From: Greg Kroah-Hartman Date: Thu, 30 Jul 2026 13:31:56 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8caf3927fee950d908cd2803dc920ea71c259157;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch mm-damon-core-validate-ranges-in-damon_set_regions.patch --- diff --git a/queue-6.6/coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch b/queue-6.6/coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch new file mode 100644 index 0000000000..6b3bee28ec --- /dev/null +++ b/queue-6.6/coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch @@ -0,0 +1,43 @@ +From zuoqian113@gmail.com Thu Jul 30 15:29:33 2026 +From: Qian Zuo +Date: Tue, 7 Jul 2026 03:46:08 +0000 +Subject: coredump: fix pidfs file refcount leak in umh_coredump_setup +To: viro@zeniv.linux.org.uk, brauner@kernel.org +Cc: gregkh@linuxfoundation.org, oleg@redhat.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Qian Zuo +Message-ID: <20260707034608.912-1-zuoqian113@gmail.com> + +From: Qian Zuo + +The backport of upstream commit b5325b2a270f introduced a reference +count leak for pidfs_file. + +In the upstream implementation, pidfs_file is declared with +__free(fput), which automatically drops the initial file reference when +leaving the scope. During the backport, the code was rewritten to manage +the file pointer manually, but after a successful replace_fd(), +pidfs_file was simply cleared without dropping the initial reference. + +As a result, the pidfs file keeps an extra reference and is never +released after the usermode helper exits, leaving associated objects, +such as struct pid, permanently allocated and triggering kmemleak +reports. + +Fix this by explicitly calling fput(pidfs_file) after replace_fd(). + +Fixes: cdb61a705f5f ("coredump: hand a pidfd to the usermode coredump helper") +Signed-off-by: Qian Zuo +Signed-off-by: Greg Kroah-Hartman +--- + fs/coredump.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -560,6 +560,7 @@ static int umh_coredump_setup(struct sub + if (err < 0) + goto out_fail; + ++ fput(pidfs_file); + pidfs_file = NULL; + } + diff --git a/queue-6.6/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch b/queue-6.6/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch new file mode 100644 index 0000000000..5b89ea1b87 --- /dev/null +++ b/queue-6.6/mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch @@ -0,0 +1,71 @@ +From 954157679ec34661c2e87e7eb796104a797c32db Mon Sep 17 00:00:00 2001 +From: SJ Park +Date: Fri, 3 Jul 2026 09:56:08 -0700 +Subject: mm/damon/core: disallow overlapping input ranges for damon_set_regions() + +From: SJ Park + +commit 954157679ec34661c2e87e7eb796104a797c32db upstream. + +damon_set_regions() assumes the input ranges are sorted by the address and +don't overlap each other. Hence the assumption was initially to be +explicitly validated. But commit 97d482f4592f ("mm/damon/sysfs: reuse +damon_set_regions() for regions setting") has mistakenly removed the +validation. + +This can make DAMON behave in unexpected ways. At the best, the +monitoring results snapshot will just look weird since there will be +overlapping regions. DAMOS will also work weirdly, applying the same +action multiple times for overlapping regions, and make DAMOS quota weird. +More seriously, depending on the setup and regions updates sequence, +negative size regions can be made. It will trigger WARN_ONCE() if the +kernel is built with CONFIG_DAMON_DEBUG_SANITY=y. Depending on the +monitoring results, the negative size region can further trigger division +by zero in damon_merge_two_regions(). + +Note that some of the consequences including the WARN_ONCE() and the +divide by zero depend on commits that were introduced after the root cause +commit 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for +regions setting"). + +Fix the problems by checking the assumption and returning an error if +the input ranges don't meet the assumption. + +The issue was discovered [1] by Sashiko. + +Link: https://lore.kernel.org/20260703165610.92894-1-sj@kernel.org +Link: https://lore.kernel.org/20260630041806.151124-1-sj@kernel.org [1] +Fixes: 97d482f4592f ("mm/damon/sysfs: reuse damon_set_regions() for regions setting") +Signed-off-by: SJ Park +Cc: # 5.19.x +Signed-off-by: Andrew Morton +Signed-off-by: SJ Park +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -210,12 +210,19 @@ int damon_set_regions(struct damon_targe + { + struct damon_region *r, *next; + unsigned int i; ++ unsigned long last_end; + int err; + + for (i = 0; i < nr_ranges; i++) { +- if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >= +- ALIGN(ranges[i].end, DAMON_MIN_REGION)) ++ unsigned long start, end; ++ ++ start = ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION); ++ end = ALIGN(ranges[i].end, DAMON_MIN_REGION); ++ if (start >= end) ++ return -EINVAL; ++ if (i > 0 && last_end > start) + return -EINVAL; ++ last_end = end; + } + + /* Remove regions which are not in the new ranges */ diff --git a/queue-6.6/mm-damon-core-validate-ranges-in-damon_set_regions.patch b/queue-6.6/mm-damon-core-validate-ranges-in-damon_set_regions.patch new file mode 100644 index 0000000000..e57d9f8bce --- /dev/null +++ b/queue-6.6/mm-damon-core-validate-ranges-in-damon_set_regions.patch @@ -0,0 +1,61 @@ +From 1292c0ecb1caefb8ca064a3639d5673991e8810c Mon Sep 17 00:00:00 2001 +From: SJ Park +Date: Mon, 29 Jun 2026 20:52:19 -0700 +Subject: mm/damon/core: validate ranges in damon_set_regions() + +From: SJ Park + +commit 1292c0ecb1caefb8ca064a3639d5673991e8810c upstream. + +DAMON core logic assumes zero length regions don't exist. However, a few +DAMON API callers including DAMON_SYSFS, DAMON_RECLAIM and DAMON_LRU_SORT +allow users to set empty monitoring target regions. This could result in +WARN_ONCE() on CONFIG_DAMON_DEBUG_SANITY enabled kernel, and +divide-by-zero from damon_merge_two_regions(). + +For example, the WANR_ONCE() can be triggered like below. + + # grep DAMON_DEBUG_SANITY /boot/config-$(uname -r) + # CONFIG_DAMON_DEBUG_SANITY=y + # damo start + # cd /sys/kernel/mm/damon/admin/kdamonds/0 + # echo 0 > contexts/0/targets/0/regions/0/start + # echo 0 > contexts/0/targets/0/regions/0/end + # echo commit > state + # dmesg + [....] + [ 73.705780] ------------[ cut here ]------------ + [ 73.707552] start 0 >= end 0 + [ 73.708452] WARNING: mm/damon/core.c:359 at damon_new_region+0x6e/0x80, CPU#1: kdamond.0/758 + [...] + +All DAMON API callers eventually use damon_set_regions() to setup the +regions. Add the validation logic in the function. + +Link: https://lore.kernel.org/20260630035221.146458-1-sj@kernel.org +Fixes: 43b0536cb471 ("mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)") +Signed-off-by: SJ Park +Cc: Yang yingliang +Cc: # 5.16.x +Signed-off-by: Andrew Morton +Signed-off-by: SJ Park +Signed-off-by: Greg Kroah-Hartman +--- + mm/damon/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/mm/damon/core.c ++++ b/mm/damon/core.c +@@ -212,6 +212,12 @@ int damon_set_regions(struct damon_targe + unsigned int i; + int err; + ++ for (i = 0; i < nr_ranges; i++) { ++ if (ALIGN_DOWN(ranges[i].start, DAMON_MIN_REGION) >= ++ ALIGN(ranges[i].end, DAMON_MIN_REGION)) ++ return -EINVAL; ++ } ++ + /* Remove regions which are not in the new ranges */ + damon_for_each_region_safe(r, next, t) { + for (i = 0; i < nr_ranges; i++) { diff --git a/queue-6.6/series b/queue-6.6/series index 9d855aaa4b..d25e058ada 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -474,3 +474,6 @@ net-ipa-fix-smem-state-handle-leaks-in-smp2p-init.patch fs-resctrl-fix-double-add-of-pseudo-locked-region-s-rmid-to-free-list.patch kvm-introduce-vcpu-wants_to_run.patch kvm-x86-only-reset-tsc-deadline-timer-in-apic_timer_expired-on-kvm_run.patch +coredump-fix-pidfs-file-refcount-leak-in-umh_coredump_setup.patch +mm-damon-core-validate-ranges-in-damon_set_regions.patch +mm-damon-core-disallow-overlapping-input-ranges-for-damon_set_regions.patch