From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:16:20 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=11f21695c07995c3148f14d55e461e284f855c22;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch mm-damon-core-make-charge_addr_from-aware-of-end-address-exclusivity.patch mm-damon-sysfs-schemes-fix-dir-put-orders-in-access_pattern_add_dirs.patch --- diff --git a/queue-6.1/kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch b/queue-6.1/kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch new file mode 100644 index 0000000000..3c89a5314e --- /dev/null +++ b/queue-6.1/kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch @@ -0,0 +1,79 @@ +From 3a07249981629ace483ebbef81ef6b34c2d2afec Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Sat, 27 Jun 2026 11:51:05 +0100 +Subject: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers + +From: Marc Zyngier + +commit 3a07249981629ace483ebbef81ef6b34c2d2afec upstream. + +kvm_io_bus_get_dev() returns a device that is only matched by the +address, and nothing else. This can cause a lifetime issue if +the matched device is not the expected type, as by the time +the caller can introspect the object, it might be gone (the srcu +lock having been dropped). + +Given that there is only a single user of this helper, the simplest +option is to move the locking responsibility to the caller, which +can keep the srcu lock held for as long as it wants. + +Note that this aligns with other kvm_io_bus*() helpers, which +already require the srcu lock to be held by the callers. + +Reported-by: Will Deacon +Fixes: 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call") +Link: https://lore.kernel.org/all/20260626111344.802555-1-maz@kernel.org +Cc: stable@vger.kernel.org +Reviewed-by: Oliver Upton +Link: https://patch.msgid.link/20260627105105.1005990-1-maz@kernel.org +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/vgic/vgic-its.c | 2 ++ + virt/kvm/kvm_main.c | 16 +++++----------- + 2 files changed, 7 insertions(+), 11 deletions(-) + +--- a/arch/arm64/kvm/vgic/vgic-its.c ++++ b/arch/arm64/kvm/vgic/vgic-its.c +@@ -713,6 +713,8 @@ struct vgic_its *vgic_msi_to_its(struct + + address = (u64)msi->address_hi << 32 | msi->address_lo; + ++ guard(srcu)(&kvm->srcu); ++ + kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address); + if (!kvm_io_dev) + return ERR_PTR(-EINVAL); +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -5465,25 +5465,19 @@ struct kvm_io_device *kvm_io_bus_get_dev + gpa_t addr) + { + struct kvm_io_bus *bus; +- int dev_idx, srcu_idx; +- struct kvm_io_device *iodev = NULL; ++ int dev_idx; + +- srcu_idx = srcu_read_lock(&kvm->srcu); ++ lockdep_assert_held(&kvm->srcu); + + bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu); + if (!bus) +- goto out_unlock; ++ return NULL; + + dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1); + if (dev_idx < 0) +- goto out_unlock; ++ return NULL; + +- iodev = bus->range[dev_idx].dev; +- +-out_unlock: +- srcu_read_unlock(&kvm->srcu, srcu_idx); +- +- return iodev; ++ return bus->range[dev_idx].dev; + } + EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev); + diff --git a/queue-6.1/mm-damon-core-make-charge_addr_from-aware-of-end-address-exclusivity.patch b/queue-6.1/mm-damon-core-make-charge_addr_from-aware-of-end-address-exclusivity.patch new file mode 100644 index 0000000000..a7b203b2e9 --- /dev/null +++ b/queue-6.1/mm-damon-core-make-charge_addr_from-aware-of-end-address-exclusivity.patch @@ -0,0 +1,40 @@ +From 5a2d162e22bf33eb89d53e802d0fc1ec422e19b6 Mon Sep 17 00:00:00 2001 +From: SeongJae Park +Date: Mon, 27 Apr 2026 21:29:40 -0700 +Subject: mm/damon/core: make charge_addr_from aware of end-address exclusivity + +From: SeongJae Park + +commit 5a2d162e22bf33eb89d53e802d0fc1ec422e19b6 upstream. + +DAMON region end address is exclusive one, but charge_addr_from is +assigned assuming the end address is inclusive. As a result, DAMOS action +to next up to min_region_sz memory can be skipped. This is quite +negligible user impact. But, the bug is a bug that can be very simply +fixed. Fix the wrong assignment to respect the exclusiveness of the +address. + +The issue was discovered [1] by Sashiko. + +Link: https://lore.kernel.org/20260428042942.118230-1-sj@kernel.org +Link: https://lore.kernel.org/20260428032324.115663-1-sj@kernel.org [1] +Fixes: 50585192bc2e ("mm/damon/schemes: skip already charged targets and regions") +Signed-off-by: SeongJae Park +Cc: # 5.16.x +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -803,7 +803,7 @@ static void damon_do_apply_schemes(struc + quota->charged_sz += sz; + if (quota->esz && quota->charged_sz >= quota->esz) { + quota->charge_target_from = t; +- quota->charge_addr_from = r->ar.end + 1; ++ quota->charge_addr_from = r->ar.end; + } + } + if (s->action != DAMOS_STAT) diff --git a/queue-6.1/mm-damon-sysfs-schemes-fix-dir-put-orders-in-access_pattern_add_dirs.patch b/queue-6.1/mm-damon-sysfs-schemes-fix-dir-put-orders-in-access_pattern_add_dirs.patch new file mode 100644 index 0000000000..52a505094a --- /dev/null +++ b/queue-6.1/mm-damon-sysfs-schemes-fix-dir-put-orders-in-access_pattern_add_dirs.patch @@ -0,0 +1,67 @@ +From d58fdbe37a829fd2e5803dd4e5a72992dd8c5368 Mon Sep 17 00:00:00 2001 +From: SeongJae Park +Date: Wed, 17 Jun 2026 17:56:47 -0700 +Subject: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() + +From: SeongJae Park + +commit d58fdbe37a829fd2e5803dd4e5a72992dd8c5368 upstream. + +Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in +error paths". + +Error paths of damon_sysfs_access_pattern_add_dirs() and +damon_sysfs_scheme_add_dirs() functions put references to directories in +wrong orders. As a result, uninitialized memory dereference and/or +memory leak can happen. Fix those. + + +This patch (of 2): + +In access_pattern_add_dirs(), error handling path puts references starting +from setup failed directories. If the failure happpened from the initial +allication in the setup functions, uninitialized memory dereference +happen. The allocation failures will not commonly happen, but the +consequence is quite bad. Fix the wrong reference put orders. + +The issue was discovered [1] by Sashiko. + +Link: https://lore.kernel.org/20260618005650.83868-2-sj@kernel.org +Link: https://lore.kernel.org/20260617060005.86852-1-sj@kernel.org [1] +Fixes: 7e84b1f8212a ("mm/damon/sysfs: support DAMON-based Operation Schemes") +Signed-off-by: SeongJae Park +Cc: # 5.18.x +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/sysfs.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/mm/damon/sysfs.c ++++ b/mm/damon/sysfs.c +@@ -679,22 +679,19 @@ static int damon_sysfs_access_pattern_ad + err = damon_sysfs_access_pattern_add_range_dir(access_pattern, + &access_pattern->sz, "sz"); + if (err) +- goto put_sz_out; ++ return err; + + err = damon_sysfs_access_pattern_add_range_dir(access_pattern, + &access_pattern->nr_accesses, "nr_accesses"); + if (err) +- goto put_nr_accesses_sz_out; ++ goto put_sz_out; + + err = damon_sysfs_access_pattern_add_range_dir(access_pattern, + &access_pattern->age, "age"); + if (err) +- goto put_age_nr_accesses_sz_out; ++ goto put_nr_accesses_sz_out; + return 0; + +-put_age_nr_accesses_sz_out: +- kobject_put(&access_pattern->age->kobj); +- access_pattern->age = NULL; + put_nr_accesses_sz_out: + kobject_put(&access_pattern->nr_accesses->kobj); + access_pattern->nr_accesses = NULL; diff --git a/queue-6.1/series b/queue-6.1/series index 2d6c5f1be7..dbe4f68b54 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1041,3 +1041,6 @@ regulator-scmi-simplify-with-scoped-for-each-of-child-loop.patch regulator-scmi-fix-of_node-refcount-leak-in-scmi_regulator_probe.patch btrfs-fix-false-io-failure-after-falling-back-to-buffered-write.patch btrfs-fix-incorrect-buffered-io-fallback-for-append-direct-writes.patch +mm-damon-core-make-charge_addr_from-aware-of-end-address-exclusivity.patch +mm-damon-sysfs-schemes-fix-dir-put-orders-in-access_pattern_add_dirs.patch +kvm-move-kvm_io_bus_get_dev-locking-responsibilities-to-callers.patch