5.4-stable patches

added patches:
	mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch
	mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch
	vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch

diff --git a/queue-5.4/mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch b/queue-5.4/mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch
new file mode 100644 (file)
index 0000000..47f731f
--- /dev/null
+++ b/queue-5.4/mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch
@@ -0,0 +1,35 @@
+From liushixin2@huawei.com  Sat Mar 30 10:11:30 2024
+From: Liu Shixin <liushixin2@huawei.com>
+Date: Thu, 7 Mar 2024 20:50:53 +0800
+Subject: mm/memory-failure: fix an incorrect use of tail pages
+To: Matthew Wilcox <willy@infradead.org>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>, Dan Williams <dan.j.williams@intel.com>, Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: <linux-kernel@vger.kernel.org>, <linux-mm@kvack.org>, <stable@vger.kernel.org>, Liu Shixin <liushixin2@huawei.com>
+Message-ID: <20240307125053.2847205-1-liushixin2@huawei.com>
+
+From: Liu Shixin <liushixin2@huawei.com>
+
+When backport commit c79c5a0a00a9 to 5.4-stable, there is a mistake change.
+The head page instead of tail page should be passed to try_to_unmap(),
+otherwise unmap will failed as follows.
+
+ Memory failure: 0x121c10: failed to unmap page (mapcount=1)
+ Memory failure: 0x121c10: recovery action for unmapping failed page: Ignored
+
+Fixes: 85015a96bc24 ("mm/memory-failure: check the mapcount of the precise page")
+Signed-off-by: Liu Shixin <liushixin2@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memory-failure.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1030,7 +1030,7 @@ static bool hwpoison_user_mappings(struc
+       if (kill)
+               collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
+ 
+-      unmap_success = try_to_unmap(p, ttu);
++      unmap_success = try_to_unmap(hpage, ttu);
+       if (!unmap_success)
+               pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
+                      pfn, page_mapcount(p));

diff --git a/queue-5.4/mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch b/queue-5.4/mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch
new file mode 100644 (file)
index 0000000..9004a38
--- /dev/null
+++ b/queue-5.4/mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch
@@ -0,0 +1,55 @@
+From stable+bounces-26998-greg=kroah.com@vger.kernel.org Wed Mar  6 16:51:22 2024
+From: Zi Yan <zi.yan@sent.com>
+Date: Wed,  6 Mar 2024 10:51:13 -0500
+Subject: mm/migrate: set swap entry values of THP tail pages properly.
+To: gregkh@linuxfoundation.org, stable@vger.kernel.org
+Cc: Zi Yan <ziy@nvidia.com>, linux-mm@kvack.org, Charan Teja Kalla <quic_charante@quicinc.com>, "Matthew Wilcox (Oracle)" <willy@infradead.org>, David Hildenbrand <david@redhat.com>, Andrew Morton <akpm@linux-foundation.org>, Huang Ying <ying.huang@intel.com>, Naoya Horiguchi <naoya.horiguchi@linux.dev>
+Message-ID: <20240306155113.118119-1-zi.yan@sent.com>
+
+From: Zi Yan <ziy@nvidia.com>
+
+The tail pages in a THP can have swap entry information stored in their
+private field. When migrating to a new page, all tail pages of the new
+page need to update ->private to avoid future data corruption.
+
+This fix is stable-only, since after commit 07e09c483cbe ("mm/huge_memory:
+work on folio->swap instead of page->private when splitting folio"),
+subpages of a swapcached THP no longer requires the maintenance.
+
+Adding THPs to the swapcache was introduced in commit
+38d8b4e6bdc87 ("mm, THP, swap: delay splitting THP during swap out"),
+where each subpage of a THP added to the swapcache had its own swapcache
+entry and required the ->private field to point to the correct swapcache
+entry. Later, when THP migration functionality was implemented in commit
+616b8371539a6 ("mm: thp: enable thp migration in generic path"),
+it initially did not handle the subpages of swapcached THPs, failing to
+update their ->private fields or replace the subpage pointers in the
+swapcache. Subsequently, commit e71769ae5260 ("mm: enable thp migration
+for shmem thp") addressed the swapcache update aspect. This patch fixes
+the update of subpage ->private fields.
+
+Closes: https://lore.kernel.org/linux-mm/1707814102-22682-1-git-send-email-quic_charante@quicinc.com/
+Fixes: 616b8371539a ("mm: thp: enable thp migration in generic path")
+Signed-off-by: Zi Yan <ziy@nvidia.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/migrate.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -441,8 +441,12 @@ int migrate_page_move_mapping(struct add
+       if (PageSwapBacked(page)) {
+               __SetPageSwapBacked(newpage);
+               if (PageSwapCache(page)) {
++                      int i;
++
+                       SetPageSwapCache(newpage);
+-                      set_page_private(newpage, page_private(page));
++                      for (i = 0; i < (1 << compound_order(page)); i++)
++                              set_page_private(newpage + i,
++                                               page_private(page + i));
+               }
+       } else {
+               VM_BUG_ON_PAGE(PageSwapCache(page), page);

diff --git a/queue-5.4/series b/queue-5.4/series
index aad7a5ef10edbd3231cfe8b094a803e37ac67dc7..7ca90b9c7fca930ff72d30914330f1c93a988a87 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -107,3 +107,6 @@ perf-core-fix-reentry-problem-in-perf_output_read_group.patch
 efivarfs-request-at-most-512-bytes-for-variable-names.patch
 powerpc-xor_vmx-add-mhard-float-to-cflags.patch
 bounds-support-non-power-of-two-config_nr_cpus.patch
+vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch
+mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch
+mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch

diff --git a/queue-5.4/vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch b/queue-5.4/vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch
new file mode 100644 (file)
index 0000000..a565ccd
--- /dev/null
+++ b/queue-5.4/vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch
@@ -0,0 +1,41 @@
+From 39cdb68c64d84e71a4a717000b6e5de208ee60cc Mon Sep 17 00:00:00 2001
+From: Yangxi Xiang <xyangxi5@gmail.com>
+Date: Tue, 28 Jun 2022 17:33:22 +0800
+Subject: vt: fix memory overlapping when deleting chars in the buffer
+
+From: Yangxi Xiang <xyangxi5@gmail.com>
+
+commit 39cdb68c64d84e71a4a717000b6e5de208ee60cc upstream.
+
+A memory overlapping copy occurs when deleting a long line. This memory
+overlapping copy can cause data corruption when scr_memcpyw is optimized
+to memcpy because memcpy does not ensure its behavior if the destination
+buffer overlaps with the source buffer. The line buffer is not always
+broken, because the memcpy utilizes the hardware acceleration, whose
+result is not deterministic.
+
+Fix this problem by using replacing the scr_memcpyw with scr_memmovew.
+
+Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Yangxi Xiang <xyangxi5@gmail.com>
+Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com
+[ KN: vc_state is not a separate structure in LTS v4.19, v5.4. Adjusted the patch
+  accordingly by using vc_x instead of state.x for backport. ]
+Signed-off-by: Kuntal Nayak <kuntal.nayak@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/vt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -855,7 +855,7 @@ static void delete_char(struct vc_data *
+       unsigned short *p = (unsigned short *) vc->vc_pos;
+ 
+       vc_uniscr_delete(vc, nr);
+-      scr_memcpyw(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2);
++      scr_memmovew(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2);
+       scr_memsetw(p + vc->vc_cols - vc->vc_x - nr, vc->vc_video_erase_char,
+                       nr * 2);
+       vc->vc_need_wrap = 0;