aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2013-10-31mm: memcg: fix test for child groupsJohannes Weiner1-24/+11
When memcg code needs to know whether any given memcg has children, it uses the cgroup child iteration primitives and returns true/false depending on whether the iteration loop is executed at least once or not. Because a cgroup's list of children is RCU protected, these primitives require the RCU read-lock to be held, which is not the case for all memcg callers. This results in the following splat when e.g. enabling hierarchy mode: WARNING: CPU: 3 PID: 1 at kernel/cgroup.c:3043 css_next_child+0xa3/0x160() CPU: 3 PID: 1 Comm: systemd Not tainted 3.12.0-rc5-00117-g83f11a9-dirty #18 Hardware name: LENOVO 3680B56/3680B56, BIOS 6QET69WW (1.39 ) 04/26/2012 Call Trace: dump_stack+0x54/0x74 warn_slowpath_common+0x78/0xa0 warn_slowpath_null+0x1a/0x20 css_next_child+0xa3/0x160 mem_cgroup_hierarchy_write+0x5b/0xa0 cgroup_file_write+0x108/0x2a0 vfs_write+0xbd/0x1e0 SyS_write+0x4c/0xa0 system_call_fastpath+0x16/0x1b In the memcg case, we only care about children when we are attempting to modify inheritable attributes interactively. Racing with deletion could mean a spurious -EBUSY, no problem. Racing with addition is handled just fine as well through the memcg_create_mutex: if the child group is not on the list after the mutex is acquired, it won't be initialized from the parent's attributes until after the unlock. Signed-off-by: Johannes Weiner <[email protected]> Acked-by: Michal Hocko <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-10-31mm: memcg: lockdep annotation for memcg OOM lockJohannes Weiner1-1/+10
The memcg OOM lock is a mutex-type lock that is open-coded due to memcg's special needs. Add annotations for lockdep coverage. Signed-off-by: Johannes Weiner <[email protected]> Cc: Michal Hocko <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-10-31mm: memcg: use proper memcg in limit bypassJohannes Weiner1-4/+4
Commit 84235de394d9 ("fs: buffer: move allocation failure loop into the allocator") allowed __GFP_NOFAIL allocations to bypass the limit if they fail to reclaim enough memory for the charge. But because the main test case was on a 3.2-based system, the patch missed the fact that on newer kernels the charge function needs to return root_mem_cgroup when bypassing the limit, and not NULL. This will corrupt whatever memory is at NULL + percpu pointer offset. Fix this quickly before problems are reported. Signed-off-by: Johannes Weiner <[email protected]> Acked-by: Michal Hocko <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-10-31vfs: decrapify dput(), fix cache behavior under normal loadLinus Torvalds1-2/+3
We do not want to dirty the dentry->d_flags cacheline in dput() just to set the DCACHE_REFERENCED flag when it is already set in the common case anyway. This way the first cacheline of the dentry (which contains the RCU lookup information etc) can stay shared among multiple CPU's. This finishes off some of the details of all the scalability patches merged during the merge window. Also don't mark dentry_kill() for inlining, since it's the uncommon path and inlining it just makes the common path slower due to extra function entry/exit overhead. Signed-off-by: Linus Torvalds <[email protected]>
2013-10-31i915: fix compiler warningLinus Torvalds1-2/+0
The last i915 drm update brought with it this annoying warning drivers/gpu/drm/i915/intel_crt.c: In function ‘intel_crt_get_config’: drivers/gpu/drm/i915/intel_crt.c:110:21: warning: unused variable ‘dev’ [-Wunused-variable] struct drm_device *dev = encoder->base.dev; ^ introduced by commit 7195a50b5c7e ("drm/i915: Add HSW CRT output readout support"). Remove the offending pointless variable. Signed-off-by: Linus Torvalds <[email protected]>
2013-10-31Merge branch 'core-urgent-for-linus' of ↵Linus Torvalds4-63/+81
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull NUMA balancing memory corruption fixes from Ingo Molnar: "So these fixes are definitely not something I'd like to sit on, but as I said to Mel at the KS the timing is quite tight, with Linus planning v3.12-final within a week. Fedora-19 is affected: comet:~> grep NUMA_BALANCING /boot/config-3.11.3-201.fc19.x86_64 CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y CONFIG_NUMA_BALANCING=y AFAICS Ubuntu will be affected as well, once it updates the kernel: hubble:~> grep NUMA_BALANCING /boot/config-3.8.0-32-generic CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y CONFIG_NUMA_BALANCING_DEFAULT_ENABLED=y CONFIG_NUMA_BALANCING=y These 6 commits are a minimalized set of cherry-picks needed to fix the memory corruption bugs. All commits are fixes, except "mm: numa: Sanitize task_numa_fault() callsites" which is a cleanup that made two followup fixes simpler. I've done targeted testing with just this SHA1 to try to make sure there are no cherry-picking artifacts. The original non-cherry-picked set of fixes were exposed to linux-next for a couple of weeks" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: mm: Account for a THP NUMA hinting update as one PTE update mm: Close races between THP migration and PMD numa clearing mm: numa: Sanitize task_numa_fault() callsites mm: Prevent parallel splits during THP migration mm: Wait for THP migrations to complete during NUMA hinting faults mm: numa: Do not account for a hinting fault if we raced
2013-10-31can: kvaser_usb: fix usb endpoints detectionOlivier Sobrie1-7/+13
Some devices, like the Kvaser Memorator Professional, have several bulk in endpoints. Only the first one found must be used by the driver. The same holds for the bulk out endpoint. The official Kvaser driver (leaf) was used as reference for this patch. Cc: linux-stable <[email protected]> Signed-off-by: Olivier Sobrie <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2013-10-31can: c_can: Fix RX message handling, handle lost message before EOBMarkus Pargmann1-3/+3
If we handle end of block messages with higher priority than a lost message, we can run into an endless interrupt loop. This is reproducable with a am335x processor and "cansequence -r" at 1Mbit. As soon as we loose a packet we can't escape from an interrupt loop. This patch fixes the problem by handling lost packets before EOB packets. Cc: linux-stable <[email protected]> Signed-off-by: Markus Pargmann <[email protected]> Signed-off-by: Marc Kleine-Budde <[email protected]>
2013-10-31Merge branch 'for-linus' of ↵Linus Torvalds7-20/+51
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "A bit later than I would want, but the changes are very minor - a few new device IDs for new hardware in existing drivers, fix for battery in Wacom devices not be considered system battery and cause emergency hibernations, and a couple of other bug fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ALPS - add support for model found on Dell XT2 Input: wacom - add support for ISDv4 0x10E sensor Input: wacom - add support for ISDv4 0x10F sensor Input: wacom - export battery scope Input: cm109 - convert high volume dev_err() to dev_err_ratelimited() Input: move name/timer init to input_alloc_dev() Input: i8042 - i8042_flush fix for a full 8042 buffer Input: pxa27x_keypad - fix NULL pointer dereference
2013-10-31Merge tag 'dt-3.13-5' of git://git.infradead.org/linux-mvebu into next/dtOlof Johansson3-2/+420
From Jason Cooper: - add the Openblocks A7 board - add Netgear ReadyNAS 104 board * tag 'dt-3.13-5' of git://git.infradead.org/linux-mvebu: ARM: mvebu: Add Netgear ReadyNAS 104 board ARM: kirkwood: add support for OpenBlocks A7 platform Signed-off-by: Olof Johansson <[email protected]>
2013-10-31Merge branch 'bcm/dt' into next/dtOlof Johansson4-7/+54
A handful of DT updates from Christian Daudt for the broadcom mobile platforms, including their rename of the platform to BCM_MOBILE to keep BCM for the vendor-level options. * bcm/dt: ARM: dts: bcm11351: Use GIC/IRQ defines for sdio interrupts ARM: dts: bcm: Add missing UARTs for bcm11351 (bcm281xx) ARM: dts: bcm281xx: Add card detect GPIO ARM: dts: rename ARCH_BCM to ARCH_BCM_MOBILE (dt) ARM: bcm281xx: Add device node for the GPIO controller Signed-off-by: Olof Johansson <[email protected]>
2013-10-31ARM: dts: bcm11351: Use GIC/IRQ defines for sdio interruptsMatt Porter1-4/+4
Trivial patch to make use of GIC/IRQ defines on the bcm11351 sdio interrupt properties. Signed-off-by: Matt Porter <[email protected]> Signed-off-by: Christian Daudt <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-31ARM: dts: bcm: Add missing UARTs for bcm11351 (bcm281xx)Tim Kryger1-0/+30
This adds in three more UARTs that were not declared earlier. Signed-off-by: Tim Kryger <[email protected]> Reviewed-by: Markus Mayer <[email protected]> Reviewed-by: Matt Porter <[email protected]> Signed-off-by: Christian Daudt <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-31ARM: dts: bcm281xx: Add card detect GPIOMarkus Mayer2-0/+2
Register GPIO 14 as card detect interrupt for the SD card slot. Signed-off-by: Markus Mayer <[email protected]> Signed-off-by: Christian Daudt <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-31ARM: dts: rename ARCH_BCM to ARCH_BCM_MOBILE (dt)Christian Daudt1-2/+2
Currently ARCH_BCM has been used for Broadcom Mobile V7 based SoCs. In order to allow other Broadcom SoCs to also use mach-bcm directory and files, this patch renames the original ARCH_BCM to ARCH_BCM_MOBILE, and uses ARCH_BCM to define any Broadcom chip residing in mach-bcm directory. Signed-off-by: Christian Daudt <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-31ARM: bcm281xx: Add device node for the GPIO controllerMarkus Mayer1-0/+16
Add the GPIO controller device node for the Broadcom bcm281xx family of mobile SoCs. Signed-off-by: Markus Mayer <[email protected]> Reviewed-by: Tim Kryger <[email protected]> Reviewed-by: Matt Porter <[email protected]> Reviewed-by: Tomasz Figa <[email protected]> Acked-by: Linus Walleij <[email protected]> Signed-off-by: Christian Daudt <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-31nfs: fix inverted test for delegation in nfs4_reclaim_open_stateJeff Layton1-1/+1
commit 6686390bab6a0e0 (NFS: remove incorrect "Lock reclaim failed!" warning.) added a test for a delegation before checking to see if any reclaimed locks failed. The test however is backward and is only doing that check when a delegation is held instead of when one isn't. Cc: NeilBrown <[email protected]> Signed-off-by: Jeff Layton <[email protected]> Fixes: 6686390bab6a: NFS: remove incorrect "Lock reclaim failed!" warning. Cc: [email protected] # 3.12 Signed-off-by: Trond Myklebust <[email protected]>
2013-10-31Merge tag 'pm+acpi-3.12-late' of ↵Linus Torvalds3-10/+3
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael J Wysocki: "Last-minute ACPI and power management fixes for 3.12 - Revert epoll and select commits related to the freezer, introduced during the 3.11 cycle, that cause mysterious user space breakage to occur during resume from suspend to RAM for multiple users of 32-bit x86 systems. Material for 3.11.y stable kernels. - Revert a recent ACPI-based PCI hotplug (ACPIPHP) commit that was part of boot problem fixes for one machine, but turns out to cause issues with hotplug on Thunderbolt chains with multiple devices. It also turns out to be unnecessary after another fix in the same area that went in later. From Mika Westerberg" * tag 'pm+acpi-3.12-late' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI / hotplug / PCI: Avoid doing too much for spurious notifies" Revert "select: use freezable blocking call" Revert "epoll: use freezable blocking call"
2013-10-31arm64: Slightly improve the warning on CPU0 enable-methodCatalin Marinas1-2/+2
Commit e8765b265a69 (arm64: read enable-method for CPU0) introduced checks for the enable method on CPU0 (to be later used with CPU suspend). However, if the kernel is compiled for UP and a DT file is used with a method like 'spin-table', Linux complains about 'invalid enable method'. This patch turns it into an 'unsupported enable method' warning. Signed-off-by: Catalin Marinas <[email protected]>
2013-10-31ALSA: fix oops in snd_pcm_info() caused by ASoC DPCMRussell King1-0/+4
Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = d5300000 [00000008] *pgd=0d265831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT ARM CPU: 0 PID: 2295 Comm: vlc Not tainted 3.11.0+ #755 task: dee74800 ti: e213c000 task.ti: e213c000 PC is at snd_pcm_info+0xc8/0xd8 LR is at 0x30232065 pc : [<c031b52c>] lr : [<30232065>] psr: a0070013 sp : e213dea8 ip : d81cb0d0 fp : c05f7678 r10: c05f7770 r9 : fffffdfd r8 : 00000000 r7 : d8a968a8 r6 : d8a96800 r5 : d8a96200 r4 : d81cb000 r3 : 00000000 r2 : d81cb000 r1 : 00000001 r0 : d8a96200 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5387d Table: 15300019 DAC: 00000015 Process vlc (pid: 2295, stack limit = 0xe213c248) [<c031b52c>] (snd_pcm_info) from [<c031b570>] (snd_pcm_info_user+0x34/0x9c) [<c031b570>] (snd_pcm_info_user) from [<c03164a4>] (snd_pcm_control_ioctl+0x274/0x280) [<c03164a4>] (snd_pcm_control_ioctl) from [<c0311458>] (snd_ctl_ioctl+0xc0/0x55c) [<c0311458>] (snd_ctl_ioctl) from [<c00eca84>] (do_vfs_ioctl+0x80/0x31c) [<c00eca84>] (do_vfs_ioctl) from [<c00ecd5c>] (SyS_ioctl+0x3c/0x60) [<c00ecd5c>] (SyS_ioctl) from [<c000e500>] (ret_fast_syscall+0x0/0x48) Code: e1a00005 e59530dc e3a01001 e1a02004 (e5933008) ---[ end trace cb3d9bdb8dfefb3c ]--- This is provoked when the ASoC front end is open along with its backend, (which causes the backend to have a runtime assigned to it) and then the SNDRV_CTL_IOCTL_PCM_INFO is requested for the (visible) backend device. Resolve this by ensuring that ASoC internal backend devices are not visible to userspace, just as the commentry for snd_pcm_new_internal() says it should be. Signed-off-by: Russell King <[email protected]> Acked-by: Mark Brown <[email protected]> Cc: <[email protected]> [v3.4+] Signed-off-by: Takashi Iwai <[email protected]>
2013-10-31serial: omap: fix missing commaPhilippe Proulx1-1/+1
Reported-by: Stephen Rothwell <[email protected]>, Signed-off-by: Philippe Proulx <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-10-31USB: Maintainers change for usb serial driversGreg KH1-50/+3
Johan has been conned^Wgracious in accepting the maintainership of the USB serial drivers, especially as he's been doing all of the real work for the past few years. At the same time, remove a bunch of old entries for USB serial drivers that don't make sense anymore, given that the developers are no longer around, and individual driver maintainerships for tiny things like this is pretty pointless. Acked-by: Johan Hovold <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
2013-10-31s390/mm: page_table_realloc returns failureDominik Dingel1-8/+13
There is a possible race between setting has_pgste and reallocation of the page_table, change the order to fix this. Also page_table_alloc_pgste can fail, in that case we need to backpropagte this as -ENOMEM to the caller of page_table_realloc. Based on a patch by Christian Borntraeger <[email protected]>. Reviewed-by: Martin Schwidefsky <[email protected]> Signed-off-by: Dominik Dingel <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-10-31ARM: mvebu: Add Netgear ReadyNAS 104 boardArnaud Ebalard2-0/+194
Main hardware parts of the (Armada 370 based) NETGEAR ReadyNAS 104 are supported by mainline kernel (USB 3.0 rear ports, USB 2.0 front port, Gigabit controller and PHYs, serial port, LEDs, buttons, SATA ports, G762 fan controller) and referenced in provided .dts file. Some additonal work remains for: - Intersil ISL12057 I2C RTC and Alarm chip: working driver but needs to be splitted for submission of RTC part first; - Front LCD (Winstar 1602G): driver needs to be written - Armada NAND controller (to access onboard 128MB of NAND): support being pushed by @free-electrons people - 4 front SATA LEDs controlled via GPIO brought by NXP PCA9554: driver is available upstream. Not referenced/tested yet. but the device is usable w/o those. Signed-off-by: Arnaud Ebalard <[email protected]> Acked-by: Andrew Lunn <[email protected]> Signed-off-by: Jason Cooper <[email protected]>
2013-10-31SUNRPC: Cleanup xs_destroy()Trond Myklebust1-10/+5
There is no longer any need for a separate xs_local_destroy() helper. Signed-off-by: Trond Myklebust <[email protected]>
2013-10-31SUNRPC: close a rare race in xs_tcp_setup_socket.NeilBrown1-4/+9
We have one report of a crash in xs_tcp_setup_socket. The call path to the crash is: xs_tcp_setup_socket -> inet_stream_connect -> lock_sock_nested. The 'sock' passed to that last function is NULL. The only way I can see this happening is a concurrent call to xs_close: xs_close -> xs_reset_transport -> sock_release -> inet_release inet_release sets: sock->sk = NULL; inet_stream_connect calls lock_sock(sock->sk); which gets NULL. All calls to xs_close are protected by XPRT_LOCKED as are most activations of the workqueue which runs xs_tcp_setup_socket. The exception is xs_tcp_schedule_linger_timeout. So presumably the timeout queued by the later fires exactly when some other code runs xs_close(). To protect against this we can move the cancel_delayed_work_sync() call from xs_destory() to xs_close(). As xs_close is never called from the worker scheduled on ->connect_worker, this can never deadlock. Signed-off-by: NeilBrown <[email protected]> [Trond: Make it safe to call cancel_delayed_work_sync() on AF_LOCAL sockets] Signed-off-by: Trond Myklebust <[email protected]>
2013-10-31MIPS: ralink: fix return value check in rt_timer_probe()Wei Yongjun1-1/+1
In case of error, the function devm_request_and_ioremap() returns NULL pointer not ERR_PTR(). Fix it by using devm_ioremap_resource() instead of devm_request_and_ioremap(). Signed-off-by: Wei Yongjun <[email protected]> Acked-by: John Crispin <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Patchwork: https://patchwork.linux-mips.org/patch/6098/ Signed-off-by: Ralf Baechle <[email protected]>
2013-10-31s390: allow to set gcc -mtune flagHeiko Carstens2-0/+69
Add a new Kconfig choice group which allows to configure how gcc should tune the generated code (via -mtune option). By default the -mtune parameter will match the -march parameter. This is a rather large patch, but I wouldn't know how to make this shorter unfortunately. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-10-31s390/percpu: remove this_cpu_xor() implementationHeiko Carstens1-6/+0
this_cpu_xor() will be removed tree wide during the next merge window. To avoid merge conflicts s390's removal comes via the s390 tree. Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Martin Schwidefsky <[email protected]>
2013-10-31s390/vtime: correct idle time calculationMartin Schwidefsky2-3/+3
Use the ACCESS_ONCE macro for both accesses to idle->sequence in the loops to calculate the idle time. If only one access uses the macro, the compiler is free to cache the value for the second access which can cause endless loops. Cc: [email protected] # 3.6+ Signed-off-by: Martin Schwidefsky <[email protected]>
2013-10-31s390/time: fix get_tod_clock_ext inline assemblyMartin Schwidefsky1-2/+4
The get_tod_clock_ext inline assembly does not specify its output operands correctly. This can cause incorrect code to be generated. Cc: [email protected] # 3.12 Signed-off-by: Martin Schwidefsky <[email protected]>
2013-10-31Input: ALPS - add support for model found on Dell XT2Yunkang Tang1-0/+1
This patch adds support for touchpad found on Dell XT2. It's a dual device with device ID: 73, 00, 14, that comply with "ALPS_PROTO_V2". Signed-off-by: Yunkang Tang <[email protected]> Signed-off-by: Dmitry Torokhov <[email protected]>
2013-10-31Merge branch 'drm-fixes-3.12' of git://people.freedesktop.org/~agd5f/linux ↵Dave Airlie3-3/+4
into drm-fixes Just a few small fixes for radeon (audio regression fix, stability fix, and an endian bug noticed by coverity). * 'drm-fixes-3.12' of git://people.freedesktop.org/~agd5f/linux: drm/radeon/dpm: fix incompatible casting on big endian drm/radeon: disable bapm on KB drm/radeon: use sw CTS/N values for audio on DCE4+
2013-10-30ARM: bcm281xx: Add ARCH_BCM_MOBILE to bcm configChristian Daudt1-0/+1
This patch (re)adds ARCH_BCM_MOBILE option to bcm_defconfig which was accidentally removed by commit 2d58b26550ad ('ARM: bcm_defconfig: Run "make savedefconfig"') Signed-off-by: Christian Daudt <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-30ARM: tegra: fix Tegra114 IOMMU register addressHiroshi Doyu1-3/+3
The IOMMU node's reg property contains completely bogus values! Somehow, this had no practical effect, despite the fact the IOMMU driver appears to be writing to those registers. I suppose that since no HW modules is actually at that address, the writes simply had no effect. Note that I'm not CCing stable here, even though the problem exists as far back as v3.9, simply because this patch doesn't fix any observed issue, and I don't want to run the risk of suddenly writing to some registers and causing a regression. Signed-off-by: Hiroshi Doyu <[email protected]> [swarren, wrote commit description] Signed-off-by: Stephen Warren <[email protected]> Signed-off-by: Olof Johansson <[email protected]>
2013-10-30Merge branch 'akpm' (fixes from Andrew Morton)Linus Torvalds4-7/+8
Merge three fixes from Andrew Morton. * emailed patches from Andrew Morton <[email protected]>: memcg: use __this_cpu_sub() to dec stats to avoid incorrect subtrahend casting percpu: fix this_cpu_sub() subtrahend casting for unsigneds mm/pagewalk.c: fix walk_page_range() access of wrong PTEs
2013-10-30memcg: use __this_cpu_sub() to dec stats to avoid incorrect subtrahend castingGreg Thelen1-1/+1
As of commit 3ea67d06e467 ("memcg: add per cgroup writeback pages accounting") memcg counter errors are possible when moving charged memory to a different memcg. Charge movement occurs when processing writes to memory.force_empty, moving tasks to a memcg with memcg.move_charge_at_immigrate=1, or memcg deletion. An example showing error after memory.force_empty: $ cd /sys/fs/cgroup/memory $ mkdir x $ rm /data/tmp/file $ (echo $BASHPID >> x/tasks && exec mmap_writer /data/tmp/file 1M) & [1] 13600 $ grep ^mapped x/memory.stat mapped_file 1048576 $ echo 13600 > tasks $ echo 1 > x/memory.force_empty $ grep ^mapped x/memory.stat mapped_file 4503599627370496 mapped_file should end with 0. 4503599627370496 == 0x10,0000,0000,0000 == 0x100,0000,0000 pages 1048576 == 0x10,0000 == 0x100 pages This issue only affects the source memcg on 64 bit machines; the destination memcg counters are correct. So the rmdir case is not too important because such counters are soon disappearing with the entire memcg. But the memcg.force_empty and memory.move_charge_at_immigrate=1 cases are larger problems as the bogus counters are visible for the (possibly long) remaining life of the source memcg. The problem is due to memcg use of __this_cpu_from(.., -nr_pages), which is subtly wrong because it subtracts the unsigned int nr_pages (either -1 or -512 for THP) from a signed long percpu counter. When nr_pages=-1, -nr_pages=0xffffffff. On 64 bit machines stat->count[idx] is signed 64 bit. So memcg's attempt to simply decrement a count (e.g. from 1 to 0) boils down to: long count = 1 unsigned int nr_pages = 1 count += -nr_pages /* -nr_pages == 0xffff,ffff */ count is now 0x1,0000,0000 instead of 0 The fix is to subtract the unsigned page count rather than adding its negation. This only works once "percpu: fix this_cpu_sub() subtrahend casting for unsigneds" is applied to fix this_cpu_sub(). Signed-off-by: Greg Thelen <[email protected]> Acked-by: Tejun Heo <[email protected]> Acked-by: Johannes Weiner <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-10-30percpu: fix this_cpu_sub() subtrahend casting for unsignedsGreg Thelen2-5/+6
this_cpu_sub() is implemented as negation and addition. This patch casts the adjustment to the counter type before negation to sign extend the adjustment. This helps in cases where the counter type is wider than an unsigned adjustment. An alternative to this patch is to declare such operations unsupported, but it seemed useful to avoid surprises. This patch specifically helps the following example: unsigned int delta = 1 preempt_disable() this_cpu_write(long_counter, 0) this_cpu_sub(long_counter, delta) preempt_enable() Before this change long_counter on a 64 bit machine ends with value 0xffffffff, rather than 0xffffffffffffffff. This is because this_cpu_sub(pcp, delta) boils down to this_cpu_add(pcp, -delta), which is basically: long_counter = 0 + 0xffffffff Also apply the same cast to: __this_cpu_sub() __this_cpu_sub_return() this_cpu_sub_return() All percpu_test.ko passes, especially the following cases which previously failed: l -= ui_one; __this_cpu_sub(long_counter, ui_one); CHECK(l, long_counter, -1); l -= ui_one; this_cpu_sub(long_counter, ui_one); CHECK(l, long_counter, -1); CHECK(l, long_counter, 0xffffffffffffffff); ul -= ui_one; __this_cpu_sub(ulong_counter, ui_one); CHECK(ul, ulong_counter, -1); CHECK(ul, ulong_counter, 0xffffffffffffffff); ul = this_cpu_sub_return(ulong_counter, ui_one); CHECK(ul, ulong_counter, 2); ul = __this_cpu_sub_return(ulong_counter, ui_one); CHECK(ul, ulong_counter, 1); Signed-off-by: Greg Thelen <[email protected]> Acked-by: Tejun Heo <[email protected]> Acked-by: Johannes Weiner <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-10-30mm/pagewalk.c: fix walk_page_range() access of wrong PTEsChen LinX1-1/+1
When walk_page_range walk a memory map's page tables, it'll skip VM_PFNMAP area, then variable 'next' will to assign to vma->vm_end, it maybe larger than 'end'. In next loop, 'addr' will be larger than 'next'. Then in /proc/XXXX/pagemap file reading procedure, the 'addr' will growing forever in pagemap_pte_range, pte_to_pagemap_entry will access the wrong pte. BUG: Bad page map in process procrank pte:8437526f pmd:785de067 addr:9108d000 vm_flags:00200073 anon_vma:f0d99020 mapping: (null) index:9108d CPU: 1 PID: 4974 Comm: procrank Tainted: G B W O 3.10.1+ #1 Call Trace: dump_stack+0x16/0x18 print_bad_pte+0x114/0x1b0 vm_normal_page+0x56/0x60 pagemap_pte_range+0x17a/0x1d0 walk_page_range+0x19e/0x2c0 pagemap_read+0x16e/0x200 vfs_read+0x84/0x150 SyS_read+0x4a/0x80 syscall_call+0x7/0xb Signed-off-by: Liu ShuoX <[email protected]> Signed-off-by: Chen LinX <[email protected]> Acked-by: Kirill A. Shutemov <[email protected]> Reviewed-by: Naoya Horiguchi <[email protected]> Cc: <[email protected]> [3.10.x+] Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2013-10-30doc:net: Fix typo in Documentation/networkingMasanari Iida11-20/+20
Correct spelling typo in Documentation/networking Signed-off-by: Masanari Iida <[email protected]> Acked-by: Randy Dunlap <[email protected]> Signed-off-by: David S. Miller <[email protected]>
2013-10-30Merge tag 'bcm-for-3.13-soc2' of git://github.com/broadcom/bcm11351 into ↵Olof Johansson5-12/+24
next/soc From Christian Daudt, BCM changes for 3.13/soc. Mostly cleanups and renaming of kernel config options, pushing down the mobile platforms one level in the naming scheme, keeping ARCH_BCM as a wider family config option. * tag 'bcm-for-3.13-soc2' of git://github.com/broadcom/bcm11351: ARM: bcm_defconfig: Run "make savedefconfig" ARM: bcm281xx: Add ARCH Timers to config rename ARCH_BCM to ARCH_BCM_MOBILE (mach-bcm) ARM: bcm281xx: more descriptive machine string ARM: bcm281xx: Enable GPIO driver Signed-off-by: Olof Johansson <[email protected]>
2013-10-30mm: list_lru: fix almost infinite loop causing effective livelockRussell King1-1/+2
I've seen a fair number of issues with kswapd and other processes appearing to get stuck in v3.12-rc. Using sysrq-p many times seems to indicate that it gets stuck somewhere in list_lru_walk_node(), called from prune_icache_sb() and super_cache_scan(). I never seem to be able to trigger a calltrace for functions above that point. So I decided to add the following to super_cache_scan(): @@ -81,10 +81,14 @@ static unsigned long super_cache_scan(struct shrinker *shrink, inodes = list_lru_count_node(&sb->s_inode_lru, sc->nid); dentries = list_lru_count_node(&sb->s_dentry_lru, sc->nid); total_objects = dentries + inodes + fs_objects + 1; +printk("%s:%u: %s: dentries %lu inodes %lu total %lu\n", current->comm, current->pid, __func__, dentries, inodes, total_objects); /* proportion the scan between the caches */ dentries = mult_frac(sc->nr_to_scan, dentries, total_objects); inodes = mult_frac(sc->nr_to_scan, inodes, total_objects); +printk("%s:%u: %s: dentries %lu inodes %lu\n", current->comm, current->pid, __func__, dentries, inodes); +BUG_ON(dentries == 0); +BUG_ON(inodes == 0); /* * prune the dcache first as the icache is pinned by it, then @@ -99,7 +103,7 @@ static unsigned long super_cache_scan(struct shrinker *shrink, freed += sb->s_op->free_cached_objects(sb, fs_objects, sc->nid); } - +printk("%s:%u: %s: dentries %lu inodes %lu freed %lu\n", current->comm, current->pid, __func__, dentries, inodes, freed); drop_super(sb); return freed; } and shortly thereafter, having applied some pressure, I got this: update-apt-xapi:1616: super_cache_scan: dentries 25632 inodes 2 total 25635 update-apt-xapi:1616: super_cache_scan: dentries 1023 inodes 0 ------------[ cut here ]------------ Kernel BUG at c0101994 [verbose debug info unavailable] Internal error: Oops - BUG: 0 [#3] SMP ARM Modules linked in: fuse rfcomm bnep bluetooth hid_cypress CPU: 0 PID: 1616 Comm: update-apt-xapi Tainted: G D 3.12.0-rc7+ #154 task: daea1200 ti: c3bf8000 task.ti: c3bf8000 PC is at super_cache_scan+0x1c0/0x278 LR is at trace_hardirqs_on+0x14/0x18 Process update-apt-xapi (pid: 1616, stack limit = 0xc3bf8240) ... Backtrace: (super_cache_scan) from [<c00cd69c>] (shrink_slab+0x254/0x4c8) (shrink_slab) from [<c00d09a0>] (try_to_free_pages+0x3a0/0x5e0) (try_to_free_pages) from [<c00c59cc>] (__alloc_pages_nodemask+0x5) (__alloc_pages_nodemask) from [<c00e07c0>] (__pte_alloc+0x2c/0x13) (__pte_alloc) from [<c00e3a70>] (handle_mm_fault+0x84c/0x914) (handle_mm_fault) from [<c001a4cc>] (do_page_fault+0x1f0/0x3bc) (do_page_fault) from [<c001a7b0>] (do_translation_fault+0xac/0xb8) (do_translation_fault) from [<c000840c>] (do_DataAbort+0x38/0xa0) (do_DataAbort) from [<c00133f8>] (__dabt_usr+0x38/0x40) Notice that we had a very low number of inodes, which were reduced to zero my mult_frac(). Now, prune_icache_sb() calls list_lru_walk_node() passing that number of inodes (0) into that as the number of objects to scan: long prune_icache_sb(struct super_block *sb, unsigned long nr_to_scan, int nid) { LIST_HEAD(freeable); long freed; freed = list_lru_walk_node(&sb->s_inode_lru, nid, inode_lru_isolate, &freeable, &nr_to_scan); which does: unsigned long list_lru_walk_node(struct list_lru *lru, int nid, list_lru_walk_cb isolate, void *cb_arg, unsigned long *nr_to_walk) { struct list_lru_node *nlru = &lru->node[nid]; struct list_head *item, *n; unsigned long isolated = 0; spin_lock(&nlru->lock); restart: list_for_each_safe(item, n, &nlru->list) { enum lru_status ret; /* * decrement nr_to_walk first so that we don't livelock if we * get stuck on large numbesr of LRU_RETRY items */ if (--(*nr_to_walk) == 0) break; So, if *nr_to_walk was zero when this function was entered, that means we're wanting to operate on (~0UL)+1 objects - which might as well be infinite. Clearly this is not correct behaviour. If we think about the behaviour of this function when *nr_to_walk is 1, then clearly it's wrong - we decrement first and then test for zero - which results in us doing nothing at all. A post-decrement would give the desired behaviour - we'd try to walk one object and one object only if *nr_to_walk were one. It also gives the correct behaviour for zero - we exit at this point. Fixes: 5cedf721a7cd ("list_lru: fix broken LRU_RETRY behaviour") Signed-off-by: Russell King <[email protected]> Cc: Dave Chinner <[email protected]> Cc: Al Viro <[email protected]> Cc: Andrew Morton <[email protected]> [ Modified to make sure we never underflow the count: this function gets called in a loop, so the 0 -> ~0ul transition is dangerous - Linus ] Signed-off-by: Linus Torvalds <[email protected]>
2013-10-30ARM: kirkwood: add support for OpenBlocks A7 platformThomas Petazzoni2-2/+226
The OpenBlocks A7 board is designed and sold by PlatHome, and based on a Kirkwood 6283 Marvell SoC. It is quite similar to the OpenBlocks A6 already supported in the kernel, with the following main differences: - The A6 uses a RTC on I2C, while the A7 uses the internal SoC RTC. - The A6 has one Ethernet port, while the A7 has two Ethernet ports - The A6 has only one USB port, while the A7 integrates a USB hub, which provides two front-side USB port, and an internal USB port as well. - The A6 has 512 MB of RAM, while the A7 has 1 GB of RAM. - Slightly different GPIOs for some functions. Signed-off-by: Thomas Petazzoni <[email protected]> Acked-by: Andrew Lunn <[email protected]> Acked-by: Gregory CLEMENT <[email protected]> Signed-off-by: Jason Cooper <[email protected]>
2013-10-30Merge tag 'tty-3.12-rc8' of ↵Linus Torvalds1-7/+2
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial fixes from Greg KH: "Here are 3 tiny fixes that are needed for 3.12-final for some serial drivers. One of them is a revert of a broken patch, and two others are fixes for reported bugs. All of these have been in linux-next for a while, I forgot I had not sent them to you yet, my fault" (Actually, Greg, you _had_ sent two of the three, so this pulls in just one actual new fix) * tag 'tty-3.12-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty/serial: at91: fix uart/usart selection for older products
2013-10-30Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds7-54/+168
Pull drm fixes from Dave Airlie: "Mainly Intel regression fixes and quirks, along with a simple one liner to fix rendernodes ioctl access (off by default, but testers want to test it)" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm: allow DRM_IOCTL_VERSION on render-nodes drm/i915: Fix the PPT fdi lane bifurcate state handling on ivb drm/i915: No LVDS hardware on Intel D410PT and D425KT drm/i915/dp: workaround BIOS eDP bpp clamping issue drm/i915: Add HSW CRT output readout support drm/i915: Add support for pipe_bpp readout
2013-10-30Merge tag 'sound-3.12' of ↵Linus Torvalds3-4/+22
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A few small HD-audio regression fixes, mostly for stable kernels, too" * tag 'sound-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Fix silent headphone on Thinkpads with AD1984A codec ALSA: hda - Add missing initial vmaster hook at build_controls callback ALSA: hda - Fix unbalanced runtime PM refcount after S3/S4
2013-10-30Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds2-2/+2
Pull KVM fixes from Paolo Bonzini: "Fixes for the 3.12 debugfs problem - removing the duplicate directory name, and using a better the error code" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: use a more sensible error number when debugfs directory creation fails KVM: Fix modprobe failure for kvm_intel/kvm_amd
2013-10-30Staging: sb105x: info leak in mp_get_count()Dan Carpenter1-1/+1
The icount.reserved[] array isn't initialized so it leaks stack information to userspace. Reported-by: Nico Golde <[email protected]> Reported-by: Fabian Yamaguchi <[email protected]> Signed-off-by: Dan Carpenter <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2013-10-30Staging: bcm: info leak in ioctlDan Carpenter1-0/+1
The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel information to user space. Reported-by: Nico Golde <[email protected]> Reported-by: Fabian Yamaguchi <[email protected]> Signed-off-by: Dan Carpenter <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
2013-10-30staging: wlags49_h2: buffer overflow setting station nameDan Carpenter1-3/+6
We need to check the length parameter before doing the memcpy(). I've actually changed it to strlcpy() as well so that it's NUL terminated. You need CAP_NET_ADMIN to trigger these so it's not the end of the world. Reported-by: Nico Golde <[email protected]> Reported-by: Fabian Yamaguchi <[email protected]> Signed-off-by: Dan Carpenter <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.