linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 4149 bytes --]

Hi all,

Today's linux-next merge of the mm-unstable tree got a conflict in:

  rust/kernel/alloc/allocator.rs

between commit:

  fde578c86281 ("rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()")

from the drm-misc-fixes tree and commit:

  cda097b07bce ("rust: support large alignments in allocations")

from the mm-unstable tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc rust/kernel/alloc/allocator.rs
index 2692cf90c948,63f271624428..000000000000
--- a/rust/kernel/alloc/allocator.rs
+++ b/rust/kernel/alloc/allocator.rs
@@@ -43,11 -42,28 +42,17 @@@ pub struct Vmalloc
  /// For more details see [self].
  pub struct KVmalloc;
  
 -/// Returns a proper size to alloc a new object aligned to `new_layout`'s alignment.
 -fn aligned_size(new_layout: Layout) -> usize {
 -    // Customized layouts from `Layout::from_size_align()` can have size < align, so pad first.
 -    let layout = new_layout.pad_to_align();
 -
 -    // Note that `layout.size()` (after padding) is guaranteed to be a multiple of `layout.align()`
 -    // which together with the slab guarantees means the `krealloc` will return a properly aligned
 -    // object (see comments in `kmalloc()` for more information).
 -    layout.size()
 -}
 -
  /// # Invariants
  ///
- /// One of the following: `krealloc`, `vrealloc`, `kvrealloc`.
+ /// One of the following: `krealloc_node_align`, `vrealloc_node_align`, `kvrealloc_node_align`.
  struct ReallocFunc(
-     unsafe extern "C" fn(*const crate::ffi::c_void, usize, u32) -> *mut crate::ffi::c_void,
+     unsafe extern "C" fn(
+         *const crate::ffi::c_void,
+         usize,
+         crate::ffi::c_ulong,
+         u32,
+         crate::ffi::c_int,
+     ) -> *mut crate::ffi::c_void,
  );
  
  impl ReallocFunc {
@@@ -76,8 -92,9 +81,9 @@@
          layout: Layout,
          old_layout: Layout,
          flags: Flags,
+         nid: NumaNode,
      ) -> Result<NonNull<[u8]>, AllocError> {
 -        let size = aligned_size(layout);
 +        let size = layout.size();
          let ptr = match ptr {
              Some(ptr) => {
                  if old_layout.size() == 0 {
@@@ -134,11 -140,10 +140,12 @@@ unsafe impl Allocator for Kmalloc 
          layout: Layout,
          old_layout: Layout,
          flags: Flags,
+         nid: NumaNode,
      ) -> Result<NonNull<[u8]>, AllocError> {
 +        let layout = Kmalloc::aligned_layout(layout);
 +
          // SAFETY: `ReallocFunc::call` has the same safety requirements as `Allocator::realloc`.
-         unsafe { ReallocFunc::KREALLOC.call(ptr, layout, old_layout, flags) }
+         unsafe { ReallocFunc::KREALLOC.call(ptr, layout, old_layout, flags, nid) }
      }
  }
  
@@@ -177,19 -177,10 +179,14 @@@ unsafe impl Allocator for KVmalloc 
          layout: Layout,
          old_layout: Layout,
          flags: Flags,
+         nid: NumaNode,
      ) -> Result<NonNull<[u8]>, AllocError> {
 +        // `KVmalloc` may use the `Kmalloc` backend, hence we have to enforce a `Kmalloc`
 +        // compatible layout.
 +        let layout = Kmalloc::aligned_layout(layout);
 +
-         // TODO: Support alignments larger than PAGE_SIZE.
-         if layout.align() > bindings::PAGE_SIZE {
-             pr_warn!("KVmalloc does not support alignments larger than PAGE_SIZE yet.\n");
-             return Err(AllocError);
-         }
- 
          // SAFETY: If not `None`, `ptr` is guaranteed to point to valid memory, which was previously
          // allocated with this `Allocator`.
-         unsafe { ReallocFunc::KVREALLOC.call(ptr, layout, old_layout, flags) }
+         unsafe { ReallocFunc::KVREALLOC.call(ptr, layout, old_layout, flags, nid) }
      }
  }

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Andrew Morton]

On Wed, 13 Aug 2025 11:11:51 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:

> Hi all,
> 
> Today's linux-next merge of the mm-unstable tree got a conflict in:
> 
>   rust/kernel/alloc/allocator.rs
> 
> between commit:
> 
>   fde578c86281 ("rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()")
> 
> from the drm-misc-fixes tree and commit:
> 
>   cda097b07bce ("rust: support large alignments in allocations")
> 
> from the mm-unstable tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 

Thanks.

Well that's messy.

Is it intended that the containing series ("Alloc and drm::Device
fixes") be merged into 6.17-rcX?

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Danilo Krummrich]

On Wed Aug 13, 2025 at 3:11 AM CEST, Stephen Rothwell wrote:
> Hi all,
>
> Today's linux-next merge of the mm-unstable tree got a conflict in:
>
>   rust/kernel/alloc/allocator.rs
>
> between commit:
>
>   fde578c86281 ("rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()")
>
> from the drm-misc-fixes tree and commit:
>
>   cda097b07bce ("rust: support large alignments in allocations")
>
> from the mm-unstable tree.
>
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.

Thanks, the resolution looks good!

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Danilo Krummrich]

On Wed Aug 13, 2025 at 5:59 AM CEST, Andrew Morton wrote:
> Thanks.
>
> Well that's messy.

I think it's not too bad, the changes are just too close to each other -- no
semantic conflict.

As a general heads-up, Rust code is a bit more prone to conflicts.

On one hand this is due to the more powerful type system and components of
different subsystems being a bit closer connected to each other to provide
additional safety guarantees.

On the other hand, there's simply a lot of foundational work going on in
parallel.

For the Rust parts that are maintained under your mm tree, I think it should
generally stay well within limits though.

> Is it intended that the containing series ("Alloc and drm::Device
> fixes") be merged into 6.17-rcX?

Yes, not sure if it will be in -rc2 already, but should be in -rc3. So, the
conflict in -next should vanish in case you backmerge the corresponding -rc.

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Matthew Wilcox]

On Mon, Jul 20, 2026 at 04:41:41PM +0200, Christoph Hellwig wrote:
> >   /**
> >  - * ttm_backup_backup_page() - Backup a page
> >  + * ttm_backup_backup_folio() - Backup a folio
> >    * @backup: The struct backup pointer to use.
> >  - * @page: The page to back up.
> >  - * @writeback: Whether to perform immediate writeback of the page.
> >  + * @folio: The folio to back up.
> >  + * @order: The allocation order of @folio.  Since TTM allocates higher-order
> >  + *         pages without __GFP_COMP, folio_nr_pages(@folio) would always
> >  + *         return 1; the caller must pass the true order explicitly.

Wait, what?  This is just broken.  TTM should change to allocate using
GFP_COMP.  Why can't graphics people ask questions before writing stupid
patches?

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Matthew Brost]

On Mon, Jul 20, 2026 at 03:46:00PM +0100, Matthew Wilcox wrote:
> On Mon, Jul 20, 2026 at 04:41:41PM +0200, Christoph Hellwig wrote:
> > >   /**
> > >  - * ttm_backup_backup_page() - Backup a page
> > >  + * ttm_backup_backup_folio() - Backup a folio
> > >    * @backup: The struct backup pointer to use.
> > >  - * @page: The page to back up.
> > >  - * @writeback: Whether to perform immediate writeback of the page.
> > >  + * @folio: The folio to back up.
> > >  + * @order: The allocation order of @folio.  Since TTM allocates higher-order
> > >  + *         pages without __GFP_COMP, folio_nr_pages(@folio) would always
> > >  + *         return 1; the caller must pass the true order explicitly.
> 
> Wait, what?  This is just broken.  TTM should change to allocate using
> GFP_COMP.  Why can't graphics people ask questions before writing stupid
> patches?
> 

To be honest, I have no idea why TTM doesn't set GFP_COMP. This
predates my work in graphics by nearly a decade.

I found the following comment in TTM, which was added in this patch:
`git format-patch -1 bf9eee249ac20`

As far as I can tell, setting GFP_COMP would make things a lot easier in
a number of places.

Christian, who maintains TTM, is out for a couple of weeks, but this is
something we should probably take a closer look at.

Sorry for sending a stupid patch.

Matt

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Matthew Brost]

On Mon, Jul 20, 2026 at 03:08:22PM -0700, Matthew Brost wrote:
> On Mon, Jul 20, 2026 at 03:46:00PM +0100, Matthew Wilcox wrote:
> > On Mon, Jul 20, 2026 at 04:41:41PM +0200, Christoph Hellwig wrote:
> > > >   /**
> > > >  - * ttm_backup_backup_page() - Backup a page
> > > >  + * ttm_backup_backup_folio() - Backup a folio
> > > >    * @backup: The struct backup pointer to use.
> > > >  - * @page: The page to back up.
> > > >  - * @writeback: Whether to perform immediate writeback of the page.
> > > >  + * @folio: The folio to back up.
> > > >  + * @order: The allocation order of @folio.  Since TTM allocates higher-order
> > > >  + *         pages without __GFP_COMP, folio_nr_pages(@folio) would always
> > > >  + *         return 1; the caller must pass the true order explicitly.
> > 
> > Wait, what?  This is just broken.  TTM should change to allocate using
> > GFP_COMP.  Why can't graphics people ask questions before writing stupid
> > patches?
> > 
> 
> To be honest, I have no idea why TTM doesn't set GFP_COMP. This
> predates my work in graphics by nearly a decade.
> 
> I found the following comment in TTM, which was added in this patch:
> `git format-patch -1 bf9eee249ac20`
> 
> As far as I can tell, setting GFP_COMP would make things a lot easier in
> a number of places.
> 
> Christian, who maintains TTM, is out for a couple of weeks, but this is
> something we should probably take a closer look at.
> 

I have looked into this a bit, changing TTM over to allocations with
GFP_COMP seems pretty straight forward. I have local patches that are
working with my driver (Xe), will post something shortly.

Matt

> Sorry for sending a stupid patch.
> 
> Matt

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Christian König]

On 7/21/26 18:55, Matthew Brost wrote:
> On Mon, Jul 20, 2026 at 03:08:22PM -0700, Matthew Brost wrote:
>> On Mon, Jul 20, 2026 at 03:46:00PM +0100, Matthew Wilcox wrote:
>>> On Mon, Jul 20, 2026 at 04:41:41PM +0200, Christoph Hellwig wrote:
>>>>>   /**
>>>>>  - * ttm_backup_backup_page() - Backup a page
>>>>>  + * ttm_backup_backup_folio() - Backup a folio
>>>>>    * @backup: The struct backup pointer to use.
>>>>>  - * @page: The page to back up.
>>>>>  - * @writeback: Whether to perform immediate writeback of the page.
>>>>>  + * @folio: The folio to back up.
>>>>>  + * @order: The allocation order of @folio.  Since TTM allocates higher-order
>>>>>  + *         pages without __GFP_COMP, folio_nr_pages(@folio) would always
>>>>>  + *         return 1; the caller must pass the true order explicitly.
>>>
>>> Wait, what?  This is just broken.  TTM should change to allocate using
>>> GFP_COMP.  Why can't graphics people ask questions before writing stupid
>>> patches?
>>>
>>
>> To be honest, I have no idea why TTM doesn't set GFP_COMP. This
>> predates my work in graphics by nearly a decade.

Oh, that is a rather long (and sad) story.

TTM (or GFX HW in general) has the requirement that a page once allocated as huge page must stay a huge page as long as it exists, in other words a page split is not possible.

This is not a problem per see because in theory there should never be a page split required for such allocations because we map everything into userspace using VM_PFNMAP and vmf_insert_pfn_prot(), so the special bit is set we don't have any direct I/O, swapping.....

>>
>> I found the following comment in TTM, which was added in this patch:
>> `git format-patch -1 bf9eee249ac20`
>>
>> As far as I can tell, setting GFP_COMP would make things a lot easier in
>> a number of places.
>>
>> Christian, who maintains TTM, is out for a couple of weeks, but this is
>> something we should probably take a closer look at.
>>
> 
> I have looked into this a bit, changing TTM over to allocations with
> GFP_COMP seems pretty straight forward. I have local patches that are
> working with my driver (Xe), will post something shortly.

Well it should work in TTM. The issue was (is?) that we had multiple other components in the kernel who got that completely wrong.

Especially KVM tried to grab a page reference from walking the page tables, ignoring the special bit in the PTE and then just incrementing the page reference from 0->1 and then later doing a put_page() into the middle of a huge page allocation.

Long story short that already resulted in multiple CVEs.

So yeah in theory we could use GFP_COMP here, but we need to make sure that this doesn't break anywhere else.

Regards,
Christian.

> 
> Matt
> 
>> Sorry for sending a stupid patch.
>>
>> Matt

Re: linux-next: manual merge of the mm-unstable tree with the drm-misc-fixes tree

[Matthew Brost]

On Mon, Aug 03, 2026 at 02:55:45PM +0200, Christian König wrote:
> On 7/21/26 18:55, Matthew Brost wrote:
> > On Mon, Jul 20, 2026 at 03:08:22PM -0700, Matthew Brost wrote:
> >> On Mon, Jul 20, 2026 at 03:46:00PM +0100, Matthew Wilcox wrote:
> >>> On Mon, Jul 20, 2026 at 04:41:41PM +0200, Christoph Hellwig wrote:
> >>>>>   /**
> >>>>>  - * ttm_backup_backup_page() - Backup a page
> >>>>>  + * ttm_backup_backup_folio() - Backup a folio
> >>>>>    * @backup: The struct backup pointer to use.
> >>>>>  - * @page: The page to back up.
> >>>>>  - * @writeback: Whether to perform immediate writeback of the page.
> >>>>>  + * @folio: The folio to back up.
> >>>>>  + * @order: The allocation order of @folio.  Since TTM allocates higher-order
> >>>>>  + *         pages without __GFP_COMP, folio_nr_pages(@folio) would always
> >>>>>  + *         return 1; the caller must pass the true order explicitly.
> >>>
> >>> Wait, what?  This is just broken.  TTM should change to allocate using
> >>> GFP_COMP.  Why can't graphics people ask questions before writing stupid
> >>> patches?
> >>>
> >>
> >> To be honest, I have no idea why TTM doesn't set GFP_COMP. This
> >> predates my work in graphics by nearly a decade.
> 
> Oh, that is a rather long (and sad) story.
> 
> TTM (or GFX HW in general) has the requirement that a page once allocated as huge page must stay a huge page as long as it exists, in other words a page split is not possible.
> 

Right, but I'd take it a step further: pages must remain resident (for
3D workloads) while DMA fences are attached to them (via the BO's
dma_resv).

That's why the pages are neither on the LRU nor rmappable. In other
words, everything is fully managed by TTM and the driver on the graphics
side.

> This is not a problem per see because in theory there should never be a page split required for such allocations because we map everything into userspace using VM_PFNMAP and vmf_insert_pfn_prot(), so the special bit is set we don't have any direct I/O, swapping.....
> 

Yes.

> >>
> >> I found the following comment in TTM, which was added in this patch:
> >> `git format-patch -1 bf9eee249ac20`
> >>
> >> As far as I can tell, setting GFP_COMP would make things a lot easier in
> >> a number of places.
> >>
> >> Christian, who maintains TTM, is out for a couple of weeks, but this is
> >> something we should probably take a closer look at.
> >>
> > 
> > I have looked into this a bit, changing TTM over to allocations with
> > GFP_COMP seems pretty straight forward. I have local patches that are
> > working with my driver (Xe), will post something shortly.
> 
> Well it should work in TTM. The issue was (is?) that we had multiple other components in the kernel who got that completely wrong.
> 

:(

> Especially KVM tried to grab a page reference from walking the page tables, ignoring the special bit in the PTE and then just incrementing the page reference from 0->1 and then later doing a put_page() into the middle of a huge page allocation.
> 

This does sound like a problem and a bit more clear than the comment in
the existing code.

> Long story short that already resulted in multiple CVEs.
> 
> So yeah in theory we could use GFP_COMP here, but we need to make sure that this doesn't break anywhere else.
> 

I haven't tested KVM or audited the entire kernel, so it's entirely
possible that my attempt to use GFP_COMP broke something. :(

It's probably worth investigating if this is still an issue. If it is,
we should at least update the comment in TTM to clearly explain what the
problem is.

Matt

> Regards,
> Christian.
> 
> > 
> > Matt
> > 
> >> Sorry for sending a stupid patch.
> >>
> >> Matt
>