[PATCH 00/10] mm: various (urgent?) fixes

[David Hildenbrand (Arm)]

Hi,

here are various MM fixes. The majority was reported by Josef at
Anthrophic, the remainder was found while reviewing/overhauling them.

Two issues/fixes reported are not included, as we are discussing
(better) alternatives on the list already.

I left most of the original commit messages as schloppy as they are: I
don't particularly care as long as the code is in good shape and as long as
they are not actively wrong. But I (and Mike) could not be stopped from
overhauling at least some of them.

While I don't think there is anything too critical in here, I think this
is a good opportunity to see how fast we can get pre-screened/pre-reviewed
fixes upstream that might be security-related.

The majority are hugetlb + uffd issues, that are not actually that
relevant for most installations. But all things that should just get
fixed. Some uffd fixes need proper follow ups to fix some more of the
root causes of leftover UFFD PTE bits (or proof that there are none
remaining).

I ran some MM selftests and nothing popped up.

So let's try to get these upstream in a timely fashion.

Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
---
David Hildenbrand (Arm) (4):
      mm/hugetlb: fix use-after-free in hugetlb_mfill_atomic_pte()
      mm/hugetlb: tolerate uffd bits set without uffd for PROT_NONE PTEs
      mm/hugetlb: tolerate UFFD_WP markers outside uffd-wp VMAs
      mm/mremap: fix calling fixup_hugetlb_reservations() on the wrong VMA

Josef Bacik (6):
      mm/vma: don't leak the commit charge on mmap failure
      mm/hugetlb: fix use-after-free of a new anon folio
      mm/hugetlb: unmap the page where the other VMA maps it
      mm/hugetlb: don't clear the resv_map of a VMA whose lock is held
      mm/hugetlb: fix endless write fault on a leftover uffd bit
      mm/hugetlb: don't leave a uffd-wp marker when zapping an RWP entry

 mm/hugetlb.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++--------------
 mm/mremap.c  |  2 +-
 mm/vma.c     | 11 ++++++----
 3 files changed, 62 insertions(+), 21 deletions(-)

---

base-commit: 0fcb05b72344f40806cbe810de8872f1698bf053

change-id: 20261015-urgent_fixes-7112629346eb

--

Cheers,

David