Matthew Wilcox (Oracle)andGreg Kroah-Hartman 461091c27f vmalloc: fix accounting with i915 ...

[ Upstream commit a2e740e216 ]

If the caller of vmap() specifies VM_MAP_PUT_PAGES (currently only the
i915 driver), we will decrement nr_vmalloc_pages and MEMCG_VMALLOC in
vfree().  These counters are incremented by vmalloc() but not by vmap() so
this will cause an underflow.  Check the VM_MAP_PUT_PAGES flag before
decrementing either counter.

Link: https://lkml.kernel.org/r/20241211202538.168311-1-willy@infradead.org
Fixes: b944afc9d6 ("mm: add a VM_MAP_PUT_PAGES flag for vmap")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-02-01 18:22:30 +01:00

..

kasan

kasan: print the original fault addr when access invalid shadow

2023-11-08 17:30:43 +01:00

backing-dev.c

writeback, cgroup: remove extra percpu_ref_exit()

2023-05-30 12:57:56 +01:00

balloon_compaction.c

…

cleancache.c

…

cma_debug.c

…

cma.c

mm/cma: use nth_page() in place of direct struct page manipulation

2023-11-28 16:54:58 +00:00

cma.h

…

compaction.c

mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations

2024-04-13 12:59:22 +02:00

debug_page_ref.c

…

debug_vm_pgtable.c

…

debug.c

…

dmapool.c

…

early_ioremap.c

…

fadvise.c

…

failslab.c

…

filemap.c

mm/filemap: fix infinite loop in generic_file_buffered_read()

2023-09-23 11:01:10 +02:00

frame_vector.c

media: vb2: frame_vector.c: replace WARN_ONCE with a comment

2023-10-10 21:53:33 +02:00

frontswap.c

…

gup_benchmark.c

…

gup.c

mm/migration: return errno when isolate_huge_page failed

2023-02-15 17:22:21 +01:00

highmem.c

…

hmm.c

…

huge_memory.c

mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage

2023-03-22 13:30:04 +01:00

hugetlb_cgroup.c

…

hugetlb.c

mm/hugetlb: change hugetlb_reserve_pages() to type bool

2024-03-15 10:48:22 -04:00

hwpoison-inject.c

…

init-mm.c

…

internal.h

mm: unconditionally close VMAs on error

2024-12-14 19:47:40 +01:00

interval_tree.c

…

ioremap.c

…

Kconfig

…

Kconfig.debug

…

khugepaged.c

mm/khugepaged: check again on anon uffd-wp during isolation

2023-04-26 11:27:38 +02:00

kmemleak.c

Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"

2022-09-15 11:32:02 +02:00

ksm.c

…

list_lru.c

…

maccess.c

maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault()

2022-11-25 17:45:53 +01:00

madvise.c

fs: add file and path permissions helpers

2024-06-21 14:52:58 +02:00

Makefile

…

mapping_dirty_helpers.c

…

memblock.c

Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."

2023-02-22 12:55:56 +01:00

memcontrol.c

memcg: protect concurrent access to mem_cgroup_idr

2024-09-12 11:06:51 +02:00

memfd.c

memfd: check for non-NULL file_seals in memfd_create() syscall

2023-06-28 10:28:09 +02:00

memory_hotplug.c

mm/memory_hotplug: use pfn math in place of direct struct page manipulation

2023-11-28 16:54:58 +00:00

memory-failure.c

mm/memory-failure: fix an incorrect use of tail pages

2024-04-13 12:59:01 +02:00

memory.c

mm: avoid leaving partial pfn mappings around in error case

2024-11-08 16:22:03 +01:00

mempolicy.c

migrate: hugetlb: check for hugetlb shared PMD in node migration

2023-02-15 17:22:21 +01:00

mempool.c

…

memremap.c

mm/memremap.c: map FS_DAX device memory as decrypted

2022-11-16 09:57:17 +01:00

memtest.c

memtest: use {READ,WRITE}_ONCE in memory scanning

2024-04-13 12:58:39 +02:00

migrate.c

mm/migrate: set swap entry values of THP tail pages properly.

2024-04-13 12:59:02 +02:00

mincore.c

fs: add file and path permissions helpers

2024-06-21 14:52:58 +02:00

mlock.c

…

mm_init.c

…

mmap.c

mm: resolve faulty mmap_region() error path behaviour

2024-12-14 19:47:40 +01:00

mmu_gather.c

mm/khugepaged: fix GUP-fast interaction by sending IPI

2022-12-14 11:31:55 +01:00

mmu_notifier.c

mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()

2022-04-27 13:53:54 +02:00

mmzone.c

arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL

2022-05-15 20:00:09 +02:00

mprotect.c

…

mremap.c

mm/mremap: hold the rmap lock in write mode when moving page table entries.

2022-08-21 15:15:21 +02:00

msync.c

…

nommu.c

mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling

2024-12-14 19:47:40 +01:00

oom_kill.c

oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup

2022-04-27 13:53:54 +02:00

page_alloc.c

mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations

2024-04-13 12:59:22 +02:00

page_counter.c

…

page_ext.c

…

page_idle.c

…

page_io.c

…

page_isolation.c

…

page_owner.c

…

page_poison.c

…

page_reporting.c

…

page_reporting.h

…

page_vma_mapped.c

…

page-writeback.c

Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"

2024-07-18 13:05:43 +02:00

pagewalk.c

mm: pagewalk: Fix race between unmap and page walker

2022-09-08 11:11:38 +02:00

percpu-internal.h

…

percpu-km.c

…

percpu-stats.c

…

percpu-vm.c

…

percpu.c

…

pgalloc-track.h

…

pgtable-generic.c

…

process_vm_access.c

…

ptdump.c

mm: pagewalk: Fix race between unmap and page walker

2022-09-08 11:11:38 +02:00

readahead.c

vfs: fix readahead(2) on block devices

2023-11-20 11:06:44 +01:00

rmap.c

mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse

2022-09-05 10:28:56 +02:00

rodata_test.c

…

shmem.c

mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling

2024-12-14 19:47:40 +01:00

shuffle.c

…

shuffle.h

…

slab_common.c

mm: krealloc: Fix MTE false alarm in __do_krealloc

2024-11-17 14:59:40 +01:00

slab.c

…

slab.h

…

slob.c

…

slub.c

mm/slub: fix to return errno if kmalloc() fails

2022-09-28 11:10:28 +02:00

sparse-vmemmap.c

…

sparse.c

mm/sparsemem: fix race in accessing memory_section->usage

2024-02-23 08:42:00 +01:00

swap_cgroup.c

…

swap_slots.c

…

swap_state.c

…

swap.c

…

swapfile.c

mm/swapfile: skip HugeTLB pages for unuse_vma

2024-10-22 15:39:24 +02:00

truncate.c

…

usercopy.c

…

userfaultfd.c

userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb

2024-03-01 13:16:43 +01:00

util.c

mm: unconditionally close VMAs on error

2024-12-14 19:47:40 +01:00

vmacache.c

…

vmalloc.c

vmalloc: fix accounting with i915

2025-02-01 18:22:30 +01:00

vmpressure.c

…

vmscan.c

mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()

2025-01-09 13:25:06 +01:00

vmstat.c

arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL

2022-05-15 20:00:09 +02:00

workingset.c

…

z3fold.c

…

zbud.c

…

zpool.c

…

zsmalloc.c

zsmalloc: fix races between asynchronous zspage free and page migration

2022-06-06 08:42:43 +02:00

zswap.c

…