struct fs_parameter_spec hugetlb_fs_parameters[] = {







#define PGOFF_LOFFT_MAX \









	(((1UL << (PAGE_SHIFT + 1)) - 1) <<  (BITS_PER_LONG - (PAGE_SHIFT + 1)))



















static int hugetlb_file_mmap_prepare_success(const struct vm_area_struct *vma)









static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)









{









	/* Unfortunate we have to reassign vma->vm_private_data. */









	return hugetlb_vma_lock_alloc((struct vm_area_struct *)vma);









}



















static int hugetlbfs_file_mmap_prepare(struct vm_area_desc *desc)









{









	struct file *file = desc->file;









	struct inode *inode = file_inode(file);









	loff_t len, vma_len;









	int ret;








@@ -119,8 +112,8 @@ static int hugetlbfs_file_mmap_prepare(struct vm_area_desc *desc)







	 * way when do_mmap unwinds (may be important on powerpc









	 * and ia64).









	 */









	vma_desc_set_flags(desc, VMA_HUGETLB_BIT, VMA_DONTEXPAND_BIT);









	desc->vm_ops = &hugetlb_vm_ops;









	vma_set_flags(vma, VMA_HUGETLB_BIT, VMA_DONTEXPAND_BIT);









	vma->vm_ops = &hugetlb_vm_ops;



















	/*









	 * page based offset in vm_pgoff could be sufficiently large to








@@ -129,16 +122,16 @@ static int hugetlbfs_file_mmap_prepare(struct vm_area_desc *desc)







	 * sizeof(unsigned long).  So, only check in those instances.









	 */









	if (sizeof(unsigned long) == sizeof(loff_t)) {









		if (desc->pgoff & PGOFF_LOFFT_MAX)









		if (vma->vm_pgoff & PGOFF_LOFFT_MAX)









			return -EINVAL;









	}



















	/* must be huge page aligned */









	if (desc->pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))









	if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))









		return -EINVAL;



















	vma_len = (loff_t)vma_desc_size(desc);









	len = vma_len + ((loff_t)desc->pgoff << PAGE_SHIFT);









	vma_len = (loff_t)(vma->vm_end - vma->vm_start);









	len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);









	/* check for overflow */









	if (len < vma_len)









		return -EINVAL;








@@ -148,7 +141,7 @@ static int hugetlbfs_file_mmap_prepare(struct vm_area_desc *desc)

















	ret = -ENOMEM;



















	vma_flags = desc->vma_flags;









	vma_flags = vma->flags;









	/*









	 * for SHM_HUGETLB, the pages are reserved in the shmget() call so skip









	 * reserving here. Note: only for SHM hugetlbfs file, the inode








@@ -158,30 +151,17 @@ static int hugetlbfs_file_mmap_prepare(struct vm_area_desc *desc)







		vma_flags_set(&vma_flags, VMA_NORESERVE_BIT);



















	if (hugetlb_reserve_pages(inode,









			desc->pgoff >> huge_page_order(h),









			len >> huge_page_shift(h), desc,









				vma->vm_pgoff >> huge_page_order(h),









				len >> huge_page_shift(h), vma,









				vma_flags) < 0)









		goto out;



















	ret = 0;









	if (vma_desc_test(desc, VMA_WRITE_BIT) && inode->i_size < len)









	if (vma_test(vma, VMA_WRITE_BIT) && inode->i_size < len)









		i_size_write(inode, len);









out:









	inode_unlock(inode);



















	if (!ret) {









		/* Allocate the VMA lock after we set it up. */









		desc->action.success_hook = hugetlb_file_mmap_prepare_success;









		/*









		 * We cannot permit the rmap finding this VMA in the time









		 * between the VMA being inserted into the VMA tree and the









		 * completion/success hook being invoked.









		 *









		 * This is because we establish a per-VMA hugetlb lock which can









		 * be raced by rmap.









		 */









		desc->action.hide_from_rmap_until_complete = true;









	}









	return ret;









}


















@@ -1227,7 +1207,7 @@ static void init_once(void *foo)

















static const struct file_operations hugetlbfs_file_operations = {









	.read_iter		= hugetlbfs_read_iter,









	.mmap_prepare		= hugetlbfs_file_mmap_prepare,









	.mmap			= hugetlbfs_file_mmap,









	.fsync			= noop_fsync,









	.get_unmapped_area	= hugetlb_get_unmapped_area,









	.llseek			= default_llseek,