From b26b6487037c9f6f97ee3f39e2a1a0c4e10634b3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 13 Oct 2025 15:37:29 +0200 Subject: [PATCH] drop hugetlbfs patch from 6.12 and 6.6 --- ...mas-without-shareable-locks-in-huget.patch | 81 ------------------- queue-6.12/series | 1 - ...mas-without-shareable-locks-in-huget.patch | 81 ------------------- queue-6.6/series | 1 - 4 files changed, 164 deletions(-) delete mode 100644 queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch delete mode 100644 queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch diff --git a/queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch deleted file mode 100644 index 78125965cf..0000000000 --- a/queue-6.12/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch +++ /dev/null @@ -1,81 +0,0 @@ -From eea6481fa69a67720377fb1ab32a54667eba54b7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 26 Sep 2025 09:02:54 +0530 -Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Deepanshu Kartikey - -[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ] - -hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate -operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: -use new vma_lock for pmd sharing synchronization"), if the trylock fails -or the VMA has no lock, it should skip that VMA. Any remaining mapped -pages are handled by remove_inode_hugepages() which is called after -hugetlb_vmdelete_list() and uses proper lock ordering to guarantee -unmapping success. - -Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs -without shareable locks, the code proceeds to call unmap_hugepage_range(). -This causes assertion failures in huge_pmd_unshare() → -hugetlb_vma_assert_locked() because no lock is actually held: - - WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted - Call Trace: - hugetlb_vma_assert_locked+0x1dd/0x250 - huge_pmd_unshare+0x2c8/0x540 - __unmap_hugepage_range+0x6e3/0x1aa0 - unmap_hugepage_range+0x32e/0x410 - hugetlb_vmdelete_list+0x189/0x1f0 - -Fix by using goto to ensure locks acquired by trylock are always released, -even when skipping VMAs without shareable locks. - -Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com -Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") -Signed-off-by: Deepanshu Kartikey -Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 -Suggested-by: Andrew Morton -Cc: David Hildenbrand -Cc: Muchun Song -Cc: Oscar Salvador -Signed-off-by: Andrew Morton -Signed-off-by: Sasha Levin ---- - fs/hugetlbfs/inode.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 4aa9a1428dd58..6fe6526c202cc 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -567,6 +567,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, - if (!hugetlb_vma_trylock_write(vma)) - continue; - -+ /* -+ * Skip VMAs without shareable locks. Per the design in commit -+ * 40549ba8f8e0, these will be handled by remove_inode_hugepages() -+ * called after this function with proper locking. -+ */ -+ if (!__vma_shareable_lock(vma)) -+ goto skip; -+ - v_start = vma_offset_start(vma, start); - v_end = vma_offset_end(vma, end); - -@@ -577,6 +585,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, - * vmas. Therefore, lock is not held when calling - * unmap_hugepage_range for private vmas. - */ -+skip: - hugetlb_vma_unlock_write(vma); - } - } --- -2.51.0 - diff --git a/queue-6.12/series b/queue-6.12/series index 427ffc3c55..04883a6369 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -208,7 +208,6 @@ keys-x.509-fix-basic-constraints-ca-flag-parsing.patch hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch ocfs2-fix-double-free-in-user_cluster_connect.patch drivers-base-node-fix-double-free-in-register_one_no.patch -hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch pci-j721e-fix-incorrect-error-message-in-probe.patch idpf-fix-mismatched-free-function-for-dma_alloc_cohe.patch diff --git a/queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch b/queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch deleted file mode 100644 index 12afd290e6..0000000000 --- a/queue-6.6/hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 83e42592569a03ef06be720e78b5d08936610bd4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 26 Sep 2025 09:02:54 +0530 -Subject: hugetlbfs: skip VMAs without shareable locks in hugetlb_vmdelete_list -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Deepanshu Kartikey - -[ Upstream commit dd83609b88986f4add37c0871c3434310652ebd5 ] - -hugetlb_vmdelete_list() uses trylock to acquire VMA locks during truncate -operations. As per the original design in commit 40549ba8f8e0 ("hugetlb: -use new vma_lock for pmd sharing synchronization"), if the trylock fails -or the VMA has no lock, it should skip that VMA. Any remaining mapped -pages are handled by remove_inode_hugepages() which is called after -hugetlb_vmdelete_list() and uses proper lock ordering to guarantee -unmapping success. - -Currently, when hugetlb_vma_trylock_write() returns success (1) for VMAs -without shareable locks, the code proceeds to call unmap_hugepage_range(). -This causes assertion failures in huge_pmd_unshare() → -hugetlb_vma_assert_locked() because no lock is actually held: - - WARNING: CPU: 1 PID: 6594 Comm: syz.0.28 Not tainted - Call Trace: - hugetlb_vma_assert_locked+0x1dd/0x250 - huge_pmd_unshare+0x2c8/0x540 - __unmap_hugepage_range+0x6e3/0x1aa0 - unmap_hugepage_range+0x32e/0x410 - hugetlb_vmdelete_list+0x189/0x1f0 - -Fix by using goto to ensure locks acquired by trylock are always released, -even when skipping VMAs without shareable locks. - -Link: https://lkml.kernel.org/r/20250926033255.10930-1-kartikey406@gmail.com -Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") -Signed-off-by: Deepanshu Kartikey -Reported-by: syzbot+f26d7c75c26ec19790e7@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=f26d7c75c26ec19790e7 -Suggested-by: Andrew Morton -Cc: David Hildenbrand -Cc: Muchun Song -Cc: Oscar Salvador -Signed-off-by: Andrew Morton -Signed-off-by: Sasha Levin ---- - fs/hugetlbfs/inode.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 914e850b9cbb7..a1ec55fc3a311 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -592,6 +592,14 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, - if (!hugetlb_vma_trylock_write(vma)) - continue; - -+ /* -+ * Skip VMAs without shareable locks. Per the design in commit -+ * 40549ba8f8e0, these will be handled by remove_inode_hugepages() -+ * called after this function with proper locking. -+ */ -+ if (!__vma_shareable_lock(vma)) -+ goto skip; -+ - v_start = vma_offset_start(vma, start); - v_end = vma_offset_end(vma, end); - -@@ -602,6 +610,7 @@ hugetlb_vmdelete_list(struct rb_root_cached *root, pgoff_t start, pgoff_t end, - * vmas. Therefore, lock is not held when calling - * unmap_hugepage_range for private vmas. - */ -+skip: - hugetlb_vma_unlock_write(vma); - } - } --- -2.51.0 - diff --git a/queue-6.6/series b/queue-6.6/series index fc4f618b7f..8671438f72 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -155,7 +155,6 @@ keys-x.509-fix-basic-constraints-ca-flag-parsing.patch hwrng-ks-sa-fix-division-by-zero-in-ks_sa_rng_init.patch ocfs2-fix-double-free-in-user_cluster_connect.patch drivers-base-node-fix-double-free-in-register_one_no.patch -hugetlbfs-skip-vmas-without-shareable-locks-in-huget.patch mtd-rawnand-atmel-fix-error-handling-path-in-atmel_n.patch nfp-fix-rss-hash-key-size-when-rss-is-not-supported.patch net-ena-return-0-in-ena_get_rxfh_key_size-when-rss-h.patch -- 2.47.3