From: Greg Kroah-Hartman Date: Sat, 30 Mar 2024 09:20:06 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v6.7.12~127 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6bd462451a472543930016aa63c74c8ee0769edb;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch --- diff --git a/queue-4.19/mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch b/queue-4.19/mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch new file mode 100644 index 00000000000..3bfeb58fd5a --- /dev/null +++ b/queue-4.19/mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch @@ -0,0 +1,35 @@ +From liushixin2@huawei.com Sat Mar 30 10:11:48 2024 +From: Liu Shixin +Date: Thu, 7 Mar 2024 20:51:50 +0800 +Subject: mm/memory-failure: fix an incorrect use of tail pages +To: Matthew Wilcox , Andrew Morton , Sasha Levin , Dan Williams , Naoya Horiguchi +Cc: , , , Liu Shixin +Message-ID: <20240307125150.2849068-1-liushixin2@huawei.com> + +From: Liu Shixin + +When backport commit c79c5a0a00a9 to 4.19-stable, there is a mistake change. +The head page instead of tail page should be passed to try_to_unmap(), +otherwise unmap will failed as follows. + + Memory failure: 0x121c10: failed to unmap page (mapcount=1) + Memory failure: 0x121c10: recovery action for unmapping failed page: Ignored + +Fixes: c6f50413f2aa ("mm/memory-failure: check the mapcount of the precise page") +Signed-off-by: Liu Shixin +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory-failure.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1033,7 +1033,7 @@ static bool hwpoison_user_mappings(struc + if (kill) + collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED); + +- unmap_success = try_to_unmap(p, ttu); ++ unmap_success = try_to_unmap(hpage, ttu); + if (!unmap_success) + pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n", + pfn, page_mapcount(p)); diff --git a/queue-4.19/mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch b/queue-4.19/mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch new file mode 100644 index 00000000000..798f832a8dd --- /dev/null +++ b/queue-4.19/mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch @@ -0,0 +1,55 @@ +From stable+bounces-26997-greg=kroah.com@vger.kernel.org Wed Mar 6 16:51:02 2024 +From: Zi Yan +Date: Wed, 6 Mar 2024 10:50:52 -0500 +Subject: mm/migrate: set swap entry values of THP tail pages properly. +To: gregkh@linuxfoundation.org, stable@vger.kernel.org +Cc: Zi Yan , linux-mm@kvack.org, Charan Teja Kalla , "Matthew Wilcox (Oracle)" , David Hildenbrand , Andrew Morton , Huang Ying , Naoya Horiguchi +Message-ID: <20240306155052.118007-1-zi.yan@sent.com> + +From: Zi Yan + +The tail pages in a THP can have swap entry information stored in their +private field. When migrating to a new page, all tail pages of the new +page need to update ->private to avoid future data corruption. + +This fix is stable-only, since after commit 07e09c483cbe ("mm/huge_memory: +work on folio->swap instead of page->private when splitting folio"), +subpages of a swapcached THP no longer requires the maintenance. + +Adding THPs to the swapcache was introduced in commit +38d8b4e6bdc87 ("mm, THP, swap: delay splitting THP during swap out"), +where each subpage of a THP added to the swapcache had its own swapcache +entry and required the ->private field to point to the correct swapcache +entry. Later, when THP migration functionality was implemented in commit +616b8371539a6 ("mm: thp: enable thp migration in generic path"), +it initially did not handle the subpages of swapcached THPs, failing to +update their ->private fields or replace the subpage pointers in the +swapcache. Subsequently, commit e71769ae5260 ("mm: enable thp migration +for shmem thp") addressed the swapcache update aspect. This patch fixes +the update of subpage ->private fields. + +Closes: https://lore.kernel.org/linux-mm/1707814102-22682-1-git-send-email-quic_charante@quicinc.com/ +Fixes: 616b8371539a ("mm: thp: enable thp migration in generic path") +Signed-off-by: Zi Yan +Acked-by: David Hildenbrand +Signed-off-by: Greg Kroah-Hartman +--- + mm/migrate.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -514,8 +514,12 @@ int migrate_page_move_mapping(struct add + if (PageSwapBacked(page)) { + __SetPageSwapBacked(newpage); + if (PageSwapCache(page)) { ++ int i; ++ + SetPageSwapCache(newpage); +- set_page_private(newpage, page_private(page)); ++ for (i = 0; i < (1 << compound_order(page)); i++) ++ set_page_private(newpage + i, ++ page_private(page + i)); + } + } else { + VM_BUG_ON_PAGE(PageSwapCache(page), page); diff --git a/queue-4.19/series b/queue-4.19/series index 93161d6faef..d5a685b3d2f 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -76,6 +76,9 @@ usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch vt-fix-unicode-buffer-corruption-when-deleting-characters.patch +vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch +mm-memory-failure-fix-an-incorrect-use-of-tail-pages.patch +mm-migrate-set-swap-entry-values-of-thp-tail-pages-properly.patch fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch printk-update-console_may_schedule-in-console_tryloc.patch btrfs-allocate-btrfs_ioctl_defrag_range_args-on-stack.patch diff --git a/queue-4.19/vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch b/queue-4.19/vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch new file mode 100644 index 00000000000..a565ccd1455 --- /dev/null +++ b/queue-4.19/vt-fix-memory-overlapping-when-deleting-chars-in-the-buffer.patch @@ -0,0 +1,41 @@ +From 39cdb68c64d84e71a4a717000b6e5de208ee60cc Mon Sep 17 00:00:00 2001 +From: Yangxi Xiang +Date: Tue, 28 Jun 2022 17:33:22 +0800 +Subject: vt: fix memory overlapping when deleting chars in the buffer + +From: Yangxi Xiang + +commit 39cdb68c64d84e71a4a717000b6e5de208ee60cc upstream. + +A memory overlapping copy occurs when deleting a long line. This memory +overlapping copy can cause data corruption when scr_memcpyw is optimized +to memcpy because memcpy does not ensure its behavior if the destination +buffer overlaps with the source buffer. The line buffer is not always +broken, because the memcpy utilizes the hardware acceleration, whose +result is not deterministic. + +Fix this problem by using replacing the scr_memcpyw with scr_memmovew. + +Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") +Cc: stable +Signed-off-by: Yangxi Xiang +Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com +[ KN: vc_state is not a separate structure in LTS v4.19, v5.4. Adjusted the patch + accordingly by using vc_x instead of state.x for backport. ] +Signed-off-by: Kuntal Nayak +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -855,7 +855,7 @@ static void delete_char(struct vc_data * + unsigned short *p = (unsigned short *) vc->vc_pos; + + vc_uniscr_delete(vc, nr); +- scr_memcpyw(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2); ++ scr_memmovew(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2); + scr_memsetw(p + vc->vc_cols - vc->vc_x - nr, vc->vc_video_erase_char, + nr * 2); + vc->vc_need_wrap = 0;