)]}'
{
  "log": [
    {
      "commit": "cd34de10471a5ddad397739fae33555d47e53769",
      "tree": "99e2e27194d72d5767093568a956751b835fdf43",
      "parents": [
        "cf85cc93b24891b7e57b1d9939742b5774570b19"
      ],
      "author": {
        "name": "Colin Cross",
        "email": "ccross@android.com",
        "time": "Mon Feb 10 13:16:29 2014 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 13 11:51:21 2014 -0800"
      },
      "message": "3.4.y: timekeeping: fix 32-bit overflow in get_monotonic_boottime\n\nfixed upstream in v3.6 by ec145babe754f9ea1079034a108104b6001e001c\n\nget_monotonic_boottime adds three nanonsecond values stored\nin longs, followed by an s64.  If the long values are all\nclose to 1e9 the first three additions can overflow and\nbecome negative when added to the s64.  Cast the first\nvalue to s64 so that all additions are 64 bit.\n\nSigned-off-by: Colin Cross \u003cccross@android.com\u003e\n[jstultz: Fished this out of the AOSP commong.git tree. This was\nfixed upstream in v3.6 by ec145babe754f9ea1079034a108104b6001e001c]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "cf85cc93b24891b7e57b1d9939742b5774570b19",
      "tree": "2a4719b1695dc561a13ea93b3083a60bca871e7b",
      "parents": [
        "ab99a94d45f5db1ed178ed986f93b938bc018a87"
      ],
      "author": {
        "name": "John Stultz",
        "email": "john.stultz@linaro.org",
        "time": "Tue Dec 10 17:18:18 2013 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 13 11:51:20 2014 -0800"
      },
      "message": "timekeeping: Avoid possible deadlock from clock_was_set_delayed\n\ncommit 6fdda9a9c5db367130cf32df5d6618d08b89f46a upstream.\n\nAs part of normal operaions, the hrtimer subsystem frequently calls\ninto the timekeeping code, creating a locking order of\n  hrtimer locks -\u003e timekeeping locks\n\nclock_was_set_delayed() was suppoed to allow us to avoid deadlocks\nbetween the timekeeping the hrtimer subsystem, so that we could\nnotify the hrtimer subsytem the time had changed while holding\nthe timekeeping locks. This was done by scheduling delayed work\nthat would run later once we were out of the timekeeing code.\n\nBut unfortunately the lock chains are complex enoguh that in\nscheduling delayed work, we end up eventually trying to grab\nan hrtimer lock.\n\nSasha Levin noticed this in testing when the new seqlock lockdep\nenablement triggered the following (somewhat abrieviated) message:\n\n[  251.100221] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[  251.100221] [ INFO: possible circular locking dependency detected ]\n[  251.100221] 3.13.0-rc2-next-20131206-sasha-00005-g8be2375-dirty #4053 Not tainted\n[  251.101967] -------------------------------------------------------\n[  251.101967] kworker/10:1/4506 is trying to acquire lock:\n[  251.101967]  (timekeeper_seq){----..}, at: [\u003cffffffff81160e96\u003e] retrigger_next_event+0x56/0x70\n[  251.101967]\n[  251.101967] but task is already holding lock:\n[  251.101967]  (hrtimer_bases.lock#11){-.-...}, at: [\u003cffffffff81160e7c\u003e] retrigger_next_event+0x3c/0x70\n[  251.101967]\n[  251.101967] which lock already depends on the new lock.\n[  251.101967]\n[  251.101967]\n[  251.101967] the existing dependency chain (in reverse order) is:\n[  251.101967]\n-\u003e #5 (hrtimer_bases.lock#11){-.-...}:\n[snipped]\n-\u003e #4 (\u0026rt_b-\u003ert_runtime_lock){-.-...}:\n[snipped]\n-\u003e #3 (\u0026rq-\u003elock){-.-.-.}:\n[snipped]\n-\u003e #2 (\u0026p-\u003epi_lock){-.-.-.}:\n[snipped]\n-\u003e #1 (\u0026(\u0026pool-\u003elock)-\u003erlock){-.-...}:\n[  251.101967]        [\u003cffffffff81194803\u003e] validate_chain+0x6c3/0x7b0\n[  251.101967]        [\u003cffffffff81194d9d\u003e] __lock_acquire+0x4ad/0x580\n[  251.101967]        [\u003cffffffff81194ff2\u003e] lock_acquire+0x182/0x1d0\n[  251.101967]        [\u003cffffffff84398500\u003e] _raw_spin_lock+0x40/0x80\n[  251.101967]        [\u003cffffffff81153e69\u003e] __queue_work+0x1a9/0x3f0\n[  251.101967]        [\u003cffffffff81154168\u003e] queue_work_on+0x98/0x120\n[  251.101967]        [\u003cffffffff81161351\u003e] clock_was_set_delayed+0x21/0x30\n[  251.101967]        [\u003cffffffff811c4bd1\u003e] do_adjtimex+0x111/0x160\n[  251.101967]        [\u003cffffffff811e2711\u003e] compat_sys_adjtimex+0x41/0x70\n[  251.101967]        [\u003cffffffff843a4b49\u003e] ia32_sysret+0x0/0x5\n[  251.101967]\n-\u003e #0 (timekeeper_seq){----..}:\n[snipped]\n[  251.101967] other info that might help us debug this:\n[  251.101967]\n[  251.101967] Chain exists of:\n  timekeeper_seq --\u003e \u0026rt_b-\u003ert_runtime_lock --\u003e hrtimer_bases.lock#11\n\n[  251.101967]  Possible unsafe locking scenario:\n[  251.101967]\n[  251.101967]        CPU0                    CPU1\n[  251.101967]        ----                    ----\n[  251.101967]   lock(hrtimer_bases.lock#11);\n[  251.101967]                                lock(\u0026rt_b-\u003ert_runtime_lock);\n[  251.101967]                                lock(hrtimer_bases.lock#11);\n[  251.101967]   lock(timekeeper_seq);\n[  251.101967]\n[  251.101967]  *** DEADLOCK ***\n[  251.101967]\n[  251.101967] 3 locks held by kworker/10:1/4506:\n[  251.101967]  #0:  (events){.+.+.+}, at: [\u003cffffffff81154960\u003e] process_one_work+0x200/0x530\n[  251.101967]  #1:  (hrtimer_work){+.+...}, at: [\u003cffffffff81154960\u003e] process_one_work+0x200/0x530\n[  251.101967]  #2:  (hrtimer_bases.lock#11){-.-...}, at: [\u003cffffffff81160e7c\u003e] retrigger_next_event+0x3c/0x70\n[  251.101967]\n[  251.101967] stack backtrace:\n[  251.101967] CPU: 10 PID: 4506 Comm: kworker/10:1 Not tainted 3.13.0-rc2-next-20131206-sasha-00005-g8be2375-dirty #4053\n[  251.101967] Workqueue: events clock_was_set_work\n\nSo the best solution is to avoid calling clock_was_set_delayed() while\nholding the timekeeping lock, and instead using a flag variable to\ndecide if we should call clock_was_set() once we\u0027ve released the locks.\n\nThis works for the case here, where the do_adjtimex() was the deadlock\ntrigger point. Unfortuantely, in update_wall_time() we still hold\nthe jiffies lock, which would deadlock with the ipi triggered by\nclock_was_set(), preventing us from calling it even after we drop the\ntimekeeping lock. So instead call clock_was_set_delayed() at that point.\n\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Richard Cochran \u003crichardcochran@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Sasha Levin \u003csasha.levin@oracle.com\u003e\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nTested-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n"
    },
    {
      "commit": "dbf3239455b155c3e72deacda93ef3a041e190c9",
      "tree": "c7a8cfce370fa0de4cdeaab1b75925061fe9ccf1",
      "parents": [
        "f61eb9ceb26cee3fdbb8c7a4920f171f7661fb4f"
      ],
      "author": {
        "name": "Ying Xue",
        "email": "ying.xue@windriver.com",
        "time": "Tue Jul 17 15:03:43 2012 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 13 11:51:19 2014 -0800"
      },
      "message": "sched/rt: Avoid updating RT entry timeout twice within one tick period\n\ncommit 57d2aa00dcec67afa52478730f2b524521af14fb upstream.\n\nThe issue below was found in 2.6.34-rt rather than mainline rt\nkernel, but the issue still exists upstream as well.\n\nSo please let me describe how it was noticed on 2.6.34-rt:\n\nOn this version, each softirq has its own thread, it means there\nis at least one RT FIFO task per cpu. The priority of these\ntasks is set to 49 by default. If user launches an RT FIFO task\nwith priority lower than 49 of softirq RT tasks, it\u0027s possible\nthere are two RT FIFO tasks enqueued one cpu runqueue at one\nmoment. By current strategy of balancing RT tasks, when it comes\nto RT tasks, we really need to put them off to a CPU that they\ncan run on as soon as possible. Even if it means a bit of cache\nline flushing, we want RT tasks to be run with the least latency.\n\nWhen the user RT FIFO task which just launched before is\nrunning, the sched timer tick of the current cpu happens. In this\ntick period, the timeout value of the user RT task will be\nupdated once. Subsequently, we try to wake up one softirq RT\ntask on its local cpu. As the priority of current user RT task\nis lower than the softirq RT task, the current task will be\npreempted by the higher priority softirq RT task. Before\npreemption, we check to see if current can readily move to a\ndifferent cpu. If so, we will reschedule to allow the RT push logic\nto try to move current somewhere else. Whenever the woken\nsoftirq RT task runs, it first tries to migrate the user FIFO RT\ntask over to a cpu that is running a task of lesser priority. If\nmigration is done, it will send a reschedule request to the found\ncpu by IPI interrupt. Once the target cpu responds the IPI\ninterrupt, it will pick the migrated user RT task to preempt its\ncurrent task. When the user RT task is running on the new cpu,\nthe sched timer tick of the cpu fires. So it will tick the user\nRT task again. This also means the RT task timeout value will be\nupdated again. As the migration may be done in one tick period,\nit means the user RT task timeout value will be updated twice\nwithin one tick.\n\nIf we set a limit on the amount of cpu time for the user RT task\nby setrlimit(RLIMIT_RTTIME), the SIGXCPU signal should be posted\nupon reaching the soft limit.\n\nBut exactly when the SIGXCPU signal should be sent depends on the\nRT task timeout value. In fact the timeout mechanism of sending\nthe SIGXCPU signal assumes the RT task timeout is increased once\nevery tick.\n\nHowever, currently the timeout value may be added twice per\ntick. So it results in the SIGXCPU signal being sent earlier\nthan expected.\n\nTo solve this issue, we prevent the timeout value from increasing\ntwice within one tick time by remembering the jiffies value of\nlast updating the timeout. As long as the RT task\u0027s jiffies is\ndifferent with the global jiffies value, we allow its timeout to\nbe updated.\n\nSigned-off-by: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: Fan Du \u003cfan.du@windriver.com\u003e\nReviewed-by: Yong Zhang \u003cyong.zhang0@gmail.com\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1342508623-2887-1-git-send-email-ying.xue@windriver.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n[ lizf: backported to 3.4: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "f61eb9ceb26cee3fdbb8c7a4920f171f7661fb4f",
      "tree": "7ef1b69d19fdc57f57ce58dc78988ce4a653aa8e",
      "parents": [
        "1e5c13ec422f665432bfc9f7c5fc1f9fd614afd3"
      ],
      "author": {
        "name": "Peter Boonstoppel",
        "email": "pboonstoppel@nvidia.com",
        "time": "Thu Aug 09 15:34:47 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 13 11:51:19 2014 -0800"
      },
      "message": "sched: Unthrottle rt runqueues in __disable_runtime()\n\ncommit a4c96ae319b8047f62dedbe1eac79e321c185749 upstream.\n\nmigrate_tasks() uses _pick_next_task_rt() to get tasks from the\nreal-time runqueues to be migrated. When rt_rq is throttled\n_pick_next_task_rt() won\u0027t return anything, in which case\nmigrate_tasks() can\u0027t move all threads over and gets stuck in an\ninfinite loop.\n\nInstead unthrottle rt runqueues before migrating tasks.\n\nAdditionally: move unthrottle_offline_cfs_rqs() to rq_offline_fair()\n\nSigned-off-by: Peter Boonstoppel \u003cpboonstoppel@nvidia.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Paul Turner \u003cpjt@google.com\u003e\nLink: http://lkml.kernel.org/r/5FBF8E85CA34454794F0F7ECBA79798F379D3648B7@HQMAIL04.nvidia.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n[ lizf: backported to 3.4: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "1e5c13ec422f665432bfc9f7c5fc1f9fd614afd3",
      "tree": "8588210c14890e4a797a9ea5402d6fa42ba3ceb6",
      "parents": [
        "21b53baf40aecb134593ec74eb787f16c569cfc5"
      ],
      "author": {
        "name": "Mike Galbraith",
        "email": "efault@gmx.de",
        "time": "Tue Aug 07 10:02:38 2012 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 13 11:51:18 2014 -0800"
      },
      "message": "sched,rt: fix isolated CPUs leaving root_task_group indefinitely throttled\n\ncommit e221d028bb08b47e624c5f0a31732c642db9d19a upstream.\n\nRoot task group bandwidth replenishment must service all CPUs, regardless of\nwhere the timer was last started, and regardless of the isolation mechanism,\nlest \u0027Quoth the Raven, \"Nevermore\"\u0027 become rt scheduling policy.\n\nSigned-off-by: Mike Galbraith \u003cefault@gmx.de\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/1344326558.6968.25.camel@marge.simpson.net\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "21b53baf40aecb134593ec74eb787f16c569cfc5",
      "tree": "c4c8bb46216c1baf4fe84d8787f5f6b7e01fe2f9",
      "parents": [
        "d5c20298b6d817b069c69d94df9cd8ed76b2ff15"
      ],
      "author": {
        "name": "Colin Cross",
        "email": "ccross@android.com",
        "time": "Wed May 16 21:34:23 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 13 11:51:18 2014 -0800"
      },
      "message": "sched/rt: Fix SCHED_RR across cgroups\n\ncommit 454c79999f7eaedcdf4c15c449e43902980cbdf5 upstream.\n\ntask_tick_rt() has an optimization to only reschedule SCHED_RR tasks\nif they were the only element on their rq.  However, with cgroups\na SCHED_RR task could be the only element on its per-cgroup rq but\nstill be competing with other SCHED_RR tasks in its parent\u0027s\ncgroup.  In this case, the SCHED_RR task in the child cgroup would\nnever yield at the end of its timeslice.  If the child cgroup\nrt_runtime_us was the same as the parent cgroup rt_runtime_us,\nthe task in the parent cgroup would starve completely.\n\nModify task_tick_rt() to check that the task is the only task on its\nrq, and that the each of the scheduling entities of its ancestors\nis also the only entity on its rq.\n\nSigned-off-by: Colin Cross \u003cccross@android.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/r/1337229266-15798-1-git-send-email-ccross@android.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "9af6b695ac764184cdbdd42b77da3e600d337d14",
      "tree": "c4a5ae98b8872f62d290396b457f72d57ac72330",
      "parents": [
        "03d35a39f4de9f2e9d7fbc5c2d03dbcc5b882df7"
      ],
      "author": {
        "name": "Paul Turner",
        "email": "pjt@google.com",
        "time": "Wed Oct 16 11:16:27 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 15 15:27:12 2014 -0800"
      },
      "message": "sched: Guarantee new group-entities always have weight\n\ncommit 0ac9b1c21874d2490331233b3242085f8151e166 upstream.\n\nCurrently, group entity load-weights are initialized to zero. This\nadmits some races with respect to the first time they are re-weighted in\nearlty use. ( Let g[x] denote the se for \"g\" on cpu \"x\". )\n\nSuppose that we have root-\u003ea and that a enters a throttled state,\nimmediately followed by a[0]-\u003et1 (the only task running on cpu[0])\nblocking:\n\n  put_prev_task(group_cfs_rq(a[0]), t1)\n  put_prev_entity(..., t1)\n  check_cfs_rq_runtime(group_cfs_rq(a[0]))\n  throttle_cfs_rq(group_cfs_rq(a[0]))\n\nThen, before unthrottling occurs, let a[0]-\u003eb[0]-\u003et2 wake for the first\ntime:\n\n  enqueue_task_fair(rq[0], t2)\n  enqueue_entity(group_cfs_rq(b[0]), t2)\n  enqueue_entity_load_avg(group_cfs_rq(b[0]), t2)\n  account_entity_enqueue(group_cfs_ra(b[0]), t2)\n  update_cfs_shares(group_cfs_rq(b[0]))\n  \u003c skipped because b is part of a throttled hierarchy \u003e\n  enqueue_entity(group_cfs_rq(a[0]), b[0])\n  ...\n\nWe now have b[0] enqueued, yet group_cfs_rq(a[0])-\u003eload.weight \u003d\u003d 0\nwhich violates invariants in several code-paths. Eliminate the\npossibility of this by initializing group entity weight.\n\nSigned-off-by: Paul Turner \u003cpjt@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20131016181627.22647.47543.stgit@sword-of-the-dawn.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Chris J Arges \u003cchris.j.arges@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "03d35a39f4de9f2e9d7fbc5c2d03dbcc5b882df7",
      "tree": "be90a817103d24c521ba427819374fd0600cef40",
      "parents": [
        "9b318052acd24780f4dba1349ef3a30a7aef52ad"
      ],
      "author": {
        "name": "Ben Segall",
        "email": "bsegall@google.com",
        "time": "Wed Oct 16 11:16:22 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 15 15:27:11 2014 -0800"
      },
      "message": "sched: Fix hrtimer_cancel()/rq-\u003elock deadlock\n\ncommit 927b54fccbf04207ec92f669dce6806848cbec7d upstream.\n\n__start_cfs_bandwidth calls hrtimer_cancel while holding rq-\u003elock,\nwaiting for the hrtimer to finish. However, if sched_cfs_period_timer\nruns for another loop iteration, the hrtimer can attempt to take\nrq-\u003elock, resulting in deadlock.\n\nFix this by ensuring that cfs_b-\u003etimer_active is cleared only if the\n_latest_ call to do_sched_cfs_period_timer is returning as idle. Then\n__start_cfs_bandwidth can just call hrtimer_try_to_cancel and wait for\nthat to succeed or timer_active \u003d\u003d 1.\n\nSigned-off-by: Ben Segall \u003cbsegall@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: pjt@google.com\nLink: http://lkml.kernel.org/r/20131016181622.22647.16643.stgit@sword-of-the-dawn.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Chris J Arges \u003cchris.j.arges@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "9b318052acd24780f4dba1349ef3a30a7aef52ad",
      "tree": "0e64c6925ec778aee88dad406f04c83763ee210c",
      "parents": [
        "16e7480c23d33d9475d45be92c1ddf218575a647"
      ],
      "author": {
        "name": "Ben Segall",
        "email": "bsegall@google.com",
        "time": "Wed Oct 16 11:16:17 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 15 15:27:11 2014 -0800"
      },
      "message": "sched: Fix cfs_bandwidth misuse of hrtimer_expires_remaining\n\ncommit db06e78cc13d70f10877e0557becc88ab3ad2be8 upstream.\n\nhrtimer_expires_remaining does not take internal hrtimer locks and thus\nmust be guarded against concurrent __hrtimer_start_range_ns (but\nreturning HRTIMER_RESTART is safe). Use cfs_b-\u003elock to make it safe.\n\nSigned-off-by: Ben Segall \u003cbsegall@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: pjt@google.com\nLink: http://lkml.kernel.org/r/20131016181617.22647.73829.stgit@sword-of-the-dawn.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Chris J Arges \u003cchris.j.arges@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "16e7480c23d33d9475d45be92c1ddf218575a647",
      "tree": "7cf3d25a05f42f95407ab5ea844d88ce451164ec",
      "parents": [
        "a63f31f1f2cdb459b121f644ccbd07ae84f45d4e"
      ],
      "author": {
        "name": "Ben Segall",
        "email": "bsegall@google.com",
        "time": "Wed Oct 16 11:16:12 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 15 15:27:11 2014 -0800"
      },
      "message": "sched: Fix race on toggling cfs_bandwidth_used\n\ncommit 1ee14e6c8cddeeb8a490d7b54cd9016e4bb900b4 upstream.\n\nWhen we transition cfs_bandwidth_used to false, any currently\nthrottled groups will incorrectly return false from cfs_rq_throttled.\nWhile tg_set_cfs_bandwidth will unthrottle them eventually, currently\nrunning code (including at least dequeue_task_fair and\ndistribute_cfs_runtime) will cause errors.\n\nFix this by turning off cfs_bandwidth_used only after unthrottling all\ncfs_rqs.\n\nTested: toggle bandwidth back and forth on a loaded cgroup. Caused\ncrashes in minutes without the patch, hasn\u0027t crashed with it.\n\nSigned-off-by: Ben Segall \u003cbsegall@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: pjt@google.com\nLink: http://lkml.kernel.org/r/20131016181611.22647.80365.stgit@sword-of-the-dawn.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Chris J Arges \u003cchris.j.arges@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "dfb473b35096a0ffae221c7eeb49c34882ea6f9c",
      "tree": "a071f807c029cc0d39a46bceffea0f7c7990f7f3",
      "parents": [
        "05bbcdd32afbfd520c71ae8104a8bf531aed9163"
      ],
      "author": {
        "name": "Ben Segall",
        "email": "bsegall@google.com",
        "time": "Wed Oct 16 11:16:32 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 08 09:42:12 2014 -0800"
      },
      "message": "sched: Avoid throttle_cfs_rq() racing with period_timer stopping\n\ncommit f9f9ffc237dd924f048204e8799da74f9ecf40cf upstream.\n\nthrottle_cfs_rq() doesn\u0027t check to make sure that period_timer is running,\nand while update_curr/assign_cfs_runtime does, a concurrently running\nperiod_timer on another cpu could cancel itself between this cpu\u0027s\nupdate_curr and throttle_cfs_rq(). If there are no other cfs_rqs running\nin the tg to restart the timer, this causes the cfs_rq to be stranded\nforever.\n\nFix this by calling __start_cfs_bandwidth() in throttle if the timer is\ninactive.\n\n(Also add some sched_debug lines for cfs_bandwidth.)\n\nTested: make a run/sleep task in a cgroup, loop switching the cgroup\nbetween 1ms/100ms quota and unlimited, checking for timer_active\u003d0 and\nthrottled\u003d1 as a failure. With the throttle_cfs_rq() change commented out\nthis fails, with the full patch it passes.\n\nSigned-off-by: Ben Segall \u003cbsegall@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: pjt@google.com\nLink: http://lkml.kernel.org/r/20131016181632.22647.84174.stgit@sword-of-the-dawn.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Chris J Arges \u003cchris.j.arges@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "3f8878956c833443d6c6e498e9ed6a18ee30e0f5",
      "tree": "4d82b3f085f1085301ebee2c9415ff13c09af66b",
      "parents": [
        "a1192c0e5d037def6763f3873d3340615c241fe7"
      ],
      "author": {
        "name": "Kirill Tkhai",
        "email": "tkhai@yandex.ru",
        "time": "Wed Nov 27 19:59:13 2013 +0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 08 09:42:11 2014 -0800"
      },
      "message": "sched/rt: Fix rq\u0027s cpupri leak while enqueue/dequeue child RT entities\n\ncommit 757dfcaa41844595964f1220f1d33182dae49976 upstream.\n\nThis patch touches the RT group scheduling case.\n\nFunctions inc_rt_prio_smp() and dec_rt_prio_smp() change (global) rq\u0027s\npriority, while rt_rq passed to them may be not the top-level rt_rq.\nThis is wrong, because changing of priority on a child level does not\nguarantee that the priority is the highest all over the rq. So, this\nleak makes RT balancing unusable.\n\nThe short example: the task having the highest priority among all rq\u0027s\nRT tasks (no one other task has the same priority) are waking on a\nthrottle rt_rq.  The rq\u0027s cpupri is set to the task\u0027s priority\nequivalent, but real rq-\u003ert.highest_prio.curr is less.\n\nThe patch below fixes the problem.\n\nSigned-off-by: Kirill Tkhai \u003ctkhai@yandex.ru\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCC: Steven Rostedt \u003crostedt@goodmis.org\u003e\nLink: http://lkml.kernel.org/r/49231385567953@web4m.yandex.ru\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "09951c9b33f8cfdc0e8c4e03fe83bc66c9d908dc",
      "tree": "4b5081c15d8231b7cb2adbb0d06a6e9f0d531150",
      "parents": [
        "58c2314ac41e8f24a2a594bd866915e38de9648e"
      ],
      "author": {
        "name": "Miao Xie",
        "email": "miaox@cn.fujitsu.com",
        "time": "Mon Dec 16 15:20:01 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jan 08 09:42:10 2014 -0800"
      },
      "message": "ftrace: Initialize the ftrace profiler for each possible cpu\n\ncommit c4602c1c818bd6626178d6d3fcc152d9f2f48ac0 upstream.\n\nFtrace currently initializes only the online CPUs. This implementation has\ntwo problems:\n- If we online a CPU after we enable the function profile, and then run the\n  test, we will lose the trace information on that CPU.\n  Steps to reproduce:\n  # echo 0 \u003e /sys/devices/system/cpu/cpu1/online\n  # cd \u003cdebugfs\u003e/tracing/\n  # echo \u003csome function name\u003e \u003e\u003e set_ftrace_filter\n  # echo 1 \u003e function_profile_enabled\n  # echo 1 \u003e /sys/devices/system/cpu/cpu1/online\n  # run test\n- If we offline a CPU before we enable the function profile, we will not clear\n  the trace information when we enable the function profile. It will trouble\n  the users.\n  Steps to reproduce:\n  # cd \u003cdebugfs\u003e/tracing/\n  # echo \u003csome function name\u003e \u003e\u003e set_ftrace_filter\n  # echo 1 \u003e function_profile_enabled\n  # run test\n  # cat trace_stat/function*\n  # echo 0 \u003e /sys/devices/system/cpu/cpu1/online\n  # echo 0 \u003e function_profile_enabled\n  # echo 1 \u003e function_profile_enabled\n  # cat trace_stat/function*\n  # run test\n  # cat trace_stat/function*\n\nSo it is better that we initialize the ftrace profiler for each possible cpu\nevery time we enable the function profile instead of just the online ones.\n\nLink: http://lkml.kernel.org/r/1387178401-10619-1-git-send-email-miaox@cn.fujitsu.com\n\nSigned-off-by: Miao Xie \u003cmiaox@cn.fujitsu.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "ee4bb2579e1182fa013694e429e6a418d6a3bb78",
      "tree": "be191e1d57a70b5fab0a943b2f4b05f1841a1086",
      "parents": [
        "894a160626d09198b104ea6702d688eca90623ad"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Dec 12 09:38:42 2013 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Dec 20 07:34:19 2013 -0800"
      },
      "message": "futex: fix handling of read-only-mapped hugepages\n\ncommit f12d5bfceb7e1f9051563381ec047f7f13956c3c upstream.\n\nThe hugepage code had the exact same bug that regular pages had in\ncommit 7485d0d3758e (\"futexes: Remove rw parameter from\nget_futex_key()\").\n\nThe regular page case was fixed by commit 9ea71503a8ed (\"futex: Fix\nregression with read only mappings\"), but the transparent hugepage case\n(added in a5b338f2b0b1: \"thp: update futex compound knowledge\") case\nremained broken.\n\nFound by Dave Jones and his trinity tool.\n\nReported-and-tested-by: Dave Jones \u003cdavej@fedoraproject.org\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Darren Hart \u003cdvhart@linux.intel.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "a8000959881be86ee8e5262d305f12accb68db70",
      "tree": "6a9b8dda7fdc42309c99584682f75f357acd067e",
      "parents": [
        "8dd978fba2216c985d6ca0801b698dae7363d1dc"
      ],
      "author": {
        "name": "Laxman Dewangan",
        "email": "ldewangan@nvidia.com",
        "time": "Mon Nov 25 19:39:47 2013 +0530"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 11 22:34:11 2013 -0800"
      },
      "message": "irq: Enable all irqs unconditionally in irq_resume\n\ncommit ac01810c9d2814238f08a227062e66a35a0e1ea2 upstream.\n\nWhen the system enters suspend, it disables all interrupts in\nsuspend_device_irqs(), including the interrupts marked EARLY_RESUME.\n\nOn the resume side things are different. The EARLY_RESUME interrupts\nare reenabled in sys_core_ops-\u003eresume and the non EARLY_RESUME\ninterrupts are reenabled in the normal system resume path.\n\nWhen suspend_noirq() failed or suspend is aborted for any other\nreason, we might omit the resume side call to sys_core_ops-\u003eresume()\nand therefor the interrupts marked EARLY_RESUME are not reenabled and\nstay disabled forever.\n\nTo solve this, enable all irqs unconditionally in irq_resume()\nregardless whether interrupts marked EARLY_RESUMEhave been already\nenabled or not.\n\nThis might try to reenable already enabled interrupts in the non\nfailure case, but the only affected platform is XEN and it has been\nconfirmed that it does not cause any side effects.\n\n[ tglx: Massaged changelog. ]\n\nSigned-off-by: Laxman Dewangan \u003cldewangan@nvidia.com\u003e\nAcked-by-and-tested-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nAcked-by: Heiko Stuebner \u003cheiko@sntech.de\u003e\nReviewed-by: Pavel Machek \u003cpavel@ucw.cz\u003e\nCc: \u003cian.campbell@citrix.com\u003e\nCc: \u003crjw@rjwysocki.net\u003e\nCc: \u003clen.brown@intel.com\u003e\nCc: \u003cgregkh@linuxfoundation.org\u003e\nLink: http://lkml.kernel.org/r/1385388587-16442-1-git-send-email-ldewangan@nvidia.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "51d351d5b949ae7204696ada7ef502ed34d34fb0",
      "tree": "f5b337191f35ac1a8b64aebad36479ed52d8beee",
      "parents": [
        "5833570f8e15cd7a40dd6c14ec73cb53736048cf"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Mon Nov 25 20:59:46 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:34 2013 -0800"
      },
      "message": "ftrace: Fix function graph with loading of modules\n\ncommit 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 upstream.\n\nCommit 8c4f3c3fa9681 \"ftrace: Check module functions being traced on reload\"\nfixed module loading and unloading with respect to function tracing, but\nit missed the function graph tracer. If you perform the following\n\n # cd /sys/kernel/debug/tracing\n # echo function_graph \u003e current_tracer\n # modprobe nfsd\n # echo nop \u003e current_tracer\n\nYou\u0027ll get the following oops message:\n\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 2910 at /linux.git/kernel/trace/ftrace.c:1640 __ftrace_hash_rec_update.part.35+0x168/0x1b9()\n Modules linked in: nfsd exportfs nfs_acl lockd ipt_MASQUERADE sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables uinput snd_hda_codec_idt\n CPU: 2 PID: 2910 Comm: bash Not tainted 3.13.0-rc1-test #7\n Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007\n  0000000000000668 ffff8800787efcf8 ffffffff814fe193 ffff88007d500000\n  0000000000000000 ffff8800787efd38 ffffffff8103b80a 0000000000000668\n  ffffffff810b2b9a ffffffff81a48370 0000000000000001 ffff880037aea000\n Call Trace:\n  [\u003cffffffff814fe193\u003e] dump_stack+0x4f/0x7c\n  [\u003cffffffff8103b80a\u003e] warn_slowpath_common+0x81/0x9b\n  [\u003cffffffff810b2b9a\u003e] ? __ftrace_hash_rec_update.part.35+0x168/0x1b9\n  [\u003cffffffff8103b83e\u003e] warn_slowpath_null+0x1a/0x1c\n  [\u003cffffffff810b2b9a\u003e] __ftrace_hash_rec_update.part.35+0x168/0x1b9\n  [\u003cffffffff81502f89\u003e] ? __mutex_lock_slowpath+0x364/0x364\n  [\u003cffffffff810b2cc2\u003e] ftrace_shutdown+0xd7/0x12b\n  [\u003cffffffff810b47f0\u003e] unregister_ftrace_graph+0x49/0x78\n  [\u003cffffffff810c4b30\u003e] graph_trace_reset+0xe/0x10\n  [\u003cffffffff810bf393\u003e] tracing_set_tracer+0xa7/0x26a\n  [\u003cffffffff810bf5e1\u003e] tracing_set_trace_write+0x8b/0xbd\n  [\u003cffffffff810c501c\u003e] ? ftrace_return_to_handler+0xb2/0xde\n  [\u003cffffffff811240a8\u003e] ? __sb_end_write+0x5e/0x5e\n  [\u003cffffffff81122aed\u003e] vfs_write+0xab/0xf6\n  [\u003cffffffff8150a185\u003e] ftrace_graph_caller+0x85/0x85\n  [\u003cffffffff81122dbd\u003e] SyS_write+0x59/0x82\n  [\u003cffffffff8150a185\u003e] ftrace_graph_caller+0x85/0x85\n  [\u003cffffffff8150a2d2\u003e] system_call_fastpath+0x16/0x1b\n ---[ end trace 940358030751eafb ]---\n\nThe above mentioned commit didn\u0027t go far enough. Well, it covered the\nfunction tracer by adding checks in __register_ftrace_function(). The\nproblem is that the function graph tracer circumvents that (for a slight\nefficiency gain when function graph trace is running with a function\ntracer. The gain was not worth this).\n\nThe problem came with ftrace_startup() which should always be called after\n__register_ftrace_function(), if you want this bug to be completely fixed.\n\nAnyway, this solution moves __register_ftrace_function() inside of\nftrace_startup() and removes the need to call them both.\n\nReported-by: Dave Wysochanski \u003cdwysocha@redhat.com\u003e\nFixes: ed926f9b35cd (\"ftrace: Use counters to enable functions to trace\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n"
    },
    {
      "commit": "fe094c412973269d2fad2e04a852771570e8edf1",
      "tree": "d0685972fcf58607e98dfe82ffa150b2f3519c09",
      "parents": [
        "df29bdd478affb8d81620e43e70635bef110a20e"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Tue Nov 26 15:03:41 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:34 2013 -0800"
      },
      "message": "cpuset: Fix memory allocator deadlock\n\ncommit 0fc0287c9ed1ffd3706f8b4d9b314aa102ef1245 upstream.\n\nJuri hit the below lockdep report:\n\n[    4.303391] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[    4.303392] [ INFO: SOFTIRQ-safe -\u003e SOFTIRQ-unsafe lock order detected ]\n[    4.303394] 3.12.0-dl-peterz+ #144 Not tainted\n[    4.303395] ------------------------------------------------------\n[    4.303397] kworker/u4:3/689 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:\n[    4.303399]  (\u0026p-\u003emems_allowed_seq){+.+...}, at: [\u003cffffffff8114e63c\u003e] new_slab+0x6c/0x290\n[    4.303417]\n[    4.303417] and this task is already holding:\n[    4.303418]  (\u0026(\u0026q-\u003e__queue_lock)-\u003erlock){..-...}, at: [\u003cffffffff812d2dfb\u003e] blk_execute_rq_nowait+0x5b/0x100\n[    4.303431] which would create a new lock dependency:\n[    4.303432]  (\u0026(\u0026q-\u003e__queue_lock)-\u003erlock){..-...} -\u003e (\u0026p-\u003emems_allowed_seq){+.+...}\n[    4.303436]\n\n[    4.303898] the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock:\n[    4.303918] -\u003e (\u0026p-\u003emems_allowed_seq){+.+...} ops: 2762 {\n[    4.303922]    HARDIRQ-ON-W at:\n[    4.303923]                     [\u003cffffffff8108ab9a\u003e] __lock_acquire+0x65a/0x1ff0\n[    4.303926]                     [\u003cffffffff8108cbe3\u003e] lock_acquire+0x93/0x140\n[    4.303929]                     [\u003cffffffff81063dd6\u003e] kthreadd+0x86/0x180\n[    4.303931]                     [\u003cffffffff816ded6c\u003e] ret_from_fork+0x7c/0xb0\n[    4.303933]    SOFTIRQ-ON-W at:\n[    4.303933]                     [\u003cffffffff8108abcc\u003e] __lock_acquire+0x68c/0x1ff0\n[    4.303935]                     [\u003cffffffff8108cbe3\u003e] lock_acquire+0x93/0x140\n[    4.303940]                     [\u003cffffffff81063dd6\u003e] kthreadd+0x86/0x180\n[    4.303955]                     [\u003cffffffff816ded6c\u003e] ret_from_fork+0x7c/0xb0\n[    4.303959]    INITIAL USE at:\n[    4.303960]                    [\u003cffffffff8108a884\u003e] __lock_acquire+0x344/0x1ff0\n[    4.303963]                    [\u003cffffffff8108cbe3\u003e] lock_acquire+0x93/0x140\n[    4.303966]                    [\u003cffffffff81063dd6\u003e] kthreadd+0x86/0x180\n[    4.303969]                    [\u003cffffffff816ded6c\u003e] ret_from_fork+0x7c/0xb0\n[    4.303972]  }\n\nWhich reports that we take mems_allowed_seq with interrupts enabled. A\nlittle digging found that this can only be from\ncpuset_change_task_nodemask().\n\nThis is an actual deadlock because an interrupt doing an allocation will\nhit get_mems_allowed()-\u003e...-\u003e__read_seqcount_begin(), which will spin\nforever waiting for the write side to complete.\n\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nReported-by: Juri Lelli \u003cjuri.lelli@gmail.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nTested-by: Juri Lelli \u003cjuri.lelli@gmail.com\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "4e0c56ab133fcb29fa3709c095f9347a033662c1",
      "tree": "4ddbc8a55d63d790669e6319b037870b4166005e",
      "parents": [
        "42979968049cc6a8ed569ae8ceb486e0637c7ce7"
      ],
      "author": {
        "name": "Mathias Krause",
        "email": "minipli@googlemail.com",
        "time": "Mon Sep 30 22:04:24 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:32 2013 -0800"
      },
      "message": "audit: fix info leak in AUDIT_GET requests\n\ncommit 64fbff9ae0a0a843365d922e0057fc785f23f0e3 upstream.\n\nWe leak 4 bytes of kernel stack in response to an AUDIT_GET request as\nwe miss to initialize the mask member of status_set. Fix that.\n\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "42979968049cc6a8ed569ae8ceb486e0637c7ce7",
      "tree": "8e7f4c4af4dc50d16a46d74ea1a8f9beb1cbab99",
      "parents": [
        "e49ee6c66ebfdf4a4fb0cecad2523c7b61fc0282"
      ],
      "author": {
        "name": "Mathias Krause",
        "email": "minipli@googlemail.com",
        "time": "Mon Sep 30 22:04:25 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:31 2013 -0800"
      },
      "message": "audit: use nlmsg_len() to get message payload length\n\ncommit 4d8fe7376a12bf4524783dd95cbc00f1fece6232 upstream.\n\nUsing the nlmsg_len member of the netlink header to test if the message\nis valid is wrong as it includes the size of the netlink header itself.\nThereby allowing to send short netlink messages that pass those checks.\n\nUse nlmsg_len() instead to test for the right message length. The result\nof nlmsg_len() is guaranteed to be non-negative as the netlink message\nalready passed the checks of nlmsg_ok().\n\nAlso switch to min_t() to please checkpatch.pl.\n\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e49ee6c66ebfdf4a4fb0cecad2523c7b61fc0282",
      "tree": "6106bc4fc818042ebfb97476a4a1c1cd04572ec9",
      "parents": [
        "d4bb402d7bda612a91235444dd4cf29b464f8eec"
      ],
      "author": {
        "name": "Tyler Hicks",
        "email": "tyhicks@canonical.com",
        "time": "Thu Jul 25 18:02:55 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:31 2013 -0800"
      },
      "message": "audit: printk USER_AVC messages when audit isn\u0027t enabled\n\ncommit 0868a5e150bc4c47e7a003367cd755811eb41e0b upstream.\n\nWhen the audit\u003d1 kernel parameter is absent and auditd is not running,\nAUDIT_USER_AVC messages are being silently discarded.\n\nAUDIT_USER_AVC messages should be sent to userspace using printk(), as\nmentioned in the commit message of 4a4cd633 (\"AUDIT: Optimise the\naudit-disabled case for discarding user messages\").\n\nWhen audit_enabled is 0, audit_receive_msg() discards all user messages\nexcept for AUDIT_USER_AVC messages. However, audit_log_common_recv_msg()\nrefuses to allocate an audit_buffer if audit_enabled is 0. The fix is to\nspecial case AUDIT_USER_AVC messages in both functions.\n\nIt looks like commit 50397bd1 (\"[AUDIT] clean up audit_receive_msg()\")\nintroduced this bug.\n\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: linux-audit@redhat.com\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Richard Guy Briggs \u003crgb@redhat.com\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "7094547c201149598a2bd90ef7f04d477dffae1b",
      "tree": "1322f341512653df7c5a93b4a26fed9aaf24217f",
      "parents": [
        "3ccb527f871a225b8eada036d24d41c59e40a2e4"
      ],
      "author": {
        "name": "Aaron Lu",
        "email": "aaron.lu@intel.com",
        "time": "Wed Nov 06 08:41:31 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:31 2013 -0800"
      },
      "message": "PM / hibernate: Avoid overflow in hibernate_preallocate_memory()\n\ncommit fd432b9f8c7c88428a4635b9f5a9c6e174df6e36 upstream.\n\nWhen system has a lot of highmem (e.g. 16GiB using a 32 bits kernel),\nthe code to calculate how much memory we need to preallocate in\nnormal zone may cause overflow. As Leon has analysed:\n\n It looks that during computing \u0027alloc\u0027 variable there is overflow:\n alloc \u003d (3943404 - 1970542) - 1978280 \u003d -5418 (signed)\n And this function goes to err_out.\n\nFix this by avoiding that overflow.\n\nReferences: https://bugzilla.kernel.org/show_bug.cgi?id\u003d60817\nReported-and-tested-by: Leon Drugi \u003ceyak@wp.pl\u003e\nSigned-off-by: Aaron Lu \u003caaron.lu@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "3e05092412210f3a298ef2a4e5f58857513e9954",
      "tree": "d9bb8d5c47986907e7ac939ef90cad5a32708c2b",
      "parents": [
        "664eaaa26bca6272673eff01ba5468f95905039d"
      ],
      "author": {
        "name": "KOSAKI Motohiro",
        "email": "kosaki.motohiro@jp.fujitsu.com",
        "time": "Mon Oct 14 17:33:16 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Dec 04 10:50:14 2013 -0800"
      },
      "message": "alarmtimer: return EINVAL instead of ENOTSUPP if rtcdev doesn\u0027t exist\n\ncommit 98d6f4dd84a134d942827584a3c5f67ffd8ec35f upstream.\n\nFedora Ruby maintainer reported latest Ruby doesn\u0027t work on Fedora Rawhide\non ARM. (http://bugs.ruby-lang.org/issues/9008)\n\nBecause of, commit 1c6b39ad3f (alarmtimers: Return -ENOTSUPP if no\nRTC device is present) intruduced to return ENOTSUPP when\nclock_get{time,res} can\u0027t find a RTC device. However this is incorrect.\n\nFirst, ENOTSUPP isn\u0027t exported to userland (ENOTSUP or EOPNOTSUP are the\nclosest userland equivlents).\n\nSecond, Posix and Linux man pages agree that clock_gettime and\nclock_getres should return EINVAL if clk_id argument is invalid.\nWhile the arugment that the clockid is valid, but just not supported\non this hardware could be made, this is just a technicality that\ndoesn\u0027t help userspace applicaitons, and only complicates error\nhandling.\n\nThus, this patch changes the code to use EINVAL.\n\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nReported-by: Vit Ondruch \u003cv.ondruch@tiscali.cz\u003e\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\n[jstultz: Tweaks to commit message to include full rational]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "c0d30628ff1b424f041d83fee37daea5f84eb0a2",
      "tree": "d7bc2b3b5824eeddeb687c3547c21984e1d6c422",
      "parents": [
        "7288f91dd5b55d82e1dee9f0d24e9f4730d57392"
      ],
      "author": {
        "name": "Kees Cook",
        "email": "keescook@chromium.org",
        "time": "Tue Nov 12 15:11:17 2013 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Nov 29 10:50:34 2013 -0800"
      },
      "message": "exec/ptrace: fix get_dumpable() incorrect tests\n\ncommit d049f74f2dbe71354d43d393ac3a188947811348 upstream.\n\nThe get_dumpable() return value is not boolean.  Most users of the\nfunction actually want to be testing for non-SUID_DUMP_USER(1) rather than\nSUID_DUMP_DISABLE(0).  The SUID_DUMP_ROOT(2) is also considered a\nprotected state.  Almost all places did this correctly, excepting the two\nplaces fixed in this patch.\n\nWrong logic:\n    if (dumpable \u003d\u003d SUID_DUMP_DISABLE) { /* be protective */ }\n        or\n    if (dumpable \u003d\u003d 0) { /* be protective */ }\n        or\n    if (!dumpable) { /* be protective */ }\n\nCorrect logic:\n    if (dumpable !\u003d SUID_DUMP_USER) { /* be protective */ }\n        or\n    if (dumpable !\u003d 1) { /* be protective */ }\n\nWithout this patch, if the system had set the sysctl fs/suid_dumpable\u003d2, a\nuser was able to ptrace attach to processes that had dropped privileges to\nthat user.  (This may have been partially mitigated if Yama was enabled.)\n\nThe macros have been moved into the file that declares get/set_dumpable(),\nwhich means things like the ia64 code can see them too.\n\nCVE-2013-2929\n\nReported-by: Vasily Kulikov \u003csegoon@openwall.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "d134082b7a9bb0e09158a2cc2e551841a84ddfa7",
      "tree": "867255fbc644ae386cb93323401437f9167cce7e",
      "parents": [
        "f22ff9d05def87a049c5c8c7b86539bd4f8e3172"
      ],
      "author": {
        "name": "Steven Rostedt",
        "email": "rostedt@goodmis.org",
        "time": "Tue Nov 05 12:51:11 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Nov 29 10:50:33 2013 -0800"
      },
      "message": "perf/ftrace: Fix paranoid level for enabling function tracer\n\ncommit 12ae030d54ef250706da5642fc7697cc60ad0df7 upstream.\n\nThe current default perf paranoid level is \"1\" which has\n\"perf_paranoid_kernel()\" return false, and giving any operations that\nuse it, access to normal users. Unfortunately, this includes function\ntracing and normal users should not be allowed to enable function\ntracing by default.\n\nThe proper level is defined at \"-1\" (full perf access), which\n\"perf_paranoid_tracepoint_raw()\" will only give access to. Use that\ncheck instead for enabling function tracing.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nTested-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCVE: CVE-2013-2930\nFixes: ced39002f5ea (\"ftrace, perf: Add support to use function tracepoint in perf\")\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "af15b7691766d99f0f84bae9b3444ab06e9beb29",
      "tree": "5d22a78374519c3feeabeaddad7e4f0fb58360a6",
      "parents": [
        "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1"
      ],
      "author": {
        "name": "Steven Rostedt",
        "email": "rostedt@goodmis.org",
        "time": "Wed Oct 09 22:23:23 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Nov 20 10:43:19 2013 -0800"
      },
      "message": "tracing: Fix potential out-of-bounds in trace_get_user()\n\ncommit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.\n\nAndrey reported the following report:\n\nERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3\nffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)\nAccessed by thread T13003:\n  #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)\n  #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)\n  #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)\n  #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)\n  #4 ffffffff812a1065 (__fput+0x155/0x360)\n  #5 ffffffff812a12de (____fput+0x1e/0x30)\n  #6 ffffffff8111708d (task_work_run+0x10d/0x140)\n  #7 ffffffff810ea043 (do_exit+0x433/0x11f0)\n  #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)\n  #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)\n  #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nAllocated by thread T5167:\n  #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)\n  #1 ffffffff8128337c (__kmalloc+0xbc/0x500)\n  #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)\n  #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)\n  #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)\n  #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)\n  #6 ffffffff8129b668 (finish_open+0x68/0xa0)\n  #7 ffffffff812b66ac (do_last+0xb8c/0x1710)\n  #8 ffffffff812b7350 (path_openat+0x120/0xb50)\n  #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)\n  #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)\n  #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)\n  #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nShadow bytes around the buggy address:\n  ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa\n  ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003d\u003effff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb\n  ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap redzone:          fa\n  Heap kmalloc redzone:  fb\n  Freed heap region:     fd\n  Shadow gap:            fe\n\nThe out-of-bounds access happens on \u0027parser-\u003ebuffer[parser-\u003eidx] \u003d 0;\u0027\n\nAlthough the crash happened in ftrace_regex_open() the real bug\noccurred in trace_get_user() where there\u0027s an incrementation to\nparser-\u003eidx without a check against the size. The way it is triggered\nis if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop\nthat reads the last character stores it and then breaks out because\nthere is no more characters. Then the last character is read to determine\nwhat to do next, and the index is incremented without checking size.\n\nThen the caller of trace_get_user() usually nulls out the last character\nwith a zero, but since the index is equal to the size, it writes a nul\ncharacter after the allocated space, which can corrupt memory.\n\nLuckily, only root user has write access to this file.\n\nLink: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home\n\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "f81d0a99446a0c4548d5783807529d075b06c64e",
      "tree": "b0697e8167ee4daf0d8b66f38270670498998f20",
      "parents": [
        "268417aeea96a1941c2cd14f0f8b5b39c374ad25"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Tue Sep 24 21:50:23 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Nov 13 12:01:48 2013 +0900"
      },
      "message": "clockevents: Sanitize ticks to nsec conversion\n\ncommit 97b9410643475d6557d2517c2aff9fd2221141a9 upstream.\n\nMarc Kleine-Budde pointed out, that commit 77cc982 \"clocksource: use\nclockevents_config_and_register() where possible\" caused a regression\nfor some of the converted subarchs.\n\nThe reason is, that the clockevents core code converts the minimal\nhardware tick delta to a nanosecond value for core internal\nusage. This conversion is affected by integer math rounding loss, so\nthe backwards conversion to hardware ticks will likely result in a\nvalue which is less than the configured hardware limitation. The\naffected subarchs used their own workaround (SIGH!) which got lost in\nthe conversion.\n\nThe solution for the issue at hand is simple: adding evt-\u003emult - 1 to\nthe shifted value before the integer divison in the core conversion\nfunction takes care of it. But this only works for the case where for\nthe scaled math mult/shift pair \"mult \u003c\u003d 1 \u003c\u003c shift\" is true. For the\ncase where \"mult \u003e 1 \u003c\u003c shift\" we can apply the rounding add only for\nthe minimum delta value to make sure that the backward conversion is\nnot less than the given hardware limit. For the upper bound we need to\nomit the rounding add, because the backwards conversion is always\nlarger than the original latch value. That would violate the upper\nbound of the hardware device.\n\nThough looking closer at the details of that function reveals another\nbogosity: The upper bounds check is broken as well. Checking for a\nresulting \"clc\" value greater than KTIME_MAX after the conversion is\npointless. The conversion does:\n\n      u64 clc \u003d (latch \u003c\u003c evt-\u003eshift) / evt-\u003emult;\n\nSo there is no sanity check for (latch \u003c\u003c evt-\u003eshift) exceeding the\n64bit boundary. The latch argument is \"unsigned long\", so on a 64bit\narch the handed in argument could easily lead to an unnoticed shift\noverflow. With the above rounding fix applied the calculation before\nthe divison is:\n\n       u64 clc \u003d (latch \u003c\u003c evt-\u003eshift) + evt-\u003emult - 1;\n\nSo we need to make sure, that neither the shift nor the rounding add\nis overflowing the u64 boundary.\n\n[ukl: move assignment to rnd after eventually changing mult, fix build\n issue and correct comment with the right math]\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Russell King - ARM Linux \u003clinux@arm.linux.org.uk\u003e\nCc: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nCc: nicolas.ferre@atmel.com\nCc: Marc Pignat \u003cmarc.pignat@hevs.ch\u003e\nCc: john.stultz@linaro.org\nCc: kernel@pengutronix.de\nCc: Ronald Wahl \u003cronald.wahl@raritan.com\u003e\nCc: LAK \u003clinux-arm-kernel@lists.infradead.org\u003e\nCc: Ludovic Desroches \u003cludovic.desroches@atmel.com\u003e\nLink: http://lkml.kernel.org/r/1380052223-24139-1-git-send-email-u.kleine-koenig@pengutronix.de\nSigned-off-by: Uwe Kleine-König \u003cu.kleine-koenig@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "1d48ca6f38fa39298474708abebeffef4ef2cd2d",
      "tree": "54af1961ab8589ebc3e6533c4083c0cdb2581db9",
      "parents": [
        "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "a.p.zijlstra@chello.nl",
        "time": "Tue Oct 02 15:41:23 2012 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Oct 01 09:10:52 2013 -0700"
      },
      "message": "perf: Fix perf_cgroup_switch for sw-events\n\ncommit 95cf59ea72331d0093010543b8951bb43f262cac upstream.\n\nJiri reported that he could trigger the WARN_ON_ONCE() in\nperf_cgroup_switch() using sw-events. This is because sw-events share\na cpuctx with multiple PMUs.\n\nUse the -\u003eunique_pmu pointer to limit the pmu iteration to unique\ncpuctx instances.\n\nReported-and-Tested-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-so7wi2zf3jjzrwcutm2mkz0j@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7",
      "tree": "17a056e20c3937a5af97acd45ac7792a420d78ab",
      "parents": [
        "2927937899b958de968119856ba659d8a4eff037"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "a.p.zijlstra@chello.nl",
        "time": "Tue Oct 02 15:38:52 2012 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Oct 01 09:10:52 2013 -0700"
      },
      "message": "perf: Clarify perf_cpu_context::active_pmu usage by renaming it to ::unique_pmu\n\ncommit 3f1f33206c16c7b3839d71372bc2ac3f305aa802 upstream.\n\nStephane thought the perf_cpu_context::active_pmu name confusing and\nsuggested using \u0027unique_pmu\u0027 instead.\n\nThis pointer is a pointer to a \u0027random\u0027 pmu sharing the cpuctx\ninstance, therefore limiting a for_each_pmu loop to those where\ncpuctx-\u003eunique_pmu matches the pmu we get a loop over unique cpuctx\ninstances.\n\nSuggested-by: Stephane Eranian \u003ceranian@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-kxyjqpfj2fn9gt7kwu5ag9ks@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "2927937899b958de968119856ba659d8a4eff037",
      "tree": "51489c3f0826002328a8bf68dccd81c8abeccab3",
      "parents": [
        "72417b659ae9c36e1807bc930240aec202970861"
      ],
      "author": {
        "name": "Li Zefan",
        "email": "lizefan@huawei.com",
        "time": "Mon Feb 18 14:13:35 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Oct 01 09:10:51 2013 -0700"
      },
      "message": "cgroup: fail if monitored file and event_control are in different cgroup\n\ncommit f169007b2773f285e098cb84c74aac0154d65ff7 upstream.\n\nIf we pass fd of memory.usage_in_bytes of cgroup A to cgroup.event_control\nof cgroup B, then we won\u0027t get memory usage notification from A but B!\n\nWhat\u0027s worse, if A and B are in different mount hierarchy, we\u0027ll end up\naccessing NULL pointer!\n\nDisallow this kind of invalid usage.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill@shutemov.name\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "62875332eafea9ee150a6037c0a1a20669e02aa1",
      "tree": "71c673017dc9991b143ad989e6b3d20802a13719",
      "parents": [
        "ebce1a846aa297022fc372d59e6829d0453125f2"
      ],
      "author": {
        "name": "Daisuke Nishimura",
        "email": "nishimura@mxp.nes.nec.co.jp",
        "time": "Tue Sep 10 18:16:36 2013 +0900"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Oct 01 09:10:51 2013 -0700"
      },
      "message": "sched/fair: Fix small race where child-\u003ese.parent,cfs_rq might point to invalid ones\n\ncommit 6c9a27f5da9609fca46cb2b183724531b48f71ad upstream.\n\nThere is a small race between copy_process() and cgroup_attach_task()\nwhere child-\u003ese.parent,cfs_rq points to invalid (old) ones.\n\n        parent doing fork()      | someone moving the parent to another cgroup\n  -------------------------------+---------------------------------------------\n    copy_process()\n      + dup_task_struct()\n        -\u003e parent-\u003ese is copied to child-\u003ese.\n           se.parent,cfs_rq of them point to old ones.\n\n                                     cgroup_attach_task()\n                                       + cgroup_task_migrate()\n                                         -\u003e parent-\u003ecgroup is updated.\n                                       + cpu_cgroup_attach()\n                                         + sched_move_task()\n                                           + task_move_group_fair()\n                                             +- set_task_rq()\n                                                -\u003e se.parent,cfs_rq of parent\n                                                   are updated.\n\n      + cgroup_fork()\n        -\u003e parent-\u003ecgroup is copied to child-\u003ecgroup. (*1)\n      + sched_fork()\n        + task_fork_fair()\n          -\u003e se.parent,cfs_rq of child are accessed\n             while they point to old ones. (*2)\n\nIn the worst case, this bug can lead to \"use-after-free\" and cause a panic,\nbecause it\u0027s new cgroup\u0027s refcount that is incremented at (*1),\nso the old cgroup(and related data) can be freed before (*2).\n\nIn fact, a panic caused by this bug was originally caught in RHEL6.4.\n\n    BUG: unable to handle kernel NULL pointer dereference at (null)\n    IP: [\u003cffffffff81051e3e\u003e] sched_slice+0x6e/0xa0\n    [...]\n    Call Trace:\n     [\u003cffffffff81051f25\u003e] place_entity+0x75/0xa0\n     [\u003cffffffff81056a3a\u003e] task_fork_fair+0xaa/0x160\n     [\u003cffffffff81063c0b\u003e] sched_fork+0x6b/0x140\n     [\u003cffffffff8106c3c2\u003e] copy_process+0x5b2/0x1450\n     [\u003cffffffff81063b49\u003e] ? wake_up_new_task+0xd9/0x130\n     [\u003cffffffff8106d2f4\u003e] do_fork+0x94/0x460\n     [\u003cffffffff81072a9e\u003e] ? sys_wait4+0xae/0x100\n     [\u003cffffffff81009598\u003e] sys_clone+0x28/0x30\n     [\u003cffffffff8100b393\u003e] stub_clone+0x13/0x20\n     [\u003cffffffff8100b072\u003e] ? system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Daisuke Nishimura \u003cnishimura@mxp.nes.nec.co.jp\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/039601ceae06$733d3130$59b79390$@mxp.nes.nec.co.jp\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "55e3e1f419f0c387a2b971cc181b8dea1b099d1d",
      "tree": "79470f040f2886669d9fb0ecce2882e875fb976f",
      "parents": [
        "31eafff4382b0f20edce1afea8e2d288c6c7187c"
      ],
      "author": {
        "name": "Tejun Heo",
        "email": "tj@kernel.org",
        "time": "Tue Dec 18 10:35:02 2012 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Aug 29 09:50:12 2013 -0700"
      },
      "message": "workqueue: consider work function when searching for busy work items\n\ncommit a2c1c57be8d9fd5b716113c8991d3d702eeacf77 upstream.\n\nTo avoid executing the same work item concurrenlty, workqueue hashes\ncurrently busy workers according to their current work items and looks\nup the the table when it wants to execute a new work item.  If there\nalready is a worker which is executing the new work item, the new item\nis queued to the found worker so that it gets executed only after the\ncurrent execution finishes.\n\nUnfortunately, a work item may be freed while being executed and thus\nrecycled for different purposes.  If it gets recycled for a different\nwork item and queued while the previous execution is still in\nprogress, workqueue may make the new work item wait for the old one\nalthough the two aren\u0027t really related in any way.\n\nIn extreme cases, this false dependency may lead to deadlock although\nit\u0027s extremely unlikely given that there aren\u0027t too many self-freeing\nwork item users and they usually don\u0027t wait for other work items.\n\nTo alleviate the problem, record the current work function in each\nbusy worker and match it together with the work item address in\nfind_worker_executing_work().  While this isn\u0027t complete, it ensures\nthat unrelated work items don\u0027t interact with each other and in the\nvery unlikely case where a twisted wq user triggers it, it\u0027s always\nonto itself making the culprit easy to spot.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Andrey Isakov \u003candy51@gmx.ru\u003e\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d51701\n[lizf: Backported to 3.4:\n - Adjust context\n - Incorporate earlier logging cleanup in process_one_work() from\n   044c782ce3a9 (\u0027workqueue: fix checkpatch issues\u0027)]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "31eafff4382b0f20edce1afea8e2d288c6c7187c",
      "tree": "77cbad322913848d13ecd4d0a3707fe86fd255c7",
      "parents": [
        "67db9db0bfd9448feb8e69224dfbb83e5834082b"
      ],
      "author": {
        "name": "Lai Jiangshan",
        "email": "laijs@cn.fujitsu.com",
        "time": "Tue Sep 18 10:40:00 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Aug 29 09:50:11 2013 -0700"
      },
      "message": "workqueue: fix possible stall on try_to_grab_pending() of a delayed work item\n\ncommit 3aa62497594430ea522050b75c033f71f2c60ee6 upstream.\n\nCurrently, when try_to_grab_pending() grabs a delayed work item, it\nleaves its linked work items alone on the delayed_works.  The linked\nwork items are always NO_COLOR and will cause future\ncwq_activate_first_delayed() increase cwq-\u003enr_active incorrectly, and\nmay cause the whole cwq to stall.  For example,\n\nstate: cwq-\u003emax_active \u003d 1, cwq-\u003enr_active \u003d 1\n       one work in cwq-\u003epool, many in cwq-\u003edelayed_works.\n\nstep1: try_to_grab_pending() removes a work item from delayed_works\n       but leaves its NO_COLOR linked work items on it.\n\nstep2: Later on, cwq_activate_first_delayed() activates the linked\n       work item increasing -\u003enr_active.\n\nstep3: cwq-\u003enr_active \u003d 1, but all activated work items of the cwq are\n       NO_COLOR.  When they finish, cwq-\u003enr_active will not be\n       decreased due to NO_COLOR, and no further work items will be\n       activated from cwq-\u003edelayed_works. the cwq stalls.\n\nFix it by ensuring the target work item is activated before stealing\nPENDING in try_to_grab_pending().  This ensures that all the linked\nwork items are activated without incorrectly bumping cwq-\u003enr_active.\n\ntj: Updated comment and description.\n\nSigned-off-by: Lai Jiangshan \u003claijs@cn.fujitsu.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n[lizf: backported to 3.4: adjust context]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "a42efb79d54d9a13c8f68df122c832bca08b74ae",
      "tree": "b49010c84b42ccc5407766471bc94c95efe63d83",
      "parents": [
        "4d5b24dd453b4ff44f69756106b029e8961dcb55"
      ],
      "author": {
        "name": "Zhang Yi",
        "email": "wetpzy@gmail.com",
        "time": "Tue Jun 25 21:19:31 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Aug 20 08:26:28 2013 -0700"
      },
      "message": "futex: Take hugepages into account when generating futex_key\n\ncommit 13d60f4b6ab5b702dc8d2ee20999f98a93728aec upstream.\n\nThe futex_keys of process shared futexes are generated from the page\noffset, the mapping host and the mapping index of the futex user space\naddress. This should result in an unique identifier for each futex.\n\nThough this is not true when futexes are located in different subpages\nof an hugepage. The reason is, that the mapping index for all those\nfutexes evaluates to the index of the base page of the hugetlbfs\nmapping. So a futex at offset 0 of the hugepage mapping and another\none at offset PAGE_SIZE of the same hugepage mapping have identical\nfutex_keys. This happens because the futex code blindly uses\npage-\u003eindex.\n\nSteps to reproduce the bug:\n\n1. Map a file from hugetlbfs. Initialize pthread_mutex1 at offset 0\n   and pthread_mutex2 at offset PAGE_SIZE of the hugetlbfs\n   mapping.\n\n   The mutexes must be initialized as PTHREAD_PROCESS_SHARED because\n   PTHREAD_PROCESS_PRIVATE mutexes are not affected by this issue as\n   their keys solely depend on the user space address.\n\n2. Lock mutex1 and mutex2\n\n3. Create thread1 and in the thread function lock mutex1, which\n   results in thread1 blocking on the locked mutex1.\n\n4. Create thread2 and in the thread function lock mutex2, which\n   results in thread2 blocking on the locked mutex2.\n\n5. Unlock mutex2. Despite the fact that mutex2 got unlocked, thread2\n   still blocks on mutex2 because the futex_key points to mutex1.\n\nTo solve this issue we need to take the normal page index of the page\nwhich contains the futex into account, if the futex is in an hugetlbfs\nmapping. In other words, we calculate the normal page mapping index of\nthe subpage in the hugetlbfs mapping.\n\nMappings which are not based on hugetlbfs are not affected and still\nuse page-\u003eindex.\n\nThanks to Mel Gorman who provided a patch for adding proper evaluation\nfunctions to the hugetlbfs code to avoid exposing hugetlbfs specific\ndetails to the futex code.\n\n[ tglx: Massaged changelog ]\n\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nReviewed-by: Jiang Biao \u003cjiang.biao2@zte.com.cn\u003e\nTested-by: Ma Chenggong \u003cma.chenggong@zte.com.cn\u003e\nReviewed-by: \u0027Mel Gorman\u0027 \u003cmgorman@suse.de\u003e\nAcked-by: \u0027Darren Hart\u0027 \u003cdvhart@linux.intel.com\u003e\nCc: \u0027Peter Zijlstra\u0027 \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/000101ce71a6%24a83c5880%24f8b50980%24@com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Mike Galbraith \u003cmgalbraith@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n"
    },
    {
      "commit": "99593eb7ca1dd9bfaa431d96e009eda23f001ace",
      "tree": "b1412f07fda67143bc2454bbb6f81e124cae3617",
      "parents": [
        "65280b8ed1cca78ff7fe63ecfdb0fff87fe184a3"
      ],
      "author": {
        "name": "Andrew Vagin",
        "email": "avagin@openvz.org",
        "time": "Fri Aug 02 21:16:43 2013 +0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Aug 14 22:57:08 2013 -0700"
      },
      "message": "tracing: Fix fields of struct trace_iterator that are zeroed by mistake\n\ncommit ed5467da0e369e65b247b99eb6403cb79172bcda upstream.\n\ntracing_read_pipe zeros all fields bellow \"seq\". The declaration contains\na comment about that, but it doesn\u0027t help.\n\nThe first field is \"snapshot\", it\u0027s true when current open file is\nsnapshot. Looks obvious, that it should not be zeroed.\n\nThe second field is \"started\". It was converted from cpumask_t to\ncpumask_var_t (v2.6.28-4983-g4462344), in other words it was\nconverted from cpumask to pointer on cpumask.\n\nCurrently the reference on \"started\" memory is lost after the first read\nfrom tracing_read_pipe and a proper object will never be freed.\n\nThe \"started\" is never dereferenced for trace_pipe, because trace_pipe\ncan\u0027t have the TRACE_FILE_ANNOTATE options.\n\nLink: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org\n\nSigned-off-by: Andrew Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "2d8be9cf0668fab848b9b7740f0725ae9181b703",
      "tree": "f0109a7365fc949575a152aaef0d2d0faf17ae67",
      "parents": [
        "be1932db6f0ffc7504f8ef513515c292c466445c"
      ],
      "author": {
        "name": "Salman Qazi",
        "email": "sqazi@google.com",
        "time": "Thu Jun 14 15:31:09 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Aug 11 15:38:43 2013 -0700"
      },
      "message": "perf: Use css_tryget() to avoid propping up css refcount\n\ncommit 9c5da09d266ca9b32eb16cf940f8161d949c2fe5 upstream.\n\nAn rmdir pushes css\u0027s ref count to zero.  However, if the associated\ndirectory is open at the time, the dentry ref count is non-zero.  If\nthe fd for this directory is then passed into perf_event_open, it\ndoes a css_get().  This bounces the ref count back up from zero.  This\nis a problem by itself.  But what makes it turn into a crash is the\nfact that we end up doing an extra dput, since we perform a dput\nwhen css_put sees the ref count go down to zero.\n\ncss_tryget() does not fall into that trap. So, we use that instead.\n\nReproduction test-case for the bug:\n\n #include \u003cunistd.h\u003e\n #include \u003csys/types.h\u003e\n #include \u003csys/stat.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003clinux/unistd.h\u003e\n #include \u003clinux/perf_event.h\u003e\n #include \u003cstring.h\u003e\n #include \u003cerrno.h\u003e\n #include \u003cstdio.h\u003e\n\n #define PERF_FLAG_PID_CGROUP    (1U \u003c\u003c 2)\n\n int perf_event_open(struct perf_event_attr *hw_event_uptr,\n                     pid_t pid, int cpu, int group_fd, unsigned long flags) {\n         return syscall(__NR_perf_event_open,hw_event_uptr, pid, cpu,\n                 group_fd, flags);\n }\n\n /*\n  * Directly poke at the perf_event bug, since it\u0027s proving hard to repro\n  * depending on where in the kernel tree.  what moved?\n  */\n int main(int argc, char **argv)\n {\n        int fd;\n        struct perf_event_attr attr;\n        memset(\u0026attr, 0, sizeof(attr));\n        attr.exclude_kernel \u003d 1;\n        attr.size \u003d sizeof(attr);\n        mkdir(\"/dev/cgroup/perf_event/blah\", 0777);\n        fd \u003d open(\"/dev/cgroup/perf_event/blah\", O_RDONLY);\n        perror(\"open\");\n        rmdir(\"/dev/cgroup/perf_event/blah\");\n        sleep(2);\n        perf_event_open(\u0026attr, fd, 0, -1,  PERF_FLAG_PID_CGROUP);\n        perror(\"perf_event_open\");\n        close(fd);\n        return 0;\n }\n\nSigned-off-by: Salman Qazi \u003csqazi@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nLink: http://lkml.kernel.org/r/20120614223108.1025.2503.stgit@dungbeetle.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "5cbff87c00cf1b8e3a077465e4ec501dd21651c8",
      "tree": "6c002b76a1801778a213b8b4884053488290192a",
      "parents": [
        "6c9ef8363ab2802bb8f418f32bb9f83d48c9da2a"
      ],
      "author": {
        "name": "Jiri Olsa",
        "email": "jolsa@redhat.com",
        "time": "Fri Feb 01 11:23:45 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Aug 11 15:38:43 2013 -0700"
      },
      "message": "perf: Fix event group context move\n\ncommit 0231bb5336758426b44ccd798ccd3c5419c95d58 upstream.\n\nWhen we have group with mixed events (hw/sw) we want to end up\nwith group leader being in hw context. So if group leader is\ninitialy sw event, we move all the events under hw context.\n\nThe move is done for each event by removing it from its context\nand adding it back into proper one. As a part of the removal the\nevent is automatically disabled, which is not what we want at\nthis stage of creating groups.\n\nThe fix is to initialize event state after removal from sw\ncontext.\n\nThis fix resulted from the following discussion:\n\n  http://thread.gmane.org/gmane.linux.kernel.perf.user/1144\n\nReported-by: Andreas Hollmann \u003chollmann@in.tum.de\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Corey Ashford \u003ccjashfor@linux.vnet.ibm.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nCc: Vince Weaver \u003cvince@deater.net\u003e\nLink: http://lkml.kernel.org/r/1359714225-4231-1-git-send-email-jolsa@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "1836cd176170d39f5b1fda9cd47d3c3f0f10dad2",
      "tree": "6452080dec303b174785e4b68ffaff2673e2a33c",
      "parents": [
        "ee9ef037ac99b542df34848fca2c9765910535e6"
      ],
      "author": {
        "name": "Zhu Yanhai",
        "email": "gaoyang.zyh@taobao.com",
        "time": "Tue Jan 08 12:56:52 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Aug 11 15:38:43 2013 -0700"
      },
      "message": "sched: Fix the broken sched_rr_get_interval()\n\ncommit a59f4e079d19464eebb9b06513a1d4f55fdae5ba upstream.\n\nThe caller of sched_sliced() should pass se.cfs_rq and se as the\narguments, however in sched_rr_get_interval() we gave it\nrq.cfs_rq and se, which made the following computation obviously\nwrong.\n\nThe change was introduced by commit:\n\n  77034937dc45 sched: fix crash in sys_sched_rr_get_interval()\n\n... 5 years ago, while it had been the correct \u0027cfs_rq_of\u0027 before\nthe commit. The change seems to be irrelevant to the commit\nmsg, which was to return a 0 timeslice for tasks that are on an\nidle runqueue. So I believe that was just a plain typo.\n\nSigned-off-by: Zhu Yanhai \u003cgaoyang.zyh@taobao.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Paul Turner \u003cpjt@google.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/1357621012-15039-1-git-send-email-gaoyang.zyh@taobao.com\n[ Since this is an ABI and an old bug, we\u0027ll test this via a\n  slow upstream route, to hopefully discover any app breakage. ]\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "352b6418a2d14c754b41f23e0698f0006c914b95",
      "tree": "381768caaaa7dcaa97e24c51ca84830ecd9cca6e",
      "parents": [
        "e5f8b2d71c3b617d2d5ce9568067b1458b47a517"
      ],
      "author": {
        "name": "zhangwei(Jovi)",
        "email": "jovi.zhangwei@huawei.com",
        "time": "Mon Jul 29 09:33:58 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Aug 04 16:25:45 2013 +0800"
      },
      "message": "tracing: Fix irqs-off tag display in syscall tracing\n\ncommit 11034ae9c20f4057a6127fc965906417978e69b2 upstream\n\nInitialization of variable irq_flags and pc was missed when backport\n11034ae9c to linux-3.0.y and linux-3.4.y, my fault.\n\nSigned-off-by: zhangwei(Jovi) \u003cjovi.zhangwei@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "39367f485b87492a5e51af8496a684eafa4aec86",
      "tree": "53b728ea867eaaced43fa13a3fd77233b5e997ca",
      "parents": [
        "f36a0d6764dcb33a280dce206f1be4bcaff5714e"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri Jul 05 12:09:18 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:26:47 2013 -0700"
      },
      "message": "hrtimers: Move SMP function call to thread context\n\ncommit 5ec2481b7b47a4005bb446d176e5d0257400c77d upstream.\n\nsmp_call_function_* must not be called from softirq context.\n\nBut clock_was_set() which calls on_each_cpu() is called from softirq\ncontext to implement a delayed clock_was_set() for the timer interrupt\nhandler. Though that almost never gets invoked. A recent change in the\nresume code uses the softirq based delayed clock_was_set to support\nXens resume mechanism.\n\nlinux-next contains a new warning which warns if smp_call_function_*\nis called from softirq context which gets triggered by that Xen\nchange.\n\nFix this by moving the delayed clock_was_set() call to a work context.\n\nReported-and-tested-by: Artem Savkov \u003cartem.savkov@gmail.com\u003e\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nCc: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e,\nCc: Konrad Wilk \u003ckonrad.wilk@oracle.com\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: xen-devel@lists.xen.org\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "f36a0d6764dcb33a280dce206f1be4bcaff5714e",
      "tree": "39e30c2832c12b3ad897df6fbf4e97a252887d44",
      "parents": [
        "e2f918414ca99c5321ad352fa6dfa3147e3e31d8"
      ],
      "author": {
        "name": "zhangwei(Jovi)",
        "email": "jovi.zhangwei@huawei.com",
        "time": "Wed Apr 10 11:26:23 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:26:46 2013 -0700"
      },
      "message": "tracing: Fix irqs-off tag display in syscall tracing\n\ncommit 11034ae9c20f4057a6127fc965906417978e69b2 upstream.\n\nAll syscall tracing irqs-off tags are wrong, the syscall enter entry doesn\u0027t\ndisable irqs.\n\n [root@jovi tracing]#echo \"syscalls:sys_enter_open\" \u003e set_event\n [root@jovi tracing]# cat trace\n # tracer: nop\n #\n # entries-in-buffer/entries-written: 13/13   #P:2\n #\n #                              _-----\u003d\u003e irqs-off\n #                             / _----\u003d\u003e need-resched\n #                            | / _---\u003d\u003e hardirq/softirq\n #                            || / _--\u003d\u003e preempt-depth\n #                            ||| /     delay\n #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION\n #              | |       |   ||||       |         |\n       irqbalance-513   [000] d... 56115.496766: sys_open(filename: 804e1a6, flags: 0, mode: 1b6)\n       irqbalance-513   [000] d... 56115.497008: sys_open(filename: 804e1bb, flags: 0, mode: 1b6)\n         sendmail-771   [000] d... 56115.827982: sys_open(filename: b770e6d1, flags: 0, mode: 1b6)\n\nThe reason is syscall tracing doesn\u0027t record irq_flags into buffer.\nThe proper display is:\n\n [root@jovi tracing]#echo \"syscalls:sys_enter_open\" \u003e set_event\n [root@jovi tracing]# cat trace\n # tracer: nop\n #\n # entries-in-buffer/entries-written: 14/14   #P:2\n #\n #                              _-----\u003d\u003e irqs-off\n #                             / _----\u003d\u003e need-resched\n #                            | / _---\u003d\u003e hardirq/softirq\n #                            || / _--\u003d\u003e preempt-depth\n #                            ||| /     delay\n #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION\n #              | |       |   ||||       |         |\n       irqbalance-514   [001] ....    46.213921: sys_open(filename: 804e1a6, flags: 0, mode: 1b6)\n       irqbalance-514   [001] ....    46.214160: sys_open(filename: 804e1bb, flags: 0, mode: 1b6)\n            \u003c...\u003e-920   [001] ....    47.307260: sys_open(filename: 4e82a0c5, flags: 80000, mode: 0)\n\nLink: http://lkml.kernel.org/r/1365564393-10972-3-git-send-email-jovi.zhangwei@huawei.com\n\nCc: stable@vger.kernel.org # 2.6.35\nSigned-off-by: zhangwei(Jovi) \u003cjovi.zhangwei@huawei.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "41154a356f6516ffa266e50ff7d1bf706893dfe3",
      "tree": "c42911b2319dfe276ebc9e14476ae317ece83020",
      "parents": [
        "1f11f44083bca90ce4f534023658d481b5707d94"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Fri Jul 12 11:08:33 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:25:48 2013 -0700"
      },
      "message": "perf: Fix perf_lock_task_context() vs RCU\n\ncommit 058ebd0eba3aff16b144eabf4510ed9510e1416e upstream.\n\nJiri managed to trigger this warning:\n\n [] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [] [ INFO: possible circular locking dependency detected ]\n [] 3.10.0+ #228 Tainted: G        W\n [] -------------------------------------------------------\n [] p/6613 is trying to acquire lock:\n []  (rcu_node_0){..-...}, at: [\u003cffffffff810ca797\u003e] rcu_read_unlock_special+0xa7/0x250\n []\n [] but task is already holding lock:\n []  (\u0026ctx-\u003elock){-.-...}, at: [\u003cffffffff810f2879\u003e] perf_lock_task_context+0xd9/0x2c0\n []\n [] which lock already depends on the new lock.\n []\n [] the existing dependency chain (in reverse order) is:\n []\n [] -\u003e #4 (\u0026ctx-\u003elock){-.-...}:\n [] -\u003e #3 (\u0026rq-\u003elock){-.-.-.}:\n [] -\u003e #2 (\u0026p-\u003epi_lock){-.-.-.}:\n [] -\u003e #1 (\u0026rnp-\u003enocb_gp_wq[1]){......}:\n [] -\u003e #0 (rcu_node_0){..-...}:\n\nPaul was quick to explain that due to preemptible RCU we cannot call\nrcu_read_unlock() while holding scheduler (or nested) locks when part\nof the read side critical section was preemptible.\n\nTherefore solve it by making the entire RCU read side non-preemptible.\n\nAlso pull out the retry from under the non-preempt to play nice with RT.\n\nReported-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nHelped-out-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "1f11f44083bca90ce4f534023658d481b5707d94",
      "tree": "0813157a3ebf651d5a1e897454dd9f0c18272f53",
      "parents": [
        "c4c6a6ea3adbe790d81ef72f623e22591704fdb9"
      ],
      "author": {
        "name": "Jiri Olsa",
        "email": "jolsa@redhat.com",
        "time": "Tue Jul 09 17:44:11 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:25:48 2013 -0700"
      },
      "message": "perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid scenario\n\ncommit 06f417968beac6e6b614e17b37d347aa6a6b1d30 upstream.\n\nThe \u0027!ctx-\u003eis_active\u0027 check has a valid scenario, so\nthere\u0027s no need for the warning.\n\nThe reason is that there\u0027s a time window between the\n\u0027ctx-\u003eis_active\u0027 check in the perf_event_enable() function\nand the __perf_event_enable() function having:\n\n  - IRQs on\n  - ctx-\u003elock unlocked\n\nwhere the task could be killed and \u0027ctx\u0027 deactivated by\nperf_event_exit_task(), ending up with the warning below.\n\nSo remove the WARN_ON_ONCE() check and add comments to\nexplain it all.\n\nThis addresses the following warning reported by Vince Weaver:\n\n[  324.983534] ------------[ cut here ]------------\n[  324.984420] WARNING: at kernel/events/core.c:1953 __perf_event_enable+0x187/0x190()\n[  324.984420] Modules linked in:\n[  324.984420] CPU: 19 PID: 2715 Comm: nmi_bug_snb Not tainted 3.10.0+ #246\n[  324.984420] Hardware name: Supermicro X8DTN/X8DTN, BIOS 4.6.3 01/08/2010\n[  324.984420]  0000000000000009 ffff88043fce3ec8 ffffffff8160ea0b ffff88043fce3f00\n[  324.984420]  ffffffff81080ff0 ffff8802314fdc00 ffff880231a8f800 ffff88043fcf7860\n[  324.984420]  0000000000000286 ffff880231a8f800 ffff88043fce3f10 ffffffff8108103a\n[  324.984420] Call Trace:\n[  324.984420]  \u003cIRQ\u003e  [\u003cffffffff8160ea0b\u003e] dump_stack+0x19/0x1b\n[  324.984420]  [\u003cffffffff81080ff0\u003e] warn_slowpath_common+0x70/0xa0\n[  324.984420]  [\u003cffffffff8108103a\u003e] warn_slowpath_null+0x1a/0x20\n[  324.984420]  [\u003cffffffff81134437\u003e] __perf_event_enable+0x187/0x190\n[  324.984420]  [\u003cffffffff81130030\u003e] remote_function+0x40/0x50\n[  324.984420]  [\u003cffffffff810e51de\u003e] generic_smp_call_function_single_interrupt+0xbe/0x130\n[  324.984420]  [\u003cffffffff81066a47\u003e] smp_call_function_single_interrupt+0x27/0x40\n[  324.984420]  [\u003cffffffff8161fd2f\u003e] call_function_single_interrupt+0x6f/0x80\n[  324.984420]  \u003cEOI\u003e  [\u003cffffffff816161a1\u003e] ? _raw_spin_unlock_irqrestore+0x41/0x70\n[  324.984420]  [\u003cffffffff8113799d\u003e] perf_event_exit_task+0x14d/0x210\n[  324.984420]  [\u003cffffffff810acd04\u003e] ? switch_task_namespaces+0x24/0x60\n[  324.984420]  [\u003cffffffff81086946\u003e] do_exit+0x2b6/0xa40\n[  324.984420]  [\u003cffffffff8161615c\u003e] ? _raw_spin_unlock_irq+0x2c/0x30\n[  324.984420]  [\u003cffffffff81087279\u003e] do_group_exit+0x49/0xc0\n[  324.984420]  [\u003cffffffff81096854\u003e] get_signal_to_deliver+0x254/0x620\n[  324.984420]  [\u003cffffffff81043057\u003e] do_signal+0x57/0x5a0\n[  324.984420]  [\u003cffffffff8161a164\u003e] ? __do_page_fault+0x2a4/0x4e0\n[  324.984420]  [\u003cffffffff8161665c\u003e] ? retint_restore_args+0xe/0xe\n[  324.984420]  [\u003cffffffff816166cd\u003e] ? retint_signal+0x11/0x84\n[  324.984420]  [\u003cffffffff81043605\u003e] do_notify_resume+0x65/0x80\n[  324.984420]  [\u003cffffffff81616702\u003e] retint_signal+0x46/0x84\n[  324.984420] ---[ end trace 442ec2f04db3771a ]---\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSuggested-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Corey Ashford \u003ccjashfor@linux.vnet.ibm.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1373384651-6109-2-git-send-email-jolsa@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "c4c6a6ea3adbe790d81ef72f623e22591704fdb9",
      "tree": "c5b11f6d4dfa366f85c86e153227a40b4146047b",
      "parents": [
        "ca9c5a9c9bc8bcf8e7308013a08d214df6eee673"
      ],
      "author": {
        "name": "Jiri Olsa",
        "email": "jolsa@redhat.com",
        "time": "Tue Jul 09 17:44:10 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:25:48 2013 -0700"
      },
      "message": "perf: Clone child context from parent context pmu\n\ncommit 734df5ab549ca44f40de0f07af1c8803856dfb18 upstream.\n\nCurrently when the child context for inherited events is\ncreated, it\u0027s based on the pmu object of the first event\nof the parent context.\n\nThis is wrong for the following scenario:\n\n  - HW context having HW and SW event\n  - HW event got removed (closed)\n  - SW event stays in HW context as the only event\n    and its pmu is used to clone the child context\n\nThe issue starts when the cpu context object is touched\nbased on the pmu context object (__get_cpu_context). In\nthis case the HW context will work with SW cpu context\nending up with following WARN below.\n\nFixing this by using parent context pmu object to clone\nfrom child context.\n\nAddresses the following warning reported by Vince Weaver:\n\n[ 2716.472065] ------------[ cut here ]------------\n[ 2716.476035] WARNING: at kernel/events/core.c:2122 task_ctx_sched_out+0x3c/0x)\n[ 2716.476035] Modules linked in: nfsd auth_rpcgss oid_registry nfs_acl nfs locn\n[ 2716.476035] CPU: 0 PID: 3164 Comm: perf_fuzzer Not tainted 3.10.0-rc4 #2\n[ 2716.476035] Hardware name: AOpen   DE7000/nMCP7ALPx-DE R1.06 Oct.19.2012, BI2\n[ 2716.476035]  0000000000000000 ffffffff8102e215 0000000000000000 ffff88011fc18\n[ 2716.476035]  ffff8801175557f0 0000000000000000 ffff880119fda88c ffffffff810ad\n[ 2716.476035]  ffff880119fda880 ffffffff810af02a 0000000000000009 ffff880117550\n[ 2716.476035] Call Trace:\n[ 2716.476035]  [\u003cffffffff8102e215\u003e] ? warn_slowpath_common+0x5b/0x70\n[ 2716.476035]  [\u003cffffffff810ab2bd\u003e] ? task_ctx_sched_out+0x3c/0x5f\n[ 2716.476035]  [\u003cffffffff810af02a\u003e] ? perf_event_exit_task+0xbf/0x194\n[ 2716.476035]  [\u003cffffffff81032a37\u003e] ? do_exit+0x3e7/0x90c\n[ 2716.476035]  [\u003cffffffff810cd5ab\u003e] ? __do_fault+0x359/0x394\n[ 2716.476035]  [\u003cffffffff81032fe6\u003e] ? do_group_exit+0x66/0x98\n[ 2716.476035]  [\u003cffffffff8103dbcd\u003e] ? get_signal_to_deliver+0x479/0x4ad\n[ 2716.476035]  [\u003cffffffff810ac05c\u003e] ? __perf_event_task_sched_out+0x230/0x2d1\n[ 2716.476035]  [\u003cffffffff8100205d\u003e] ? do_signal+0x3c/0x432\n[ 2716.476035]  [\u003cffffffff810abbf9\u003e] ? ctx_sched_in+0x43/0x141\n[ 2716.476035]  [\u003cffffffff810ac2ca\u003e] ? perf_event_context_sched_in+0x7a/0x90\n[ 2716.476035]  [\u003cffffffff810ac311\u003e] ? __perf_event_task_sched_in+0x31/0x118\n[ 2716.476035]  [\u003cffffffff81050dd9\u003e] ? mmdrop+0xd/0x1c\n[ 2716.476035]  [\u003cffffffff81051a39\u003e] ? finish_task_switch+0x7d/0xa6\n[ 2716.476035]  [\u003cffffffff81002473\u003e] ? do_notify_resume+0x20/0x5d\n[ 2716.476035]  [\u003cffffffff813654f5\u003e] ? retint_signal+0x3d/0x78\n[ 2716.476035] ---[ end trace 827178d8a5966c3d ]---\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Corey Ashford \u003ccjashfor@linux.vnet.ibm.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1373384651-6109-1-git-send-email-jolsa@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "d018274f859ae2cfbe86646948b65a4edd0d335f",
      "tree": "fe9f668b148a0981ffccee200c9c6da59f86d288",
      "parents": [
        "39d2dd53da0ef0be782387f79fe6bfefc0808629"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Thu May 30 21:10:37 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:25:47 2013 -0700"
      },
      "message": "tracing: Use current_uid() for critical time tracing\n\ncommit f17a5194859a82afe4164e938b92035b86c55794 upstream.\n\nThe irqsoff tracer records the max time that interrupts are disabled.\nThere are hooks in the assembly code that calls back into the tracer when\ninterrupts are disabled or enabled.\n\nWhen they are enabled, the tracer checks if the amount of time they\nwere disabled is larger than the previous recorded max interrupts off\ntime. If it is, it creates a snapshot of the currently running trace\nto store where the last largest interrupts off time was held and how\nit happened.\n\nDuring testing, this RCU lockdep dump appeared:\n\n[ 1257.829021] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 1257.829021] [ INFO: suspicious RCU usage. ]\n[ 1257.829021] 3.10.0-rc1-test+ #171 Tainted: G        W\n[ 1257.829021] -------------------------------\n[ 1257.829021] /home/rostedt/work/git/linux-trace.git/include/linux/rcupdate.h:780 rcu_read_lock() used illegally while idle!\n[ 1257.829021]\n[ 1257.829021] other info that might help us debug this:\n[ 1257.829021]\n[ 1257.829021]\n[ 1257.829021] RCU used illegally from idle CPU!\n[ 1257.829021] rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n[ 1257.829021] RCU used illegally from extended quiescent state!\n[ 1257.829021] 2 locks held by trace-cmd/4831:\n[ 1257.829021]  #0:  (max_trace_lock){......}, at: [\u003cffffffff810e2b77\u003e] stop_critical_timing+0x1a3/0x209\n[ 1257.829021]  #1:  (rcu_read_lock){.+.+..}, at: [\u003cffffffff810dae5a\u003e] __update_max_tr+0x88/0x1ee\n[ 1257.829021]\n[ 1257.829021] stack backtrace:\n[ 1257.829021] CPU: 3 PID: 4831 Comm: trace-cmd Tainted: G        W    3.10.0-rc1-test+ #171\n[ 1257.829021] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007\n[ 1257.829021]  0000000000000001 ffff880065f49da8 ffffffff8153dd2b ffff880065f49dd8\n[ 1257.829021]  ffffffff81092a00 ffff88006bd78680 ffff88007add7500 0000000000000003\n[ 1257.829021]  ffff88006bd78680 ffff880065f49e18 ffffffff810daebf ffffffff810dae5a\n[ 1257.829021] Call Trace:\n[ 1257.829021]  [\u003cffffffff8153dd2b\u003e] dump_stack+0x19/0x1b\n[ 1257.829021]  [\u003cffffffff81092a00\u003e] lockdep_rcu_suspicious+0x109/0x112\n[ 1257.829021]  [\u003cffffffff810daebf\u003e] __update_max_tr+0xed/0x1ee\n[ 1257.829021]  [\u003cffffffff810dae5a\u003e] ? __update_max_tr+0x88/0x1ee\n[ 1257.829021]  [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021]  [\u003cffffffff810dbf85\u003e] update_max_tr_single+0x11d/0x12d\n[ 1257.829021]  [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021]  [\u003cffffffff810e2b15\u003e] stop_critical_timing+0x141/0x209\n[ 1257.829021]  [\u003cffffffff8109569a\u003e] ? trace_hardirqs_on+0xd/0xf\n[ 1257.829021]  [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021]  [\u003cffffffff810e3057\u003e] time_hardirqs_on+0x2a/0x2f\n[ 1257.829021]  [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021]  [\u003cffffffff8109550c\u003e] trace_hardirqs_on_caller+0x16/0x197\n[ 1257.829021]  [\u003cffffffff8109569a\u003e] trace_hardirqs_on+0xd/0xf\n[ 1257.829021]  [\u003cffffffff811002b9\u003e] user_enter+0xfd/0x107\n[ 1257.829021]  [\u003cffffffff810029b4\u003e] do_notify_resume+0x92/0x97\n[ 1257.829021]  [\u003cffffffff8154bdca\u003e] int_signal+0x12/0x17\n\nWhat happened was entering into the user code, the interrupts were enabled\nand a max interrupts off was recorded. The trace buffer was saved along with\nvarious information about the task: comm, pid, uid, priority, etc.\n\nThe uid is recorded with task_uid(tsk). But this is a macro that uses rcu_read_lock()\nto retrieve the data, and this happened to happen where RCU is blind (user_enter).\n\nAs only the preempt and irqs off tracers can have this happen, and they both\nonly have the tsk \u003d\u003d current, if tsk \u003d\u003d current, use current_uid() instead of\ntask_uid(), as current_uid() does not use RCU as only current can change its uid.\n\nThis fixes the RCU suspicious splat.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "60a0c1a6129d06f1f6bc71acd50c8d289484c7ea",
      "tree": "ce74c210c62dc509861027b92c1923e44c504f50",
      "parents": [
        "8899476bd4758c47c2e4e4b92bb64fb9177b0c28"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Mon Jul 01 22:14:10 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 28 16:25:44 2013 -0700"
      },
      "message": "tick: Prevent uncontrolled switch to oneshot mode\n\ncommit 1f73a9806bdd07a5106409bbcab3884078bd34fe upstream.\n\nWhen the system switches from periodic to oneshot mode, the broadcast\nlogic causes a possibility that a CPU which has not yet switched to\noneshot mode puts its own clock event device into oneshot mode without\nupdating the state and the timer handler.\n\nCPU0\t\t\t\tCPU1\n\t\t\t\tper cpu tickdev is in periodic mode\n\t\t\t\tand switched to broadcast\n\nSwitch to oneshot mode\n tick_broadcast_switch_to_oneshot()\n  cpumask_copy(tick_oneshot_broacast_mask,\n\t       tick_broadcast_mask);\n\n  broadcast device mode \u003d oneshot\n\n\t\t\t\tTimer interrupt\n\n\t\t\t\tirq_enter()\n\t\t\t\t tick_check_oneshot_broadcast()\n\t\t\t\t  dev-\u003eset_mode(ONESHOT);\n\n\t\t\t\ttick_handle_periodic()\n\t\t\t\t if (dev-\u003emode \u003d\u003d ONESHOT)\n\t\t\t\t   dev-\u003enext_event +\u003d period;\n\t\t\t\t   FAIL.\n\nWe fail, because dev-\u003enext_event contains KTIME_MAX, if the device was\nin periodic mode before the uncontrolled switch to oneshot happened.\n\nWe must copy the broadcast bits over to the oneshot mask, because\notherwise a CPU which relies on the broadcast would not been woken up\nanymore after the broadcast device switched to oneshot mode.\n\nSo we need to verify in tick_check_oneshot_broadcast() whether the CPU\nhas already switched to oneshot mode. If not, leave the device\nuntouched and let the CPU switch controlled into oneshot mode.\n\nThis is a long standing bug, which was never noticed, because the main\nuser of the broadcast x86 cannot run into that scenario, AFAICT. The\nnonarchitected timer mess of ARM creates a gazillion of differently\nbroken abominations which trigger the shortcomings of that broadcast\ncode, which better had never been necessary in the first place.\n\nReported-and-tested-by: Stehle Vincent-B46079 \u003cB46079@freescale.com\u003e\nReviewed-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e,\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nLink: http://lkml.kernel.org/r/alpine.DEB.2.02.1307012153060.4013@ionos.tec.linutronix.de\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "7b1648b7dc2f1954a3492e5127a4b6a408814964",
      "tree": "db0999d2cdd59238bfcf1da4f34598b570061f26",
      "parents": [
        "9d57dc4b0be6fe82b22dc310724a79a728b48147"
      ],
      "author": {
        "name": "Bart Van Assche",
        "email": "bart.vanassche@gmail.com",
        "time": "Tue May 21 20:43:50 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 21 18:19:01 2013 -0700"
      },
      "message": "timer: Fix jiffies wrap behavior of round_jiffies_common()\n\ncommit 9e04d3804d3ac97d8c03a41d78d0f0674b5d01e1 upstream.\n\nDirect compare of jiffies related values does not work in the wrap\naround case. Replace it with time_is_after_jiffies().\n\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nCc: Arjan van de Ven \u003carjan@infradead.org\u003e\nCc: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nLink: http://lkml.kernel.org/r/519BC066.5080600@acm.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "f95bc0f79df33f63a1615d18c92abf829208e2a2",
      "tree": "a8d60e42979356fdc2569bd88394d87e5ebcd253",
      "parents": [
        "a8fc29c2b3c5c9116f441ce599d7f82acc0f9795"
      ],
      "author": {
        "name": "Ben Hutchings",
        "email": "ben@decadent.org.uk",
        "time": "Fri Jun 28 02:40:30 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun Jul 21 18:19:01 2013 -0700"
      },
      "message": "genirq: Fix can_request_irq() for IRQs without an action\n\ncommit 2779db8d37d4b542d9ca2575f5f178dbeaca6c86 upstream.\n\nCommit 02725e7471b8 (\u0027genirq: Use irq_get/put functions\u0027),\ninadvertently changed can_request_irq() to return 0 for IRQs that have\nno action.  This causes pcibios_lookup_irq() to select only IRQs that\nalready have an action with IRQF_SHARED set, or to fail if there are\nnone.  Change can_request_irq() to return 1 for IRQs that have no\naction (if the first two conditions are met).\n\nReported-by: Bjarni Ingi Gislason \u003cbjarniig@rhi.hi.is\u003e\nTested-by: Bjarni Ingi Gislason \u003cbjarniig@rhi.hi.is\u003e (against 3.2)\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: 709647@bugs.debian.org\nLink: http://bugs.debian.org/709647\nLink: http://lkml.kernel.org/r/1372383630.23847.40.camel@deadeye.wl.decadent.org.uk\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "6d96e9394365dfddf5d418d8178ce2a503448c29",
      "tree": "356dfe3055d85c2198b9351f5c8d3d410000a3ed",
      "parents": [
        "36c982c1c71b5bb35d06d46ffb82593bf8dbe8c7"
      ],
      "author": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jul 11 14:04:48 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sat Jul 13 11:03:41 2013 -0700"
      },
      "message": "Revert \"sched: Add missing call to calc_load_exit_idle()\"\n\nThis reverts commit 48f0f14ffb6ff4852922994d11fbda418d40100e which was\ncommit 749c8814f08f12baa4a9c2812a7c6ede7d69507d upstream.\n\nIt seems to be misapplied, and not needed for 3.4-stable\n\nReported-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nCc: Charles Wang \u003cmuming.wq@taobao.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "703197b61d05f5edae54bad3256901c5a5c8794c",
      "tree": "68a7a7ea0fbf0348291f74075795fee86566b87c",
      "parents": [
        "535fad87e86d33ea41d4b8580fadf62f5865ae6b"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Tue Jun 04 10:44:21 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jul 03 10:59:06 2013 -0700"
      },
      "message": "perf: Fix mmap() accounting hole\n\ncommit 9bb5d40cd93c9dd4be74834b1dcb1ba03629716b upstream.\n\nVince\u0027s fuzzer once again found holes. This time it spotted a leak in\nthe locked page accounting.\n\nWhen an event had redirected output and its close() was the last\nreference to the buffer we didn\u0027t have a vm context to undo accounting.\n\nChange the code to destroy the buffer on the last munmap() and detach\nall redirected events at that time. This provides us the right context\nto undo the vm accounting.\n\n[Backporting for 3.4-stable.\nVM_RESERVED flag was replaced with pair \u0027VM_DONTEXPAND | VM_DONTDUMP\u0027 in\n314e51b9 since 3.7.0-rc1, and 314e51b9 comes from a big patchset, we didn\u0027t\nbackport the patchset, so I restored \u0027VM_DNOTEXPAND | VM_DONTDUMP\u0027 as before:\n-\tvma-\u003evm_flags |\u003d VM_DONTCOPY | VM_DONTEXPAND | VM_DONTDUMP;\n+\tvma-\u003evm_flags |\u003d VM_DONTCOPY | VM_RESERVED;\n -- zliu]\n\nReported-and-tested-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20130604084421.GI8923@twins.programming.kicks-ass.net\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Zhouping Liu \u003czliu@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "535fad87e86d33ea41d4b8580fadf62f5865ae6b",
      "tree": "144c7d400374a57142d4e176c6f0ac34ba926028",
      "parents": [
        "5d2a2c717306c11672aef8ca6a1535ff78f57fa8"
      ],
      "author": {
        "name": "Peter Zijlstra",
        "email": "peterz@infradead.org",
        "time": "Tue May 28 10:55:48 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jul 03 10:59:06 2013 -0700"
      },
      "message": "perf: Fix perf mmap bugs\n\ncommit 26cb63ad11e04047a64309362674bcbbd6a6f246 upstream.\n\nVince reported a problem found by his perf specific trinity\nfuzzer.\n\nAl noticed 2 problems with perf\u0027s mmap():\n\n - it has issues against fork() since we use vma-\u003evm_mm for accounting.\n - it has an rb refcount leak on double mmap().\n\nWe fix the issues against fork() by using VM_DONTCOPY; I don\u0027t\nthink there\u0027s code out there that uses this; we didn\u0027t hear\nabout weird accounting problems/crashes. If we do need this to\nwork, the previously proposed VM_PINNED could make this work.\n\nAside from the rb reference leak spotted by Al, Vince\u0027s example\nprog was indeed doing a double mmap() through the use of\nperf_event_set_output().\n\nThis exposes another problem, since we now have 2 events with\none buffer, the accounting gets screwy because we account per\nevent. Fix this by making the buffer responsible for its own\naccounting.\n\n[Backporting for 3.4-stable.\nVM_RESERVED flag was replaced with pair \u0027VM_DONTEXPAND | VM_DONTDUMP\u0027 in\n314e51b9 since 3.7.0-rc1, and 314e51b9 comes from a big patchset, we didn\u0027t\nbackport the patchset, so I restored \u0027VM_DNOTEXPAND | VM_DONTDUMP\u0027 as before:\n-       vma-\u003evm_flags |\u003d VM_DONTCOPY | VM_DONTEXPAND | VM_DONTDUMP;\n+       vma-\u003evm_flags |\u003d VM_DONTCOPY | VM_RESERVED;\n -- zliu]\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nLink: http://lkml.kernel.org/r/20130528085548.GA12193@twins.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Zhouping Liu \u003czliu@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "ed0b72ac1e4361d9aaf2922adfba4a263cc37e03",
      "tree": "a650fbbca90c4af7fd3bc08ca549b6d08995b6bc",
      "parents": [
        "630493e2e96ab876b8085a3352e255d2f56be75c"
      ],
      "author": {
        "name": "Oleg Nesterov",
        "email": "oleg@redhat.com",
        "time": "Thu Jun 20 17:50:09 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Jul 03 10:59:01 2013 -0700"
      },
      "message": "hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()\n\ncommit c790b0ad23f427c7522ffed264706238c57c007e upstream.\n\nfetch_bp_busy_slots() and toggle_bp_slot() use\nfor_each_online_cpu(), this is obviously wrong wrt cpu_up() or\ncpu_down(), we can over/under account the per-cpu numbers.\n\nFor example:\n\n\t# echo 0 \u003e\u003e /sys/devices/system/cpu/cpu1/online\n\t# perf record -e mem:0x10 -p 1 \u0026\n\t# echo 1 \u003e\u003e /sys/devices/system/cpu/cpu1/online\n\t# perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10 -C1 -a \u0026\n\t# taskset -p 0x2 1\n\ntriggers the same WARN_ONCE(\"Can\u0027t find any breakpoint slot\") in\narch_install_hw_breakpoint().\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nLink: http://lkml.kernel.org/r/20130620155009.GA6327@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "fc1cbc74d5de169112578e4479d48408b222e325",
      "tree": "06735eb64dfd3b9610826f61c668ee1ec12c2e05",
      "parents": [
        "b3cba474228862814480d40554f77e98483f41ed"
      ],
      "author": {
        "name": "Robin Holt",
        "email": "holt@sgi.com",
        "time": "Wed Jun 12 14:04:37 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jun 20 11:58:45 2013 -0700"
      },
      "message": "reboot: rigrate shutdown/reboot to boot cpu\n\ncommit cf7df378aa4ff7da3a44769b7ff6e9eef1a9f3db upstream.\n\nWe recently noticed that reboot of a 1024 cpu machine takes approx 16\nminutes of just stopping the cpus.  The slowdown was tracked to commit\nf96972f2dc63 (\"kernel/sys.c: call disable_nonboot_cpus() in\nkernel_restart()\").\n\nThe current implementation does all the work of hot removing the cpus\nbefore halting the system.  We are switching to just migrating to the\nboot cpu and then continuing with shutdown/reboot.\n\nThis also has the effect of not breaking x86\u0027s command line parameter\nfor specifying the reboot cpu.  Note, this code was shamelessly copied\nfrom arch/x86/kernel/reboot.c with bits removed pertaining to the\nreboot_cpu command line parameter.\n\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nTested-by: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nCc: \"Srivatsa S. Bhat\" \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Russ Anderson \u003crja@sgi.com\u003e\nCc: Robin Holt \u003cholt@sgi.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: Guan Xuetao \u003cgxt@mprc.pku.edu.cn\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "b3cba474228862814480d40554f77e98483f41ed",
      "tree": "ac70cc8e20df21d9f64b27bd5f2318964b204cd1",
      "parents": [
        "91c930674642f4b849d64398db261ad13c3ab354"
      ],
      "author": {
        "name": "Srivatsa S. Bhat",
        "email": "srivatsa.bhat@linux.vnet.ibm.com",
        "time": "Wed Jun 12 14:04:36 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jun 20 11:58:44 2013 -0700"
      },
      "message": "CPU hotplug: provide a generic helper to disable/enable CPU hotplug\n\ncommit 16e53dbf10a2d7e228709a7286310e629ede5e45 upstream.\n\nThere are instances in the kernel where we would like to disable CPU\nhotplug (from sysfs) during some important operation.  Today the freezer\ncode depends on this and the code to do it was kinda tailor-made for\nthat.\n\nRestructure the code and make it generic enough to be useful for other\nusecases too.\n\nSigned-off-by: Srivatsa S. Bhat \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Russ Anderson \u003crja@sgi.com\u003e\nCc: Robin Holt \u003cholt@sgi.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: Guan Xuetao \u003cgxt@mprc.pku.edu.cn\u003e\nCc: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "bc4d36c41f16a66c320fd0282110ddc82aa1eb09",
      "tree": "4d15ef32790902916c0b92b33b299dfeb2834b5d",
      "parents": [
        "3a22cc7f184b77731816e55662cd12f0c3d24d56"
      ],
      "author": {
        "name": "Steven Rostedt",
        "email": "rostedt@goodmis.org",
        "time": "Fri Jun 07 17:02:08 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jun 13 09:45:03 2013 -0700"
      },
      "message": "ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section\n\ncommit 7f49ef69db6bbf756c0abca7e9b65b32e999eec8 upstream.\n\nAs ftrace_filter_lseek is now used with ftrace_pid_fops, it needs to\nbe moved out of the #ifdef CONFIG_DYNAMIC_FTRACE section as the\nftrace_pid_fops is defined when DYNAMIC_FTRACE is not.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n[ lizf: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "3a22cc7f184b77731816e55662cd12f0c3d24d56",
      "tree": "ce3612a4ea2ec1ed53d5c98a24b88aa80067129c",
      "parents": [
        "ce840e2f7825bfd240782dc209c2f2b8db514287"
      ],
      "author": {
        "name": "Namhyung Kim",
        "email": "namhyung.kim@lge.com",
        "time": "Fri Jun 07 17:01:16 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Jun 13 09:45:03 2013 -0700"
      },
      "message": "tracing: Fix possible NULL pointer dereferences\n\ncommit 6a76f8c0ab19f215af2a3442870eeb5f0e81998d upstream.\n\nCurrently set_ftrace_pid and set_graph_function files use seq_lseek\nfor their fops.  However seq_open() is called only for FMODE_READ in\nthe fops-\u003eopen() so that if an user tries to seek one of those file\nwhen she open it for writing, it sees NULL seq_file and then panic.\n\nIt can be easily reproduced with following command:\n\n  $ cd /sys/kernel/debug/tracing\n  $ echo 1234 | sudo tee -a set_ftrace_pid\n\nIn this example, GNU coreutils\u0027 tee opens the file with fopen(, \"a\")\nand then the fopen() internally calls lseek().\n\nLink:\nhttp://lkml.kernel.org/r/1365663302-2170-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n[ lizf: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n"
    },
    {
      "commit": "53b4378e4f77b7ab6565d6d40559bd5eb1b34629",
      "tree": "148210911b9a3072f9c3bc72b464606481e76bbd",
      "parents": [
        "b58f2e1650eafddfdfcff2f4831bf2896f8c9bf6"
      ],
      "author": {
        "name": "Oleg Nesterov",
        "email": "oleg@redhat.com",
        "time": "Thu May 16 17:43:55 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun May 19 10:54:50 2013 -0700"
      },
      "message": "usermodehelper: check subprocess_info-\u003epath !\u003d NULL\n\ncommit 264b83c07a84223f0efd0d1db9ccc66d6f88288f upstream.\n\nargv_split(empty_or_all_spaces) happily succeeds, it simply returns\nargc \u003d\u003d 0 and argv[0] \u003d\u003d NULL. Change call_usermodehelper_exec() to\ncheck sub_info-\u003epath !\u003d NULL to avoid the crash.\n\nThis is the minimal fix, todo:\n\n - perhaps we should change argv_split() to return NULL or change the\n   callers.\n\n - kill or justify -\u003epath[0] check\n\n - narrow the scope of helper_lock()\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-By: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "cba998b9b3799a5d6861a969d7b7d9b4f4f181f6",
      "tree": "2fe75a00c6475f4e284dae7a737d0ab5f0f0e84d",
      "parents": [
        "33b7cfcb34b4ae37cde7a8a1c97c9be27677e931"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Tue May 14 15:40:48 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun May 19 10:54:40 2013 -0700"
      },
      "message": "tracing: Fix leaks of filter preds\n\ncommit 60705c89460fdc7227f2d153b68b3f34814738a4 upstream.\n\nSpecial preds are created when folding a series of preds that\ncan be done in serial. These are allocated in an ops field of\nthe pred structure. But they were never freed, causing memory\nleaks.\n\nThis was discovered using the kmemleak checker:\n\nunreferenced object 0xffff8800797fd5e0 (size 32):\n  comm \"swapper/0\", pid 1, jiffies 4294690605 (age 104.608s)\n  hex dump (first 32 bytes):\n    00 00 01 00 03 00 05 00 07 00 09 00 0b 00 0d 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff814b52af\u003e] kmemleak_alloc+0x73/0x98\n    [\u003cffffffff8111ff84\u003e] kmemleak_alloc_recursive.constprop.42+0x16/0x18\n    [\u003cffffffff81120e68\u003e] __kmalloc+0xd7/0x125\n    [\u003cffffffff810d47eb\u003e] kcalloc.constprop.24+0x2d/0x2f\n    [\u003cffffffff810d4896\u003e] fold_pred_tree_cb+0xa9/0xf4\n    [\u003cffffffff810d3781\u003e] walk_pred_tree+0x47/0xcc\n    [\u003cffffffff810d5030\u003e] replace_preds.isra.20+0x6f8/0x72f\n    [\u003cffffffff810d50b5\u003e] create_filter+0x4e/0x8b\n    [\u003cffffffff81b1c30d\u003e] ftrace_test_event_filter+0x5a/0x155\n    [\u003cffffffff8100028d\u003e] do_one_initcall+0xa0/0x137\n    [\u003cffffffff81afbedf\u003e] kernel_init_freeable+0x14d/0x1dc\n    [\u003cffffffff814b24b7\u003e] kernel_init+0xe/0xdb\n    [\u003cffffffff814d539c\u003e] ret_from_fork+0x7c/0xb0\n    [\u003cffffffffffffffff\u003e] 0xffffffffffffffff\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Tom Zanussi \u003ctzanussi@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "33b7cfcb34b4ae37cde7a8a1c97c9be27677e931",
      "tree": "79d2091b2bcdfe3fda377633dc0322d0ce903781",
      "parents": [
        "ed032fd4d81041e4002fc55ff1832ee588f103da"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri May 03 15:02:50 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun May 19 10:54:40 2013 -0700"
      },
      "message": "tick: Cleanup NOHZ per cpu data on cpu down\n\ncommit 4b0c0f294f60abcdd20994a8341a95c8ac5eeb96 upstream.\n\nPrarit reported a crash on CPU offline/online. The reason is that on\nCPU down the NOHZ related per cpu data of the dead cpu is not cleaned\nup. If at cpu online an interrupt happens before the per cpu tick\ndevice is registered the irq_enter() check potentially sees stale data\nand dereferences a NULL pointer.\n\nCleanup the data after the cpu is dead.\n\nReported-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Mike Galbraith \u003cbitbucket@online.de\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1305031451561.2886@ionos\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "ed032fd4d81041e4002fc55ff1832ee588f103da",
      "tree": "7c7b9a9a90ea7bd6fb41e03de122b36b3a787e33",
      "parents": [
        "ad86524f948c1914dbd5bc460a5c6fd131ec054a"
      ],
      "author": {
        "name": "Tirupathi Reddy",
        "email": "tirupath@codeaurora.org",
        "time": "Tue May 14 13:59:02 2013 +0530"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sun May 19 10:54:39 2013 -0700"
      },
      "message": "timer: Don\u0027t reinitialize the cpu base lock during CPU_UP_PREPARE\n\ncommit 42a5cf46cd56f46267d2a9fcf2655f4078cd3042 upstream.\n\nAn inactive timer\u0027s base can refer to a offline cpu\u0027s base.\n\nIn the current code, cpu_base\u0027s lock is blindly reinitialized each\ntime a CPU is brought up. If a CPU is brought online during the period\nthat another thread is trying to modify an inactive timer on that CPU\nwith holding its timer base lock, then the lock will be reinitialized\nunder its feet. This leads to following SPIN_BUG().\n\n\u003c0\u003e BUG: spinlock already unlocked on CPU#3, kworker/u:3/1466\n\u003c0\u003e lock: 0xe3ebe000, .magic: dead4ead, .owner: kworker/u:3/1466, .owner_cpu: 1\n\u003c4\u003e [\u003cc0013dc4\u003e] (unwind_backtrace+0x0/0x11c) from [\u003cc026e794\u003e] (do_raw_spin_unlock+0x40/0xcc)\n\u003c4\u003e [\u003cc026e794\u003e] (do_raw_spin_unlock+0x40/0xcc) from [\u003cc076c160\u003e] (_raw_spin_unlock+0x8/0x30)\n\u003c4\u003e [\u003cc076c160\u003e] (_raw_spin_unlock+0x8/0x30) from [\u003cc009b858\u003e] (mod_timer+0x294/0x310)\n\u003c4\u003e [\u003cc009b858\u003e] (mod_timer+0x294/0x310) from [\u003cc00a5e04\u003e] (queue_delayed_work_on+0x104/0x120)\n\u003c4\u003e [\u003cc00a5e04\u003e] (queue_delayed_work_on+0x104/0x120) from [\u003cc04eae00\u003e] (sdhci_msm_bus_voting+0x88/0x9c)\n\u003c4\u003e [\u003cc04eae00\u003e] (sdhci_msm_bus_voting+0x88/0x9c) from [\u003cc04d8780\u003e] (sdhci_disable+0x40/0x48)\n\u003c4\u003e [\u003cc04d8780\u003e] (sdhci_disable+0x40/0x48) from [\u003cc04bf300\u003e] (mmc_release_host+0x4c/0xb0)\n\u003c4\u003e [\u003cc04bf300\u003e] (mmc_release_host+0x4c/0xb0) from [\u003cc04c7aac\u003e] (mmc_sd_detect+0x90/0xfc)\n\u003c4\u003e [\u003cc04c7aac\u003e] (mmc_sd_detect+0x90/0xfc) from [\u003cc04c2504\u003e] (mmc_rescan+0x7c/0x2c4)\n\u003c4\u003e [\u003cc04c2504\u003e] (mmc_rescan+0x7c/0x2c4) from [\u003cc00a6a7c\u003e] (process_one_work+0x27c/0x484)\n\u003c4\u003e [\u003cc00a6a7c\u003e] (process_one_work+0x27c/0x484) from [\u003cc00a6e94\u003e] (worker_thread+0x210/0x3b0)\n\u003c4\u003e [\u003cc00a6e94\u003e] (worker_thread+0x210/0x3b0) from [\u003cc00aad9c\u003e] (kthread+0x80/0x8c)\n\u003c4\u003e [\u003cc00aad9c\u003e] (kthread+0x80/0x8c) from [\u003cc000ea80\u003e] (kernel_thread_exit+0x0/0x8)\n\nAs an example, this particular crash occurred when CPU #3 is executing\nmod_timer() on an inactive timer whose base is refered to offlined CPU\n#2.  The code locked the timer_base corresponding to CPU #2. Before it\ncould proceed, CPU #2 came online and reinitialized the spinlock\ncorresponding to its base. Thus now CPU #3 held a lock which was\nreinitialized. When CPU #3 finally ended up unlocking the old cpu_base\ncorresponding to CPU #2, we hit the above SPIN_BUG().\n\nCPU #0\t\tCPU #3\t\t\t\t       CPU #2\n------\t\t-------\t\t\t\t       -------\n.....\t\t ......\t\t\t\t      \u003cOffline\u003e\n\t\tmod_timer()\n\t\t lock_timer_base\n\t\t   spin_lock_irqsave(\u0026base-\u003elock)\n\ncpu_up(2)\t .....\t\t\t\t        ......\n\t\t\t\t\t\t\tinit_timers_cpu()\n....\t\t .....\t\t\t\t    \tspin_lock_init(\u0026base-\u003elock)\n.....\t\t   spin_unlock_irqrestore(\u0026base-\u003elock)  ......\n\t\t   \u003cspin_bug\u003e\n\nAllocation of per_cpu timer vector bases is done only once under\n\"tvec_base_done[]\" check. In the current code, spinlock_initialization\nof base-\u003elock isn\u0027t under this check. When a CPU is up each time the\nbase lock is reinitialized. Move base spinlock initialization under\nthe check.\n\nSigned-off-by: Tirupathi Reddy \u003ctirupath@codeaurora.org\u003e\nLink: http://lkml.kernel.org/r/1368520142-4136-1-git-send-email-tirupath@codeaurora.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e4727b26cd5c972a1688e23c877538ccdd5513be",
      "tree": "f600a5c94337ab2ab5c08c0fa6fccc2dfe9c2537",
      "parents": [
        "dcf3dfc3242fffb483a84dede9b3759a9b488c94"
      ],
      "author": {
        "name": "Chen Gang",
        "email": "gang.chen@asianux.com",
        "time": "Mon Apr 29 15:05:19 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sat May 11 13:48:14 2013 -0700"
      },
      "message": "kernel/audit_tree.c: tree will leak memory when failure occurs in audit_trim_trees()\n\ncommit 12b2f117f3bf738c1a00a6f64393f1953a740bd4 upstream.\n\naudit_trim_trees() calls get_tree().  If a failure occurs we must call\nput_tree().\n\n[akpm@linux-foundation.org: run put_tree() before mutex_lock() for small scalability improvement]\nSigned-off-by: Chen Gang \u003cgang.chen@asianux.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Jonghwan Choi \u003cjhbird.choi@samsung.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "dcf3dfc3242fffb483a84dede9b3759a9b488c94",
      "tree": "abfbf8826932b6459c7932c61452d5967a1183fc",
      "parents": [
        "22d9af8fbdb154769a9802127d81f61077bf649b"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Fri Mar 15 13:10:35 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Sat May 11 13:48:14 2013 -0700"
      },
      "message": "tracing: Fix ftrace_dump()\n\ncommit 7fe70b579c9e3daba71635e31b6189394e7b79d3 upstream.\n\nftrace_dump() had a lot of issues. What ftrace_dump() does, is when\nftrace_dump_on_oops is set (via a kernel parameter or sysctl), it\nwill dump out the ftrace buffers to the console when either a oops,\npanic, or a sysrq-z occurs.\n\nThis was written a long time ago when ftrace was fragile to recursion.\nBut it wasn\u0027t written well even for that.\n\nThere\u0027s a possible deadlock that can occur if a ftrace_dump() is happening\nand an NMI triggers another dump. This is because it grabs a lock\nbefore checking if the dump ran.\n\nIt also totally disables ftrace, and tracing for no good reasons.\n\nAs the ring_buffer now checks if it is read via a oops or NMI, where\nthere\u0027s a chance that the buffer gets corrupted, it will disable\nitself. No need to have ftrace_dump() do the same.\n\nftrace_dump() is now cleaned up where it uses an atomic counter to\nmake sure only one dump happens at a time. A simple atomic_inc_return()\nis enough that is needed for both other CPUs and NMIs. No need for\na spinlock, as if one CPU is running the dump, no other CPU needs\nto do it too.\n\nThe tracing_on variable is turned off and not turned on. The original\ncode did this, but it wasn\u0027t pretty. By just disabling this variable\nwe get the result of not seeing traces that happen between crashes.\n\nFor sysrq-z, it doesn\u0027t get turned on, but the user can always write\na \u00271\u0027 to the tracing_on file. If they are using sysrq-z, then they should\nknow about tracing_on.\n\nThe new code is much easier to read and less error prone. No more\ndeadlock possibility when an NMI triggers here.\n\nReported-by: zhangwei(Jovi) \u003cjovi.zhangwei@huawei.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "357093a8b82c10e6fff37d3c772ccc0e3b0549c4",
      "tree": "7dd7440413bebabe4173b2e34574582b28b07e32",
      "parents": [
        "97630ecdbda8138baf35a66b6e59dee940da05e1"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Thu Apr 25 11:45:53 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:56 2013 -0700"
      },
      "message": "clockevents: Set dummy handler on CPU_DEAD shutdown\n\ncommit 6f7a05d7018de222e40ca003721037a530979974 upstream.\n\nVitaliy reported that a per cpu HPET timer interrupt crashes the\nsystem during hibernation. What happens is that the per cpu HPET timer\ngets shut down when the nonboot cpus are stopped. When the nonboot\ncpus are onlined again the HPET code sets up the MSI interrupt which\nfires before the clock event device is registered. The event handler\nis still set to hrtimer_interrupt, which then crashes the machine due\nto highres mode not being active.\n\nSee http://bugs.debian.org/cgi-bin/bugreport.cgi?bug\u003d700333\n\nThere is no real good way to avoid that in the HPET code. The HPET\ncode alrady has a mechanism to detect spurious interrupts when event\nhandler \u003d\u003d NULL for a similar reason.\n\nWe can handle that in the clockevent/tick layer and replace the\nprevious functional handler with a dummy handler like we do in\ntick_setup_new_device().\n\nThe original clockevents code did this in clockevents_exchange_device(),\nbut that got removed by commit 7c1e76897 (clockevents: prevent\nclockevent event_handler ending up handler_noop) which forgot to fix\nit up in tick_shutdown(). Same issue with the broadcast device.\n\nReported-by: Vitaliy Fillipov \u003cvitalif@yourcmc.ru\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: 700333@bugs.debian.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "97630ecdbda8138baf35a66b6e59dee940da05e1",
      "tree": "455d48c2c0f99103af12d4790c88d52626a63990",
      "parents": [
        "b593b4dc6442a5fd8a569fdbcc8cb5fa2609d1b1"
      ],
      "author": {
        "name": "Li Zefan",
        "email": "lizefan@huawei.com",
        "time": "Tue Mar 12 15:36:00 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:56 2013 -0700"
      },
      "message": "cgroup: fix an off-by-one bug which may trigger BUG_ON()\n\ncommit 3ac1707a13a3da9cfc8f242a15b2fae6df2c5f88 upstream.\n\nThe 3rd parameter of flex_array_prealloc() is the number of elements,\nnot the index of the last element.\n\nThe effect of the bug is, when opening cgroup.procs, a flex array will\nbe allocated and all elements of the array is allocated with\nGFP_KERNEL flag, but the last one is GFP_ATOMIC, and if we fail to\nallocate memory for it, it\u0027ll trigger a BUG_ON().\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "194d30b3996940a012ed8265f3969f1f75ff7ec5",
      "tree": "868ee65fabc0ec7e028d76b62fd685dd1cb47196",
      "parents": [
        "86a640faa8585b60b2f2f78dd9769e2cc939208f"
      ],
      "author": {
        "name": "Prarit Bhargava",
        "email": "prarit@redhat.com",
        "time": "Mon Apr 08 08:47:15 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:55 2013 -0700"
      },
      "message": "hrtimer: Add expiry time overflow check in hrtimer_interrupt\n\ncommit 8f294b5a139ee4b75e890ad5b443c93d1e558a8b upstream.\n\nThe settimeofday01 test in the LTP testsuite effectively does\n\n        gettimeofday(current time);\n        settimeofday(Jan 1, 1970 + 100 seconds);\n        settimeofday(current time);\n\nThis test causes a stack trace to be displayed on the console during the\nsetting of timeofday to Jan 1, 1970 + 100 seconds:\n\n[  131.066751] ------------[ cut here ]------------\n[  131.096448] WARNING: at kernel/time/clockevents.c:209 clockevents_program_event+0x135/0x140()\n[  131.104935] Hardware name: Dinar\n[  131.108150] Modules linked in: sg nfsv3 nfs_acl nfsv4 auth_rpcgss nfs dns_resolver fscache lockd sunrpc nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables kvm_amd kvm sp5100_tco bnx2 i2c_piix4 crc32c_intel k10temp fam15h_power ghash_clmulni_intel amd64_edac_mod pcspkr serio_raw edac_mce_amd edac_core microcode xfs libcrc32c sr_mod sd_mod cdrom ata_generic crc_t10dif pata_acpi radeon i2c_algo_bit drm_kms_helper ttm drm ahci pata_atiixp libahci libata usb_storage i2c_core dm_mirror dm_region_hash dm_log dm_mod\n[  131.176784] Pid: 0, comm: swapper/28 Not tainted 3.8.0+ #6\n[  131.182248] Call Trace:\n[  131.184684]  \u003cIRQ\u003e  [\u003cffffffff810612af\u003e] warn_slowpath_common+0x7f/0xc0\n[  131.191312]  [\u003cffffffff8106130a\u003e] warn_slowpath_null+0x1a/0x20\n[  131.197131]  [\u003cffffffff810b9fd5\u003e] clockevents_program_event+0x135/0x140\n[  131.203721]  [\u003cffffffff810bb584\u003e] tick_program_event+0x24/0x30\n[  131.209534]  [\u003cffffffff81089ab1\u003e] hrtimer_interrupt+0x131/0x230\n[  131.215437]  [\u003cffffffff814b9600\u003e] ? cpufreq_p4_target+0x130/0x130\n[  131.221509]  [\u003cffffffff81619119\u003e] smp_apic_timer_interrupt+0x69/0x99\n[  131.227839]  [\u003cffffffff8161805d\u003e] apic_timer_interrupt+0x6d/0x80\n[  131.233816]  \u003cEOI\u003e  [\u003cffffffff81099745\u003e] ? sched_clock_cpu+0xc5/0x120\n[  131.240267]  [\u003cffffffff814b9ff0\u003e] ? cpuidle_wrap_enter+0x50/0xa0\n[  131.246252]  [\u003cffffffff814b9fe9\u003e] ? cpuidle_wrap_enter+0x49/0xa0\n[  131.252238]  [\u003cffffffff814ba050\u003e] cpuidle_enter_tk+0x10/0x20\n[  131.257877]  [\u003cffffffff814b9c89\u003e] cpuidle_idle_call+0xa9/0x260\n[  131.263692]  [\u003cffffffff8101c42f\u003e] cpu_idle+0xaf/0x120\n[  131.268727]  [\u003cffffffff815f8971\u003e] start_secondary+0x255/0x257\n[  131.274449] ---[ end trace 1151a50552231615 ]---\n\nWhen we change the system time to a low value like this, the value of\ntimekeeper-\u003eoffs_real will be a negative value.\n\nIt seems that the WARN occurs because an hrtimer has been started in the time\nbetween the releasing of the timekeeper lock and the IPI call (via a call to\non_each_cpu) in clock_was_set() in the do_settimeofday() code.  The end result\nis that a REALTIME_CLOCK timer has been added with softexpires \u003d expires \u003d\nKTIME_MAX.  The hrtimer_interrupt() fires/is called and the loop at\nkernel/hrtimer.c:1289 is executed.  In this loop the code subtracts the\nclock base\u0027s offset (which was set to timekeeper-\u003eoffs_real in\ndo_settimeofday()) from the current hrtimer_cpu_base-\u003eexpiry value (which\nwas KTIME_MAX):\n\n\tKTIME_MAX - (a negative value) \u003d overflow\n\nA simple check for an overflow can resolve this problem.  Using KTIME_MAX\ninstead of the overflow value will result in the hrtimer function being run,\nand the reprogramming of the timer after that.\n\nReviewed-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\n[jstultz: Tweaked commit subject]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "86a640faa8585b60b2f2f78dd9769e2cc939208f",
      "tree": "f91b3b3ee63b94b5b2c97690a1d6131332ce5a7d",
      "parents": [
        "a91a9f1e121a879f742f4c1718d58ba94e046dee"
      ],
      "author": {
        "name": "David Engraf",
        "email": "david.engraf@sysgo.com",
        "time": "Tue Mar 19 13:29:55 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:55 2013 -0700"
      },
      "message": "hrtimer: Fix ktime_add_ns() overflow on 32bit architectures\n\ncommit 51fd36f3fad8447c487137ae26b9d0b3ce77bb25 upstream.\n\nOne can trigger an overflow when using ktime_add_ns() on a 32bit\narchitecture not supporting CONFIG_KTIME_SCALAR.\n\nWhen passing a very high value for u64 nsec, e.g. 7881299347898368000\nthe do_div() function converts this value to seconds (7881299347) which\nis still to high to pass to the ktime_set() function as long. The result\nin is a negative value.\n\nThe problem on my system occurs in the tick-sched.c,\ntick_nohz_stop_sched_tick() when time_delta is set to\ntimekeeping_max_deferment(). The check for time_delta \u003c KTIME_MAX is\nvalid, thus ktime_add_ns() is called with a too large value resulting in\na negative expire value. This leads to an endless loop in the ticker code:\n\ntime_delta: 7881299347898368000\nexpires \u003d ktime_add_ns(last_update, time_delta)\nexpires: negative value\n\nThis fix caps the value to KTIME_MAX.\n\nThis error doesn\u0027t occurs on 64bit or architectures supporting\nCONFIG_KTIME_SCALAR (e.g. ARM, x86-32).\n\nSigned-off-by: David Engraf \u003cdavid.engraf@sysgo.com\u003e\n[jstultz: Minor tweaks to commit message \u0026 header]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "761694a0bdc01817d1212b1127234dcaf828fde7",
      "tree": "cb2c7b2d912bbe675c86f854d86fa137bbdfbf87",
      "parents": [
        "e1672f4e2c9fb1231a6242ca1596806f123da3c5"
      ],
      "author": {
        "name": "Namhyung Kim",
        "email": "namhyung.kim@lge.com",
        "time": "Thu Apr 11 16:01:38 2013 +0900"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:54 2013 -0700"
      },
      "message": "tracing: Reset ftrace_graph_filter_enabled if count is zero\n\ncommit 9f50afccfdc15d95d7331acddcb0f7703df089ae upstream.\n\nThe ftrace_graph_count can be decreased with a \"!\" pattern, so that\nthe enabled flag should be updated too.\n\nLink: http://lkml.kernel.org/r/1365663698-2413-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e1672f4e2c9fb1231a6242ca1596806f123da3c5",
      "tree": "b36e7f377900905a74acc59a60b3b80035a328a6",
      "parents": [
        "226c8ea60cfc71732ff2212fae71077789718e51"
      ],
      "author": {
        "name": "Namhyung Kim",
        "email": "namhyung.kim@lge.com",
        "time": "Wed Apr 10 09:18:12 2013 +0900"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:54 2013 -0700"
      },
      "message": "tracing: Check return value of tracing_init_dentry()\n\ncommit ed6f1c996bfe4b6e520cf7a74b51cd6988d84420 upstream.\n\nCheck return value and bail out if it\u0027s NULL.\n\nLink: http://lkml.kernel.org/r/1365553093-10180-2-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "226c8ea60cfc71732ff2212fae71077789718e51",
      "tree": "2b732acfa2d9c2011645cec8ce97732748fc28fb",
      "parents": [
        "d4ca6ccafc266cefbd004e515695cbeb1e8b8411"
      ],
      "author": {
        "name": "Namhyung Kim",
        "email": "namhyung.kim@lge.com",
        "time": "Mon Apr 01 21:46:24 2013 +0900"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:54 2013 -0700"
      },
      "message": "tracing: Fix off-by-one on allocating stat-\u003epages\n\ncommit 39e30cd1537937d3c00ef87e865324e981434e5b upstream.\n\nThe first page was allocated separately, so no need to start from 0.\n\nLink: http://lkml.kernel.org/r/1364820385-32027-2-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "d4ca6ccafc266cefbd004e515695cbeb1e8b8411",
      "tree": "ee4323abe88e7c646ccda4f23255cdfa5fe95eb3",
      "parents": [
        "af1860122000cf090868fb7f7fbba7417e4575bd"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Wed Mar 13 23:34:22 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:54 2013 -0700"
      },
      "message": "tracing: Remove most or all of stack tracer stack size from stack_max_size\n\ncommit 4df297129f622bdc18935c856f42b9ddd18f9f28 upstream.\n\nCurrently, the depth reported in the stack tracer stack_trace file\ndoes not match the stack_max_size file. This is because the stack_max_size\nincludes the overhead of stack tracer itself while the depth does not.\n\nThe first time a max is triggered, a calculation is not performed that\nfigures out the overhead of the stack tracer and subtracts it from\nthe stack_max_size variable. The overhead is stored and is subtracted\nfrom the reported stack size for comparing for a new max.\n\nNow the stack_max_size corresponds to the reported depth:\n\n # cat stack_max_size\n4640\n\n # cat stack_trace\n        Depth    Size   Location    (48 entries)\n        -----    ----   --------\n  0)     4640      32   _raw_spin_lock+0x18/0x24\n  1)     4608     112   ____cache_alloc+0xb7/0x22d\n  2)     4496      80   kmem_cache_alloc+0x63/0x12f\n  3)     4416      16   mempool_alloc_slab+0x15/0x17\n[...]\n\nWhile testing against and older gcc on x86 that uses mcount instead\nof fentry, I found that pasing in ip + MCOUNT_INSN_SIZE let the\nstack trace show one more function deep which was missing before.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "af1860122000cf090868fb7f7fbba7417e4575bd",
      "tree": "7b4b78cfbb68a81cb1463aaac0faa1b46e4052ec",
      "parents": [
        "893238186e35bdd59efde4572bcb6d0653c0ec65"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Wed Mar 13 21:25:35 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:54 2013 -0700"
      },
      "message": "tracing: Fix stack tracer with fentry use\n\ncommit d4ecbfc49b4b1d4b597fb5ba9e4fa25d62f105c5 upstream.\n\nWhen gcc 4.6 on x86 is used, the function tracer will use the new\noption -mfentry which does a call to \"fentry\" at every function\ninstead of \"mcount\". The significance of this is that fentry is\ncalled as the first operation of the function instead of the mcount\nusage of being called after the stack.\n\nThis causes the stack tracer to show some bogus results for the size\nof the last function traced, as well as showing \"ftrace_call\" instead\nof the function. This is due to the stack frame not being set up\nby the function that is about to be traced.\n\n # cat stack_trace\n        Depth    Size   Location    (48 entries)\n        -----    ----   --------\n  0)     4824     216   ftrace_call+0x5/0x2f\n  1)     4608     112   ____cache_alloc+0xb7/0x22d\n  2)     4496      80   kmem_cache_alloc+0x63/0x12f\n\nThe 216 size for ftrace_call includes both the ftrace_call stack\n(which includes the saving of registers it does), as well as the\nstack size of the parent.\n\nTo fix this, if CC_USING_FENTRY is defined, then the stack_tracer\nwill reserve the first item in stack_dump_trace[] array when\ncalling save_stack_trace(), and it will fill it in with the parent ip.\nThen the code will look for the parent pointer on the stack and\ngive the real size of the parent\u0027s stack pointer:\n\n # cat stack_trace\n        Depth    Size   Location    (14 entries)\n        -----    ----   --------\n  0)     2640      48   update_group_power+0x26/0x187\n  1)     2592     224   update_sd_lb_stats+0x2a5/0x4ac\n  2)     2368     160   find_busiest_group+0x31/0x1f1\n  3)     2208     256   load_balance+0xd9/0x662\n\nI\u0027m Cc\u0027ing stable, although it\u0027s not urgent, as it only shows bogus\nsize for item #0, the rest of the trace is legit. It should still be\ncorrected in previous stable releases.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "893238186e35bdd59efde4572bcb6d0653c0ec65",
      "tree": "4da26b69bc9c3432a7a77c653f882ccd2ced8424",
      "parents": [
        "a393520aa653a5e1133e14a1984b5e5815e01cf6"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Wed Mar 13 20:43:57 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue May 07 19:51:54 2013 -0700"
      },
      "message": "tracing: Use stack of calling function for stack tracer\n\ncommit 87889501d0adfae10e3b0f0e6f2d7536eed9ae84 upstream.\n\nUse the stack of stack_trace_call() instead of check_stack() as\nthe test pointer for max stack size. It makes it a bit cleaner\nand a little more accurate.\n\nAdding stable, as a later fix depends on this patch.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "da307d100cd4979e353e8265d0691263aa2a0086",
      "tree": "616b976a535fa6a9e8fdebcde048c9260d52897b",
      "parents": [
        "a3c21277df060c3c83b2aba4120d0370cf204d36"
      ],
      "author": {
        "name": "Tommi Rantala",
        "email": "tt.rantala@gmail.com",
        "time": "Sat Apr 13 22:49:14 2013 +0300"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Apr 25 21:19:55 2013 -0700"
      },
      "message": "perf: Treat attr.config as u64 in perf_swevent_init()\n\ncommit 8176cced706b5e5d15887584150764894e94e02f upstream.\n\nTrinity discovered that we fail to check all 64 bits of\nattr.config passed by user space, resulting to out-of-bounds\naccess of the perf_swevent_enabled array in\nsw_perf_event_destroy().\n\nIntroduced in commit b0a873ebb (\"perf: Register PMU\nimplementations\").\n\nSigned-off-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: davej@redhat.com\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nLink: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "410537558144cc886d780a02af9a09a122bff35b",
      "tree": "4bb0fec2c15698657d1d5929db9ca3f8d5759954",
      "parents": [
        "2a6b0247eee46f424e032fb7431cc4700ad19ea5"
      ],
      "author": {
        "name": "Tejun Heo",
        "email": "tj@kernel.org",
        "time": "Mon Mar 18 12:22:34 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Apr 25 21:19:55 2013 -0700"
      },
      "message": "sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s\n\ncommit 383efcd00053ec40023010ce5034bd702e7ab373 upstream.\n\ntry_to_wake_up_local() should only be invoked to wake up another\ntask in the same runqueue and BUG_ON()s are used to enforce the\nrule. Missing try_to_wake_up_local() can stall workqueue\nexecution but such stalls are likely to be finite either by\nanother work item being queued or the one blocked getting\nunblocked.  There\u0027s no reason to trigger BUG while holding rq\nlock crashing the whole system.\n\nConvert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20130318192234.GD3042@htj.dyndns.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "cf276742f2dcdf5258aac98447e8b4b9fba55aaa",
      "tree": "6de34c2bd35c7c5756470dabd4c30df3d7fc3b3d",
      "parents": [
        "f42097f7eb860a967d1629c4bb00f2a083edc1dc"
      ],
      "author": {
        "name": "Emese Revfy",
        "email": "re.emese@gmail.com",
        "time": "Wed Apr 17 15:58:36 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Apr 25 21:19:54 2013 -0700"
      },
      "message": "kernel/signal.c: stop info leak via the tkill and the tgkill syscalls\n\ncommit b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f upstream.\n\nThis fixes a kernel memory contents leak via the tkill and tgkill syscalls\nfor compat processes.\n\nThis is visible in the siginfo_t-\u003e_sifields._rt.si_sigval.sival_ptr field\nwhen handling signals delivered from tkill.\n\nThe place of the infoleak:\n\nint copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)\n{\n        ...\n        put_user_ex(ptr_to_compat(from-\u003esi_ptr), \u0026to-\u003esi_ptr);\n        ...\n}\n\nSigned-off-by: Emese Revfy \u003cre.emese@gmail.com\u003e\nReviewed-by: PaX Team \u003cpageexec@freemail.hu\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "110360768eb74d67bac851b7c0209a923258a314",
      "tree": "b51a45e613abfe9c2c27f7d210be22a56103b83b",
      "parents": [
        "816e2bb1b20b734d2e4286c12f0b18ae9dff35ab"
      ],
      "author": {
        "name": "Michael Bohan",
        "email": "mbohan@codeaurora.org",
        "time": "Tue Mar 19 19:19:25 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Apr 25 21:19:54 2013 -0700"
      },
      "message": "hrtimer: Don\u0027t reinitialize a cpu_base lock on CPU_UP\n\ncommit 84cc8fd2fe65866e49d70b38b3fdf7219dd92fe0 upstream.\n\nThe current code makes the assumption that a cpu_base lock won\u0027t be\nheld if the CPU corresponding to that cpu_base is offline, which isn\u0027t\nalways true.\n\nIf a hrtimer is not queued, then it will not be migrated by\nmigrate_hrtimers() when a CPU is offlined. Therefore, the hrtimer\u0027s\ncpu_base may still point to a CPU which has subsequently gone offline\nif the timer wasn\u0027t enqueued at the time the CPU went down.\n\nNormally this wouldn\u0027t be a problem, but a cpu_base\u0027s lock is blindly\nreinitialized each time a CPU is brought up. If a CPU is brought\nonline during the period that another thread is performing a hrtimer\noperation on a stale hrtimer, then the lock will be reinitialized\nunder its feet, and a SPIN_BUG() like the following will be observed:\n\n\u003c0\u003e[   28.082085] BUG: spinlock already unlocked on CPU#0, swapper/0/0\n\u003c0\u003e[   28.087078]  lock: 0xc4780b40, value 0x0 .magic: dead4ead, .owner: \u003cnone\u003e/-1, .owner_cpu: -1\n\u003c4\u003e[   42.451150] [\u003cc0014398\u003e] (unwind_backtrace+0x0/0x120) from [\u003cc0269220\u003e] (do_raw_spin_unlock+0x44/0xdc)\n\u003c4\u003e[   42.460430] [\u003cc0269220\u003e] (do_raw_spin_unlock+0x44/0xdc) from [\u003cc071b5bc\u003e] (_raw_spin_unlock+0x8/0x30)\n\u003c4\u003e[   42.469632] [\u003cc071b5bc\u003e] (_raw_spin_unlock+0x8/0x30) from [\u003cc00a9ce0\u003e] (__hrtimer_start_range_ns+0x1e4/0x4f8)\n\u003c4\u003e[   42.479521] [\u003cc00a9ce0\u003e] (__hrtimer_start_range_ns+0x1e4/0x4f8) from [\u003cc00aa014\u003e] (hrtimer_start+0x20/0x28)\n\u003c4\u003e[   42.489247] [\u003cc00aa014\u003e] (hrtimer_start+0x20/0x28) from [\u003cc00e6190\u003e] (rcu_idle_enter_common+0x1ac/0x320)\n\u003c4\u003e[   42.498709] [\u003cc00e6190\u003e] (rcu_idle_enter_common+0x1ac/0x320) from [\u003cc00e6440\u003e] (rcu_idle_enter+0xa0/0xb8)\n\u003c4\u003e[   42.508259] [\u003cc00e6440\u003e] (rcu_idle_enter+0xa0/0xb8) from [\u003cc000f268\u003e] (cpu_idle+0x24/0xf0)\n\u003c4\u003e[   42.516503] [\u003cc000f268\u003e] (cpu_idle+0x24/0xf0) from [\u003cc06ed3c0\u003e] (rest_init+0x88/0xa0)\n\u003c4\u003e[   42.524319] [\u003cc06ed3c0\u003e] (rest_init+0x88/0xa0) from [\u003cc0c00978\u003e] (start_kernel+0x3d0/0x434)\n\nAs an example, this particular crash occurred when hrtimer_start() was\nexecuted on CPU #0. The code locked the hrtimer\u0027s current cpu_base\ncorresponding to CPU #1. CPU #0 then tried to switch the hrtimer\u0027s\ncpu_base to an optimal CPU which was online. In this case, it selected\nthe cpu_base corresponding to CPU #3.\n\nBefore it could proceed, CPU #1 came online and reinitialized the\nspinlock corresponding to its cpu_base. Thus now CPU #0 held a lock\nwhich was reinitialized. When CPU #0 finally ended up unlocking the\nold cpu_base corresponding to CPU #1 so that it could switch to CPU\n#3, we hit this SPIN_BUG() above while in switch_hrtimer_base().\n\nCPU #0                            CPU #1\n----                              ----\n...                               \u003coffline\u003e\nhrtimer_start()\nlock_hrtimer_base(base #1)\n...                               init_hrtimers_cpu()\nswitch_hrtimer_base()             ...\n...                               raw_spin_lock_init(\u0026cpu_base-\u003elock)\nraw_spin_unlock(\u0026cpu_base-\u003elock)  ...\n\u003cspin_bug\u003e\n\nSolve this by statically initializing the lock.\n\nSigned-off-by: Michael Bohan \u003cmbohan@codeaurora.org\u003e\nLink: http://lkml.kernel.org/r/1363745965-23475-1-git-send-email-mbohan@codeaurora.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "fdd9ce008f3de39fa7fcd17717f1d7a0895269ea",
      "tree": "f69986fac5f79f8dc785ef2b490162d17f80c8a7",
      "parents": [
        "bff6627568427d14375d84426f491646fdf71a1f"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Sat Apr 06 10:10:27 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Apr 16 21:27:27 2013 -0700"
      },
      "message": "sched_clock: Prevent 64bit inatomicity on 32bit systems\n\ncommit a1cbcaa9ea87b87a96b9fc465951dcf36e459ca2 upstream.\n\nThe sched_clock_remote() implementation has the following inatomicity\nproblem on 32bit systems when accessing the remote scd-\u003eclock, which\nis a 64bit value.\n\nCPU0\t\t\tCPU1\n\nsched_clock_local()\tsched_clock_remote(CPU0)\n...\n\t\t\tremote_clock \u003d scd[CPU0]-\u003eclock\n\t\t\t    read_low32bit(scd[CPU0]-\u003eclock)\ncmpxchg64(scd-\u003eclock,...)\n\t\t\t    read_high32bit(scd[CPU0]-\u003eclock)\n\nWhile the update of scd-\u003eclock is using an atomic64 mechanism, the\nreadout on the remote cpu is not, which can cause completely bogus\nreadouts.\n\nIt is a quite rare problem, because it requires the update to hit the\nnarrow race window between the low/high readout and the update must go\nacross the 32bit boundary.\n\nThe resulting misbehaviour is, that CPU1 will see the sched_clock on\nCPU1 ~4 seconds ahead of it\u0027s own and update CPU1s sched_clock value\nto this bogus timestamp. This stays that way due to the clamping\nimplementation for about 4 seconds until the synchronization with\nCLOCK_MONOTONIC undoes the problem.\n\nThe issue is hard to observe, because it might only result in a less\naccurate SCHED_OTHER timeslicing behaviour. To create observable\ndamage on realtime scheduling classes, it is necessary that the bogus\nupdate of CPU1 sched_clock happens in the context of an realtime\nthread, which then gets charged 4 seconds of RT runtime, which results\nin the RT throttler mechanism to trigger and prevent scheduling of RT\ntasks for a little less than 4 seconds. So this is quite unlikely as\nwell.\n\nThe issue was quite hard to decode as the reproduction time is between\n2 days and 3 weeks and intrusive tracing makes it less likely, but the\nfollowing trace recorded with trace_clock\u003dglobal, which uses\nsched_clock_local(), gave the final hint:\n\n  \u003cidle\u003e-0   0d..30 400269.477150: hrtimer_cancel: hrtimer\u003d0xf7061e80\n  \u003cidle\u003e-0   0d..30 400269.477151: hrtimer_start:  hrtimer\u003d0xf7061e80 ...\nirq/20-S-587 1d..32 400273.772118: sched_wakeup:   comm\u003d ... target_cpu\u003d0\n  \u003cidle\u003e-0   0dN.30 400273.772118: hrtimer_cancel: hrtimer\u003d0xf7061e80\n\nWhat happens is that CPU0 goes idle and invokes\nsched_clock_idle_sleep_event() which invokes sched_clock_local() and\nCPU1 runs a remote wakeup for CPU0 at the same time, which invokes\nsched_remote_clock(). The time jump gets propagated to CPU0 via\nsched_remote_clock() and stays stale on both cores for ~4 seconds.\n\nThere are only two other possibilities, which could cause a stale\nsched clock:\n\n1) ktime_get() which reads out CLOCK_MONOTONIC returns a sporadic\n   wrong value.\n\n2) sched_clock() which reads the TSC returns a sporadic wrong value.\n\n#1 can be excluded because sched_clock would continue to increase for\n   one jiffy and then go stale.\n\n#2 can be excluded because it would not make the clock jump\n   forward. It would just result in a stale sched_clock for one jiffy.\n\nAfter quite some brain twisting and finding the same pattern on other\ntraces, sched_clock_remote() remained the only place which could cause\nsuch a problem and as explained above it\u0027s indeed racy on 32bit\nsystems.\n\nSo while on 64bit systems the readout is atomic, we need to verify the\nremote readout on 32bit machines. We need to protect the local-\u003eclock\nreadout in sched_clock_remote() on 32bit as well because an NMI could\nhit between the low and the high readout, call sched_clock_local() and\nmodify local-\u003eclock.\n\nThanks to Siegfried Wulsch for bearing with my debug requests and\ngoing through the tedious tasks of running a bunch of reproducer\nsystems to generate the debug information which let me decode the\nissue.\n\nReported-by: Siegfried Wulsch \u003cSiegfried.Wulsch@rovema.de\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1304051544160.21884@ionos\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e3573b2133637edf3a6cb39241e9270affa535c7",
      "tree": "d4ccc29a2ac633ab2b848304acf3446ac018827a",
      "parents": [
        "e264d3cf890eb1ead5200731b9e3dbd1d1b71fa8"
      ],
      "author": {
        "name": "Huacai Chen",
        "email": "chenhc@lemote.com",
        "time": "Sun Apr 07 02:14:14 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Apr 16 21:27:26 2013 -0700"
      },
      "message": "PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()\n\ncommit 6f389a8f1dd22a24f3d9afc2812b30d639e94625 upstream.\n\nAs commit 40dc166c (PM / Core: Introduce struct syscore_ops for core\nsubsystems PM) say, syscore_ops operations should be carried with one\nCPU on-line and interrupts disabled. However, after commit f96972f2d\n(kernel/sys.c: call disable_nonboot_cpus() in kernel_restart()),\nsyscore_shutdown() is called before disable_nonboot_cpus(), so break\nthe rules. We have a MIPS machine with a 8259A PIC, and there is an\nexternal timer (HPET) linked at 8259A. Since 8259A has been shutdown\ntoo early (by syscore_shutdown()), disable_nonboot_cpus() runs without\ntimer interrupt, so it hangs and reboot fails. This patch call\nsyscore_shutdown() a little later (after disable_nonboot_cpus()) to\navoid reboot failure, this is the same way as poweroff does.\n\nFor consistency, add disable_nonboot_cpus() to kernel_halt().\n\nSigned-off-by: Huacai Chen \u003cchenhc@lemote.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e264d3cf890eb1ead5200731b9e3dbd1d1b71fa8",
      "tree": "f0ac71897029ad2ec81178e32aec9eddb24e769e",
      "parents": [
        "b43105dee8480ca5784de5c858d1cccee74ebfb1"
      ],
      "author": {
        "name": "Namhyung Kim",
        "email": "namhyung.kim@lge.com",
        "time": "Mon Apr 01 21:46:23 2013 +0900"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Tue Apr 16 21:27:26 2013 -0700"
      },
      "message": "tracing: Fix double free when function profile init failed\n\ncommit 83e03b3fe4daffdebbb42151d5410d730ae50bd1 upstream.\n\nOn the failure path, stat-\u003estart and stat-\u003epages will refer same page.\nSo it\u0027ll attempt to free the same page again and get kernel panic.\n\nLink: http://lkml.kernel.org/r/1364820385-32027-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "5592a94b44df6e6d48e34cfe596844637a2976ac",
      "tree": "75de4b4f29df40c505eefb9627a4149c5a66b125",
      "parents": [
        "ddcd89f15f9e85d5cd37c866a1c5da9a3ca204d1"
      ],
      "author": {
        "name": "Vikram Mulukutla",
        "email": "markivx@codeaurora.org",
        "time": "Mon Jul 30 14:39:58 2012 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Apr 12 09:38:47 2013 -0700"
      },
      "message": "panic: fix a possible deadlock in panic()\n\ncommit 190320c3b6640d4104650f55ff69611e050ea06b upstream.\n\npanic_lock is meant to ensure that panic processing takes place only on\none cpu; if any of the other cpus encounter a panic, they will spin\nwaiting to be shut down.\n\nHowever, this causes a regression in this scenario:\n\n1. Cpu 0 encounters a panic and acquires the panic_lock\n   and proceeds with the panic processing.\n2. There is an interrupt on cpu 0 that also encounters\n   an error condition and invokes panic.\n3. This second invocation fails to acquire the panic_lock\n   and enters the infinite while loop in panic_smp_self_stop.\n\nThus all panic processing is stopped, and the cpu is stuck for eternity\nin the while(1) inside panic_smp_self_stop.\n\nTo address this, disable local interrupts with local_irq_disable before\nacquiring the panic_lock.  This will prevent interrupt handlers from\nexecuting during the panic processing, thus avoiding this particular\nproblem.\n\nSigned-off-by: Vikram Mulukutla \u003cmarkivx@codeaurora.org\u003e\nReviewed-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nCc: Michael Holzheu \u003cholzheu@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "b81d3241838167667fc1ec9bb5670d5f661a3628",
      "tree": "625e62463a9e8bc060ea8a5b036d5c107bae16c2",
      "parents": [
        "b26bcbe0a7bba3321cefa4c9936e05cb58df03cb"
      ],
      "author": {
        "name": "Jan Kiszka",
        "email": "jan.kiszka@siemens.com",
        "time": "Tue Mar 26 17:53:03 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Apr 12 09:38:45 2013 -0700"
      },
      "message": "ftrace: Consistently restore trace function on sysctl enabling\n\ncommit 5000c418840b309251c5887f0b56503aae30f84c upstream.\n\nIf we reenable ftrace via syctl, we currently set ftrace_trace_function\nbased on the previous simplistic algorithm. This is inconsistent with\nwhat update_ftrace_function does. So better call that helper instead.\n\nLink: http://lkml.kernel.org/r/5151D26F.1070702@siemens.com\n\nSigned-off-by: Jan Kiszka \u003cjan.kiszka@siemens.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "7b7cf9fa6d3406c1c7410afa861d524f732e4a7c",
      "tree": "0695fbf0df793cbc91d723893f77eafd60e31d10",
      "parents": [
        "2f6b6e28ca9af9c1f745efa9277e3e7c9ad64883"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Thu Mar 14 15:03:53 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Apr 05 10:04:37 2013 -0700"
      },
      "message": "tracing: Prevent buffer overwrite disabled for latency tracers\n\ncommit 613f04a0f51e6e68ac6fe571ab79da3c0a5eb4da upstream.\n\nThe latency tracers require the buffers to be in overwrite mode,\notherwise they get screwed up. Force the buffers to stay in overwrite\nmode when latency tracers are enabled.\n\nAdded a flag_changed() method to the tracer structure to allow\nthe tracers to see what flags are being changed, and also be able\nto prevent the change from happing.\n\n[Backported for 3.4-stable. Re-added current_trace NULL checks; removed\nallocated_snapshot field; adapted to tracing_trace_options_write without\ntrace_set_options.]\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "2f6b6e28ca9af9c1f745efa9277e3e7c9ad64883",
      "tree": "2e66c696fe47845e4d2f3ed4cd12d02441ddf9b5",
      "parents": [
        "2457a4005a53bd8d9a266ab8f9f6388b57ca133a"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Thu Mar 14 13:50:56 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Apr 05 10:04:37 2013 -0700"
      },
      "message": "tracing: Protect tracer flags with trace_types_lock\n\ncommit 69d34da2984c95b33ea21518227e1f9470f11d95 upstream.\n\nSeems that the tracer flags have never been protected from\nsynchronous writes. Luckily, admins don\u0027t usually modify the\ntracing flags via two different tasks. But if scripts were to\nbe used to modify them, then they could get corrupted.\n\nMove the trace_types_lock that protects against tracers changing\nto also protect the flags being set.\n\n[Backported for 3.4, 3.0-stable. Moved return to after unlock.]\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "30e8f45d7687bcc6ac4010ea37ae78d8e365d2b7",
      "tree": "c344b733d36fa45ccd430574eebc7227bb014a06",
      "parents": [
        "556ba7075b9b95a0439cd7b52a1284b88b8fa755"
      ],
      "author": {
        "name": "Andrew Morton",
        "email": "akpm@linux-foundation.org",
        "time": "Wed Mar 13 14:59:34 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Fri Apr 05 10:04:14 2013 -0700"
      },
      "message": "kernel/signal.c: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER\n\ncommit 522cff142d7d2f9230839c9e1f21a4d8bcc22a4a upstream.\n\n__ARCH_HAS_SA_RESTORER is the preferred conditional for use in 3.9 and\nlater kernels, per Kees.\n\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: PaX Team \u003cpageexec@freemail.hu\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: Julien Tinnes \u003cjln@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "5899ef0b272b58f2927eb3376afaad2b02559180",
      "tree": "e74731ea62cd7ba183152d23eef8e39a536f207e",
      "parents": [
        "cbff2b6d371dbbae19de1dcfd09051683eca02ca"
      ],
      "author": {
        "name": "Frederic Weisbecker",
        "email": "fweisbec@gmail.com",
        "time": "Wed Feb 20 16:15:36 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:12:27 2013 -0700"
      },
      "message": "nohz: Make tick_nohz_irq_exit() irq safe\n\ncommit e5ab012c3271990e8457055c25cafddc1ae8aa6b upstream.\n\nAs it stands, irq_exit() may or may not be called with\nirqs disabled, depending on __ARCH_IRQ_EXIT_IRQS_DISABLED\nthat the arch can define.\n\nIt makes tick_nohz_irq_exit() unsafe. For example two\ninterrupts can race in tick_nohz_stop_sched_tick(): the inner\nmost one computes the expiring time on top of the timer list,\nthen it\u0027s interrupted right before reprogramming the\nclock. The new interrupt enqueues a new timer list timer,\nit reprogram the clock to take it into account and it exits.\nThe CPUs resumes the inner most interrupt and performs the clock\nreprogramming without considering the new timer list timer.\n\nThis regression has been introduced by:\n     280f06774afedf849f0b34248ed6aff57d0f6908\n     (\"nohz: Separate out irq exit and idle loop dyntick logic\")\n\nLet\u0027s fix it right now with the appropriate protections.\n\nA saner long term solution will be to remove\n__ARCH_IRQ_EXIT_IRQS_DISABLED and mandate that irq_exit() is called\nwith interrupts disabled.\n\nSigned-off-by: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linuxfoundation.org\u003e\nLink: http://lkml.kernel.org/r/1361373336-11337-1-git-send-email-fweisbec@gmail.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "8d96fcec68c30196fca01a75a911835c7b89a50d",
      "tree": "1a5524de1f2dda9b4426e941f7955eb854d8bc22",
      "parents": [
        "3d2e7424b3e18dc851a4b0efdc6676c09573f55f"
      ],
      "author": {
        "name": "Mark Rutland",
        "email": "mark.rutland@arm.com",
        "time": "Thu Mar 07 15:09:24 2013 +0000"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:12:26 2013 -0700"
      },
      "message": "clockevents: Don\u0027t allow dummy broadcast timers\n\ncommit a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a upstream.\n\nCurrently tick_check_broadcast_device doesn\u0027t reject clock_event_devices\nwith CLOCK_EVT_FEAT_DUMMY, and may select them in preference to real\nhardware if they have a higher rating value. In this situation, the\ndummy timer is responsible for broadcasting to itself, and the core\nclockevents code may attempt to call non-existent callbacks for\nprogramming the dummy, eventually leading to a panic.\n\nThis patch makes tick_check_broadcast_device always reject dummy timers,\npreventing this problem.\n\nSigned-off-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: linux-arm-kernel@lists.infradead.org\nCc: Jon Medhurst (Tixy) \u003ctixy@linaro.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "52cecaa20589203f08a965af4604acec8a946825",
      "tree": "0e48ffe412192e158f736d6a7ae3b1d896901b52",
      "parents": [
        "1e3b58b64c6574c9c8e299c68c8c4716f8dd3c21"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Wed Mar 13 11:15:19 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:12:06 2013 -0700"
      },
      "message": "tracing: Fix free of probe entry by calling call_rcu_sched()\n\ncommit 740466bc89ad8bd5afcc8de220f715f62b21e365 upstream.\n\nBecause function tracing is very invasive, and can even trace\ncalls to rcu_read_lock(), RCU access in function tracing is done\nwith preempt_disable_notrace(). This requires a synchronize_sched()\nfor updates and not a synchronize_rcu().\n\nFunction probes (traceon, traceoff, etc) must be freed after\na synchronize_sched() after its entry has been removed from the\nhash. But call_rcu() is used. Fix this by using call_rcu_sched().\n\nAlso fix the usage to use hlist_del_rcu() instead of hlist_del().\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Paul McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "1e3b58b64c6574c9c8e299c68c8c4716f8dd3c21",
      "tree": "84e8d63958b4c88068b5f0011160d39f5e305d8e",
      "parents": [
        "74a523fb1759bd3afabf586740041e6d09d731c2"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Tue Mar 12 11:32:32 2013 -0400"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 28 12:12:06 2013 -0700"
      },
      "message": "tracing: Fix race in snapshot swapping\n\ncommit 2721e72dd10f71a3ba90f59781becf02638aa0d9 upstream.\n\nAlthough the swap is wrapped with a spin_lock, the assignment\nof the temp buffer used to swap is not within that lock.\nIt needs to be moved into that lock, otherwise two swaps\nhappening on two different CPUs, can end up using the wrong\ntemp buffer to assign in the swap.\n\nLuckily, all current callers of the swap function appear to have\ntheir own locks. But in case something is added that allows two\ndifferent callers to call the swap, then there\u0027s a chance that\nthis race can trigger and corrupt the buffers.\n\nNew code is coming soon that will allow for this race to trigger.\n\nI\u0027ve Cc\u0027d stable, so this bug will not show up if someone backports\none of the changes that can trigger this bug.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "44ddae422775744b49248dff8818a141d3a03820",
      "tree": "22f91f1b83b72fa8cf4c652b70a30ce0ba7f99a9",
      "parents": [
        "a4371b6605f7b6930ba95df316948be6b306be73"
      ],
      "author": {
        "name": "Kees Cook",
        "email": "keescook@chromium.org",
        "time": "Wed Mar 13 14:59:33 2013 -0700"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Wed Mar 20 13:04:58 2013 -0700"
      },
      "message": "signal: always clear sa_restorer on execve\n\ncommit 2ca39528c01a933f6689cd6505ce65bd6d68a530 upstream.\n\nWhen the new signal handlers are set up, the location of sa_restorer is\nnot cleared, leaking a parent process\u0027s address space location to\nchildren.  This allows for a potential bypass of the parent\u0027s ASLR by\nexamining the sa_restorer value returned when calling sigaction().\n\nBased on what should be considered \"secret\" about addresses, it only\nmatters across the exec not the fork (since the VMAs haven\u0027t changed\nuntil the exec).  But since exec sets SIG_DFL and keeps sa_restorer,\nthis is where it should be fixed.\n\nGiven the few uses of sa_restorer, a \"set\" function was not written\nsince this would be the only use.  Instead, we use\n__ARCH_HAS_SA_RESTORER, as already done in other places.\n\nExample of the leak before applying this patch:\n\n  $ cat /proc/$$/maps\n  ...\n  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so\n  ...\n  $ ./leak\n  ...\n  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so\n  ...\n  1 0 (nil) 0x7fb9f30b94a0\n  2 4000000 (nil) 0x7f278bcaa4a0\n  3 4000000 (nil) 0x7f278bcaa4a0\n  4 0 (nil) 0x7fb9f30b94a0\n  ...\n\n[akpm@linux-foundation.org: use SA_RESTORER for backportability]\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReported-by: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: PaX Team \u003cpageexec@freemail.hu\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: Julien Tinnes \u003cjln@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "abf73cb191a83045c3cc6f46ea78b94439957585",
      "tree": "cb88f3a2335ab2db1e92601774312115f230d274",
      "parents": [
        "f39e4f133d52fad48f5c823b6c8a867caf101677"
      ],
      "author": {
        "name": "Steven Rostedt",
        "email": "srostedt@redhat.com",
        "time": "Wed Feb 27 21:48:09 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Mar 14 11:29:51 2013 -0700"
      },
      "message": "ftrace: Update the kconfig for DYNAMIC_FTRACE\n\ncommit db05021d49a994ee40a9735d9c3cb0060c9babb8 upstream.\n\nThe prompt to enable DYNAMIC_FTRACE (the ability to nop and\nenable function tracing at run time) had a confusing statement:\n\n \"enable/disable ftrace tracepoints dynamically\"\n\nThis was written before tracepoints were added to the kernel,\nbut now that tracepoints have been added, this is very confusing\nand has confused people enough to give wrong information during\npresentations.\n\nNot only that, I looked at the help text, and it still references\nthat dreaded daemon that use to wake up once a second to update\nthe nop locations and brick NICs, that hasn\u0027t been around for over\nfive years.\n\nTime to bring the text up to the current decade.\n\nReported-by: Ezequiel Garcia \u003celezegarcia@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "916b6c67cd471fafa3e5e53ce8389c36749ed6f1",
      "tree": "72cc7d232c2d88d38d5475da41c7ae49826649f7",
      "parents": [
        "a74e9a386f6e775f88061f7958b8b34c6742f926"
      ],
      "author": {
        "name": "Li Zefan",
        "email": "lizefan@huawei.com",
        "time": "Thu Jan 24 14:43:28 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Mar 04 06:06:44 2013 +0800"
      },
      "message": "cgroup: fix exit() vs rmdir() race\n\ncommit 71b5707e119653039e6e95213f00479668c79b75 upstream.\n\nIn cgroup_exit() put_css_set_taskexit() is called without any lock,\nwhich might lead to accessing a freed cgroup:\n\nthread1                           thread2\n---------------------------------------------\nexit()\n  cgroup_exit()\n    put_css_set_taskexit()\n      atomic_dec(cgrp-\u003ecount);\n                                   rmdir();\n      /* not safe !! */\n      check_for_release(cgrp);\n\nrcu_read_lock() can be used to make sure the cgroup is alive.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "a74e9a386f6e775f88061f7958b8b34c6742f926",
      "tree": "a71c10ec1690efe570ec1236198f499faa9c661b",
      "parents": [
        "68412b1718c488e58783d1c576d0aeb34012092d"
      ],
      "author": {
        "name": "Li Zefan",
        "email": "lizefan@huawei.com",
        "time": "Fri Jan 25 16:08:01 2013 +0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Mar 04 06:06:44 2013 +0800"
      },
      "message": "cpuset: fix cpuset_print_task_mems_allowed() vs rename() race\n\ncommit 63f43f55c9bbc14f76b582644019b8a07dc8219a upstream.\n\nrename() will change dentry-\u003ed_name. The result of this race can\nbe worse than seeing partially rewritten name, but we might access\na stale pointer because rename() will re-allocate memory to hold\na longer name.\n\nIt\u0027s safe in the protection of dentry-\u003ed_lock.\n\nv2: check NULL dentry before acquiring dentry lock.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "d48e3a8dc45d9eac3e2be330ef4df663a6f54dfc",
      "tree": "9f7b986eae868c5e7c3c308f2f25099ee8b88a07",
      "parents": [
        "ef7a6c344031cd99e16a116a7984d9428dce8401"
      ],
      "author": {
        "name": "Xi Wang",
        "email": "xi.wang@gmail.com",
        "time": "Wed Feb 27 17:05:21 2013 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Mar 04 06:06:41 2013 +0800"
      },
      "message": "sysctl: fix null checking in bin_dn_node_address()\n\ncommit df1778be1a33edffa51d094eeda87c858ded6560 upstream.\n\nThe null check of `strchr() + 1\u0027 is broken, which is always non-null,\nleading to OOB read.  Instead, check the result of strchr().\n\nSigned-off-by: Xi Wang \u003cxi.wang@gmail.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "e6842472eb7f8091c27eb43ad934097ce04d3fbb",
      "tree": "1955782375cc0a83a91aa2e849381efa3a161a63",
      "parents": [
        "db3d76a623b8ce429318cc2491881c02b790dab4"
      ],
      "author": {
        "name": "Steven Rostedt (Red Hat)",
        "email": "rostedt@goodmis.org",
        "time": "Wed Feb 13 15:18:38 2013 -0500"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Mar 04 06:06:38 2013 +0800"
      },
      "message": "ftrace: Call ftrace cleanup module notifier after all other notifiers\n\ncommit 8c189ea64eea01ca20d102ddb74d6936dd16c579 upstream.\n\nCommit: c1bf08ac \"ftrace: Be first to run code modification on modules\"\n\nchanged ftrace module notifier\u0027s priority to INT_MAX in order to\nprocess the ftrace nops before anything else could touch them\n(namely kprobes). This was the correct thing to do.\n\nUnfortunately, the ftrace module notifier also contains the ftrace\nclean up code. As opposed to the set up code, this code should be\nrun *after* all the module notifiers have run in case a module is doing\ncorrect clean-up and unregisters its ftrace hooks. Basically, ftrace\nneeds to do clean up on module removal, as it needs to know about code\nbeing removed so that it doesn\u0027t try to modify that code. But after it\nremoves the module from its records, if a ftrace user tries to remove\na probe, that removal will fail due as the record of that code segment\nno longer exists.\n\nNothing really bad happens if the probe removal is called after ftrace\ndid the clean up, but the ftrace removal function will return an error.\nCorrect code (such as kprobes) will produce a WARN_ON() if it fails\nto remove the probe. As people get annoyed by frivolous warnings, it\u0027s\nbest to do the ftrace clean up after everything else.\n\nBy splitting the ftrace_module_notifier into two notifiers, one that\ndoes the module load setup that is run at high priority, and the other\nthat is called for module clean up that is run at low priority, the\nproblem is solved.\n\nReported-by: Frank Ch. Eigler \u003cfche@redhat.com\u003e\nAcked-by: Masami Hiramatsu \u003cmasami.hiramatsu.pt@hitachi.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "db3d76a623b8ce429318cc2491881c02b790dab4",
      "tree": "8dd76a8c3267c521b211bd19a0065f45b881182a",
      "parents": [
        "0c8581863389e969dcbf6d9e79971435a1ecf554"
      ],
      "author": {
        "name": "Tejun Heo",
        "email": "tj@kernel.org",
        "time": "Wed Feb 20 15:24:12 2013 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Mon Mar 04 06:06:38 2013 +0800"
      },
      "message": "posix-timer: Don\u0027t call idr_find() with out-of-range ID\n\ncommit e182bb38d7db7494fa5dcd82da17fe0dedf60ecf upstream.\n\nWhen idr_find() was fed a negative ID, it used to look up the ID\nignoring the sign bit before recent (\"idr: remove MAX_IDR_MASK and\nmove left MAX_IDR_* into idr.c\") patch. Now a negative ID triggers\na WARN_ON_ONCE().\n\n__lock_timer() feeds timer_id from userland directly to idr_find()\nwithout sanitizing it which can trigger the above malfunctions.  Add a\nrange check on @timer_id before invoking idr_find() in __lock_timer().\n\nWhile timer_t is defined as int by all archs at the moment, Andrew\nworries that it may be defined as a larger type later on.  Make the\ntest cover larger integers too so that it at least is guaranteed to\nnot return the wrong timer.\n\nNote that WARN_ON_ONCE() in idr_find() on id \u003c 0 is transitional\nprecaution while moving away from ignoring MSB.  Once it\u0027s gone we can\nremove the guard as long as timer_t isn\u0027t larger than int.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/20130220232412.GL3570@htj.dyndns.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "803437207a3e6fef7791adeb7a0c2adb4b012459",
      "tree": "eec95051fb2e48121d2b7bd57b4c40e96809c879",
      "parents": [
        "e3aa5ed471454f36e99b8d3a960746eb58c07180"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Mon Feb 18 09:52:08 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:59:01 2013 -0800"
      },
      "message": "futex: Revert \"futex: Mark get_robust_list as deprecated\"\n\ncommit fe2b05f7ca9f906be61dced5489f63b8b4d7c770 upstream.\n\nThis reverts commit ec0c4274e33c0373e476b73e01995c53128f1257.\n\nget_robust_list() is in use and a removal would break existing user\nspace. With the permission checks in place it\u0027s not longer a security\nhole. Remove the deprecation warnings.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nCc: Richard Weinberger \u003crichard@nod.at\u003e\nCc: akpm@linux-foundation.org\nCc: paul.gortmaker@windriver.com\nCc: davej@redhat.com\nCc: keescook@chromium.org\nCc: ebiederm@xmission.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "dd9c58a90c955ae794c1080156db8d8f64a52a21",
      "tree": "a232bd8d075111e352edf86dfc9de49b7fcddce3",
      "parents": [
        "7c3e516d99265e4aa915f3c05611b0f426bf8ce3"
      ],
      "author": {
        "name": "Leonid Shatz",
        "email": "leonid.shatz@ravellosystems.com",
        "time": "Mon Feb 04 14:33:37 2013 +0200"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:58:59 2013 -0800"
      },
      "message": "hrtimer: Prevent hrtimer_enqueue_reprogram race\n\ncommit b22affe0aef429d657bc6505aacb1c569340ddd2 upstream.\n\nhrtimer_enqueue_reprogram contains a race which could result in\ntimer.base switch during unlock/lock sequence.\n\nhrtimer_enqueue_reprogram is releasing the lock protecting the timer\nbase for calling raise_softirq_irqsoff() due to a lock ordering issue\nversus rq-\u003elock.\n\nIf during that time another CPU calls __hrtimer_start_range_ns() on\nthe same hrtimer, the timer base might switch, before the current CPU\ncan lock base-\u003elock again and therefor the unlock_timer_base() call\nwill unlock the wrong lock.\n\n[ tglx: Added comment and massaged changelog ]\n\nSigned-off-by: Leonid Shatz \u003cleonid.shatz@ravellosystems.com\u003e\nSigned-off-by: Izik Eidus \u003cizik.eidus@ravellosystems.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nLink: http://lkml.kernel.org/r/1359981217-389-1-git-send-email-izik.eidus@ravellosystems.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "7c3e516d99265e4aa915f3c05611b0f426bf8ce3",
      "tree": "ca0e3900b725d528910363170a55f591c40fec50",
      "parents": [
        "b3c57f009cfd9ed81737169c4026bfd03191d993"
      ],
      "author": {
        "name": "Stanislaw Gruszka",
        "email": "sgruszka@redhat.com",
        "time": "Fri Feb 15 11:08:11 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:58:59 2013 -0800"
      },
      "message": "posix-cpu-timers: Fix nanosleep task_struct leak\n\ncommit e6c42c295e071dd74a66b5a9fcf4f44049888ed8 upstream.\n\nThe trinity fuzzer triggered a task_struct reference leak via\nclock_nanosleep with CPU_TIMERs. do_cpu_nanosleep() calls\nposic_cpu_timer_create(), but misses a corresponding\nposix_cpu_timer_del() which leads to the task_struct reference leak.\n\nReported-and-tested-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nLink: http://lkml.kernel.org/r/20130215100810.GF4392@redhat.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "b3c57f009cfd9ed81737169c4026bfd03191d993",
      "tree": "73ae8bf6b8258783eb608f18f4c984d36c2a6fcf",
      "parents": [
        "526a26556b9069238ea7eecb9095cc672daef0e5"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri Nov 23 10:08:44 2012 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:58:58 2013 -0800"
      },
      "message": "genirq: Avoid deadlock in spurious handling\n\ncommit e716efde75267eab919cdb2bef5b2cb77f305326 upstream.\n\ncommit 52553ddf(genirq: fix regression in irqfixup, irqpoll)\nintroduced a potential deadlock by calling the action handler with the\nirq descriptor lock held.\n\nRemove the call and let the handling code run even for an interrupt\nwhere only a single action is registered. That matches the goal of\nthe above commit and avoids the deadlock.\n\nDocument the confusing action \u003d desc-\u003eaction reload in the handling\nloop while at it.\n\nReported-and-tested-by: \"Wang, Warner\" \u003cwarner.wang@hp.com\u003e\nTested-by: Edward Donovan \u003cedward.donovan@numble.net\u003e\nCc: \"Wang, Song-Bo (Stoney)\" \u003csong-bo.wang@hp.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "526a26556b9069238ea7eecb9095cc672daef0e5",
      "tree": "8dc2f9265c4ec28a26528bf8ab37b3af49449f43",
      "parents": [
        "17c2f96bd1de5999900303b3eb923b8cdf6ee2ba"
      ],
      "author": {
        "name": "H. Peter Anvin",
        "email": "hpa@linux.intel.com",
        "time": "Thu Feb 07 17:14:08 2013 -0800"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 28 06:58:58 2013 -0800"
      },
      "message": "timeconst.pl: Eliminate Perl warning\n\ncommit 63a3f603413ffe82ad775f2d62a5afff87fd94a0 upstream.\n\ndefined(@array) is deprecated in Perl and gives off a warning.\nRestructure the code to remove that warning.\n\n[ hpa: it would be interesting to revert to the timeconst.bc script.\n  It appears that the failures reported by akpm during testing of\n  that script was due to a known broken version of make, not a problem\n  with bc.  The Makefile rules could probably be restructured to avoid\n  the make bug, or it is probably old enough that it doesn\u0027t matter. ]\n\nReported-by: Andi Kleen \u003cak@linux.intel.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    },
    {
      "commit": "ce0030c00f95cf9110d9cdcd41e901e1fb814417",
      "tree": "40b124b99205bd469ed156b682d7f0f4e5726e5a",
      "parents": [
        "9ad3bfb9e26197c378d6c239180ed7bcf7c29fd8"
      ],
      "author": {
        "name": "Alexandre SIMON",
        "email": "Alexandre.Simon@univ-lorraine.fr",
        "time": "Fri Feb 01 15:31:54 2013 +0100"
      },
      "committer": {
        "name": "Greg Kroah-Hartman",
        "email": "gregkh@linuxfoundation.org",
        "time": "Thu Feb 21 10:04:57 2013 -0800"
      },
      "message": "printk: fix buffer overflow when calling log_prefix function from call_console_drivers\n\nThis patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling\nlog_prefix() function from call_console_drivers().\n\nThis bug existed in previous releases but has been revealed with commit\n162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 \u003d\u003e 3.0) that made changes\nabout how to allocate memory for early printk buffer (use of memblock_alloc).\nIt disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 \u003d\u003e 3.5)\nthat does a refactoring of printk buffer management.\n\nIn log_prefix(), the access to \"p[0]\", \"p[1]\", \"p[2]\" or\n\"simple_strtoul(\u0026p[1], \u0026endp, 10)\" may cause a buffer overflow as this\nfunction is called from call_console_drivers by passing \"\u0026LOG_BUF(cur_index)\"\nwhere the index must be masked to do not exceed the buffer\u0027s boundary.\n\nThe trick is to prepare in call_console_drivers() a buffer with the necessary\ndata (PRI field of syslog message) to be safely evaluated in log_prefix().\n\nThis patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.\n\nWithout this patch, one can freeze a server running this loop from shell :\n  $ export DUMMY\u003d`cat /dev/urandom | tr -dc \u002712345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn\u0027 | head -c255`\n  $ while true do ; echo $DUMMY \u003e /dev/kmsg ; done\n\nThe \"server freeze\" depends on where memblock_alloc does allocate printk buffer :\nif the buffer overflow is inside another kernel allocation the problem may not\nbe revealed, else the server may hangs up.\n\nSigned-off-by: Alexandre SIMON \u003cAlexandre.Simon@univ-lorraine.fr\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n"
    }
  ],
  "next": "7308f843f36c30dd1247989a45611760567ea44f"
}