This is a note to let you know that I've just added the patch titled parisc: fix expand_stack() conversion to the 6.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: parisc-fix-expand_stack-conversion.patch and it can be found in the queue-6.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From ea3f8272876f2958463992f6736ab690fde7fa9c Mon Sep 17 00:00:00 2001 From: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Date: Thu, 29 Jun 2023 23:04:57 -0700 Subject: parisc: fix expand_stack() conversion From: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> commit ea3f8272876f2958463992f6736ab690fde7fa9c upstream. In commit 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") I tried to deal with the remaining odd page fault handling cases. The oddest one is ia64, which has stacks that grow both up and down. And because ia64 was _so_ odd, I asked people to verify the end result. But a close second oddity is parisc, which is the only one that has a main stack growing up (our "CONFIG_STACK_GROWSUP" config option). But it looked obvious enough that I didn't worry about it. I should have worried a bit more. Not because it was particularly complex, but because I just used the wrong variable name. The previous vma isn't called "prev", it's called "prev_vma". Blush. Fixes: 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/parisc/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/parisc/mm/fault.c +++ b/arch/parisc/mm/fault.c @@ -289,7 +289,7 @@ retry: mmap_read_lock(mm); vma = find_vma_prev(mm, address, &prev_vma); if (!vma || address < vma->vm_start) { - if (!prev || !(prev->vm_flags & VM_GROWSUP)) + if (!prev_vma || !(prev_vma->vm_flags & VM_GROWSUP)) goto bad_area; vma = expand_stack(mm, address); if (!vma) Patches currently in stable-queue which might be from torvalds@xxxxxxxxxxxxxxxxxxxx are queue-6.4/mm-always-expand-the-stack-with-the-mmap-write-lock-held.patch queue-6.4/arm-mm-convert-to-using-lock_mm_and_find_vma.patch queue-6.4/mm-fault-convert-remaining-simple-cases-to-lock_mm_and_find_vma.patch queue-6.4/sparc32-fix-lock_mm_and_find_vma-conversion.patch queue-6.4/mm-make-the-page-fault-mmap-locking-killable.patch queue-6.4/powerpc-mm-convert-to-using-lock_mm_and_find_vma.patch queue-6.4/mm-khugepaged-fix-regression-in-collapse_file.patch queue-6.4/powerpc-mm-convert-coprocessor-fault-to-lock_mm_and_find_vma.patch queue-6.4/gup-add-warning-if-some-caller-would-seem-to-want-stack-expansion.patch queue-6.4/arm64-mm-convert-to-using-lock_mm_and_find_vma.patch queue-6.4/mm-introduce-new-lock_mm_and_find_vma-page-fault-helper.patch queue-6.4/mm-make-find_extend_vma-fail-if-write-lock-not-held.patch queue-6.4/riscv-mm-convert-to-using-lock_mm_and_find_vma.patch queue-6.4/execve-expand-new-process-stack-manually-ahead-of-time.patch queue-6.4/mips-mm-convert-to-using-lock_mm_and_find_vma.patch queue-6.4/parisc-fix-expand_stack-conversion.patch