+++ /dev/null
-From stable+bounces-196812-greg=kroah.com@vger.kernel.org Mon Nov 24 22:43:40 2025
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Nov 2025 16:43:34 -0500
-Subject: mm/mempool: fix poisoning order>0 pages with HIGHMEM
-To: stable@vger.kernel.org
-Cc: Vlastimil Babka <vbabka@suse.cz>, kernel test robot <oliver.sang@intel.com>, Christoph Hellwig <hch@lst.de>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20251124214334.44494-2-sashal@kernel.org>
-
-From: Vlastimil Babka <vbabka@suse.cz>
-
-[ Upstream commit ec33b59542d96830e3c89845ff833cf7b25ef172 ]
-
-The kernel test has reported:
-
- BUG: unable to handle page fault for address: fffba000
- #PF: supervisor write access in kernel mode
- #PF: error_code(0x0002) - not-present page
- *pde = 03171067 *pte = 00000000
- Oops: Oops: 0002 [#1]
- CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca
- Tainted: [T]=RANDSTRUCT
- Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
- EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
- Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
- EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
- ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
- DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
- CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
- Call Trace:
- poison_element (mm/mempool.c:83 mm/mempool.c:102)
- mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
- mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
- ? mempool_alloc_pages (mm/mempool.c:640)
- bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
- ? mempool_alloc_pages (mm/mempool.c:640)
- do_one_initcall (init/main.c:1283)
-
-Christoph found out this is due to the poisoning code not dealing
-properly with CONFIG_HIGHMEM because only the first page is mapped but
-then the whole potentially high-order page is accessed.
-
-We could give up on HIGHMEM here, but it's straightforward to fix this
-with a loop that's mapping, poisoning or checking and unmapping
-individual pages.
-
-Reported-by: kernel test robot <oliver.sang@intel.com>
-Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com
-Analyzed-by: Christoph Hellwig <hch@lst.de>
-Fixes: bdfedb76f4f5 ("mm, mempool: poison elements backed by slab allocator")
-Cc: stable@vger.kernel.org
-Tested-by: kernel test robot <oliver.sang@intel.com>
-Reviewed-by: Christoph Hellwig <hch@lst.de>
-Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz
-Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- mm/mempool.c | 32 ++++++++++++++++++++++++++------
- 1 file changed, 26 insertions(+), 6 deletions(-)
-
---- a/mm/mempool.c
-+++ b/mm/mempool.c
-@@ -64,10 +64,20 @@ static void check_element(mempool_t *poo
- /* Mempools backed by page allocator */
- if (pool->free == mempool_free_pages) {
- int order = (int)(long)pool->pool_data;
-- void *addr = kmap_local_page((struct page *)element);
-
-- __check_element(pool, addr, 1UL << (PAGE_SHIFT + order));
-- kunmap_local(addr);
-+#ifdef CONFIG_HIGHMEM
-+ for (int i = 0; i < (1 << order); i++) {
-+ struct page *page = (struct page *)element;
-+ void *addr = kmap_local_page(page + i);
-+
-+ __check_element(pool, addr, PAGE_SIZE);
-+ kunmap_local(addr);
-+ }
-+#else
-+ void *addr = page_address((struct page *)element);
-+
-+ __check_element(pool, addr, PAGE_SIZE << order);
-+#endif
- }
- }
-
-@@ -88,10 +98,20 @@ static void poison_element(mempool_t *po
- /* Mempools backed by page allocator */
- if (pool->alloc == mempool_alloc_pages) {
- int order = (int)(long)pool->pool_data;
-- void *addr = kmap_local_page((struct page *)element);
-
-- __poison_element(addr, 1UL << (PAGE_SHIFT + order));
-- kunmap_local(addr);
-+#ifdef CONFIG_HIGHMEM
-+ for (int i = 0; i < (1 << order); i++) {
-+ struct page *page = (struct page *)element;
-+ void *addr = kmap_local_page(page + i);
-+
-+ __poison_element(addr, PAGE_SIZE);
-+ kunmap_local(addr);
-+ }
-+#else
-+ void *addr = page_address((struct page *)element);
-+
-+ __poison_element(addr, PAGE_SIZE << order);
-+#endif
- }
- }
- #else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
+++ /dev/null
-From stable+bounces-196811-greg=kroah.com@vger.kernel.org Mon Nov 24 22:43:40 2025
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 24 Nov 2025 16:43:33 -0500
-Subject: mm/mempool: replace kmap_atomic() with kmap_local_page()
-To: stable@vger.kernel.org
-Cc: "Fabio M. De Francesco" <fabio.maria.de.francesco@linux.intel.com>, Ira Weiny <ira.weiny@intel.com>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>
-Message-ID: <20251124214334.44494-1-sashal@kernel.org>
-
-From: "Fabio M. De Francesco" <fabio.maria.de.francesco@linux.intel.com>
-
-[ Upstream commit f2bcc99a5e901a13b754648d1dbab60f4adf9375 ]
-
-kmap_atomic() has been deprecated in favor of kmap_local_page().
-
-Therefore, replace kmap_atomic() with kmap_local_page().
-
-kmap_atomic() is implemented like a kmap_local_page() which also disables
-page-faults and preemption (the latter only in !PREEMPT_RT kernels). The
-kernel virtual addresses returned by these two API are only valid in the
-context of the callers (i.e., they cannot be handed to other threads).
-
-With kmap_local_page() the mappings are per thread and CPU local like in
-kmap_atomic(); however, they can handle page-faults and can be called from
-any context (including interrupts). The tasks that call kmap_local_page()
-can be preempted and, when they are scheduled to run again, the kernel
-virtual addresses are restored and are still valid.
-
-The code blocks between the mappings and un-mappings don't rely on the
-above-mentioned side effects of kmap_atomic(), so that mere replacements
-of the old API with the new one is all that they require (i.e., there is
-no need to explicitly call pagefault_disable() and/or preempt_disable()).
-
-Link: https://lkml.kernel.org/r/20231120142640.7077-1-fabio.maria.de.francesco@linux.intel.com
-Signed-off-by: Fabio M. De Francesco <fabio.maria.de.francesco@linux.intel.com>
-Cc: Ira Weiny <ira.weiny@intel.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Stable-dep-of: ec33b59542d9 ("mm/mempool: fix poisoning order>0 pages with HIGHMEM")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- mm/mempool.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
---- a/mm/mempool.c
-+++ b/mm/mempool.c
-@@ -64,10 +64,10 @@ static void check_element(mempool_t *poo
- /* Mempools backed by page allocator */
- if (pool->free == mempool_free_pages) {
- int order = (int)(long)pool->pool_data;
-- void *addr = kmap_atomic((struct page *)element);
-+ void *addr = kmap_local_page((struct page *)element);
-
- __check_element(pool, addr, 1UL << (PAGE_SHIFT + order));
-- kunmap_atomic(addr);
-+ kunmap_local(addr);
- }
- }
-
-@@ -88,10 +88,10 @@ static void poison_element(mempool_t *po
- /* Mempools backed by page allocator */
- if (pool->alloc == mempool_alloc_pages) {
- int order = (int)(long)pool->pool_data;
-- void *addr = kmap_atomic((struct page *)element);
-+ void *addr = kmap_local_page((struct page *)element);
-
- __poison_element(addr, 1UL << (PAGE_SHIFT + order));
-- kunmap_atomic(addr);
-+ kunmap_local(addr);
- }
- }
- #else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
9p-fix-sys-fs-9p-caches-overwriting-itself.patch
9p-sysfs_init-don-t-hardcode-error-to-enomem.patch
acpi-property-return-present-device-nodes-only-on-fw.patch
-tools-bitmap-add-missing-asm-generic-bitsperlong.h-i.patch
fbdev-add-bounds-checking-in-bit_putcs-to-fix-vmallo.patch
ceph-add-checking-of-wait_for_completion_killable-re.patch
net-vlan-sync-vlan-features-with-lower-device.patch
usb-deprecate-the-third-argument-of-usb_maxpacket.patch
input-remove-third-argument-of-usb_maxpacket.patch
input-pegasus-notetaker-fix-potential-out-of-bounds-access.patch
-mm-mempool-replace-kmap_atomic-with-kmap_local_page.patch
-mm-mempool-fix-poisoning-order-0-pages-with-highmem.patch
mm-mprotect-use-long-for-page-accountings-and-retval.patch
mm-mprotect-delete-pmd_none_or_clear_bad_unless_trans_huge.patch
+++ /dev/null
-From badfd5e0bfb9e452ee05578edc90f0a5f28f6732 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 5 Sep 2025 15:47:06 -0700
-Subject: tools bitmap: Add missing asm-generic/bitsperlong.h include
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Ian Rogers <irogers@google.com>
-
-[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
-
-small_const_nbits is defined in asm-generic/bitsperlong.h which
-bitmap.h uses but doesn't include causing build failures in some build
-systems. Add the missing #include.
-
-Note the bitmap.h in tools has diverged from that of the kernel, so no
-changes are made there.
-
-Signed-off-by: Ian Rogers <irogers@google.com>
-Acked-by: Yury Norov <yury.norov@gmail.com>
-Cc: Adrian Hunter <adrian.hunter@intel.com>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: André Almeida <andrealmeid@igalia.com>
-Cc: Daniel Borkmann <daniel@iogearbox.net>
-Cc: Darren Hart <dvhart@infradead.org>
-Cc: David S. Miller <davem@davemloft.net>
-Cc: Davidlohr Bueso <dave@stgolabs.net>
-Cc: Ido Schimmel <idosch@nvidia.com>
-Cc: Ingo Molnar <mingo@redhat.com>
-Cc: Jakub Kicinski <kuba@kernel.org>
-Cc: Jamal Hadi Salim <jhs@mojatatu.com>
-Cc: Jason Xing <kerneljasonxing@gmail.com>
-Cc: Jiri Olsa <jolsa@kernel.org>
-Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
-Cc: Kan Liang <kan.liang@linux.intel.com>
-Cc: Mark Rutland <mark.rutland@arm.com>
-Cc: Maurice Lambert <mauricelambert434@gmail.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Paolo Abeni <pabeni@redhat.com>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Petr Machata <petrm@nvidia.com>
-Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Cc: Yuyang Huang <yuyanghuang@google.com>
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- tools/include/linux/bitmap.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
-index 61cf3b9a23a6f..614df0e8822c4 100644
---- a/tools/include/linux/bitmap.h
-+++ b/tools/include/linux/bitmap.h
-@@ -3,6 +3,7 @@
- #define _PERF_BITOPS_H
-
- #include <string.h>
-+#include <asm-generic/bitsperlong.h>
- #include <linux/align.h>
- #include <linux/bitops.h>
- #include <stdlib.h>
---
-2.51.0
-
projects / thirdparty / kernel / stable-queue.git / commitdiff
