--- /dev/null
+From zuoqian113@gmail.com Thu Jul 30 15:29:33 2026
+From: Qian Zuo <zuoqian113@gmail.com>
+Date: Tue, 7 Jul 2026 03:46:08 +0000
+Subject: coredump: fix pidfs file refcount leak in umh_coredump_setup
+To: viro@zeniv.linux.org.uk, brauner@kernel.org
+Cc: gregkh@linuxfoundation.org, oleg@redhat.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Qian Zuo <zuoqian113@gmail.com>
+Message-ID: <20260707034608.912-1-zuoqian113@gmail.com>
+
+From: Qian Zuo <zuoqian113@gmail.com>
+
+The backport of upstream commit b5325b2a270f introduced a reference
+count leak for pidfs_file.
+
+In the upstream implementation, pidfs_file is declared with
+__free(fput), which automatically drops the initial file reference when
+leaving the scope. During the backport, the code was rewritten to manage
+the file pointer manually, but after a successful replace_fd(),
+pidfs_file was simply cleared without dropping the initial reference.
+
+As a result, the pidfs file keeps an extra reference and is never
+released after the usermode helper exits, leaving associated objects,
+such as struct pid, permanently allocated and triggering kmemleak
+reports.
+
+Fix this by explicitly calling fput(pidfs_file) after replace_fd().
+
+Fixes: cdb61a705f5f ("coredump: hand a pidfd to the usermode coredump helper")
+Signed-off-by: Qian Zuo <zuoqian113@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/coredump.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -560,6 +560,7 @@ static int umh_coredump_setup(struct sub
+ if (err < 0)
+ goto out_fail;
+
++ fput(pidfs_file);
+ pidfs_file = NULL;
+ }
+
--- /dev/null
+From 954157679ec34661c2e87e7eb796104a797c32db Mon Sep 17 00:00:00 2001
+From: SJ Park <sj@kernel.org>
+Date: Fri, 3 Jul 2026 09:56:08 -0700
+Subject: mm/damon/core: disallow overlapping input ranges for damon_set_regions()
+
+From: SJ Park <sj@kernel.org>
+
+commit 954157679ec34661c2e87e7eb796104a797c32db upstream.
+
+damon_set_regions() assumes the input ranges are sorted by the address and
+don't overlap each other. Hence the assumption was initially to be
+explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse
+damon_set_regions() for regions setting") has mistakenly removed the
+validation.
+
+This can make DAMON behave in unexpected ways. At the best, the
+monitoring results snapshot will just look weird since there will be
+overlapping regions. DAMOS will also work weirdly, applying the same
+action multiple times for overlapping regions, and make DAMOS quota weird.
+More seriously, depending on the setup and regions updates sequence,
+negative size regions can be made. It will trigger WARN_ONCE() if the
+kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the
+monitoring results, the negative size region can further trigger division
+by zero in damon_merge_two_regions().
+
+Note that some of the consequences including the WARN_ONCE() and the
+divide by zero depend on commits that were introduced after the root cause
+commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for
+regions setting").
+
+Fix the problems by checking the assumption and returning an error if
+the input ranges don't meet the assumption.
+
+The issue was discovered [1] by Sashiko.
+
+Link: https://lore.kernel.org/20260703165610.92894-1-sj@kernel.org
+Link: https://lore.kernel.org/20260630041806.151124-1-sj@kernel.org [1]
+Fixes: 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting")
+Signed-off-by: SJ Park <sj@kernel.org>
+Cc: <stable@vger.kernel.org> # 5.19.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: SJ Park <sj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/mm/damon/core.c
++++ b/mm/damon/core.c
+@@ -210,12 +210,19 @@ int damon_set_regions(struct damon_targe
+ {
+ struct damon_region *r, *next;
+ unsigned int i;
++ unsigned long last_end;
+ int err;
+
+ for (i = 0; i < nr_ranges; i++) {
+- if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >=
+- ALIGN(ranges[i].end, DAMON_MIN_REGION))
++ unsigned long start, end;
++
++ start = ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION);
++ end = ALIGN(ranges[i].end, DAMON_MIN_REGION);
++ if (start >= end)
++ return -EINVAL;
++ if (i > 0 && last_end > start)
+ return -EINVAL;
++ last_end = end;
+ }
+
+ /* Remove regions which are not in the new ranges */
--- /dev/null
+From 1292c0ecb1caefb8ca064a3639d5673991e8810c Mon Sep 17 00:00:00 2001
+From: SJ Park <sj@kernel.org>
+Date: Mon, 29 Jun 2026 20:52:19 -0700
+Subject: mm/damon/core: validate ranges in damon_set_regions()
+
+From: SJ Park <sj@kernel.org>
+
+commit 1292c0ecb1caefb8ca064a3639d5673991e8810c upstream.
+
+DAMON core logic assumes zero length regions don't exist. However, a few
+DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT
+allow users to set empty monitoring target regions. This could result in
+WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and
+divide-by-zero from damon_merge_two_regions().
+
+For example, the WANR_ONCE() can be triggered like below.
+
+ # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r)
+ # CONFIG_DAMON_DEBUG_SANITY=y
+ # damo start
+ # cd /sys/kernel/mm/damon/admin/kdamonds/0
+ # echo 0 > contexts/0/targets/0/regions/0/start
+ # echo 0 > contexts/0/targets/0/regions/0/end
+ # echo commit > state
+ # dmesg
+ [....]
+ [ 73.705780] ------------[ cut here ]------------
+ [ 73.707552] start 0 >= end 0
+ [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758
+ [...]
+
+All DAMON API callers eventually use damon_set_regions() to setup the
+regions. Add the validation logic in the function.
+
+Link: https://lore.kernel.org/20260630035221.146458-1-sj@kernel.org
+Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)")
+Signed-off-by: SJ Park <sj@kernel.org>
+Cc: Yang yingliang <yangyingliang@huawei.com>
+Cc: <stable@vger.kernel.org> # 5.16.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: SJ Park <sj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/damon/core.c
++++ b/mm/damon/core.c
+@@ -212,6 +212,12 @@ int damon_set_regions(struct damon_targe
+ unsigned int i;
+ int err;
+
++ for (i = 0; i < nr_ranges; i++) {
++ if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >=
++ ALIGN(ranges[i].end, DAMON_MIN_REGION))
++ return -EINVAL;
++ }
++
+ /* Remove regions which are not in the new ranges */
+ damon_for_each_region_safe(r, next, t) {
+ for (i = 0; i < nr_ranges; i++) {
fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch
kvm-introduce-vcpu-wants_to_run.patch
kvm-x86-only-reset-tsc-deadline-timer-in-apic_timer_expired-on-kvm_run.patch
+coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch
+mm-damon-core-validate-ranges-in-damon_set_regions.patch
+mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
