)]}' { "log": [ { "commit": "fda73056f62d84376a3d29926708b4a08155da31", "tree": "0080c4eec02c23179f59a50d269f48f7662b61ce", "parents": [ "cf8f2e58d0893f9785b8056b29d9bbcb4758765f", "94f578e6aba14bb2aeb00db2e7f6e5f704fee937" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Jan 14 21:50:44 2014 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Jan 14 21:50:44 2014 -0800" }, "message": "Merge tag \u0027v3.4.76\u0027 into cm-11.0\n\nThis is the 3.4.76 stable release\n\nConflicts:\n\tdrivers/gpio/gpio-msm-v2.c\n\nChange-Id: Ic80b29098bdf656b5e5c9b95d98d2ec64bba1f28\n" }, { "commit": "2efb73fb4f0f5081ba6450e789b52f70247c80d9", "tree": "e465ae3ab65422857f5bb82cd1076921f19c39df", "parents": [ "1005954e40d50fbbbf48bd3c7fe4942f42f26f75" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@huawei.com", "time": "Wed Dec 18 17:08:59 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jan 08 09:42:12 2014 -0800" }, "message": "mm/hugetlb: check for pte NULL pointer in __page_check_address()\n\ncommit 98398c32f6687ee1e1f3ae084effb4b75adb0747 upstream.\n\nIn __page_check_address(), if address\u0027s pud is not present,\nhuge_pte_offset() will return NULL, we should check the return value.\n\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nCc: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: qiuxishi \u003cqiuxishi@huawei.com\u003e\nCc: Hanjun Guo \u003cguohanjun@huawei.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2a38ada0f1ab9f894eea4428731ebc811b51c3f3", "tree": "759c765808a23a3a35e4ba10d8306c847c0205b7", "parents": [ "19218e895cefdd389c96af12c93c89e7276bbaad", "44d19f5a04ae4e433548ba2f25e4d2ccfcac765e" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Dec 08 12:50:38 2013 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Dec 08 12:50:38 2013 -0800" }, "message": "Merge tag \u0027v3.4.72\u0027 into tmp\n\nThis is the 3.4.72 stable release\n\nConflicts:\n\tarch/arm/Kconfig\n\tarch/arm/include/asm/mutex.h\n\tarch/arm/kernel/perf_event.c\n\tarch/arm/kernel/traps.c\n\tarch/arm/mm/dma-mapping.c\n\tdrivers/base/power/main.c\n\tdrivers/bluetooth/ath3k.c\n\tdrivers/bluetooth/btusb.c\n\tdrivers/gpu/drm/radeon/radeon_mode.h\n\tdrivers/mmc/card/block.c\n\tdrivers/mmc/host/sdhci.c\n\tdrivers/usb/core/message.c\n\tdrivers/usb/host/xhci-plat.c\n\tdrivers/usb/host/xhci.h\n\tdrivers/virtio/virtio_ring.c\n\tfs/ubifs/dir.c\n\tinclude/linux/freezer.h\n\tinclude/linux/virtio.h\n\tinclude/media/v4l2-ctrls.h\n\tinclude/net/bluetooth/hci_core.h\n\tinclude/net/bluetooth/mgmt.h\n\tkernel/cgroup.c\n\tkernel/futex.c\n\tkernel/signal.c\n\tnet/bluetooth/hci_conn.c\n\tnet/bluetooth/hci_core.c\n\tnet/bluetooth/hci_event.c\n\tnet/bluetooth/l2cap_core.c\n\tnet/bluetooth/mgmt.c\n\tnet/bluetooth/rfcomm/sock.c\n\tnet/bluetooth/smp.c\n\nChange-Id: I4fb0d5de74ca76f933d95d98e1a9c2c859402f34\n" }, { "commit": "8bfabdd83683743dea60ad3beaad869fbb777baf", "tree": "bff0eba04c76d3637762ad1505c347e8c917e16f", "parents": [ "a2c24e623fd6f54c9e825fb29eec0194b2c74ba0", "991de6bc312c55bef9edb406452097b3e5975b61" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Fri Dec 06 22:18:19 2013 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Fri Dec 06 22:18:19 2013 -0800" }, "message": "Merge remote-tracking branch \u0027codeaurora/kk_2.7.1\u0027 into cm-11.0\n" }, { "commit": "36abcfd971000b6e589ff65c3456d45b98757f89", "tree": "2306000f20fd9f8bbedc8b8339a4585e0f57ae24", "parents": [ "d1c2fbe849e5669959be5a1db1b6d65ca43a19e7" ], "author": { "name": "Lisa Du", "email": "cldu@marvell.com", "time": "Wed Sep 11 14:22:36 2013 -0700" }, "committer": { "name": "Swetha Chikkaboraiah", "email": "schikk@codeaurora.org", "time": "Mon Dec 02 18:32:37 2013 +0530" }, "message": "mm: vmscan: fix do_try_to_free_pages() livelock\n\nThis patch is based on KOSAKI\u0027s work and I add a little more description,\nplease refer https://lkml.org/lkml/2012/6/14/74.\n\nCurrently, I found system can enter a state that there are lots of free\npages in a zone but only order-0 and order-1 pages which means the zone is\nheavily fragmented, then high order allocation could make direct reclaim\npath\u0027s long stall(ex, 60 seconds) especially in no swap and no compaciton\nenviroment. This problem happened on v3.4, but it seems issue still lives\nin current tree, the reason is do_try_to_free_pages enter live lock:\n\nkswapd will go to sleep if the zones have been fully scanned and are still\nnot balanced. As kswapd thinks there\u0027s little point trying all over again\nto avoid infinite loop. Instead it changes order from high-order to\n0-order because kswapd think order-0 is the most important. Look at\n73ce02e9 in detail. If watermarks are ok, kswapd will go back to sleep\nand may leave zone-\u003eall_unreclaimable \u003d3D 0. It assume high-order users\ncan still perform direct reclaim if they wish.\n\nDirect reclaim continue to reclaim for a high order which is not a\nCOSTLY_ORDER without oom-killer until kswapd turn on\nzone-\u003eall_unreclaimble\u003d . This is because to avoid too early oom-kill.\nSo it means direct_reclaim depends on kswapd to break this loop.\n\nIn worst case, direct-reclaim may continue to page reclaim forever when\nkswapd sleeps forever until someone like watchdog detect and finally kill\nthe process. As described in:\nhttp://thread.gmane.org/gmane.linux.kernel.mm/103737\n\nWe can\u0027t turn on zone-\u003eall_unreclaimable from direct reclaim path because\ndirect reclaim path don\u0027t take any lock and this way is racy. Thus this\npatch removes zone-\u003eall_unreclaimable field completely and recalculates\nzone reclaimable state every time.\n\nNote: we can\u0027t take the idea that direct-reclaim see zone-\u003epages_scanned\ndirectly and kswapd continue to use zone-\u003eall_unreclaimable. Because, it\nis racy. commit 929bea7c71 (vmscan: all_unreclaimable() use\nzone-\u003eall_unreclaimable as a name) describes the detail.\n\nCRs-fixed: 573027\nChange-Id: I49970a0fa751cf33af293fd1ee784e36422785b1\n[akpm@linux-foundation.org: uninline zone_reclaimable_pages() and zone_reclaimable()]\nCc: Aaditya Kumar \u003caaditya.kumar.30@gmail.com\u003e\nCc: Ying Han \u003cyinghan@google.com\u003e\nCc: Nick Piggin \u003cnpiggin@gmail.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Bob Liu \u003clliubbo@gmail.com\u003e\nCc: Neil Zhang \u003czhangwm@marvell.com\u003e\nCc: Russell King - ARM Linux \u003clinux@arm.linux.org.uk\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Minchan Kim \u003cminchan@kernel.org\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Lisa Du \u003ccldu@marvell.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nGit-commit: 6e543d5780e36ff5ee56c44d7e2e30db3457a7ed\n[lauraa@codeaurora.org: Some context fixups and variable name changes due\nto backporting. Dropped parts that don\u0027t apply to older kernels]\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Swetha Chikkaboraiah \u003cschikk@codeaurora.org\u003e\n" }, { "commit": "d1c2fbe849e5669959be5a1db1b6d65ca43a19e7", "tree": "8fb7b4e0a552efbfaa21a8de5c41f707734f78e7", "parents": [ "e38e32468d062236395576053b98a088a776c63c" ], "author": { "name": "Shaohua Li", "email": "shli@kernel.org", "time": "Fri Feb 22 16:34:38 2013 -0800" }, "committer": { "name": "Swetha Chikkaboraiah", "email": "schikk@codeaurora.org", "time": "Mon Dec 02 18:32:00 2013 +0530" }, "message": "swap: add per-partition lock for swapfile\n\nswap_lock is heavily contended when I test swap to 3 fast SSD (even\nslightly slower than swap to 2 such SSD). The main contention comes\nfrom swap_info_get(). This patch tries to fix the gap with adding a new\nper-partition lock.\n\nGlobal data like nr_swapfiles, total_swap_pages, least_priority and\nswap_list are still protected by swap_lock.\n\nnr_swap_pages is an atomic now, it can be changed without swap_lock. In\ntheory, it\u0027s possible get_swap_page() finds no swap pages but actually\nthere are free swap pages. But sounds not a big problem.\n\nAccessing partition specific data (like scan_swap_map and so on) is only\nprotected by swap_info_struct.lock.\n\nChanging swap_info_struct.flags need hold swap_lock and\nswap_info_struct.lock, because scan_scan_map() will check it. read the\nflags is ok with either the locks hold.\n\nIf both swap_lock and swap_info_struct.lock must be hold, we always hold\nthe former first to avoid deadlock.\n\nswap_entry_free() can change swap_list. To delete that code, we add a\nnew highest_priority_index. Whenever get_swap_page() is called, we\ncheck it. If it\u0027s valid, we use it.\n\nIt\u0027s a pity get_swap_page() still holds swap_lock(). But in practice,\nswap_lock() isn\u0027t heavily contended in my test with this patch (or I can\nsay there are other much more heavier bottlenecks like TLB flush). And\nBTW, looks get_swap_page() doesn\u0027t really need the lock. We never free\nswap_info[] and we check SWAP_WRITEOK flag. The only risk without the\nlock is we could swapout to some low priority swap, but we can quickly\nrecover after several rounds of swap, so sounds not a big deal to me.\nBut I\u0027d prefer to fix this if it\u0027s a real problem.\n\n\"swap: make each swap partition have one address_space\" improved the\nswapout speed from 1.7G/s to 2G/s. This patch further improves the\nspeed to 2.3G/s, so around 15% improvement. It\u0027s a multi-process test,\nso TLB flush isn\u0027t the biggest bottleneck before the patches.\n\nCRs-Fixed: 573027\nChange-Id: Ic8d600653479c0e6767f04462c3f057b0fe94332\n[arnd@arndb.de: fix it for nommu]\n[hughd@google.com: add missing unlock]\n[minchan@kernel.org: get rid of lockdep whinge on sys_swapon]\nSigned-off-by: Shaohua Li \u003cshli@fusionio.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Minchan Kim \u003cminchan.kim@gmail.com\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Seth Jennings \u003csjenning@linux.vnet.ibm.com\u003e\nCc: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nCc: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nCc: Dan Magenheimer \u003cdan.magenheimer@oracle.com\u003e\nCc: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nGit-commit: ec8acf20afb8534ed511f6613dd2226b9e301010\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[lauraa@codeaurora.org: Various context fixups due to backport]\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Swetha Chikkaboraiah \u003cschikk@codeaurora.org\u003e\n" }, { "commit": "b07ef016454ff46f98e633b5a6247ca7e343fb67", "tree": "0bf6063dd93e4186cc9c2d0b2c72a43c74c787f1", "parents": [ "8c16bfc9ef0f2353e55b6d44fe6f2fddc76260d7" ], "author": { "name": "Khalid Aziz", "email": "khalid.aziz@oracle.com", "time": "Wed Sep 11 14:22:20 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:49 2013 +0900" }, "message": "mm: fix aio performance regression for database caused by THP\n\ncommit 7cb2ef56e6a8b7b368b2e883a0a47d02fed66911 upstream.\n\nI am working with a tool that simulates oracle database I/O workload.\nThis tool (orion to be specific -\n\u003chttp://docs.oracle.com/cd/E11882_01/server.112/e16638/iodesign.htm#autoId24\u003e)\nallocates hugetlbfs pages using shmget() with SHM_HUGETLB flag. It then\ndoes aio into these pages from flash disks using various common block\nsizes used by database. I am looking at performance with two of the most\ncommon block sizes - 1M and 64K. aio performance with these two block\nsizes plunged after Transparent HugePages was introduced in the kernel.\nHere are performance numbers:\n\n\t\tpre-THP\t\t2.6.39\t\t3.11-rc5\n1M read\t\t8384 MB/s\t5629 MB/s\t6501 MB/s\n64K read\t7867 MB/s\t4576 MB/s\t4251 MB/s\n\nI have narrowed the performance impact down to the overheads introduced by\nTHP in __get_page_tail() and put_compound_page() routines. perf top shows\n\u003e40% of cycles being spent in these two routines. Every time direct I/O\nto hugetlbfs pages starts, kernel calls get_page() to grab a reference to\nthe pages and calls put_page() when I/O completes to put the reference\naway. THP introduced significant amount of locking overhead to get_page()\nand put_page() when dealing with compound pages because hugepages can be\nsplit underneath get_page() and put_page(). It added this overhead\nirrespective of whether it is dealing with hugetlbfs pages or transparent\nhugepages. This resulted in 20%-45% drop in aio performance when using\nhugetlbfs pages.\n\nSince hugetlbfs pages can not be split, there is no reason to go through\nall the locking overhead for these pages from what I can see. I added\ncode to __get_page_tail() and put_compound_page() to bypass all the\nlocking code when working with hugetlbfs pages. This improved performance\nsignificantly. Performance numbers with this patch:\n\n\t\tpre-THP\t\t3.11-rc5\t3.11-rc5 + Patch\n1M read\t\t8384 MB/s\t6501 MB/s\t8371 MB/s\n64K read\t7867 MB/s\t4251 MB/s\t6510 MB/s\n\nPerformance with 64K read is still lower than what it was before THP, but\nstill a 53% improvement. It does mean there is more work to be done but I\nwill take a 53% improvement for now.\n\nPlease take a look at the following patch and let me know if it looks\nreasonable.\n\n[akpm@linux-foundation.org: tweak comments]\nSigned-off-by: Khalid Aziz \u003ckhalid.aziz@oracle.com\u003e\nCc: Pravin B Shelar \u003cpshelar@nicira.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "60c6aa3ad74360adfaa171598a0ea9d0783ad532", "tree": "9c63a7d35e83d32afa3483352a0f7ac189f7bd13", "parents": [ "df6516ade182c732e3d2691e0b60190f7abc1261" ], "author": { "name": "Fengguang Wu", "email": "fengguang.wu@intel.com", "time": "Wed Oct 16 13:47:03 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:42 2013 -0800" }, "message": "writeback: fix negative bdi max pause\n\ncommit e3b6c655b91e01a1dade056cfa358581b47a5351 upstream.\n\nToralf runs trinity on UML/i386. After some time it hangs and the last\nmessage line is\n\n\tBUG: soft lockup - CPU#0 stuck for 22s! [trinity-child0:1521]\n\nIt\u0027s found that pages_dirtied becomes very large. More than 1000000000\npages in this case:\n\n\tperiod \u003d HZ * pages_dirtied / task_ratelimit;\n\tBUG_ON(pages_dirtied \u003e 2000000000);\n\tBUG_ON(pages_dirtied \u003e 1000000000); \u003c---------\n\nUML debug printf shows that we got negative pause here:\n\n\tick: pause : -984\n\tick: pages_dirtied : 0\n\tick: task_ratelimit: 0\n\n\t pause:\n\t+ if (pause \u003c 0) {\n\t+ extern int printf(char *, ...);\n\t+ printf(\"ick : pause : %li\\n\", pause);\n\t+ printf(\"ick: pages_dirtied : %lu\\n\", pages_dirtied);\n\t+ printf(\"ick: task_ratelimit: %lu\\n\", task_ratelimit);\n\t+ BUG_ON(1);\n\t+ }\n\t trace_balance_dirty_pages(bdi,\n\nSince pause is bounded by [min_pause, max_pause] where min_pause is also\nbounded by max_pause. It\u0027s suspected and demonstrated that the\nmax_pause calculation goes wrong:\n\n\tick: pause : -717\n\tick: min_pause : -177\n\tick: max_pause : -717\n\tick: pages_dirtied : 14\n\tick: task_ratelimit: 0\n\nThe problem lies in the two \"long \u003d unsigned long\" assignments in\nbdi_max_pause() which might go negative if the highest bit is 1, and the\nmin_t(long, ...) check failed to protect it falling under 0. Fix all of\nthem by using \"unsigned long\" throughout the function.\n\nSigned-off-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nReported-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nTested-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Richard Weinberger \u003crichard@nod.at\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4f158a61fd1de13f4a77c48c40e4f13bf35a7703", "tree": "e7380630a448543af418345e8495e41012538b1a", "parents": [ "61675fc94f88967c290224a2b3929b87a2a7f2e1", "8e041b4ec175dd209c303e81cd28b993536b0ab8" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Fri Nov 01 11:34:15 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Fri Nov 01 11:34:15 2013 -0700" }, "message": "Merge tag \u0027AU_LINUX_ANDROID_JB_2.6.04.03.00.109.111\u0027 into cm-10.2-dev\n\nAU_LINUX_ANDROID_JB_2.6.04.03.00.109.111 based on quic/aosp/jb_2.6\n\nConflicts:\n\tdrivers/media/video/msm/actuators/msm_actuator.c\n\tdrivers/media/video/msm/cpp/msm_cpp.c\n\tdrivers/media/video/msm/msm.c\n\tdrivers/media/video/msm/msm_camera.c\n\tdrivers/media/video/msm/server/msm_cam_server.c\n\tdrivers/video/msm/external_common.c\n\tdrivers/video/msm/external_common.h\n\tdrivers/video/msm/msm_fb.c\n\nChange-Id: I1669e03f336163cfdc02d077b4f554352801ae6d\n" }, { "commit": "3deb9fa1b539063c61d28c6939cfd000858f80ac", "tree": "973f05e01d35bd6a4c3af3fa14560833169a7989", "parents": [ "9584f632fb2dac1d1ef5bc5e7ebe904f7b9aab71" ], "author": { "name": "Greg Reid", "email": "greid@codeaurora.org", "time": "Fri Oct 12 12:07:37 2012 -0400" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Mon Oct 28 15:12:31 2013 -0700" }, "message": "kernel: Add hooks for user-accessible timers in the kernel.\n\nHooks for user-accessible timers allow implementation of a\nmore efficient gettimeofday in user-space.\n\nChange-Id: If2f63d010c1cf142eb84f3745617e756913e46f7\nSigned-off-by: Brent DeGraaf \u003cbdegraaf@codeaurora.org\u003e\n" }, { "commit": "4c481c15615a3ff1cd28d2cfd687817704be63ad", "tree": "dc15be09c319156ed362f1c349bc1d052cfb7542", "parents": [ "a8cefcec4999befc00b4be17985644b7a092dff1", "0841f631e5cecf7fb08f6ae6c89e47b79dca83cd" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Oct 22 15:09:42 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Oct 22 15:09:42 2013 -0700" }, "message": "Merge tag \u0027AU_LINUX_ANDROID_JB_2.6.04.03.00.109.082\u0027 into revert-linux\n\nAU_LINUX_ANDROID_JB_2.6.04.03.00.109.082 based on quic/aosp/jb_2.6\n\nConflicts:\n\tarch/arm/mach-msm/ipc_router.h\n\tarch/arm/mach-msm/ipc_socket.c\n\tdrivers/media/video/msm/actuators/msm_actuator.c\n\tdrivers/media/video/msm/csi/msm_csid.c\n\tdrivers/media/video/msm/vfe/msm_vfe32.c\n\tdrivers/video/msm/hdmi_msm.c\n\tinclude/media/msm_camera.h\n\nChange-Id: I9285b7519314f034fb8a6a4b7e2d21aa2e3e3739\n" }, { "commit": "47bed364d1eed775c358204b9eb7affb0ce64033", "tree": "dd53f5d49316e0b2e5541ecaecd59c2367307cab", "parents": [ "9a63af54974c73f5723bf9a5c03d195f4d473c20" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 27 08:36:04 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 22 09:02:25 2013 +0100" }, "message": "mm: do not grow the stack vma just because of an overrun on preceding vma\n\ncommit 09884964335e85e897876d17783c2ad33cf8a2e0 upstream.\n\nThe stack vma is designed to grow automatically (marked with VM_GROWSUP\nor VM_GROWSDOWN depending on architecture) when an access is made beyond\nthe existing boundary. However, particularly if you have not limited\nyour stack at all (\"ulimit -s unlimited\"), this can cause the stack to\ngrow even if the access was really just one past *another* segment.\n\nAnd that\u0027s wrong, especially since we first grow the segment, but then\nimmediately later enforce the stack guard page on the last page of the\nsegment. So _despite_ first growing the stack segment as a result of\nthe access, the kernel will then make the access cause a SIGSEGV anyway!\n\nSo do the same logic as the guard page check does, and consider an\naccess to within one page of the next segment to be a bad access, rather\nthan growing the stack to abut the next segment.\n\nReported-and-tested-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9a63af54974c73f5723bf9a5c03d195f4d473c20", "tree": "c38e05af749c5400104567d26266532cc6f510a0", "parents": [ "27eea92a6552a4163e17175511791f1951ffc8e9" ], "author": { "name": "Cyril Hrubis", "email": "chrubis@suse.cz", "time": "Mon Apr 29 15:08:33 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 22 09:02:25 2013 +0100" }, "message": "mm/mmap: check for RLIMIT_AS before unmapping\n\ncommit e8420a8ece80b3fe810415ecf061d54ca7fab266 upstream.\n\nFix a corner case for MAP_FIXED when requested mapping length is larger\nthan rlimit for virtual memory. In such case any overlapping mappings\nare unmapped before we check for the limit and return ENOMEM.\n\nThe check is moved before the loop that unmaps overlapping parts of\nexisting mappings. When we are about to hit the limit (currently mapped\npages + len \u003e limit) we scan for overlapping pages and check again\naccounting for them.\n\nThis fixes situation when userspace program expects that the previous\nmappings are preserved after the mmap() syscall has returned with error.\n(POSIX clearly states that successfull mapping shall replace any\nprevious mappings.)\n\nThis corner case was found and can be tested with LTP testcase:\n\ntestcases/open_posix_testsuite/conformance/interfaces/mmap/24-2.c\n\nIn this case the mmap, which is clearly over current limit, unmaps\ndynamic libraries and the testcase segfaults right after returning into\nuserspace.\n\nI\u0027ve also looked at the second instance of the unmapping loop in the\ndo_brk(). The do_brk() is called from brk() syscall and from vm_brk().\nThe brk() syscall checks for overlapping mappings and bails out when\nthere are any (so it can\u0027t be triggered from the brk syscall). The\nvm_brk() is called only from binmft handlers so it shouldn\u0027t be\ntriggered unless binmft handler created overlapping mappings.\n\nSigned-off-by: Cyril Hrubis \u003cchrubis@suse.cz\u003e\nReviewed-by: Mel Gorman \u003cmgorman@suse.de\u003e\nReviewed-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "022a41db8aa1bc0b4ff4c013f889292324a1c465", "tree": "11f00ef8d0aa584b956a194de5ee4c3be5fc5120", "parents": [ "9712612a91e92824349ce9fece31dba6d2fbde70" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Mon Apr 29 15:06:11 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:49 2013 -0700" }, "message": "mm, show_mem: suppress page counts in non-blockable contexts\n\ncommit 4b59e6c4730978679b414a8da61514a2518da512 upstream.\n\nOn large systems with a lot of memory, walking all RAM to determine page\ntypes may take a half second or even more.\n\nIn non-blockable contexts, the page allocator will emit a page allocation\nfailure warning unless __GFP_NOWARN is specified. In such contexts, irqs\nare typically disabled and such a lengthy delay may even result in NMI\nwatchdog timeouts.\n\nTo fix this, suppress the page walk in such contexts when printing the\npage allocation failure warning.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Dave Hansen \u003cdave@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0d39cce32ae80b52a37eb756bfd7b59ac370ffee", "tree": "469183d881e5a39ae14e91b990fe8bf61d910dd7", "parents": [ "01a74c11d3ab3adb842e168ee0c2ac1efe35d71a" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Fri Sep 27 17:08:49 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "mm, memcg: give exiting processes access to memory reserves\n\ncommit 465adcf1ea7b2e49b2e0899366624f5532b64012\n\nA memcg may livelock when oom if the process that grabs the hierarchy\u0027s\noom lock is never the first process with PF_EXITING set in the memcg\u0027s\ntask iteration.\n\nThe oom killer, both global and memcg, will defer if it finds an\neligible process that is in the process of exiting and it is not being\nptraced. The idea is to allow it to exit without using memory reserves\nbefore needlessly killing another process.\n\nThis normally works fine except in the memcg case with a large number of\nthreads attached to the oom memcg. In this case, the memcg oom killer\nonly gets called for the process that grabs the hierarchy\u0027s oom lock;\nall others end up blocked on the memcg\u0027s oom waitqueue. Thus, if the\nprocess that grabs the hierarchy\u0027s oom lock is never the first\nPF_EXITING process in the memcg\u0027s task iteration, the oom killer is\nconstantly deferred without anything making progress.\n\nThe fix is to give PF_EXITING processes access to memory reserves so\nthat we\u0027ve marked them as oom killed without any iteration. This allows\n__mem_cgroup_try_charge() to succeed so that the process may exit. This\nmakes the memcg oom killer exemption for TIF_MEMDIE tasks, now\nimmediately granted for processes with pending SIGKILLs and those in the\nexit path, to be equivalent to what is done for the global oom killer.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[Qiang: backported to 3.4:\n - move the changes from memcontrol.c to oom_kill.c]\nSigned-off-by: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e9223e5a30bd5930092ae22692e2cda76c9afd0c", "tree": "f45dbdc1ec3a0acd3ba4c3c9995315cdfc8cae00", "parents": [ "0841f631e5cecf7fb08f6ae6c89e47b79dca83cd" ], "author": { "name": "Tomasz Stanislawski", "email": "t.stanislaws@samsung.com", "time": "Wed Jun 12 21:05:02 2013 +0000" }, "committer": { "name": "Srinivasarao P", "email": "spathi@codeaurora.org", "time": "Fri Sep 27 11:02:59 2013 +0530" }, "message": "mm/page_alloc.c: fix watermark check in __zone_watermark_ok()\n\nThe watermark check consists of two sub-checks. The first one is:\n\n\tif (free_pages \u003c\u003d min + lowmem_reserve)\n\t\treturn false;\n\nThe check assures that there is minimal amount of RAM in the zone. If\nCMA is used then the free_pages is reduced by the number of free pages\nin CMA prior to the over-mentioned check.\n\n\tif (!(alloc_flags \u0026 ALLOC_CMA))\n\t\tfree_pages -\u003d zone_page_state(z, NR_FREE_CMA_PAGES);\n\nThis prevents the zone from being drained from pages available for\nnon-movable allocations.\n\nThe second check prevents the zone from getting too fragmented.\n\n\tfor (o \u003d 0; o \u003c order; o++) {\n\t\tfree_pages -\u003d z-\u003efree_area[o].nr_free \u003c\u003c o;\n\t\tmin \u003e\u003e\u003d 1;\n\t\tif (free_pages \u003c\u003d min)\n\t\t\treturn false;\n\t}\n\nThe field z-\u003efree_area[o].nr_free is equal to the number of free pages\nincluding free CMA pages. Therefore the CMA pages are subtracted twice.\nThis may cause a false positive fail of __zone_watermark_ok() if the CMA\narea gets strongly fragmented. In such a case there are many 0-order\nfree pages located in CMA. Those pages are subtracted twice therefore\nthey will quickly drain free_pages during the check against\nfragmentation. The test fails even though there are many free non-cma\npages in the zone.\n\nThis patch fixes this issue by subtracting CMA pages only for a purpose of\n(free_pages \u003c\u003d min + lowmem_reserve) check.\n\nLaura said:\n\n We were observing allocation failures of higher order pages (order 5 \u003d\n 128K typically) under tight memory conditions resulting in driver\n failure. The output from the page allocation failure showed plenty of\n free pages of the appropriate order/type/zone and mostly CMA pages in\n the lower orders.\n\n For full disclosure, we still observed some page allocation failures\n even after applying the patch but the number was drastically reduced and\n those failures were attributed to fragmentation/other system issues.\n\nChange-Id: Ic2c0c233993c41c630e24d71df5e12aa614588e5\nCRs-Fixed:549847\nSigned-off-by: Tomasz Stanislawski \u003ct.stanislaws@samsung.com\u003e\nSigned-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nTested-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nCc: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nAcked-by: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nTested-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[3.7+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nGit-commit: 026b08147923142e925a7d0aaa39038055ae0156\nGit-repo: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Srinivasarao P \u003cspathi@codeaurora.org\u003e\n" }, { "commit": "d778ca56a22b5ca0c96e39db08b4994166d435d6", "tree": "c780b888c0962eda62dcfa22719ef53f757c52a8", "parents": [ "5a20c03a7dc54e3eea59b0be6027b124235b6761" ], "author": { "name": "Libin", "email": "huawei.libin@huawei.com", "time": "Wed Sep 11 14:20:38 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "mm/huge_memory.c: fix potential NULL pointer dereference\n\ncommit a8f531ebc33052642b4bd7b812eedf397108ce64 upstream.\n\nIn collapse_huge_page() there is a race window between releasing the\nmmap_sem read lock and taking the mmap_sem write lock, so find_vma() may\nreturn NULL. So check the return value to avoid NULL pointer dereference.\n\ncollapse_huge_page\n\tkhugepaged_alloc_page\n\t\tup_read(\u0026mm-\u003emmap_sem)\n\tdown_write(\u0026mm-\u003emmap_sem)\n\tvma \u003d find_vma(mm, address)\n\nSigned-off-by: Libin \u003chuawei.libin@huawei.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nReviewed-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5a20c03a7dc54e3eea59b0be6027b124235b6761", "tree": "77683c26bbafea4d3f56c71d7bccaf825c45f154", "parents": [ "55ee351dc444224f7bb9697a98b2d06e8625f491" ], "author": { "name": "Greg Thelen", "email": "gthelen@google.com", "time": "Wed Sep 11 14:23:08 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:50 2013 -0700" }, "message": "memcg: fix multiple large threshold notifications\n\ncommit 2bff24a3707093c435ab3241c47dcdb5f16e432b upstream.\n\nA memory cgroup with (1) multiple threshold notifications and (2) at least\none threshold \u003e\u003d2G was not reliable. Specifically the notifications would\neither not fire or would not fire in the proper order.\n\nThe __mem_cgroup_threshold() signaling logic depends on keeping 64 bit\nthresholds in sorted order. mem_cgroup_usage_register_event() sorts them\nwith compare_thresholds(), which returns the difference of two 64 bit\nthresholds as an int. If the difference is positive but has bit[31] set,\nthen sort() treats the difference as negative and breaks sort order.\n\nThis fix compares the two arbitrary 64 bit thresholds returning the\nclassic -1, 0, 1 result.\n\nThe test below sets two notifications (at 0x1000 and 0x81001000):\n cd /sys/fs/cgroup/memory\n mkdir x\n for x in 4096 2164264960; do\n cgroup_event_listener x/memory.usage_in_bytes $x | sed \"s/^/$x listener:/\" \u0026\n done\n echo $$ \u003e x/cgroup.procs\n anon_leaker 500M\n\nv3.11-rc7 fails to signal the 4096 event listener:\n Leaking...\n Done leaking pages.\n\nPatched v3.11-rc7 properly notifies:\n Leaking...\n 4096 listener:2013:8:31:14:13:36\n Done leaking pages.\n\nThe fixed bug is old. It appears to date back to the introduction of\nmemcg threshold notifications in v2.6.34-rc1-116-g2e72b6347c94 \"memcg:\nimplement memory thresholds\"\n\nSigned-off-by: Greg Thelen \u003cgthelen@google.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a42efb79d54d9a13c8f68df122c832bca08b74ae", "tree": "b49010c84b42ccc5407766471bc94c95efe63d83", "parents": [ "4d5b24dd453b4ff44f69756106b029e8961dcb55" ], "author": { "name": "Zhang Yi", "email": "wetpzy@gmail.com", "time": "Tue Jun 25 21:19:31 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:28 2013 -0700" }, "message": "futex: Take hugepages into account when generating futex_key\n\ncommit 13d60f4b6ab5b702dc8d2ee20999f98a93728aec upstream.\n\nThe futex_keys of process shared futexes are generated from the page\noffset, the mapping host and the mapping index of the futex user space\naddress. This should result in an unique identifier for each futex.\n\nThough this is not true when futexes are located in different subpages\nof an hugepage. The reason is, that the mapping index for all those\nfutexes evaluates to the index of the base page of the hugetlbfs\nmapping. So a futex at offset 0 of the hugepage mapping and another\none at offset PAGE_SIZE of the same hugepage mapping have identical\nfutex_keys. This happens because the futex code blindly uses\npage-\u003eindex.\n\nSteps to reproduce the bug:\n\n1. Map a file from hugetlbfs. Initialize pthread_mutex1 at offset 0\n and pthread_mutex2 at offset PAGE_SIZE of the hugetlbfs\n mapping.\n\n The mutexes must be initialized as PTHREAD_PROCESS_SHARED because\n PTHREAD_PROCESS_PRIVATE mutexes are not affected by this issue as\n their keys solely depend on the user space address.\n\n2. Lock mutex1 and mutex2\n\n3. Create thread1 and in the thread function lock mutex1, which\n results in thread1 blocking on the locked mutex1.\n\n4. Create thread2 and in the thread function lock mutex2, which\n results in thread2 blocking on the locked mutex2.\n\n5. Unlock mutex2. Despite the fact that mutex2 got unlocked, thread2\n still blocks on mutex2 because the futex_key points to mutex1.\n\nTo solve this issue we need to take the normal page index of the page\nwhich contains the futex into account, if the futex is in an hugetlbfs\nmapping. In other words, we calculate the normal page mapping index of\nthe subpage in the hugetlbfs mapping.\n\nMappings which are not based on hugetlbfs are not affected and still\nuse page-\u003eindex.\n\nThanks to Mel Gorman who provided a patch for adding proper evaluation\nfunctions to the hugetlbfs code to avoid exposing hugetlbfs specific\ndetails to the futex code.\n\n[ tglx: Massaged changelog ]\n\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nReviewed-by: Jiang Biao \u003cjiang.biao2@zte.com.cn\u003e\nTested-by: Ma Chenggong \u003cma.chenggong@zte.com.cn\u003e\nReviewed-by: \u0027Mel Gorman\u0027 \u003cmgorman@suse.de\u003e\nAcked-by: \u0027Darren Hart\u0027 \u003cdvhart@linux.intel.com\u003e\nCc: \u0027Peter Zijlstra\u0027 \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/000101ce71a6%24a83c5880%24f8b50980%24@com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Mike Galbraith \u003cmgalbraith@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "cd1be30ea12a61a67386e5752a6f7f0b12a55c9b", "tree": "89e650a6afe074ea49735bcadeefdd51e5aa2a7f", "parents": [ "ec3c697d1904c8c126ac8f88b16949e4c7038c2b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Apr 27 13:25:38 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:27 2013 -0700" }, "message": "vm: add no-mmu vm_iomap_memory() stub\n\ncommit 3c0b9de6d37a481673e81001c57ca0e410c72346 upstream.\n\nI think we could just move the full vm_iomap_memory() function into\nutil.h or similar, but I didn\u0027t get any reply from anybody actually\nusing nommu even to this trivial patch, so I\u0027m not going to touch it any\nmore than required.\n\nHere\u0027s the fairly minimal stub to make the nommu case at least\npotentially work. It doesn\u0027t seem like anybody cares, though.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Guenter Roeck \u003clinux@roeck-us.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5bd38ba6b6c5bce90cf703359ec37be344710cf0", "tree": "fafba6c7a02fc388c4d7a58d6e05cb523d8db5bb", "parents": [ "ddd9ef4d2b8ef897e57363e95058e1c596fb9598" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Wed Jul 31 13:08:11 2013 -0700" }, "committer": { "name": "Gerrit - the friendly Code Review server", "email": "code-review@localhost", "time": "Wed Aug 14 04:35:26 2013 -0700" }, "message": "mm: Don\u0027t use CMA page for file cache\n\nDespite the best efforts of redirection, the file system may still\nallocate CMA pages with references held for long periods of time.\nIf a CMA page ends up being allocated, free it and get a non-CMA page.\n\nChange-Id: I2001151a2936a6d0780d223dda85a87c04ddb8c6\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "19d22ea89933ca48bcb10fc7919ed7bbefd52362", "tree": "b47da3af5d3566935e77ee3975e3bd93d515a926", "parents": [ "40a017c96a98a29c9d39bf0ca34651288984e9ce" ], "author": { "name": "Wanpeng Li", "email": "liwanp@linux.vnet.ibm.com", "time": "Wed Jul 03 15:02:40 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:26:07 2013 +0800" }, "message": "mm/memory-hotplug: fix lowmem count overflow when offline pages\n\ncommit cea27eb2a202959783f81254c48c250ddd80e129 upstream.\n\nThe logic for the memory-remove code fails to correctly account the\nTotal High Memory when a memory block which contains High Memory is\nofflined as shown in the example below. The following patch fixes it.\n\nBefore logic memory remove:\n\nMemTotal: 7603740 kB\nMemFree: 6329612 kB\nBuffers: 94352 kB\nCached: 872008 kB\nSwapCached: 0 kB\nActive: 626932 kB\nInactive: 519216 kB\nActive(anon): 180776 kB\nInactive(anon): 222944 kB\nActive(file): 446156 kB\nInactive(file): 296272 kB\nUnevictable: 0 kB\nMlocked: 0 kB\nHighTotal: 7294672 kB\nHighFree: 5704696 kB\nLowTotal: 309068 kB\nLowFree: 624916 kB\n\nAfter logic memory remove:\n\nMemTotal: 7079452 kB\nMemFree: 5805976 kB\nBuffers: 94372 kB\nCached: 872000 kB\nSwapCached: 0 kB\nActive: 626936 kB\nInactive: 519236 kB\nActive(anon): 180780 kB\nInactive(anon): 222944 kB\nActive(file): 446156 kB\nInactive(file): 296292 kB\nUnevictable: 0 kB\nMlocked: 0 kB\nHighTotal: 7294672 kB\nHighFree: 5181024 kB\nLowTotal: 4294752076 kB\nLowFree: 624952 kB\n\n[mhocko@suse.cz: fix CONFIG_HIGHMEM\u003dn build]\nSigned-off-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[2.6.24+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zhouping Liu \u003czliu@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1c9ce1e6c11777c95b974883be2f0313873d6f14", "tree": "68b149cb9f9e7988fc0955239208d9ab104d7bb6", "parents": [ "849520777e464fa051188d1118d43f21babb9dbe", "00709f7f01c3a10252f030f0bdacecbb349d7be4" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Mon Jul 22 22:10:20 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Mon Jul 22 22:10:20 2013 -0700" }, "message": "Merge tag \u0027v3.4.11\u0027 into cm-10.1\n\nThis is the 3.4.11 stable release\n\nConflicts:\n\tarch/arm/vfp/vfpmodule.c\n\tnet/bluetooth/hci_event.c\n\tnet/bluetooth/l2cap_core.c\n\nChange-Id: I164bf611358e14afd3ff48e55a99c0d7c7afc45f\n" }, { "commit": "f517dfe6d161bf37a9355c86ea5cb605b06d5963", "tree": "610e29e1cbcd1f50888bcf131390d900f51f82b9", "parents": [ "0938e135aa8513f9bc379a408d3c6c1fd24eb46a" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Wed Jun 12 14:05:04 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:46 2013 -0700" }, "message": "mm: migration: add migrate_entry_wait_huge()\n\ncommit 30dad30922ccc733cfdbfe232090cf674dc374dc upstream.\n\nWhen we have a page fault for the address which is backed by a hugepage\nunder migration, the kernel can\u0027t wait correctly and do busy looping on\nhugepage fault until the migration finishes. As a result, users who try\nto kick hugepage migration (via soft offlining, for example) occasionally\nexperience long delay or soft lockup.\n\nThis is because pte_offset_map_lock() can\u0027t get a correct migration entry\nor a correct page table lock for hugepage. This patch introduces\nmigration_entry_wait_huge() to solve this.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nReviewed-by: Rik van Riel \u003criel@redhat.com\u003e\nReviewed-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c09c35b2ae5ea7f62b0fd5369935b8e6af25e9cd", "tree": "3899916b5478074de32197baade2e42f19d79ec8", "parents": [ "508056cc78435675c3f77dbb8de03f5b5ebe7d17" ], "author": { "name": "Rafael Aquini", "email": "aquini@redhat.com", "time": "Wed Jun 12 14:04:49 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:45 2013 -0700" }, "message": "swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion\n\ncommit cbab0e4eec299e9059199ebe6daf48730be46d2b upstream.\n\nread_swap_cache_async() can race against get_swap_page(), and stumble\nacross a SWAP_HAS_CACHE entry in the swap map whose page wasn\u0027t brought\ninto the swapcache yet.\n\nThis transient swap_map state is expected to be transitory, but the\nactual placement of discard at scan_swap_map() inserts a wait for I/O\ncompletion thus making the thread at read_swap_cache_async() to loop\naround its -EEXIST case, while the other end at get_swap_page() is\nscheduled away at scan_swap_map(). This can leave the system deadlocked\nif the I/O completion happens to be waiting on the CPU waitqueue where\nread_swap_cache_async() is busy looping and !CONFIG_PREEMPT.\n\nThis patch introduces a cond_resched() call to make the aforementioned\nread_swap_cache_async() busy loop condition to bail out when necessary,\nthus avoiding the subtle race window.\n\nSigned-off-by: Rafael Aquini \u003caquini@redhat.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: Hugh Dickins \u003chughd@google.com\u003e\nCc: Shaohua Li \u003cshli@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dde448d95d8698ee4c8373bb48fe08a22f41052f", "tree": "7fe87fa93bfa5b81e6f87b147e32512d2e8198e3", "parents": [ "ac4f6190fae02a3dc30133f90488b996f726bf7a", "f95b978981a7d154ba40d14c18e8ed5c694e6124" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Thu Jun 20 11:32:42 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Thu Jun 20 11:32:42 2013 -0700" }, "message": "Merge tag \u0027v3.4.10\u0027 into cm-10.1\n\nThis is the 3.4.10 stable release\n\nConflicts:\n\tarch/arm/mm/tlb-v7.S\n\tarch/arm/vfp/entry.S\n\tdrivers/base/power/main.c\n\tdrivers/mmc/host/sdhci.c\n\tdrivers/net/tun.c\n\tdrivers/usb/core/hub.c\n\tdrivers/usb/host/xhci.h\n\tinclude/linux/sched.h\n\tkernel/power/suspend.c\n\nChange-Id: Ia2477ec93ceb64b13dd1a2d8aa646cb233387d14\n" }, { "commit": "6092ad5bbc7631f60be754f5013533c909eca733", "tree": "28814f5f27be2ddae945951a5aa52bf6bb77c2a1", "parents": [ "c8a097fd8d73584d7c1577e0aee41c2a177394f7" ], "author": { "name": "Aneesh Kumar K.V", "email": "aneesh.kumar@linux.vnet.ibm.com", "time": "Fri May 24 15:55:21 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:29 2013 -0700" }, "message": "mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer\n\ncommit 7c3425123ddfdc5f48e7913ff59d908789712b18 upstream.\n\nWe should not use set_pmd_at to update pmd_t with pgtable_t pointer.\nset_pmd_at is used to set pmd with huge pte entries and architectures\nlike ppc64, clear few flags from the pte when saving a new entry.\nWithout this change we observe bad pte errors like below on ppc64 with\nTHP enabled.\n\n BUG: Bad page map in process ld mm\u003d0xc000001ee39f4780 pte:7fc3f37848000001 pmd:c000001ec0000000\n\nSigned-off-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nReviewed-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c8a097fd8d73584d7c1577e0aee41c2a177394f7", "tree": "5d4d67a3aa976328b73d771646ebcc7d4ce7908d", "parents": [ "60e255daee832c39d2099d8f942cbb901d9cb36f" ], "author": { "name": "Cliff Wickman", "email": "cpw@sgi.com", "time": "Fri May 24 15:55:36 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:28 2013 -0700" }, "message": "mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas\n\ncommit a9ff785e4437c83d2179161e012f5bdfbd6381f0 upstream.\n\nA panic can be caused by simply cat\u0027ing /proc/\u003cpid\u003e/smaps while an\napplication has a VM_PFNMAP range. It happened in-house when a\nbenchmarker was trying to decipher the memory layout of his program.\n\n/proc/\u003cpid\u003e/smaps and similar walks through a user page table should not\nbe looking at VM_PFNMAP areas.\n\nCertain tests in walk_page_range() (specifically split_huge_page_pmd())\nassume that all the mapped PFN\u0027s are backed with page structures. And\nthis is not usually true for VM_PFNMAP areas. This can result in panics\non kernel page faults when attempting to address those page structures.\n\nThere are a half dozen callers of walk_page_range() that walk through a\ntask\u0027s entire page table (as N. Horiguchi pointed out). So rather than\nchange all of them, this patch changes just walk_page_range() to ignore\nVM_PFNMAP areas.\n\nThe logic of hugetlb_vma() is moved back into walk_page_range(), as we\nwant to test any vma in the range.\n\nVM_PFNMAP areas are used by:\n- graphics memory manager gpu/drm/drm_gem.c\n- global reference unit sgi-gru/grufile.c\n- sgi special memory char/mspec.c\n- and probably several out-of-tree modules\n\n[akpm@linux-foundation.org: remove now-unused hugetlb_vma() stub]\nSigned-off-by: Cliff Wickman \u003ccpw@sgi.com\u003e\nReviewed-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Dave Hansen \u003cdave.hansen@intel.com\u003e\nCc: David Sterba \u003cdsterba@suse.cz\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@gmail.com\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bfd7610d981cd0fab6d68576c638c8e7550f3e51", "tree": "d02823a9243e95f5d4157d7d0b6dbb9717a99901", "parents": [ "c846d9bcb65f83a639709904af076ad82811156f" ], "author": { "name": "Xiao Guangrong", "email": "xiaoguangrong@linux.vnet.ibm.com", "time": "Fri May 24 15:55:11 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:25 2013 -0700" }, "message": "mm: mmu_notifier: re-fix freed page still mapped in secondary MMU\n\ncommit d34883d4e35c0a994e91dd847a82b4c9e0c31d83 upstream.\n\nCommit 751efd8610d3 (\"mmu_notifier_unregister NULL Pointer deref and\nmultiple -\u003erelease()\") breaks the fix 3ad3d901bbcf (\"mm: mmu_notifier:\nfix freed page still mapped in secondary MMU\").\n\nSince hlist_for_each_entry_rcu() is changed now, we can not revert that\npatch directly, so this patch reverts the commit and simply fix the bug\nspotted by that patch\n\nThis bug spotted by commit 751efd8610d3 is:\n\n There is a race condition between mmu_notifier_unregister() and\n __mmu_notifier_release().\n\n Assume two tasks, one calling mmu_notifier_unregister() as a result\n of a filp_close() -\u003eflush() callout (task A), and the other calling\n mmu_notifier_release() from an mmput() (task B).\n\n A B\n t1 srcu_read_lock()\n t2 if (!hlist_unhashed())\n t3 srcu_read_unlock()\n t4 srcu_read_lock()\n t5 hlist_del_init_rcu()\n t6 synchronize_srcu()\n t7 srcu_read_unlock()\n t8 hlist_del_rcu() \u003c--- NULL pointer deref.\n\nThis can be fixed by using hlist_del_init_rcu instead of hlist_del_rcu.\n\nThe another issue spotted in the commit is \"multiple -\u003erelease()\ncallouts\", we needn\u0027t care it too much because it is really rare (e.g,\ncan not happen on kvm since mmu-notify is unregistered after\nexit_mmap()) and the later call of multiple -\u003erelease should be fast\nsince all the pages have already been released by the first call.\nAnyway, this issue should be fixed in a separate patch.\n\n-stable suggestions: Any version that has commit 751efd8610d3 need to be\nbackported. I find the oldest version has this commit is 3.0-stable.\n\n[akpm@linux-foundation.org: tweak comments]\nSigned-off-by: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nTested-by: Robin Holt \u003cholt@sgi.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "11e88c5e7bbb812ed25f1e6a8e98d334f0e7dc38", "tree": "f15d8065f22fa06aaba34d3e3b5dee7f8fbe867a", "parents": [ "03908608b9a65cb8564ba19caa7608dd470ec4cb" ], "author": { "name": "Leonid Yegoshin", "email": "Leonid.Yegoshin@imgtec.com", "time": "Fri May 24 15:55:18 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:13 2013 -0700" }, "message": "mm compaction: fix of improper cache flush in migration code\n\ncommit c2cc499c5bcf9040a738f49e8051b42078205748 upstream.\n\nPage \u0027new\u0027 during MIGRATION can\u0027t be flushed with flush_cache_page().\nUsing flush_cache_page(vma, addr, pfn) is justified only if the page is\nalready placed in process page table, and that is done right after\nflush_cache_page(). But without it the arch function has no knowledge\nof process PTE and does nothing.\n\nBesides that, flush_cache_page() flushes an application cache page, but\nthe kernel has a different page virtual address and dirtied it.\n\nReplace it with flush_dcache_page(new) which is the proper usage.\n\nThe old page is flushed in try_to_unmap_one() before migration.\n\nThis bug takes place in Sead3 board with M14Kc MIPS CPU without cache\naliasing (but Harvard arch - separate I and D cache) in tight memory\nenvironment (128MB) each 1-3days on SOAK test. It fails in cc1 during\nkernel build (SIGILL, SIGBUS, SIGSEG) if CONFIG_COMPACTION is switched\nON.\n\nSigned-off-by: Leonid Yegoshin \u003cLeonid.Yegoshin@imgtec.com\u003e\nCc: Leonid Yegoshin \u003cyegoshin@mips.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nCc: Russell King \u003crmk@arm.linux.org.uk\u003e\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dab2d3dc45ae7343216635d981d43637e1cb7d45", "tree": "a79004a3fcee0ada81f9dd12ed77caf5807edc58", "parents": [ "dd77cf8cc7aca5902e759c26049730c151bc885f" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Tue May 07 16:18:13 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:48 2013 -0700" }, "message": "hugetlbfs: fix mmap failure in unaligned size request\n\ncommit af73e4d9506d3b797509f3c030e7dcd554f7d9c4 upstream.\n\nThe current kernel returns -EINVAL unless a given mmap length is\n\"almost\" hugepage aligned. This is because in sys_mmap_pgoff() the\ngiven length is passed to vm_mmap_pgoff() as it is without being aligned\nwith hugepage boundary.\n\nThis is a regression introduced in commit 40716e29243d (\"hugetlbfs: fix\nalignment of huge page requests\"), where alignment code is pushed into\nhugetlb_file_setup() and the variable len in caller side is not changed.\n\nTo fix this, this patch partially reverts that commit, and adds\nalignment code in caller side. And it also introduces hstate_sizelog()\nin order to get proper hstate to specified hugepage size.\n\nAddresses https://bugzilla.kernel.org/show_bug.cgi?id\u003d56881\n\n[akpm@linux-foundation.org: fix warning when CONFIG_HUGETLB_PAGE\u003dn]\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReported-by: \u003ciceman_dvd@yahoo.com\u003e\nCc: Steven Truelove \u003csteven.truelove@utoronto.ca\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "273a82bee94d42ba58b264bc427cd75df65b81fc", "tree": "29c58f1e1b209f4e6ab09fb0ea8188e52501d6db", "parents": [ "ede49f3642cce1fe60ac81cb1953e7a8fd91e8ce" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Mon Apr 29 15:07:44 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:55 2013 -0700" }, "message": "mm: allow arch code to control the user page table ceiling\n\ncommit 6ee8630e02be6dd89926ca0fbc21af68b23dc087 upstream.\n\nOn architectures where a pgd entry may be shared between user and kernel\n(e.g. ARM+LPAE), freeing page tables needs a ceiling other than 0.\nThis patch introduces a generic USER_PGTABLES_CEILING that arch code can\noverride. It is the responsibility of the arch code setting the ceiling\nto ensure the complete freeing of the page tables (usually in\npgd_free()).\n\n[catalin.marinas@arm.com: commit log; shift_arg_pages(), asm-generic/pgtables.h changes]\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ddc967f09f9e6008b095f039c963e5ab74be383", "tree": "b6dc90465e3a243b63bb887f2f5e603005d16ff1", "parents": [ "ec005c0b2a1870b17795e5d6ae97a78a76f1febe" ], "author": { "name": "Marek Szyprowski", "email": "m.szyprowski@samsung.com", "time": "Tue Feb 12 13:46:24 2013 -0800" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Thu May 02 21:07:30 2013 -0700" }, "message": "mm: cma: fix accounting of CMA pages placed in high memory\n\nThe total number of low memory pages is determined as totalram_pages -\ntotalhigh_pages, so without this patch all CMA pageblocks placed in\nhighmem were accounted to low memory.\n\nChange-Id: I10b78fa6a710828520a487b2fc2419b4f7521a6f\nCRs-Fixed: 480377\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nAcked-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nCc: Minchan Kim \u003cminchan.kim@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nGit-commit: 41a7973447b0b8717f0a214d4328dc31ec2291d7\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "ec005c0b2a1870b17795e5d6ae97a78a76f1febe", "tree": "7b2884cb0e5b25a8eb4cc3262875457133594e43", "parents": [ "5e6e44d63c5ccdfffa2709b4924256ccdc937209" ], "author": { "name": "Marek Szyprowski", "email": "m.szyprowski@samsung.com", "time": "Tue Dec 11 16:02:59 2012 -0800" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Thu May 02 21:07:20 2013 -0700" }, "message": "mm: cma: remove watermark hacks\n\nCommits 2139cbe627b8 (\"cma: fix counting of isolated pages\") and\nd95ea5d18e69 (\"cma: fix watermark checking\") introduced a reliable\nmethod of free page accounting when memory is being allocated from CMA\nregions, so the workaround introduced earlier by commit 49f223a9cd96\n(\"mm: trigger page reclaim in alloc_contig_range() to stabilise\nwatermarks\") can be finally removed.\n\nChange-Id: Iae17de8185eeabffd46752dbaf819591e6585869\nCRs-Fixed: 480377\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nCc: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nAcked-by: Michal Nazarewicz \u003cmina86@mina86.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nGit-commit: bc357f431c836c6631751e3ef7dfe7882394ad67\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[lauraa@codeaurora.org: Context fixup in mmzone.h, keep zone definition in\nalloc_contig_range for other purposes]\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "c420060e7b21368c21972e8a29e4ff56abb9d219", "tree": "069e6e4afb23f00817a7daf0bec549435359ab27", "parents": [ "726cc91ed26521f3e678346e5745203a70edd456" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 16 13:45:37 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "vm: add vm_iomap_memory() helper function\n\ncommit b4cbb197c7e7a68dbad0d491242e3ca67420c13e upstream.\n\nVarious drivers end up replicating the code to mmap() their memory\nbuffers into user space, and our core memory remapping function may be\nvery flexible but it is unnecessarily complicated for the common cases\nto use.\n\nOur internal VM uses pfn\u0027s (\"page frame numbers\") which simplifies\nthings for the VM, and allows us to pass physical addresses around in a\ndenser and more efficient format than passing a \"phys_addr_t\" around,\nand having to shift it up and down by the page size. But it just means\nthat drivers end up doing that shifting instead at the interface level.\n\nIt also means that drivers end up mucking around with internal VM things\nlike the vma details (vm_pgoff, vm_start/end) way more than they really\nneed to.\n\nSo this just exports a function to map a certain physical memory range\ninto user space (using a phys_addr_t based interface that is much more\nnatural for a driver) and hides all the complexity from the driver.\nSome drivers will still end up tweaking the vm_page_prot details for\nthings like prefetching or cacheability etc, but that\u0027s actually\nrelevant to the driver, rather than caring about what the page offset of\nthe mapping is into the particular IO memory region.\n\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n\n" }, { "commit": "f42097f7eb860a967d1629c4bb00f2a083edc1dc", "tree": "4ce01e4ea7e752794e5e7c1bf6067227467d70bd", "parents": [ "4f969dd6ce2941f9ce917684a058af2d7f6c77e9" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Wed Apr 17 15:58:30 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "hugetlbfs: add swap entry check in follow_hugetlb_page()\n\ncommit 9cc3a5bd40067b9a0fbd49199d0780463fc2140f upstream.\n\nWith applying the previous patch \"hugetlbfs: stop setting VM_DONTDUMP in\ninitializing vma(VM_HUGETLB)\" to reenable hugepage coredump, if a memory\nerror happens on a hugepage and the affected processes try to access the\nerror hugepage, we hit VM_BUG_ON(atomic_read(\u0026page-\u003e_count) \u003c\u003d 0) in\nget_page().\n\nThe reason for this bug is that coredump-related code doesn\u0027t recognise\n\"hugepage hwpoison entry\" with which a pmd entry is replaced when a memory\nerror occurs on a hugepage.\n\nIn other words, physical address information is stored in different bit\nlayout between hugepage hwpoison entry and pmd entry, so\nfollow_hugetlb_page() which is called in get_dump_page() returns a wrong\npage from a given address.\n\nThe expected behavior is like this:\n\n absent is_swap_pte FOLL_DUMP Expected behavior\n -------------------------------------------------------------------\n true false false hugetlb_fault\n false true false hugetlb_fault\n false false false return page\n true false true skip page (to avoid allocation)\n false true true hugetlb_fault\n false false true return page\n\nWith this patch, we can call hugetlb_fault() and take proper actions (we\nwait for migration entries, fail with VM_FAULT_HWPOISON_LARGE for\nhwpoisoned entries,) and as the result we can dump all hugepages except\nfor hwpoisoned ones.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: HATAYAMA Daisuke \u003cd.hatayama@jp.fujitsu.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cdc8958a19b38773292cb6916f77f1e3bdf6d0fc", "tree": "a60e744f239db71d4bc7fcc687a0ceebbbe1b638", "parents": [ "5592a94b44df6e6d48e34cfe596844637a2976ac" ], "author": { "name": "Jan Stancek", "email": "jstancek@redhat.com", "time": "Mon Apr 08 13:00:02 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:47 2013 -0700" }, "message": "mm: prevent mmap_cache race in find_vma()\n\ncommit b6a9b7f6b1f21735a7456d534dc0e68e61359d2c upstream.\n\nfind_vma() can be called by multiple threads with read lock\nheld on mm-\u003emmap_sem and any of them can update mm-\u003emmap_cache.\nPrevent compiler from re-fetching mm-\u003emmap_cache, because other\nreaders could update it in the meantime:\n\n thread 1 thread 2\n |\n find_vma() | find_vma()\n struct vm_area_struct *vma \u003d NULL; |\n vma \u003d mm-\u003emmap_cache; |\n if (!(vma \u0026\u0026 vma-\u003evm_end \u003e addr |\n \u0026\u0026 vma-\u003evm_start \u003c\u003d addr)) { |\n | mm-\u003emmap_cache \u003d vma;\n return vma; |\n ^^ compiler may optimize this |\n local variable out and re-read |\n mm-\u003emmap_cache |\n\nThis issue can be reproduced with gcc-4.8.0-1 on s390x by running\nmallocstress testcase from LTP, which triggers:\n\n kernel BUG at mm/rmap.c:1088!\n Call Trace:\n ([\u003c000003d100c57000\u003e] 0x3d100c57000)\n [\u003c000000000023a1c0\u003e] do_wp_page+0x2fc/0xa88\n [\u003c000000000023baae\u003e] handle_pte_fault+0x41a/0xac8\n [\u003c000000000023d832\u003e] handle_mm_fault+0x17a/0x268\n [\u003c000000000060507a\u003e] do_protection_exception+0x1e2/0x394\n [\u003c0000000000603a04\u003e] pgm_check_handler+0x138/0x13c\n [\u003c000003fffcf1f07a\u003e] 0x3fffcf1f07a\n Last Breaking-Event-Address:\n [\u003c000000000024755e\u003e] page_add_new_anon_rmap+0xc2/0x168\n\nThanks to Jakub Jelinek for his insight on gcc and helping to\ntrack this down.\n\nSigned-off-by: Jan Stancek \u003cjstancek@redhat.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[bwh: Backported to 3.2: adjust context, indentation]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "15962c2598f71e0fed921ae441fede5df2bb9e1c", "tree": "a8ce44efcbe6d4bd71e2913b8e46be7697cd7caa", "parents": [ "366e0f00106958cf80e0c4a4c664c02562568525" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Fri Apr 05 12:39:18 2013 -0700" }, "committer": { "name": "Gerrit - the friendly Code Review server", "email": "code-review@localhost", "time": "Mon Apr 08 14:49:42 2013 -0700" }, "message": "mm: Retry original migrate type if CMA failed\n\nCurrently, __rmqueue_cma will disregard the original migrate type\nand only try MIGRATE_CMA for allocations. If the MIGRATE_CMA\nallocation fails, the fallback types of the original migrate type\nare used. Note that in this current path we never try to actually\nallocate from the original migrate type. If the only pages left\nin the system are the original migrate type, we will fail the\nallocation since we never actually try the original migrate type.\nThis may lead to infinite looping since the system still (correctly)\ncalculates there are pages available for allocation and will keep\ntrying to allocate pages. Fix this degenerate case by allocating\nfrom the original migrate type if the MIGRATE_CMA allocation fails.\n\nChange-Id: I62ab293dc694955eaf88e790131a8565395ba8cb\nCRs-Fixed: 470615\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "bea7cce4319edd8c15d78833f9b5bb752f997662", "tree": "96c435437d49f4448158a1ffb5a5e0dff0523bde", "parents": [ "612dadee15aa0a474309a93f53172920fe93d609" ], "author": { "name": "Wanpeng Li", "email": "liwanp@linux.vnet.ibm.com", "time": "Fri Mar 22 15:04:40 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:12 2013 -0700" }, "message": "mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting\n\ncommit d00285884c0892bb1310df96bce6056e9ce9b9d9 upstream.\n\nhugetlb_total_pages is used for overcommit calculations but the current\nimplementation considers only the default hugetlb page size (which is\neither the first defined hugepage size or the one specified by\ndefault_hugepagesz kernel boot parameter).\n\nIf the system is configured for more than one hugepage size, which is\npossible since commit a137e1cc6d6e (\"hugetlbfs: per mount huge page\nsizes\") then the overcommit estimation done by __vm_enough_memory()\n(resp. shown by meminfo_proc_show) is not precise - there is an\nimpression of more available/allowed memory. This can lead to an\nunexpected ENOMEM/EFAULT resp. SIGSEGV when memory is accounted.\n\nTestcase:\n boot: hugepagesz\u003d1G hugepages\u003d1\n the default overcommit ratio is 50\n before patch:\n\n egrep \u0027CommitLimit\u0027 /proc/meminfo\n CommitLimit: 55434168 kB\n\n after patch:\n\n egrep \u0027CommitLimit\u0027 /proc/meminfo\n CommitLimit: 54909880 kB\n\n[akpm@linux-foundation.org: coding-style tweak]\nSigned-off-by: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: \"Aneesh Kumar K.V\" \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nCc: Hillf Danton \u003cdhillf@gmail.com\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3126603e01babcec7cfe2f284099e2adff095bff", "tree": "edd0b3fd6d738ef785f4338825b703f1e7fa7db7", "parents": [ "96ace773358d2989ea522a1cdccf65d75c1335f3" ], "author": { "name": "Mathieu Desnoyers", "email": "mathieu.desnoyers@efficios.com", "time": "Mon Feb 25 10:20:36 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 14 11:29:51 2013 -0700" }, "message": "Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys\n\ncommit 8aec0f5d4137532de14e6554fd5dd201ff3a3c49 upstream.\n\nLooking at mm/process_vm_access.c:process_vm_rw() and comparing it to\ncompat_process_vm_rw() shows that the compatibility code requires an\nexplicit \"access_ok()\" check before calling\ncompat_rw_copy_check_uvector(). The same difference seems to appear when\nwe compare fs/read_write.c:do_readv_writev() to\nfs/compat.c:compat_do_readv_writev().\n\nThis subtle difference between the compat and non-compat requirements\nshould probably be debated, as it seems to be error-prone. In fact,\nthere are two others sites that use this function in the Linux kernel,\nand they both seem to get it wrong:\n\nNow shifting our attention to fs/aio.c, we see that aio_setup_iocb()\nalso ends up calling compat_rw_copy_check_uvector() through\naio_setup_vectored_rw(). Unfortunately, the access_ok() check appears to\nbe missing. Same situation for\nsecurity/keys/compat.c:compat_keyctl_instantiate_key_iov().\n\nI propose that we add the access_ok() check directly into\ncompat_rw_copy_check_uvector(), so callers don\u0027t have to worry about it,\nand it therefore makes the compat call code similar to its non-compat\ncounterpart. Place the access_ok() check in the same location where\ncopy_from_user() can trigger a -EFAULT error in the non-compat code, so\nthe ABI behaviors are alike on both compat and non-compat.\n\nWhile we are here, fix compat_do_readv_writev() so it checks for\ncompat_rw_copy_check_uvector() negative return values.\n\nAnd also, fix a memory leak in compat_keyctl_instantiate_key_iov() error\nhandling.\n\nAcked-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nAcked-by: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nSigned-off-by: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f4ce5b3f263c05e7af66fa4eba7c4eb8e1b006bf", "tree": "4d6ca134dbfbde49745557a183d144cb59457ba7", "parents": [ "06c7976c91566d676766ad57b574757f6d0abd02" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Fri Feb 22 16:35:59 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:01 2013 -0800" }, "message": "mm/fadvise.c: drain all pagevecs if POSIX_FADV_DONTNEED fails to discard all pages\n\ncommit 67d46b296a1ba1477c0df8ff3bc5e0167a0b0732 upstream.\n\nRob van der Heij reported the following (paraphrased) on private mail.\n\n\tThe scenario is that I want to avoid backups to fill up the page\n\tcache and purge stuff that is more likely to be used again (this is\n\twith s390x Linux on z/VM, so I don\u0027t give it as much memory that\n\twe don\u0027t care anymore). So I have something with LD_PRELOAD that\n\tintercepts the close() call (from tar, in this case) and issues\n\ta posix_fadvise() just before closing the file.\n\n\tThis mostly works, except for small files (less than 14 pages)\n\tthat remains in page cache after the face.\n\nUnfortunately Rob has not had a chance to test this exact patch but the\ntest program below should be reproducing the problem he described.\n\nThe issue is the per-cpu pagevecs for LRU additions. If the pages are\nadded by one CPU but fadvise() is called on another then the pages\nremain resident as the invalidate_mapping_pages() only drains the local\npagevecs via its call to pagevec_release(). The user-visible effect is\nthat a program that uses fadvise() properly is not obeyed.\n\nA possible fix for this is to put the necessary smarts into\ninvalidate_mapping_pages() to globally drain the LRU pagevecs if a\npagevec page could not be discarded. The downside with this is that an\ninode cache shrink would send a global IPI and memory pressure\npotentially causing global IPI storms is very undesirable.\n\nInstead, this patch adds a check during fadvise(POSIX_FADV_DONTNEED) to\ncheck if invalidate_mapping_pages() discarded all the requested pages.\nIf a subset of pages are discarded it drains the LRU pagevecs and tries\nagain. If the second attempt fails, it assumes it is due to the pages\nbeing mapped, locked or dirty and does not care. With this patch, an\napplication using fadvise() correctly will be obeyed but there is a\ndownside that a malicious application can force the kernel to send\nglobal IPIs and increase overhead.\n\nIf accepted, I would like this to be considered as a -stable candidate.\nIt\u0027s not an urgent issue but it\u0027s a system call that is not working as\nadvertised which is weak.\n\nThe following test program demonstrates the problem. It should never\nreport that pages are still resident but will without this patch. It\nassumes that CPU 0 and 1 exist.\n\nint main() {\n\tint fd;\n\tint pagesize \u003d getpagesize();\n\tssize_t written \u003d 0, expected;\n\tchar *buf;\n\tunsigned char *vec;\n\tint resident, i;\n\tcpu_set_t set;\n\n\t/* Prepare a buffer for writing */\n\texpected \u003d FILESIZE_PAGES * pagesize;\n\tbuf \u003d malloc(expected + 1);\n\tif (buf \u003d\u003d NULL) {\n\t\tprintf(\"ENOMEM\\n\");\n\t\texit(EXIT_FAILURE);\n\t}\n\tbuf[expected] \u003d 0;\n\tmemset(buf, \u0027a\u0027, expected);\n\n\t/* Prepare the mincore vec */\n\tvec \u003d malloc(FILESIZE_PAGES);\n\tif (vec \u003d\u003d NULL) {\n\t\tprintf(\"ENOMEM\\n\");\n\t\texit(EXIT_FAILURE);\n\t}\n\n\t/* Bind ourselves to CPU 0 */\n\tCPU_ZERO(\u0026set);\n\tCPU_SET(0, \u0026set);\n\tif (sched_setaffinity(getpid(), sizeof(set), \u0026set) \u003d\u003d -1) {\n\t\tperror(\"sched_setaffinity\");\n\t\texit(EXIT_FAILURE);\n\t}\n\n\t/* open file, unlink and write buffer */\n\tfd \u003d open(\"fadvise-test-file\", O_CREAT|O_EXCL|O_RDWR);\n\tif (fd \u003d\u003d -1) {\n\t\tperror(\"open\");\n\t\texit(EXIT_FAILURE);\n\t}\n\tunlink(\"fadvise-test-file\");\n\twhile (written \u003c expected) {\n\t\tssize_t this_write;\n\t\tthis_write \u003d write(fd, buf + written, expected - written);\n\n\t\tif (this_write \u003d\u003d -1) {\n\t\t\tperror(\"write\");\n\t\t\texit(EXIT_FAILURE);\n\t\t}\n\n\t\twritten +\u003d this_write;\n\t}\n\tfree(buf);\n\n\t/*\n\t * Force ourselves to another CPU. If fadvise only flushes the local\n\t * CPUs pagevecs then the fadvise will fail to discard all file pages\n\t */\n\tCPU_ZERO(\u0026set);\n\tCPU_SET(1, \u0026set);\n\tif (sched_setaffinity(getpid(), sizeof(set), \u0026set) \u003d\u003d -1) {\n\t\tperror(\"sched_setaffinity\");\n\t\texit(EXIT_FAILURE);\n\t}\n\n\t/* sync and fadvise to discard the page cache */\n\tfsync(fd);\n\tif (posix_fadvise(fd, 0, expected, POSIX_FADV_DONTNEED) \u003d\u003d -1) {\n\t\tperror(\"posix_fadvise\");\n\t\texit(EXIT_FAILURE);\n\t}\n\n\t/* map the file and use mincore to see which parts of it are resident */\n\tbuf \u003d mmap(NULL, expected, PROT_READ, MAP_SHARED, fd, 0);\n\tif (buf \u003d\u003d NULL) {\n\t\tperror(\"mmap\");\n\t\texit(EXIT_FAILURE);\n\t}\n\tif (mincore(buf, expected, vec) \u003d\u003d -1) {\n\t\tperror(\"mincore\");\n\t\texit(EXIT_FAILURE);\n\t}\n\n\t/* Check residency */\n\tfor (i \u003d 0, resident \u003d 0; i \u003c FILESIZE_PAGES; i++) {\n\t\tif (vec[i])\n\t\t\tresident++;\n\t}\n\tif (resident !\u003d 0) {\n\t\tprintf(\"Nr unexpected pages resident: %d\\n\", resident);\n\t\texit(EXIT_FAILURE);\n\t}\n\n\tmunmap(buf, expected);\n\tclose(fd);\n\tfree(vec);\n\texit(EXIT_SUCCESS);\n}\n\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nReported-by: Rob van der Heij \u003crvdheij@gmail.com\u003e\nTested-by: Rob van der Heij \u003crvdheij@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "06c7976c91566d676766ad57b574757f6d0abd02", "tree": "ddf95fb6f65792326ace682ea9170e4e9fa52a05", "parents": [ "3b6e03c9ac4d57ccb03737a997069dc7ab65601c" ], "author": { "name": "Greg Thelen", "email": "gthelen@google.com", "time": "Fri Feb 22 16:36:01 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:01 2013 -0800" }, "message": "tmpfs: fix use-after-free of mempolicy object\n\ncommit 5f00110f7273f9ff04ac69a5f85bb535a4fd0987 upstream.\n\nThe tmpfs remount logic preserves filesystem mempolicy if the mpol\u003dM\noption is not specified in the remount request. A new policy can be\nspecified if mpol\u003dM is given.\n\nBefore this patch remounting an mpol bound tmpfs without specifying\nmpol\u003d mount option in the remount request would set the filesystem\u0027s\nmempolicy object to a freed mempolicy object.\n\nTo reproduce the problem boot a DEBUG_PAGEALLOC kernel and run:\n # mkdir /tmp/x\n\n # mount -t tmpfs -o size\u003d100M,mpol\u003dinterleave nodev /tmp/x\n\n # grep /tmp/x /proc/mounts\n nodev /tmp/x tmpfs rw,relatime,size\u003d102400k,mpol\u003dinterleave:0-3 0 0\n\n # mount -o remount,size\u003d200M nodev /tmp/x\n\n # grep /tmp/x /proc/mounts\n nodev /tmp/x tmpfs rw,relatime,size\u003d204800k,mpol\u003d??? 0 0\n # note ? garbage in mpol\u003d... output above\n\n # dd if\u003d/dev/zero of\u003d/tmp/x/f count\u003d1\n # panic here\n\nPanic:\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003c (null)\u003e] (null)\n [...]\n Oops: 0010 [#1] SMP DEBUG_PAGEALLOC\n Call Trace:\n mpol_shared_policy_init+0xa5/0x160\n shmem_get_inode+0x209/0x270\n shmem_mknod+0x3e/0xf0\n shmem_create+0x18/0x20\n vfs_create+0xb5/0x130\n do_last+0x9a1/0xea0\n path_openat+0xb3/0x4d0\n do_filp_open+0x42/0xa0\n do_sys_open+0xfe/0x1e0\n compat_sys_open+0x1b/0x20\n cstar_dispatch+0x7/0x1f\n\nNon-debug kernels will not crash immediately because referencing the\ndangling mpol will not cause a fault. Instead the filesystem will\nreference a freed mempolicy object, which will cause unpredictable\nbehavior.\n\nThe problem boils down to a dropped mpol reference below if\nshmem_parse_options() does not allocate a new mpol:\n\n config \u003d *sbinfo\n shmem_parse_options(data, \u0026config, true)\n mpol_put(sbinfo-\u003empol)\n sbinfo-\u003empol \u003d config.mpol /* BUG: saves unreferenced mpol */\n\nThis patch avoids the crash by not releasing the mempolicy if\nshmem_parse_options() doesn\u0027t create a new mpol.\n\nHow far back does this issue go? I see it in both 2.6.36 and 3.3. I did\nnot look back further.\n\nSigned-off-by: Greg Thelen \u003cgthelen@google.com\u003e\nAcked-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7fecb64cca9a98f60ff4bc794bb353512bd5c665", "tree": "eff3883ea5932d820a5166067695ccabec0d07a1", "parents": [ "d0730c2bf33c1cdab392f88013be6b5ebacf0f29" ], "author": { "name": "Robin Holt", "email": "holt@sgi.com", "time": "Fri Feb 22 16:35:34 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:00 2013 -0800" }, "message": "mmu_notifier_unregister NULL Pointer deref and multiple -\u003erelease() callouts\n\ncommit 751efd8610d3d7d67b7bdf7f62646edea7365dd7 upstream.\n\nThere is a race condition between mmu_notifier_unregister() and\n__mmu_notifier_release().\n\nAssume two tasks, one calling mmu_notifier_unregister() as a result of a\nfilp_close() -\u003eflush() callout (task A), and the other calling\nmmu_notifier_release() from an mmput() (task B).\n\n A B\nt1 srcu_read_lock()\nt2 if (!hlist_unhashed())\nt3 srcu_read_unlock()\nt4 srcu_read_lock()\nt5 hlist_del_init_rcu()\nt6 synchronize_srcu()\nt7 srcu_read_unlock()\nt8 hlist_del_rcu() \u003c--- NULL pointer deref.\n\nAdditionally, the list traversal in __mmu_notifier_release() is not\nprotected by the by the mmu_notifier_mm-\u003ehlist_lock which can result in\ncallouts to the -\u003erelease() notifier from both mmu_notifier_unregister()\nand __mmu_notifier_release().\n\n-stable suggestions:\n\nThe stable trees prior to 3.7.y need commits 21a92735f660 and\n70400303ce0c cherry-picked in that order prior to cherry-picking this\ncommit. The 3.7.y tree already has those two commits.\n\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Wanpeng Li \u003cliwanp@linux.vnet.ibm.com\u003e\nCc: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nCc: Avi Kivity \u003cavi@redhat.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Sagi Grimberg \u003csagig@mellanox.co.il\u003e\nCc: Haggai Eran \u003chaggaie@mellanox.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d0730c2bf33c1cdab392f88013be6b5ebacf0f29", "tree": "e077ff276de128de50cb464cad3a591f1a11b270", "parents": [ "4209ee0d3f7992af3903b5f9a3359f6d2f597c4b" ], "author": { "name": "Andrea Arcangeli", "email": "aarcange@redhat.com", "time": "Mon Oct 08 16:31:52 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:00 2013 -0800" }, "message": "mm: mmu_notifier: make the mmu_notifier srcu static\n\ncommit 70400303ce0c4ced3139499c676d5c79636b0c72 upstream.\n\nThe variable must be static especially given the variable name.\n\ns/RCU/SRCU/ over a few comments.\n\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nCc: Sagi Grimberg \u003csagig@mellanox.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Haggai Eran \u003chaggaie@mellanox.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4209ee0d3f7992af3903b5f9a3359f6d2f597c4b", "tree": "5009887555ccf68907acf7ff9b14c9acfed6ee00", "parents": [ "362efcc9b0ba020f9124c70c56381ed64491aeca" ], "author": { "name": "Sagi Grimberg", "email": "sagig@mellanox.co.il", "time": "Mon Oct 08 16:29:24 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:00 2013 -0800" }, "message": "mm: mmu_notifier: have mmu_notifiers use a global SRCU so they may safely schedule\n\ncommit 21a92735f660eaecf69a6f2e777f18463760ec32 upstream.\n\nWith an RCU based mmu_notifier implementation, any callout to\nmmu_notifier_invalidate_range_{start,end}() or\nmmu_notifier_invalidate_page() would not be allowed to call schedule()\nas that could potentially allow a modification to the mmu_notifier\nstructure while it is currently being used.\n\nSince srcu allocs 4 machine words per instance per cpu, we may end up\nwith memory exhaustion if we use srcu per mm. So all mms share a global\nsrcu. Note that during large mmu_notifier activity exit \u0026 unregister\npaths might hang for longer periods, but it is tolerable for current\nmmu_notifier clients.\n\nSigned-off-by: Sagi Grimberg \u003csagig@mellanox.co.il\u003e\nSigned-off-by: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Haggai Eran \u003chaggaie@mellanox.com\u003e\nCc: \"Paul E. McKenney\" \u003cpaulmck@us.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "17c2f96bd1de5999900303b3eb923b8cdf6ee2ba", "tree": "f6ba7eb0b52708858ab17225f83b5d738bebba5e", "parents": [ "5c444ede11d516377ec6a3230d450441f46cfb4f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Feb 18 09:58:02 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:58:58 2013 -0800" }, "message": "mm: fix pageblock bitmap allocation\n\ncommit 7c45512df987c5619db041b5c9b80d281e26d3db upstream.\n\nCommit c060f943d092 (\"mm: use aligned zone start for pfn_to_bitidx\ncalculation\") fixed out calculation of the index into the pageblock\nbitmap when a !SPARSEMEM zome was not aligned to pageblock_nr_pages.\n\nHowever, the _allocation_ of that bitmap had never taken this alignment\nrequirement into accout, so depending on the exact size and alignment of\nthe zone, the use of that index could then access past the allocation,\nresulting in some very subtle memory corruption.\n\nThis was reported (and bisected) by Ingo Molnar: one of his random\nconfig builds would hang with certain very specific kernel command line\noptions.\n\nIn the meantime, commit c060f943d092 has been marked for stable, so this\nfix needs to be back-ported to the stable kernels that backported the\ncommit to use the right alignment.\n\nBisected-and-tested-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "48f37419dd547478aa46e9898dba65f8a6cfe0a1", "tree": "8bd5eb745415feb736c4f5525a8cee682671cbff", "parents": [ "55eb56c75771a81d99e6a70af688f77cb38ff729" ], "author": { "name": "Heesub Shin", "email": "heesub.shin@samsung.com", "time": "Mon Jan 07 11:10:13 2013 +0900" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Wed Feb 20 14:40:26 2013 -0800" }, "message": "cma: redirect page allocation to CMA\n\nCMA pages are designed to be used as fallback for movable allocations\nand cannot be used for non-movable allocations. If CMA pages are\nutilized poorly, non-movable allocations may end up getting starved if\nall regular movable pages are allocated and the only pages left are\nCMA. Always using CMA pages first creates unacceptable performance\nproblems. As a midway alternative, use CMA pages for certain\nuserspace allocations. The userspace pages can be migrated or dropped\nquickly which giving decent utilization.\n\nChange-Id: I6165dda01b705309eebabc6dfa67146b7a95c174\nCRs-Fixed: 452508\n[lauraa@codeaurora.org: Missing CONFIG_CMA guards, add commit text]\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "55eb56c75771a81d99e6a70af688f77cb38ff729", "tree": "ef6fc63d0d0fed345b0f8f93f19312fce6ac19e4", "parents": [ "1ace3155a4baf5a959ce5c372c99a286d7ec2de2" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Mon Feb 18 07:17:06 2013 -0800" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Wed Feb 20 14:40:08 2013 -0800" }, "message": "Revert \"mm: cma: on movable allocations try MIGRATE_CMA first\"\n\nThis reverts commit b5662d64fa5ee483b985b351dec993402422fee3.\n\nUsing CMA pages first creates good utilization but has some\nunfortunate side effects. Many movable allocations come from\nthe filesystem layer which can hold on to pages for long periods\nof time which causes high allocation times (~200ms) and high\nrates of failure. Revert this patch and use alternate allocation\nstrategies to get better utilization.\n\nChange-Id: I917e137d5fb292c9f8282506f71a799a6451ccfa\nCRs-Fixed: 452508\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "1ace3155a4baf5a959ce5c372c99a286d7ec2de2", "tree": "dd39d97b1f226c4fadd71e7271f9fe50036cd90d", "parents": [ "4777a5ac5cfe6001027c3781808bfcc10c431d15" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Tue Feb 12 13:30:04 2013 -0800" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Wed Feb 20 14:39:41 2013 -0800" }, "message": "mm: Don\u0027t put CMA pages on per cpu lists\n\nCMA allocations rely on being able to migrate pages out\nquickly to fulfill the allocations. Most use cases for\nmovable allocations meet this requirement. File system\nallocations may take an unaccpetably long time to\nmigrate, which creates delays from CMA. Prevent CMA\npages from ending up on the per-cpu lists to avoid\ncode paths grabbing CMA pages on the fast path. CMA\npages can still be allocated as a fallback under tight\nmemory pressure.\n\nCRs-Fixed: 452508\nChange-Id: I79a28f697275a2a1870caabae53c8ea345b4b47d\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "850bf199320393f313bcdeda21eab85b3777efb9", "tree": "d5e52f60cc70eea92fe841c92543531578ed49b3", "parents": [ "7ea4328ba50cffa9e8c4452f0318f22f34444177" ], "author": { "name": "Bartlomiej Zolnierkiewicz", "email": "b.zolnierkie@samsung.com", "time": "Mon Oct 08 16:32:05 2012 -0700" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Sun Feb 03 08:14:15 2013 -0800" }, "message": "cma: fix watermark checking\n\n* Add ALLOC_CMA alloc flag and pass it to [__]zone_watermark_ok()\n (from Minchan Kim).\n\n* During watermark check decrease available free pages number by\n free CMA pages number if necessary (unmovable allocations cannot\n use pages from CMA areas).\n\nCRs-Fixed: 446321\nChange-Id: Ibd069b028eb80b70701c1b81cb28a503d8265be0\nSigned-off-by: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nSigned-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nCc: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nCc: Michal Nazarewicz \u003cmina86@mina86.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lauraa@codeaurora.org: context fixups]\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "b70fa754f45acaf4ccf453978e415f5d0ae46d22", "tree": "70159ad1c99004fae119d536ff83df067b8c5307", "parents": [ "b9c24b258289287f8c3f649d299d48920757dcc5" ], "author": { "name": "Rabin Vincent", "email": "rabin.vincent@stericsson.com", "time": "Tue Dec 11 16:00:24 2012 -0800" }, "committer": { "name": "Sudhir Sharma", "email": "sudsha@codeaurora.org", "time": "Fri Jan 18 01:07:25 2013 -0800" }, "message": "mm: show migration types in show_mem\n\nThis is useful to diagnose the reason for page allocation failure for\ncases where there appear to be several free pages.\n\nExample, with this alloc_pages(GFP_ATOMIC) failure:\n\n swapper/0: page allocation failure: order:0, mode:0x0\n ...\n Mem-info:\n Normal per-cpu:\n CPU 0: hi: 90, btch: 15 usd: 48\n CPU 1: hi: 90, btch: 15 usd: 21\n active_anon:0 inactive_anon:0 isolated_anon:0\n active_file:0 inactive_file:84 isolated_file:0\n unevictable:0 dirty:0 writeback:0 unstable:0\n free:4026 slab_reclaimable:75 slab_unreclaimable:484\n mapped:0 shmem:0 pagetables:0 bounce:0\n Normal free:16104kB min:2296kB low:2868kB high:3444kB active_anon:0kB\n inactive_anon:0kB active_file:0kB inactive_file:336kB unevictable:0kB\n isolated(anon):0kB isolated(file):0kB present:331776kB mlocked:0kB\n dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:300kB\n slab_unreclaimable:1936kB kernel_stack:328kB pagetables:0kB unstable:0kB\n bounce:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no\n lowmem_reserve[]: 0 0\n\nBefore the patch, it\u0027s hard (for me, at least) to say why all these free\nchunks weren\u0027t considered for allocation:\n\n Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB 1*512kB\n 1*1024kB 1*2048kB 3*4096kB \u003d 16128kB\n\nAfter the patch, it\u0027s obvious that the reason is that all of these are\nin the MIGRATE_CMA (C) freelist:\n\n Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 1*256kB (C) 1*512kB\n (C) 1*1024kB (C) 1*2048kB (C) 3*4096kB (C) \u003d 16128kB\n\nChange-Id: Ic5fe77d762e0c03715bfb917774e7c4f03ac43f5\nSigned-off-by: Rabin Vincent \u003crabin.vincent@stericsson.com\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "b9c24b258289287f8c3f649d299d48920757dcc5", "tree": "7d0d3f3ab08b5fc6cbee8d416592a9e4df0f4295", "parents": [ "13f0fb1b9b6ec96b03ede07393d7efa19de53527" ], "author": { "name": "Michal Nazarewicz", "email": "mina86@mina86.com", "time": "Tue Nov 20 16:37:50 2012 +0100" }, "committer": { "name": "Sudhir Sharma", "email": "sudsha@codeaurora.org", "time": "Fri Jan 18 01:06:32 2013 -0800" }, "message": "mm: cma: on movable allocations try MIGRATE_CMA first\n\nIt has been observed that system tends to keep a lot of CMA free pages\neven in very high memory pressure use cases. The CMA fallback for\nmovable pages is used very rarely, only when system is completely\npruned from MOVABLE pages. This means that the out-of-memory is\ntriggered for unmovable allocations even when there are many CMA pages\navailable. This problem was not observed previously since movable\npages were used as a fallback for unmovable allocations.\n\nTo avoid such situation this commit changes the allocation order so\nthat on movable allocations the MIGRATE_CMA pageblocks are used first.\n\nThis change means that the MIGRATE_CMA can be removed from fallback\npath of the MIGRATE_MOVABLE type. This means that the\n__rmqueue_fallback() function will never deal with CMA pages and thus\nall the checks around MIGRATE_CMA can be removed from that function.\n\nChange-Id: Ie13312d62a6af12d7aa78b4283ed25535a6d49fd\nCRs-Fixed: 435287\nSigned-off-by: Michal Nazarewicz \u003cmina86@mina86.com\u003e\nReported-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nCc: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "9035b20988416173a48ad2f00190846faf15ccb7", "tree": "a1f6e7fb6a1283ec52e85f2143751a9f301d581e", "parents": [ "4faf067ae71be3d652e09c3119ce8125498cdf64" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Tue May 29 15:06:23 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:50:53 2013 -0800" }, "message": "thp, memcg: split hugepage for memcg oom on cow\n\ncommit 1f1d06c34f7675026326cd9f39ff91e4555cf355 upstream.\n\nOn COW, a new hugepage is allocated and charged to the memcg. If the\nsystem is oom or the charge to the memcg fails, however, the fault\nhandler will return VM_FAULT_OOM which results in an oom kill.\n\nInstead, it\u0027s possible to fallback to splitting the hugepage so that the\nCOW results only in an order-0 page being allocated and charged to the\nmemcg which has a higher liklihood to succeed. This is expensive\nbecause the hugepage must be split in the page fault handler, but it is\nmuch better than unnecessarily oom killing a process.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Johannes Weiner \u003cjweiner@redhat.com\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ce19422296fb5fb5997d81e1b0043d771def7996", "tree": "92b8292798661ad6d3d4e4e4a8649949b30872cf", "parents": [ "c0b96525363543a1ba6a277546ebc26ad9a53aa1" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Fri Jan 11 14:31:51 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:50:43 2013 -0800" }, "message": "mm: use aligned zone start for pfn_to_bitidx calculation\n\ncommit c060f943d0929f3e429c5d9522290584f6281d6e upstream.\n\nThe current calculation in pfn_to_bitidx assumes that (pfn -\nzone-\u003ezone_start_pfn) \u003e\u003e pageblock_order will return the same bit for\nall pfn in a pageblock. If zone_start_pfn is not aligned to\npageblock_nr_pages, this may not always be correct.\n\nConsider the following with pageblock order \u003d 10, zone start 2MB:\n\n pfn | pfn - zone start | (pfn - zone start) \u003e\u003e page block order\n ----------------------------------------------------------------\n 0x26000 | 0x25e00\t | 0x97\n 0x26100 | 0x25f00\t | 0x97\n 0x26200 | 0x26000\t | 0x98\n 0x26300 | 0x26100\t | 0x98\n\nThis means that calling {get,set}_pageblock_migratetype on a single page\nwill not set the migratetype for the full block. Fix this by rounding\ndown zone_start_pfn when doing the bitidx calculation.\n\nFor our use case, the effects of this bug were mostly tied to the fact\nthat CMA allocations would either take a long time or fail to happen.\nDepending on the driver using CMA, this could result in anything from\nvisual glitches to application failures.\n\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c0b96525363543a1ba6a277546ebc26ad9a53aa1", "tree": "88515adb3db5516bc858a5ac00d941bfea786106", "parents": [ "b1ca420793e505d04f3a47a74651af7c037774b7" ], "author": { "name": "Jason Liu", "email": "r64343@freescale.com", "time": "Fri Jan 11 14:31:47 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:50:43 2013 -0800" }, "message": "mm: compaction: fix echo 1 \u003e compact_memory return error issue\n\ncommit 7964c06d66c76507d8b6b662bffea770c29ef0ce upstream.\n\nwhen run the folloing command under shell, it will return error\n\n sh/$ echo 1 \u003e /proc/sys/vm/compact_memory\n sh/$ sh: write error: Bad address\n\nAfter strace, I found the following log:\n\n ...\n write(1, \"1\\n\", 2) \u003d 3\n write(1, \"\", 4294967295) \u003d -1 EFAULT (Bad address)\n write(2, \"echo: write error: Bad address\\n\", 31echo: write error: Bad address\n ) \u003d 31\n\nThis tells system return 3(COMPACT_COMPLETE) after write data to\ncompact_memory.\n\nThe fix is to make the system just return 0 instead 3(COMPACT_COMPLETE)\nfrom sysctl_compaction_handler after compaction_nodes finished.\n\nSigned-off-by: Jason Liu \u003cr64343@freescale.com\u003e\nSuggested-by: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b14d552774ed848ca1ca94d8adedcd743e3aa671", "tree": "36e3c23c3b3a2923a95b01583a48a31fccafff40", "parents": [ "e0996e350216f727b0f0e6219e79c8da5b3d1416" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.cz", "time": "Fri Jan 04 15:35:12 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:07:18 2013 -0800" }, "message": "mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT\n\ncommit 53a59fc67f97374758e63a9c785891ec62324c81 upstream.\n\nSince commit e303297e6c3a (\"mm: extended batches for generic\nmmu_gather\") we are batching pages to be freed until either\ntlb_next_batch cannot allocate a new batch or we are done.\n\nThis works just fine most of the time but we can get in troubles with\nnon-preemptible kernel (CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY)\non large machines where too aggressive batching might lead to soft\nlockups during process exit path (exit_mmap) because there are no\nscheduling points down the free_pages_and_swap_cache path and so the\nfreeing can take long enough to trigger the soft lockup.\n\nThe lockup is harmless except when the system is setup to panic on\nsoftlockup which is not that unusual.\n\nThe simplest way to work around this issue is to limit the maximum\nnumber of batches in a single mmu_gather. 10k of collected pages should\nbe safe to prevent from soft lockups (we would have 2ms for one) even if\nthey are all freed without an explicit scheduling point.\n\nThis patch doesn\u0027t add any new explicit scheduling points because it\nrelies on zap_pmd_range during page tables zapping which calls\ncond_resched per PMD.\n\nThe following lockup has been reported for 3.0 kernel with a huge\nprocess (in order of hundreds gigs but I do know any more details).\n\n BUG: soft lockup - CPU#56 stuck for 22s! [kernel:31053]\n Modules linked in: af_packet nfs lockd fscache auth_rpcgss nfs_acl sunrpc mptctl mptbase autofs4 binfmt_misc dm_round_robin dm_multipath bonding cpufreq_conservative cpufreq_userspace cpufreq_powersave pcc_cpufreq mperf microcode fuse loop osst sg sd_mod crc_t10dif st qla2xxx scsi_transport_fc scsi_tgt netxen_nic i7core_edac iTCO_wdt joydev e1000e serio_raw pcspkr edac_core iTCO_vendor_support acpi_power_meter rtc_cmos hpwdt hpilo button container usbhid hid dm_mirror dm_region_hash dm_log linear uhci_hcd ehci_hcd usbcore usb_common scsi_dh_emc scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh dm_snapshot pcnet32 mii edd dm_mod raid1 ext3 mbcache jbd fan thermal processor thermal_sys hwmon cciss scsi_mod\n Supported: Yes\n CPU 56\n Pid: 31053, comm: kernel Not tainted 3.0.31-0.9-default #1 HP ProLiant DL580 G7\n RIP: 0010: _raw_spin_unlock_irqrestore+0x8/0x10\n RSP: 0018:ffff883ec1037af0 EFLAGS: 00000206\n RAX: 0000000000000e00 RBX: ffffea01a0817e28 RCX: ffff88803ffd9e80\n RDX: 0000000000000200 RSI: 0000000000000206 RDI: 0000000000000206\n RBP: 0000000000000002 R08: 0000000000000001 R09: ffff887ec724a400\n R10: 0000000000000000 R11: dead000000200200 R12: ffffffff8144c26e\n R13: 0000000000000030 R14: 0000000000000297 R15: 000000000000000e\n FS: 00007ed834282700(0000) GS:ffff88c03f200000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n CR2: 000000000068b240 CR3: 0000003ec13c5000 CR4: 00000000000006e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process kernel (pid: 31053, threadinfo ffff883ec1036000, task ffff883ebd5d4100)\n Call Trace:\n release_pages+0xc5/0x260\n free_pages_and_swap_cache+0x9d/0xc0\n tlb_flush_mmu+0x5c/0x80\n tlb_finish_mmu+0xe/0x50\n exit_mmap+0xbd/0x120\n mmput+0x49/0x120\n exit_mm+0x122/0x160\n do_exit+0x17a/0x430\n do_group_exit+0x3d/0xb0\n get_signal_to_deliver+0x247/0x480\n do_signal+0x71/0x1b0\n do_notify_resume+0x98/0xb0\n int_signal+0x12/0x17\n DWARF2 unwinder stuck at int_signal+0x12/0x17\n\nSigned-off-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6718272b115afbf5d80ea1e0a4d18f9fcb32351f", "tree": "b46ec69ae31ba7534be322f62e7d47a4c99687c1", "parents": [ "25747cc45825ffc0192779a224d3bb9bc4b9edbd" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Wed Jan 02 02:01:33 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:49 2013 -0800" }, "message": "tmpfs mempolicy: fix /proc/mounts corrupting memory\n\ncommit f2a07f40dbc603c15f8b06e6ec7f768af67b424f upstream.\n\nRecently I suggested using \"mount -o remount,mpol\u003dlocal /tmp\" in NUMA\nmempolicy testing. Very nasty. Reading /proc/mounts, /proc/pid/mounts\nor /proc/pid/mountinfo may then corrupt one bit of kernel memory, often\nin a page table (causing \"Bad swap\" or \"Bad page map\" warning or \"Bad\npagetable\" oops), sometimes in a vm_area_struct or rbnode or somewhere\nworse. \"mpol\u003dprefer\" and \"mpol\u003dprefer:Node\" are equally toxic.\n\nRecent NUMA enhancements are not to blame: this dates back to 2.6.35,\nwhen commit e17f74af351c \"mempolicy: don\u0027t call mpol_set_nodemask() when\nno_context\" skipped mpol_parse_str()\u0027s call to mpol_set_nodemask(),\nwhich used to initialize v.preferred_node, or set MPOL_F_LOCAL in flags.\nWith slab poisoning, you can then rely on mpol_to_str() to set the bit\nfor node 0x6b6b, probably in the next page above the caller\u0027s stack.\n\nmpol_parse_str() is only called from shmem_parse_options(): no_context\nis always true, so call it unused for now, and remove !no_context code.\nSet v.nodes or v.preferred_node or MPOL_F_LOCAL as mpol_to_str() might\nexpect. Then mpol_to_str() can ignore its no_context argument also,\nthe mpol being appropriately initialized whether contextualized or not.\nRename its no_context unused too, and let subsequent patch remove them\n(that\u0027s not needed for stable backporting, which would involve rejects).\n\nI don\u0027t understand why MPOL_LOCAL is described as a pseudo-policy:\nit\u0027s a reasonable policy which suffers from a confusing implementation\nin terms of MPOL_PREFERRED with MPOL_F_LOCAL. I believe this would be\nmuch more robust if MPOL_LOCAL were recognized in switch statements\nthroughout, MPOL_F_LOCAL deleted, and MPOL_PREFERRED use the (possibly\nempty) nodes mask like everyone else, instead of its preferred_node\nvariant (I presume an optimization from the days before MPOL_LOCAL).\nBut that would take me too long to get right and fully tested.\n\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "711cf004f2148f1d1967bc5eca025019e5001212", "tree": "83ba439251b29610cc5ea1f6626d0190521769d9", "parents": [ "6cb6a94380506d9e5491b8e145811bd676ce6f3d" ], "author": { "name": "Sonny Rao", "email": "sonnyrao@chromium.org", "time": "Thu Dec 20 15:05:07 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:48 2013 -0800" }, "message": "mm: fix calculation of dirtyable memory\n\ncommit c8b74c2f6604923de91f8aa6539f8bb934736754 upstream.\n\nThe system uses global_dirtyable_memory() to calculate number of\ndirtyable pages/pages that can be allocated to the page cache. A bug\ncauses an underflow thus making the page count look like a big unsigned\nnumber. This in turn confuses the dirty writeback throttling to\naggressively write back pages as they become dirty (usually 1 page at a\ntime). This generally only affects systems with highmem because the\nunderflowed count gets subtracted from the global count of dirtyable\nmemory.\n\nThe problem was introduced with v3.2-4896-gab8fabd\n\nFix is to ensure we don\u0027t get an underflowed total of either highmem or\nglobal dirtyable memory.\n\nSigned-off-by: Sonny Rao \u003csonnyrao@chromium.org\u003e\nSigned-off-by: Puneet Kumar \u003cpuneetster@chromium.org\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nTested-by: Damien Wyart \u003cdamien.wyart@free.fr\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e8eebe90fb591b76950eff0238bf9b15717e02cc", "tree": "e10e9ef030b746dbf2f505685fa9bb71336e5494", "parents": [ "a88184417fb27c2f5482eb98d37c7f3664508d0c" ], "author": { "name": "Liam Mark", "email": "lmark@codeaurora.org", "time": "Fri Jan 04 09:40:11 2013 -0800" }, "committer": { "name": "Liam Mark", "email": "lmark@codeaurora.org", "time": "Fri Jan 04 10:09:06 2013 -0800" }, "message": "android/lowmemorykiller: Selectively count free CMA pages\n\nIn certain memory configurations there can be a large number of\nCMA pages which are not suitable to satisfy certain memory\nrequests.\n\nThis large number of unsuitable pages can cause the\nlowmemorykiller to not kill any tasks because the\nlowmemorykiller counts all free pages.\nIn order to ensure the lowmemorykiller properly evaluates the\nfree memory only count the free CMA pages if they are suitable\nfor satisfying the memory request.\n\nChange-Id: I7f06d53e2d8cfe7439e5561fe6e5209ce73b1c90\nCRs-fixed: 437016\nSigned-off-by: Liam Mark \u003clmark@codeaurora.org\u003e\n" }, { "commit": "733d861236661e6252afbb9ccb179d48f79334f3", "tree": "4edda9907fc715e98063a422b18ec1175423775f", "parents": [ "922b8422857516bf67a760a398327a96fbbfa6a9" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Mon Dec 17 18:33:37 2012 -0800" }, "committer": { "name": "Neha Pandey", "email": "nehap@codeaurora.org", "time": "Thu Dec 27 15:18:16 2012 -0800" }, "message": "mm: Use correct define for CMA features\n\nCMA features may ifdef out parts of the code with\nCONFIG_CMA. Older code uses CONFIG_DMA_CMA. Switch\nto using the newer CONFIG_CMA to ensure the code gets\ncompiled when needed.\n\nChange-Id: I3cae639797787b4926a6c5e057de973b66196707\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Neha Pandey \u003cnehap@codeaurora.org\u003e\n" }, { "commit": "922b8422857516bf67a760a398327a96fbbfa6a9", "tree": "693ead65bf39d2c97f122257b390a570869c3da2", "parents": [ "13afc1a418378a97ba455122c6f6f79e1048c5cb" ], "author": { "name": "Larry Bassel", "email": "lbassel@codeaurora.org", "time": "Fri Dec 14 14:21:05 2012 -0800" }, "committer": { "name": "Neha Pandey", "email": "nehap@codeaurora.org", "time": "Thu Dec 27 14:11:13 2012 -0800" }, "message": "mm: make counts of CMA free pages correct\n\nBoth patches needed, second patch (among other things) fixes\na bug in the first.\n\ncommit 2139cbe627b8910ded55148f87ee10f7485408ed\nAuthor: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nDate: Mon Oct 8 16:32:00 2012 -0700\n\n cma: fix counting of isolated pages\n\n Isolated free pages shouldn\u0027t be accounted to NR_FREE_PAGES counter. Fix\n it by properly decreasing/increasing NR_FREE_PAGES counter in\n set_migratetype_isolate()/unset_migratetype_isolate() and removing counter\n adjustment for isolated pages from free_one_page() and split_free_page().\n\n Signed-off-by: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\n Signed-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\n Cc: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\n Cc: Michal Nazarewicz \u003cmina86@mina86.com\u003e\n Cc: Minchan Kim \u003cminchan@kernel.org\u003e\n Cc: Mel Gorman \u003cmgorman@suse.de\u003e\n Cc: Hugh Dickins \u003chughd@google.com\u003e\n Signed-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n Signed-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n [lbassel@codeaurora.org: backport from 3.7, small changes needed]\n Signed-off-by: Larry Bassel \u003clbassel@codeaurora.org\u003e\n\ncommit d1ce749a0db12202b711d1aba1d29e823034648d\nAuthor: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nDate: Mon Oct 8 16:32:02 2012 -0700\n\n cma: count free CMA pages\n\n Add NR_FREE_CMA_PAGES counter to be later used for checking watermark in\n __zone_watermark_ok(). For simplicity and to avoid #ifdef hell make this\n counter always available (not only when CONFIG_CMA\u003dy).\n\n [akpm@linux-foundation.org: use conventional migratetype naming]\n Signed-off-by: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\n Signed-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\n Cc: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\n Cc: Michal Nazarewicz \u003cmina86@mina86.com\u003e\n Cc: Minchan Kim \u003cminchan@kernel.org\u003e\n Cc: Mel Gorman \u003cmgorman@suse.de\u003e\n Cc: Hugh Dickins \u003chughd@google.com\u003e\n Signed-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n Signed-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n [lbassel@codeaurora.org: backport from 3.7, small changes needed]\n Signed-off-by: Larry Bassel \u003clbassel@codeaurora.org\u003e\n\nChange-Id: I7d4f5fe0b6931192706337e0b730f43e7cccd031\nSigned-off-by: Larry Bassel \u003clbassel@codeaurora.org\u003e\nSigned-off-by: Neha Pandey \u003cnehap@codeaurora.org\u003e\n" }, { "commit": "ead8c6b3697c9d45c16ecad17e5b4101573767f9", "tree": "5d79b88f792e5ac5a027ae1197bebc196e4cd530", "parents": [ "d7ba8dff3e8afc83efe19c52ac7bd9ee2b65720b" ], "author": { "name": "Marek Szyprowski", "email": "m.szyprowski@samsung.com", "time": "Wed Nov 07 15:37:07 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 17 10:37:44 2012 -0800" }, "message": "mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls\n\ncommit 387870f2d6d679746020fa8e25ef786ff338dc98 upstream.\n\ndmapool always calls dma_alloc_coherent() with GFP_ATOMIC flag,\nregardless the flags provided by the caller. This causes excessive\npruning of emergency memory pools without any good reason. Additionaly,\non ARM architecture any driver which is using dmapools will sooner or\nlater trigger the following error:\n\"ERROR: 256 KiB atomic DMA coherent pool is too small!\nPlease increase it with coherent_pool\u003d kernel parameter!\".\nIncreasing the coherent pool size usually doesn\u0027t help much and only\ndelays such error, because all GFP_ATOMIC DMA allocations are always\nserved from the special, very limited memory pool.\n\nThis patch changes the dmapool code to correctly use gfp flags provided\nby the dmapool caller.\n\nReported-by: Soeren Moch \u003csmoch@web.de\u003e\nReported-by: Thomas Petazzoni \u003cthomas.petazzoni@free-electrons.com\u003e\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nTested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nTested-by: Soeren Moch \u003csmoch@web.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "78a685beb044864de000a6f7339bce57513172bb", "tree": "768425b1ce982640ddc3f4690ca9cd43dd6b1bb5", "parents": [ "b947fcbcca85da6ad3ec79f6aa86b550f458e049" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Wed Dec 05 14:01:41 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 17 10:37:42 2012 -0800" }, "message": "tmpfs: fix shared mempolicy leak\n\ncommit 18a2f371f5edf41810f6469cb9be39931ef9deb9 upstream.\n\nThis fixes a regression in 3.7-rc, which has since gone into stable.\n\nCommit 00442ad04a5e (\"mempolicy: fix a memory corruption by refcount\nimbalance in alloc_pages_vma()\") changed get_vma_policy() to raise the\nrefcount on a shmem shared mempolicy; whereas shmem_alloc_page() went\non expecting alloc_page_vma() to drop the refcount it had acquired.\nThis deserves a rework: but for now fix the leak in shmem_alloc_page().\n\nHugh: shmem_swapin() did not need a fix, but surely it\u0027s clearer to use\nthe same refcounting there as in shmem_alloc_page(), delete its onstack\nmempolicy, and the strange mpol_cond_copy() and __mpol_cond_copy() -\nthose were invented to let swapin_readahead() make an unknown number of\ncalls to alloc_pages_vma() with one mempolicy; but since 00442ad04a5e,\nalloc_pages_vma() has kept refcount in balance, so now no problem.\n\nReported-and-tested-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "70b7280939672e434a6e2536a9a36f4dafc17934", "tree": "8e1632a6ea5252d7ce556de3be828f2606c4d345", "parents": [ "afb2a33921982599d247a46b2306c75a4b69064b" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Fri Nov 30 14:07:01 2012 -0800" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:17 2012 -0800" }, "message": "mm: Use aligned zone start for pfn_to_bitidx calculation\n\nThe current calculation in pfn_to_bitidx assumes that\n(pfn - zone-\u003ezone_start_pfn) \u003e\u003e pageblock_order will return the\nsame bit for all pfn in a pageblock. If zone_start_pfn is not\naligned to pageblock_nr_pages, this may not always be correct.\n\nConsider the following with pageblock order \u003d 10, zone start 2MB:\n\npfn | pfn - zone start | (pfn - zone start) \u003e\u003e page block order\n----------------------------------------------------------------\n0x26000 | 0x25e00\t | 0x97\n0x26100 | 0x25f00\t | 0x97\n0x26200 | 0x26000\t | 0x98\n0x26300 | 0x26100\t | 0x98\n\nThis means that calling {get,set}_pageblock_migratetype on a single\npage will not set the migratetype for the full block. Fix this by\nrounding down zone_start_pfn when doing the bitidx calculation.\n\nChange-Id: I13e2f53f50db294f38ec86138c17c6fe29f0ee82\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "d3c11452319e8e958cc7485fa78d7737429323dd", "tree": "4f25f8d653217a3f61532e99187f4e8543c5f1ff", "parents": [ "c21a803d13f8f03d10a4b70e80408b99645d9efa" ], "author": { "name": "Minchan Kim", "email": "minchan.kim@gmail.com", "time": "Fri May 11 09:37:13 2012 +0200" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:15 2012 -0800" }, "message": "cma: fix migration mode\n\n__alloc_contig_migrate_range calls migrate_pages with wrong argument\nfor migrate_mode. Fix it.\n\nChange-Id: I84697cf7c6aef6253e9ee7e5b3028c946b95e253\nCc: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nSigned-off-by: Minchan Kim \u003cminchan@kernel.org\u003e\nAcked-by: Michal Nazarewicz \u003cmina86@mina86.com\u003e\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "c21a803d13f8f03d10a4b70e80408b99645d9efa", "tree": "a2d7da6a22e64724de6eb6ccb526ff23eb83c052", "parents": [ "926c5240503f037ba0d5f45b6673487a4ec6bd18" ], "author": { "name": "woojoong.lee", "email": "woojoong.lee@samsung.com", "time": "Mon Dec 03 17:58:43 2012 -0800" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:15 2012 -0800" }, "message": "cma : use migrate_prep() instead of migrate_prep_local()\n\n__alloc_contig_migrate_range() should use all possible ways to get all the\npages migrated from the given memory range, so pruning per-cpu lru lists\nfor all CPUs is required, regadless the cost of such operation. Otherwise\nsome pages which got stuck at per-cpu lru list might get missed by\nmigration procedure causing the contiguous allocation to fail.\n\nChange-Id: I70cc0864c57dd49e89f57797122a3fd0f300647a\nSigned-off-by: woojoong.lee \u003cwoojoong.lee@samsung.com\u003e\nReviewed-on: http://165.213.202.130:8080/43063\nTested-by: System S/W SCM \u003cscm.systemsw@samsung.com\u003e\nReviewed-by: daeho jeong \u003cdaeho.jeong@samsung.com\u003e\nReviewed-by: Jeong-Ho Kim \u003cjammer@samsung.com\u003e\nTested-by: Jeong-Ho Kim \u003cjammer@samsung.com\u003e\n[lauraa@codeaurora.org: Applied to correct file]\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "926c5240503f037ba0d5f45b6673487a4ec6bd18", "tree": "a05055556ef818570aec12318cc677e145d485ca", "parents": [ "2dc518e5ebceb877016e7189b27e5506cb67c2ed" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Tue Nov 27 10:17:24 2012 -0800" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:14 2012 -0800" }, "message": "mm: Add is_cma_pageblock definition\n\nBring back the is_cma_pageblock definition for determining if a\npage is CMA or not.\n\nChange-Id: I39fd546e22e240b752244832c79514f109c8e84b\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "2dc518e5ebceb877016e7189b27e5506cb67c2ed", "tree": "16cbe592362825a2c1586a8db4ae324e7dcaf4f1", "parents": [ "039f2980c4f82d1b1c3e174ceaa56d514caffe35" ], "author": { "name": "Liam Mark", "email": "lmark@codeaurora.org", "time": "Tue Nov 27 18:49:58 2012 -0800" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:13 2012 -0800" }, "message": "mm: split_free_page ignore memory watermarks for CMA\n\nMemory watermarks were sometimes preventing CMA allocations\nin low memory.\n\nChange-Id: I550ec987cbd6bc6dadd72b4a764df20cd0758479\nSigned-off-by: Liam Mark \u003clmark@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "039f2980c4f82d1b1c3e174ceaa56d514caffe35", "tree": "e64572ca200b2db400917574afe10d811ddb8928", "parents": [ "630920b02b470e77b2832286f3791dbb43f4bc57" ], "author": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Thu Nov 29 16:22:01 2012 -0800" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:13 2012 -0800" }, "message": "mm: Don\u0027t use CMA pages for writes\n\nIf CMA pages are used for writes, the writes may not complete\nfast enough for CMA to be allocated within a reasonable amount\nof time. If we get a CMA page, get another one to use instead.\n\nChange-Id: I19d8ba655da7525d68d5947337d500566998971c\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "630920b02b470e77b2832286f3791dbb43f4bc57", "tree": "bf9d1e9bf20c0f5d0ecd2ee731908194c28514ef", "parents": [ "5249a0554b29373a26f5f6bf7e19124a2bab143d" ], "author": { "name": "Heesub Shin", "email": "heesub.shin@samsung.com", "time": "Mon Dec 03 17:55:40 2012 -0800" }, "committer": { "name": "Mitchel Humpherys", "email": "mitchelh@codeaurora.org", "time": "Tue Dec 11 21:45:12 2012 -0800" }, "message": "cma: fix race condition on a page\n\ncruel, brute-force method for letting cma/migration to\nfinish its job without stealing the lock\nmigration_entry_wait() and creating a live-lock on the\nfaulted page. This patch solves the case of\npage-\u003e_count \u003d\u003d 2 migration failure.\n\nChange-Id: Ia94542a80e44a213831291af289bbf5ee6880bfd\nSigned-off-by: Heesub Shin \u003cheesub.shin@samsung.com\u003e\nReviewed-on: http://165.213.202.130:8080/39341\nTested-by: System S/W SCM \u003cscm.systemsw@samsung.com\u003e\nTested-by: Dongjun Shin \u003cd.j.shin@samsung.com\u003e\nReviewed-by: Hyunju Ahn \u003chyunju.ahn@samsung.com\u003e\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\n" }, { "commit": "0b4d372b78bef8ebbccca2e310973b550f1dc6f2", "tree": "ad53e26e09c054420a6f0c31c15b70d5dd433d9e", "parents": [ "25a30e7cc1562e110c401f286f41c801d80b2b0a" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Thu Nov 29 13:54:34 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 10 10:59:39 2012 -0800" }, "message": "mm: soft offline: split thp at the beginning of soft_offline_page()\n\ncommit 783657a7dc20e5c0efbc9a09a9dd38e238a723da upstream.\n\nWhen we try to soft-offline a thp tail page, put_page() is called on the\ntail page unthinkingly and VM_BUG_ON is triggered in put_compound_page().\n\nThis patch splits thp before going into the main body of soft-offlining.\n\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Tony Luck \u003ctony.luck@intel.com\u003e\nCc: Andi Kleen \u003candi.kleen@intel.com\u003e\nCc: Wu Fengguang \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "25a30e7cc1562e110c401f286f41c801d80b2b0a", "tree": "d1b916128ce5937deab743bdfd587f7a886e2270", "parents": [ "86d80959eb81b931a509fe9ea78b31f319882637" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@huawei.com", "time": "Thu Nov 29 13:54:21 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 10 10:59:39 2012 -0800" }, "message": "mm/vmemmap: fix wrong use of virt_to_page\n\ncommit ae64ffcac35de0db628ba9631edf8ff34c5cd7ac upstream.\n\nI enable CONFIG_DEBUG_VIRTUAL and CONFIG_SPARSEMEM_VMEMMAP, when doing\nmemory hotremove, there is a kernel BUG at arch/x86/mm/physaddr.c:20.\n\nIt is caused by free_section_usemap()-\u003evirt_to_page(), virt_to_page() is\nonly used for kernel direct mapping address, but sparse-vmemmap uses\nvmemmap address, so it is going wrong here.\n\n ------------[ cut here ]------------\n kernel BUG at arch/x86/mm/physaddr.c:20!\n invalid opcode: 0000 [#1] SMP\n Modules linked in: acpihp_drv acpihp_slot edd cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq mperf fuse vfat fat loop dm_mod coretemp kvm crc32c_intel ipv6 ixgbe igb iTCO_wdt i7core_edac edac_core pcspkr iTCO_vendor_support ioatdma microcode joydev sr_mod i2c_i801 dca lpc_ich mfd_core mdio tpm_tis i2c_core hid_generic tpm cdrom sg tpm_bios rtc_cmos button ext3 jbd mbcache usbhid hid uhci_hcd ehci_hcd usbcore usb_common sd_mod crc_t10dif processor thermal_sys hwmon scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh_emc scsi_dh ata_generic ata_piix libata megaraid_sas scsi_mod\n CPU 39\n Pid: 6454, comm: sh Not tainted 3.7.0-rc1-acpihp-final+ #45 QCI QSSC-S4R/QSSC-S4R\n RIP: 0010:[\u003cffffffff8103c908\u003e] [\u003cffffffff8103c908\u003e] __phys_addr+0x88/0x90\n RSP: 0018:ffff8804440d7c08 EFLAGS: 00010006\n RAX: 0000000000000006 RBX: ffffea0012000000 RCX: 000000000000002c\n ...\n\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nReviewd-by: Wen Congyang \u003cwency@cn.fujitsu.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReviewed-by: Yasuaki Ishimatsu \u003cisimatu.yasuaki@jp.fujitsu.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ec5924204b7fa09a679c4456ac8e2176a2950ce6", "tree": "b2e8878d42c734b9004f5d5ced95e4160abcede1", "parents": [ "f86c309e326f800e8fb028df35051aac5a26ef8d" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Fri Nov 16 14:15:04 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:37:47 2012 -0800" }, "message": "tmpfs: change final i_blocks BUG to WARNING\n\ncommit 0f3c42f522dc1ad7e27affc0a4aa8c790bce0a66 upstream.\n\nUnder a particular load on one machine, I have hit shmem_evict_inode()\u0027s\nBUG_ON(inode-\u003ei_blocks), enough times to narrow it down to a particular\nrace between swapout and eviction.\n\nIt comes from the \"if (freed \u003e 0)\" asymmetry in shmem_recalc_inode(),\nand the lack of coherent locking between mapping\u0027s nrpages and shmem\u0027s\nswapped count. There\u0027s a window in shmem_writepage(), between lowering\nnrpages in shmem_delete_from_page_cache() and then raising swapped\ncount, when the freed count appears to be +1 when it should be 0, and\nthen the asymmetry stops it from being corrected with -1 before hitting\nthe BUG.\n\nOne answer is coherent locking: using tree_lock throughout, without\ninfo-\u003elock; reasonable, but the raw_spin_lock in percpu_counter_add() on\nused_blocks makes that messier than expected. Another answer may be a\nfurther effort to eliminate the weird shmem_recalc_inode() altogether,\nbut previous attempts at that failed.\n\nSo far undecided, but for now change the BUG_ON to WARN_ON: in usual\ncircumstances it remains a useful consistency check.\n\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "e5c4ee6a081ec04e8ba54b00a4385391ab77e2f8", "tree": "dc0fca050cef42f6f670ef441a8db2b5085b9b85", "parents": [ "9098e8785685bd245027447b5628fa872babd3b8" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.cz", "time": "Fri Nov 16 14:14:49 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:37:45 2012 -0800" }, "message": "memcg: oom: fix totalpages calculation for memory.swappiness\u003d\u003d0\n\ncommit 9a5a8f19b43430752067ecaee62fc59e11e88fa6 upstream.\n\noom_badness() takes a totalpages argument which says how many pages are\navailable and it uses it as a base for the score calculation. The value\nis calculated by mem_cgroup_get_limit which considers both limit and\ntotal_swap_pages (resp. memsw portion of it).\n\nThis is usually correct but since fe35004fbf9e (\"mm: avoid swapping out\nwith swappiness\u003d\u003d0\") we do not swap when swappiness is 0 which means\nthat we cannot really use up all the totalpages pages. This in turn\nconfuses oom score calculation if the memcg limit is much smaller than\nthe available swap because the used memory (capped by the limit) is\nnegligible comparing to totalpages so the resulting score is too small\nif adj!\u003d0 (typically task with CAP_SYS_ADMIN or non zero oom_score_adj).\nA wrong process might be selected as result.\n\nThe problem can be worked around by checking mem_cgroup_swappiness\u003d\u003d0\nand not considering swap at all in such a case.\n\nSigned-off-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3f874ecc49208f3635e29c3a08ade01778ad85e4", "tree": "13a274853bac30e5a564bcc42a26e2ec585bbbd6", "parents": [ "16286083befef95045f84ecc10f19b1a14fc7283" ], "author": { "name": "Takamori Yamaguchi", "email": "takamori.yamaguchi@jp.sony.com", "time": "Thu Nov 08 15:53:39 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:37:19 2012 -0800" }, "message": "mm: bugfix: set current-\u003ereclaim_state to NULL while returning from kswapd()\n\ncommit b0a8cc58e6b9aaae3045752059e5e6260c0b94bc upstream.\n\nIn kswapd(), set current-\u003ereclaim_state to NULL before returning, as\ncurrent-\u003ereclaim_state holds reference to variable on kswapd()\u0027s stack.\n\nIn rare cases, while returning from kswapd() during memory offlining,\n__free_slab() and freepages() can access the dangling pointer of\ncurrent-\u003ereclaim_state.\n\nSigned-off-by: Takamori Yamaguchi \u003ctakamori.yamaguchi@jp.sony.com\u003e\nSigned-off-by: Aaditya Kumar \u003caaditya.kumar@ap.sony.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "71a36b53c81c3ecd1359af68ca4373e7d941a4c5", "tree": "f353a1e4b1dd04048c64ab6ecce786d3825d6b2d", "parents": [ "368845fde9e704288f370df57988767aab6042b4" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 25 13:37:31 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:56 2012 -0700" }, "message": "mm: fix XFS oops due to dirty pages without buffers on s390\n\ncommit ef5d437f71afdf4afdbab99213add99f4b1318fd upstream.\n\nOn s390 any write to a page (even from kernel itself) sets architecture\nspecific page dirty bit. Thus when a page is written to via buffered\nwrite, HW dirty bit gets set and when we later map and unmap the page,\npage_remove_rmap() finds the dirty bit and calls set_page_dirty().\n\nDirtying of a page which shouldn\u0027t be dirty can cause all sorts of\nproblems to filesystems. The bug we observed in practice is that\nbuffers from the page get freed, so when the page gets later marked as\ndirty and writeback writes it, XFS crashes due to an assertion\nBUG_ON(!PagePrivate(page)) in page_buffers() called from\nxfs_count_page_state().\n\nSimilar problem can also happen when zero_user_segment() call from\nxfs_vm_writepage() (or block_write_full_page() for that matter) set the\nhardware dirty bit during writeback, later buffers get freed, and then\npage unmapped.\n\nFix the issue by ignoring s390 HW dirty bit for page cache pages of\nmappings with mapping_cap_account_dirty(). This is safe because for\nsuch mappings when a page gets marked as writeable in PTE it is also\nmarked dirty in do_wp_page() or do_page_fault(). When the dirty bit is\ncleared by clear_page_dirty_for_io(), the page gets writeprotected in\npage_mkclean(). So pagecache page is writeable if and only if it is\ndirty.\n\nThanks to Hugh Dickins for pointing out mapping has to have\nmapping_cap_account_dirty() for things to work and proposing a cleaned\nup variant of the patch.\n\nThe patch has survived about two hours of running fsx-linux on tmpfs\nwhile heavily swapping and several days of running on out build machines\nwhere the original problem was triggered.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "368845fde9e704288f370df57988767aab6042b4", "tree": "0ba42c19ff563daa24bdc08c2c1d7cf3bbaabd7d", "parents": [ "c87ece5a158f3907193202d84f2a316a4c363768" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Mon Oct 22 16:35:18 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Oct 31 10:02:56 2012 -0700" }, "message": "x86, mm: Trim memory in memblock to be page aligned\n\ncommit 6ede1fd3cb404c0016de6ac529df46d561bd558b upstream.\n\nWe will not map partial pages, so need to make sure memblock\nallocation will not allocate those bytes out.\n\nAlso we will use for_each_mem_pfn_range() to loop to map memory\nrange to keep them consistent.\n\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nLink: http://lkml.kernel.org/r/CAE9FiQVZirvaBMFYRfXMmWEcHbKSicQEHz4VAwUv0xFCk51ZNw@mail.gmail.com\nAcked-by: Jacob Shin \u003cjacob.shin@amd.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "530258fceacd8c17075906c648c1ba20928c940b", "tree": "6adac17cf54efdc5e000c5c2b22fee2a59b4e6a8", "parents": [ "fb2ca533f518dabf814c6aab3b7ce3c236959a68" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Sun Oct 07 20:32:51 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:27:57 2012 -0700" }, "message": "tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking\n\ncommit 35c2a7f4908d404c9124c2efc6ada4640ca4d5d5 upstream.\n\nFuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),\n\tu64 inum \u003d fid-\u003eraw[2];\nwhich is unhelpfully reported as at the end of shmem_alloc_inode():\n\nBUG: unable to handle kernel paging request at ffff880061cd3000\nIP: [\u003cffffffff812190d0\u003e] shmem_alloc_inode+0x40/0x40\nOops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\nCall Trace:\n [\u003cffffffff81488649\u003e] ? exportfs_decode_fh+0x79/0x2d0\n [\u003cffffffff812d77c3\u003e] do_handle_open+0x163/0x2c0\n [\u003cffffffff812d792c\u003e] sys_open_by_handle_at+0xc/0x10\n [\u003cffffffff83a5f3f8\u003e] tracesys+0xe1/0xe6\n\nRight, tmpfs is being stupid to access fid-\u003eraw[2] before validating that\nfh_len includes it: the buffer kmalloc\u0027ed by do_sys_name_to_handle() may\nfall at the end of a page, and the next page not be present.\n\nBut some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being\ncareless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and\ncould oops in the same way: add the missing fh_len checks to those.\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Sage Weil \u003csage@inktank.com\u003e\nCc: Steven Whitehouse \u003cswhiteho@redhat.com\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d9302b128e4640df707c99335b3f3ad0e13d0148", "tree": "49e55a194b48cd0f94ede0c18154102127639796", "parents": [ "04ea8a8388992ad12bc1b32cc16f4220300ea167" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Mon Oct 08 16:29:20 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:57 2012 +0900" }, "message": "mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma()\n\ncommit 00442ad04a5eac08a98255697c510e708f6082e2 upstream.\n\nCommit cc9a6c877661 (\"cpuset: mm: reduce large amounts of memory barrier\nrelated damage v3\") introduced a potential memory corruption.\nshmem_alloc_page() uses a pseudo vma and it has one significant unique\ncombination, vma-\u003evm_ops\u003dNULL and vma-\u003epolicy-\u003eflags \u0026 MPOL_F_SHARED.\n\nget_vma_policy() does NOT increase a policy ref when vma-\u003evm_ops\u003dNULL\nand mpol_cond_put() DOES decrease a policy ref when a policy has\nMPOL_F_SHARED. Therefore, when a cpuset update race occurs,\nalloc_pages_vma() falls in \u0027goto retry_cpuset\u0027 path, decrements the\nreference count and frees the policy prematurely.\n\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nReviewed-by: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "04ea8a8388992ad12bc1b32cc16f4220300ea167", "tree": "5f043e7c716903e12b7d43a7a0caa4d7b9eb5b75", "parents": [ "04a30bd9dccbeee2cc6b035e42a37e9be0fa8c6c" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Oct 08 16:29:19 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:57 2012 +0900" }, "message": "mempolicy: fix refcount leak in mpol_set_shared_policy()\n\ncommit 63f74ca21f1fad36d075e063f06dcc6d39fe86b2 upstream.\n\nWhen shared_policy_replace() fails to allocate new-\u003epolicy is not freed\ncorrectly by mpol_set_shared_policy(). The problem is that shared\nmempolicy code directly call kmem_cache_free() in multiple places where\nit is easy to make a mistake.\n\nThis patch creates an sp_free wrapper function and uses it. The bug was\nintroduced pre-git age (IOW, before 2.6.12-rc2).\n\n[mgorman@suse.de: Editted changelog]\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nReviewed-by: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "04a30bd9dccbeee2cc6b035e42a37e9be0fa8c6c", "tree": "8b8c631b4b951e9a1676464c8f033143b979f7ed", "parents": [ "33efe2910bf7865a7d1fba4b06c9fa4b6fda6856" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Mon Oct 08 16:29:17 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:56 2012 +0900" }, "message": "mempolicy: fix a race in shared_policy_replace()\n\ncommit b22d127a39ddd10d93deee3d96e643657ad53a49 upstream.\n\nshared_policy_replace() use of sp_alloc() is unsafe. 1) sp_node cannot\nbe dereferenced if sp-\u003elock is not held and 2) another thread can modify\nsp_node between spin_unlock for allocating a new sp node and next\nspin_lock. The bug was introduced before 2.6.12-rc2.\n\nKosaki\u0027s original patch for this problem was to allocate an sp node and\npolicy within shared_policy_replace and initialise it when the lock is\nreacquired. I was not keen on this approach because it partially\nduplicates sp_alloc(). As the paths were sp-\u003elock is taken are not that\nperformance critical this patch converts sp-\u003elock to sp-\u003emutex so it can\nsleep when calling sp_alloc().\n\n[kosaki.motohiro@jp.fujitsu.com: Original patch]\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nReviewed-by: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "33efe2910bf7865a7d1fba4b06c9fa4b6fda6856", "tree": "2f888a8c23ba8bf9f831253e49cd696497fbc888", "parents": [ "14cfd9f986d521f3f97139fa2ae5db67886059d1" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@jp.fujitsu.com", "time": "Mon Oct 08 16:29:16 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:56 2012 +0900" }, "message": "mempolicy: remove mempolicy sharing\n\ncommit 869833f2c5c6e4dd09a5378cfc665ffb4615e5d2 upstream.\n\nDave Jones\u0027 system call fuzz testing tool \"trinity\" triggered the\nfollowing bug error with slab debugging enabled\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG numa_policy (Not tainted): Poison overwritten\n -----------------------------------------------------------------------------\n\n INFO: 0xffff880146498250-0xffff880146498250. First byte 0x6a instead of 0x6b\n INFO: Allocated in mpol_new+0xa3/0x140 age\u003d46310 cpu\u003d6 pid\u003d32154\n __slab_alloc+0x3d3/0x445\n kmem_cache_alloc+0x29d/0x2b0\n mpol_new+0xa3/0x140\n sys_mbind+0x142/0x620\n system_call_fastpath+0x16/0x1b\n\n INFO: Freed in __mpol_put+0x27/0x30 age\u003d46268 cpu\u003d6 pid\u003d32154\n __slab_free+0x2e/0x1de\n kmem_cache_free+0x25a/0x260\n __mpol_put+0x27/0x30\n remove_vma+0x68/0x90\n exit_mmap+0x118/0x140\n mmput+0x73/0x110\n exit_mm+0x108/0x130\n do_exit+0x162/0xb90\n do_group_exit+0x4f/0xc0\n sys_exit_group+0x17/0x20\n system_call_fastpath+0x16/0x1b\n\n INFO: Slab 0xffffea0005192600 objects\u003d27 used\u003d27 fp\u003d0x (null) flags\u003d0x20000000004080\n INFO: Object 0xffff880146498250 @offset\u003d592 fp\u003d0xffff88014649b9d0\n\nThe problem is that the structure is being prematurely freed due to a\nreference count imbalance. In the following case mbind(addr, len) should\nreplace the memory policies of both vma1 and vma2 and thus they will\nbecome to share the same mempolicy and the new mempolicy will have the\nMPOL_F_SHARED flag.\n\n +-------------------+-------------------+\n | vma1 | vma2(shmem) |\n +-------------------+-------------------+\n | |\n addr addr+len\n\nalloc_pages_vma() uses get_vma_policy() and mpol_cond_put() pair for\nmaintaining the mempolicy reference count. The current rule is that\nget_vma_policy() only increments refcount for shmem VMA and\nmpol_conf_put() only decrements refcount if the policy has\nMPOL_F_SHARED.\n\nIn above case, vma1 is not shmem vma and vma-\u003epolicy has MPOL_F_SHARED!\nThe reference count will be decreased even though was not increased\nwhenever alloc_page_vma() is called. This has been broken since commit\n[52cd3b07: mempolicy: rework mempolicy Reference Counting] in 2008.\n\nThere is another serious bug with the sharing of memory policies.\nCurrently, mempolicy rebind logic (it is called from cpuset rebinding)\nignores a refcount of mempolicy and override it forcibly. Thus, any\nmempolicy sharing may cause mempolicy corruption. The bug was\nintroduced by commit [68860ec1: cpusets: automatic numa mempolicy\nrebinding].\n\nIdeally, the shared policy handling would be rewritten to either\nproperly handle COW of the policy structures or at least reference count\nMPOL_F_SHARED based exclusively on information within the policy.\nHowever, this patch takes the easier approach of disabling any policy\nsharing between VMAs. Each new range allocated with sp_alloc will\nallocate a new policy, set the reference count to 1 and drop the\nreference count of the old policy. This increases the memory footprint\nbut is not expected to be a major problem as mbind() is unlikely to be\nused for fine-grained ranges. It is also inefficient because it means\nwe allocate a new policy even in cases where mbind_range() could use the\nnew_policy passed to it. However, it is more straight-forward and the\nchange should be invisible to the user.\n\n[mgorman@suse.de: Edited changelog]\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nReviewed-by: Christoph Lameter \u003ccl@linux.com\u003e\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "14cfd9f986d521f3f97139fa2ae5db67886059d1", "tree": "ecef4bf5f2993d525f676b56ae025125fe1036a6", "parents": [ "160f00fefef1e5b72be0745236d2b65d14b99ed4" ], "author": { "name": "KOSAKI Motohiro", "email": "kosaki.motohiro@gmail.com", "time": "Mon Oct 08 16:29:14 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:56 2012 +0900" }, "message": "revert \"mm: mempolicy: Let vma_merge and vma_split handle vma-\u003evm_policy linkages\"\n\ncommit 8d34694c1abf29df1f3c7317936b7e3e2e308d9b upstream.\n\nCommit 05f144a0d5c2 (\"mm: mempolicy: Let vma_merge and vma_split handle\nvma-\u003evm_policy linkages\") removed vma-\u003evm_policy updates code but it is\nthe purpose of mbind_range(). Now, mbind_range() is virtually a no-op\nand while it does not allow memory corruption it is not the right fix.\nThis patch is a revert.\n\n[mgorman@suse.de: Edited changelog]\nSigned-off-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Josh Boyer \u003cjwboyer@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6a91e161a7f1b0125822b1693ea8fe46035b0f1b", "tree": "3da8bf0963f0c9294610ea274d1d9fea6b787aae", "parents": [ "26fc07d8da4aa118cfe44776c2d2ddef8ef5f641" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Mon Oct 08 16:33:14 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:51 2012 +0900" }, "message": "mm: fix invalidate_complete_page2() lock ordering\n\ncommit ec4d9f626d5908b6052c2973f37992f1db52e967 upstream.\n\nIn fuzzing with trinity, lockdep protested \"possible irq lock inversion\ndependency detected\" when isolate_lru_page() reenabled interrupts while\nstill holding the supposedly irq-safe tree_lock:\n\ninvalidate_inode_pages2\n invalidate_complete_page2\n spin_lock_irq(\u0026mapping-\u003etree_lock)\n clear_page_mlock\n isolate_lru_page\n spin_unlock_irq(\u0026zone-\u003elru_lock)\n\nisolate_lru_page() is correct to enable interrupts unconditionally:\ninvalidate_complete_page2() is incorrect to call clear_page_mlock() while\nholding tree_lock, which is supposed to nest inside lru_lock.\n\nBoth truncate_complete_page() and invalidate_complete_page() call\nclear_page_mlock() before taking tree_lock to remove page from radix_tree.\n I guess invalidate_complete_page2() preferred to test PageDirty (again)\nunder tree_lock before committing to the munlock; but since the page has\nalready been unmapped, its state is already somewhat inconsistent, and no\nworse if clear_page_mlock() moved up.\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nDeciphered-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Ying Han \u003cyinghan@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "26fc07d8da4aa118cfe44776c2d2ddef8ef5f641", "tree": "733486cf1bf258f6373ec7f005d27e36d726bb60", "parents": [ "70fb727d0900836b71ebf7a7badaa7b7c9068102" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.cz", "time": "Mon Oct 08 16:33:31 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:50 2012 +0900" }, "message": "hugetlb: do not use vma_hugecache_offset() for vma_prio_tree_foreach\n\ncommit 36e4f20af833d1ce196e6a4ade05dc26c44652d1 upstream.\n\nCommit 0c176d52b0b2 (\"mm: hugetlb: fix pgoff computation when unmapping\npage from vma\") fixed pgoff calculation but it has replaced it by\nvma_hugecache_offset() which is not approapriate for offsets used for\nvma_prio_tree_foreach() because that one expects index in page units\nrather than in huge_page_shift.\n\nJohannes said:\n\n: The resulting index may not be too big, but it can be too small: assume\n: hpage size of 2M and the address to unmap to be 0x200000. This is regular\n: page index 512 and hpage index 1. If you have a VMA that maps the file\n: only starting at the second huge page, that VMAs vm_pgoff will be 512 but\n: you ask for offset 1 and miss it even though it does map the page of\n: interest. hugetlb_cow() will try to unmap, miss the vma, and retry the\n: cow until the allocation succeeds or the skipped vma(s) go away.\n\nSigned-off-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nAcked-by: Hillf Danton \u003cdhillf@gmail.com\u003e\nCc: Mel Gorman \u003cmel@csn.ul.ie\u003e\nCc: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "750025ab1950b5e32e308c446de32c399cf2d6f6", "tree": "4c3abc9b042fae866b187b2b69810585d9cd1be8", "parents": [ "4893cf612a68d26cdbe0e16ba9c42772136e2340" ], "author": { "name": "Michael Wang", "email": "wangyun@linux.vnet.ibm.com", "time": "Wed Sep 05 10:33:18 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 13 05:38:37 2012 +0900" }, "message": "slab: fix the DEADLOCK issue on l3 alien lock\n\ncommit 947ca1856a7e60aa6d20536785e6a42dff25aa6e upstream.\n\nDEADLOCK will be report while running a kernel with NUMA and LOCKDEP enabled,\nthe process of this fake report is:\n\n\t kmem_cache_free()\t//free obj in cachep\n\t-\u003e cache_free_alien()\t//acquire cachep\u0027s l3 alien lock\n\t-\u003e __drain_alien_cache()\n\t-\u003e free_block()\n\t-\u003e slab_destroy()\n\t-\u003e kmem_cache_free()\t//free slab in cachep-\u003eslabp_cache\n\t-\u003e cache_free_alien()\t//acquire cachep-\u003eslabp_cache\u0027s l3 alien lock\n\nSince the cachep and cachep-\u003eslabp_cache\u0027s l3 alien are in the same lock class,\nfake report generated.\n\nThis should not happen since we already have init_lock_keys() which will\nreassign the lock class for both l3 list and l3 alien.\n\nHowever, init_lock_keys() was invoked at a wrong position which is before we\ninvoke enable_cpucache() on each cache.\n\nSince until set slab_state to be FULL, we won\u0027t invoke enable_cpucache()\non caches to build their l3 alien while creating them, so although we invoked\ninit_lock_keys(), the l3 alien lock class won\u0027t change since we don\u0027t have\nthem until invoked enable_cpucache() later.\n\nThis patch will invoke init_lock_keys() after we done enable_cpucache()\ninstead of before to avoid the fake DEADLOCK report.\n\nMichael traced the problem back to a commit in release 3.0.0:\n\ncommit 30765b92ada267c5395fc788623cb15233276f5c\nAuthor: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nDate: Thu Jul 28 23:22:56 2011 +0200\n\n slab, lockdep: Annotate the locks before using them\n\n Fernando found we hit the regular OFF_SLAB \u0027recursion\u0027 before we\n annotate the locks, cure this.\n\n The relevant portion of the stack-trace:\n\n \u003e [ 0.000000] [\u003cc085e24f\u003e] rt_spin_lock+0x50/0x56\n \u003e [ 0.000000] [\u003cc04fb406\u003e] __cache_free+0x43/0xc3\n \u003e [ 0.000000] [\u003cc04fb23f\u003e] kmem_cache_free+0x6c/0xdc\n \u003e [ 0.000000] [\u003cc04fb2fe\u003e] slab_destroy+0x4f/0x53\n \u003e [ 0.000000] [\u003cc04fb396\u003e] free_block+0x94/0xc1\n \u003e [ 0.000000] [\u003cc04fc551\u003e] do_tune_cpucache+0x10b/0x2bb\n \u003e [ 0.000000] [\u003cc04fc8dc\u003e] enable_cpucache+0x7b/0xa7\n \u003e [ 0.000000] [\u003cc0bd9d3c\u003e] kmem_cache_init_late+0x1f/0x61\n \u003e [ 0.000000] [\u003cc0bba687\u003e] start_kernel+0x24c/0x363\n \u003e [ 0.000000] [\u003cc0bba0ba\u003e] i386_start_kernel+0xa9/0xaf\n\n Reported-by: Fernando Lopez-Lezcano \u003cnando@ccrma.Stanford.EDU\u003e\n Acked-by: Pekka Enberg \u003cpenberg@kernel.org\u003e\n Signed-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\n Link: http://lkml.kernel.org/r/1311888176.2617.379.camel@laptop\n Signed-off-by: Ingo Molnar \u003cmingo@elte.hu\u003e\n\nThe commit moved init_lock_keys() before we build up the alien, so we\nfailed to reclass it.\n\nAcked-by: Christoph Lameter \u003ccl@linux.com\u003e\nTested-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Michael Wang \u003cwangyun@linux.vnet.ibm.com\u003e\nSigned-off-by: Pekka Enberg \u003cpenberg@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "49194d4e7d8c14fb83f213c54a476685f8389c70", "tree": "a773acfde98ebc23d3ecd56067e2e31a5f0bcbb3", "parents": [ "642550436c8b3a933550468996ef547630344a0e" ], "author": { "name": "Satoru Moriya", "email": "satoru.moriya@hds.com", "time": "Tue May 29 15:06:47 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:38 2012 -0700" }, "message": "mm: avoid swapping out with swappiness\u003d\u003d0\n\ncommit fe35004fbf9eaf67482b074a2e032abb9c89b1dd upstream.\n\nSometimes we\u0027d like to avoid swapping out anonymous memory. In\nparticular, avoid swapping out pages of important process or process\ngroups while there is a reasonable amount of pagecache on RAM so that we\ncan satisfy our customers\u0027 requirements.\n\nOTOH, we can control how aggressive the kernel will swap memory pages with\n/proc/sys/vm/swappiness for global and\n/sys/fs/cgroup/memory/memory.swappiness for each memcg.\n\nBut with current reclaim implementation, the kernel may swap out even if\nwe set swappiness\u003d0 and there is pagecache in RAM.\n\nThis patch changes the behavior with swappiness\u003d\u003d0. If we set\nswappiness\u003d\u003d0, the kernel does not swap out completely (for global reclaim\nuntil the amount of free pages and filebacked pages in a zone has been\nreduced to something very very small (nr_free + nr_filebacked \u003c high\nwatermark)).\n\nSigned-off-by: Satoru Moriya \u003csatoru.moriya@hds.com\u003e\nAcked-by: Minchan Kim \u003cminchan@kernel.org\u003e\nReviewed-by: Rik van Riel \u003criel@redhat.com\u003e\nAcked-by: Jerome Marchand \u003cjmarchan@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "391c314928c37b0c946061c0adddd5bd5730c8b7", "tree": "637faa9238abb81698e4b2170bbbd9ca1d704aa7", "parents": [ "e194fab8d7ebe95db5609f1cb6794c2afcc3118f" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Wed Jul 11 14:02:53 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:36 2012 -0700" }, "message": "mm: sparse: fix usemap allocation above node descriptor section\n\ncommit 99ab7b19440a72ebdf225f99b20f8ef40decee86 upstream.\n\nAfter commit f5bf18fa22f8 (\"bootmem/sparsemem: remove limit constraint\nin alloc_bootmem_section\"), usemap allocations may easily be placed\noutside the optimal section that holds the node descriptor, even if\nthere is space available in that section. This results in unnecessary\nhotplug dependencies that need to have the node unplugged before the\nsection holding the usemap.\n\nThe reason is that the bootmem allocator doesn\u0027t guarantee a linear\nsearch starting from the passed allocation goal but may start out at a\nmuch higher address absent an upper limit.\n\nFix this by trying the allocation with the limit at the section end,\nthen retry without if that fails. This keeps the fix from f5bf18fa22f8\nof not panicking if the allocation does not fit in the section, but\nstill makes sure to try to stay within the section at first.\n\n[rewritten massively by Johannes to apply to 3.4]\n\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n\n" }, { "commit": "967c0e4ab954d228ca87d85c523ae8a65c03cc5e", "tree": "2a59b0803abcfdbc2e2d7c3b8e3380de9fb7d7ba", "parents": [ "32e653056d900d3ecc984733dbfcea34c92bf6d0" ], "author": { "name": "qiuxishi", "email": "qiuxishi@gmail.com", "time": "Mon Sep 17 14:09:24 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:06 2012 -0700" }, "message": "memory hotplug: fix section info double registration bug\n\ncommit f14851af0ebb32745c6c5a2e400aa0549f9d20df upstream.\n\nThere may be a bug when registering section info. For example, on my\nItanium platform, the pfn range of node0 includes the other nodes, so\nother nodes\u0027 section info will be double registered, and memmap\u0027s page\ncount will equal to 3.\n\n node0: start_pfn\u003d0x100, spanned_pfn\u003d0x20fb00, present_pfn\u003d0x7f8a3, \u003d\u003e 0x000100-0x20fc00\n node1: start_pfn\u003d0x80000, spanned_pfn\u003d0x80000, present_pfn\u003d0x80000, \u003d\u003e 0x080000-0x100000\n node2: start_pfn\u003d0x100000, spanned_pfn\u003d0x80000, present_pfn\u003d0x80000, \u003d\u003e 0x100000-0x180000\n node3: start_pfn\u003d0x180000, spanned_pfn\u003d0x80000, present_pfn\u003d0x80000, \u003d\u003e 0x180000-0x200000\n\n free_all_bootmem_node()\n\tregister_page_bootmem_info_node()\n\t\tregister_page_bootmem_info_section()\n\nWhen hot remove memory, we can\u0027t free the memmap\u0027s page because\npage_count() is 2 after put_page_bootmem().\n\n sparse_remove_one_section()\n\tfree_section_usemap()\n\t\tfree_map_bootmem()\n\t\t\tput_page_bootmem()\n\n[akpm@linux-foundation.org: add code comment]\nSigned-off-by: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: \"Luck, Tony\" \u003ctony.luck@intel.com\u003e\nCc: Yasuaki Ishimatsu \u003cisimatu.yasuaki@jp.fujitsu.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aa7994f281a5e705b5f9cb13b3219fc346263872", "tree": "bcb197b1091bfd854890418b2aebd92c077b9a2f", "parents": [ "a4dd7e6c27a37237f09d437a515a3330093d4f70" ], "author": { "name": "Li Haifeng", "email": "omycle@gmail.com", "time": "Mon Sep 17 14:09:21 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:05 2012 -0700" }, "message": "mm/page_alloc: fix the page address of higher page\u0027s buddy calculation\n\ncommit 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac upstream.\n\nThe heuristic method for buddy has been introduced since commit\n43506fad21ca (\"mm/page_alloc.c: simplify calculation of combined index\nof adjacent buddy lists\"). But the page address of higher page\u0027s buddy\nwas wrongly calculated, which will lead page_is_buddy to fail for ever.\nIOW, the heuristic method would be disabled with the wrong page address\nof higher page\u0027s buddy.\n\nCalculating the page address of higher page\u0027s buddy should be based\nhigher_page with the offset between index of higher page and index of\nhigher page\u0027s buddy.\n\nSigned-off-by: Haifeng Li \u003comycle@gmail.com\u003e\nSigned-off-by: Gavin Shan \u003cshangw@linux.vnet.ibm.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: KyongHo Cho \u003cpullip.cho@samsung.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Minchan Kim \u003cminchan.kim@gmail.com\u003e\nCc: Johannes Weiner \u003cjweiner@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "05d71a5a25da396f76ee942af6682dfaecc73e84", "tree": "de2b299e87d121de753838be8285f9d1dc7f25e5", "parents": [ "242fa18ad8d4665c151bdd5c34ac34a8e701fff7" ], "author": { "name": "Dave Jones", "email": "davej@redhat.com", "time": "Thu Sep 06 12:01:00 2012 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Sep 14 10:00:22 2012 -0700" }, "message": "Remove user-triggerable BUG from mpol_to_str\n\ncommit 80de7c3138ee9fd86a98696fd2cf7ad89b995d0a upstream.\n\nTrivially triggerable, found by trinity:\n\n kernel BUG at mm/mempolicy.c:2546!\n Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670)\n Call Trace:\n show_numa_map+0xd5/0x450\n show_pid_numa_map+0x13/0x20\n traverse+0xf2/0x230\n seq_read+0x34b/0x3e0\n vfs_read+0xac/0x180\n sys_pread64+0xa2/0xc0\n system_call_fastpath+0x1a/0x1f\n RIP: mpol_to_str+0x156/0x360\n\nSigned-off-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "49ca240411df57586fecddd1152ff30cbef82d59", "tree": "ded76d92b3504beb4e89146c6bd0caa924694dcb", "parents": [ "a05f127752f743db1b53e0309977573566ce5b6f" ], "author": { "name": "Mel Gorman", "email": "mgorman@suse.de", "time": "Tue Jul 31 16:46:20 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:31 2012 -0700" }, "message": "mm: hugetlbfs: close race during teardown of hugetlbfs shared page tables\n\ncommit d833352a4338dc31295ed832a30c9ccff5c7a183 upstream.\n\nIf a process creates a large hugetlbfs mapping that is eligible for page\ntable sharing and forks heavily with children some of whom fault and\nothers which destroy the mapping then it is possible for page tables to\nget corrupted. Some teardowns of the mapping encounter a \"bad pmd\" and\noutput a message to the kernel log. The final teardown will trigger a\nBUG_ON in mm/filemap.c.\n\nThis was reproduced in 3.4 but is known to have existed for a long time\nand goes back at least as far as 2.6.37. It was probably was introduced\nin 2.6.20 by [39dde65c: shared page table for hugetlb page]. The messages\nlook like this;\n\n[ ..........] Lots of bad pmd messages followed by this\n[ 127.164256] mm/memory.c:391: bad pmd ffff880412e04fe8(80000003de4000e7).\n[ 127.164257] mm/memory.c:391: bad pmd ffff880412e04ff0(80000003de6000e7).\n[ 127.164258] mm/memory.c:391: bad pmd ffff880412e04ff8(80000003de0000e7).\n[ 127.186778] ------------[ cut here ]------------\n[ 127.186781] kernel BUG at mm/filemap.c:134!\n[ 127.186782] invalid opcode: 0000 [#1] SMP\n[ 127.186783] CPU 7\n[ 127.186784] Modules linked in: af_packet cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq mperf ext3 jbd dm_mod coretemp crc32c_intel usb_storage ghash_clmulni_intel aesni_intel i2c_i801 r8169 mii uas sr_mod cdrom sg iTCO_wdt iTCO_vendor_support shpchp serio_raw cryptd aes_x86_64 e1000e pci_hotplug dcdbas aes_generic container microcode ext4 mbcache jbd2 crc16 sd_mod crc_t10dif i915 drm_kms_helper drm i2c_algo_bit ehci_hcd ahci libahci usbcore rtc_cmos usb_common button i2c_core intel_agp video intel_gtt fan processor thermal thermal_sys hwmon ata_generic pata_atiixp libata scsi_mod\n[ 127.186801]\n[ 127.186802] Pid: 9017, comm: hugetlbfs-test Not tainted 3.4.0-autobuild #53 Dell Inc. OptiPlex 990/06D7TR\n[ 127.186804] RIP: 0010:[\u003cffffffff810ed6ce\u003e] [\u003cffffffff810ed6ce\u003e] __delete_from_page_cache+0x15e/0x160\n[ 127.186809] RSP: 0000:ffff8804144b5c08 EFLAGS: 00010002\n[ 127.186810] RAX: 0000000000000001 RBX: ffffea000a5c9000 RCX: 00000000ffffffc0\n[ 127.186811] RDX: 0000000000000000 RSI: 0000000000000009 RDI: ffff88042dfdad00\n[ 127.186812] RBP: ffff8804144b5c18 R08: 0000000000000009 R09: 0000000000000003\n[ 127.186813] R10: 0000000000000000 R11: 000000000000002d R12: ffff880412ff83d8\n[ 127.186814] R13: ffff880412ff83d8 R14: 0000000000000000 R15: ffff880412ff83d8\n[ 127.186815] FS: 00007fe18ed2c700(0000) GS:ffff88042dce0000(0000) knlGS:0000000000000000\n[ 127.186816] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[ 127.186817] CR2: 00007fe340000503 CR3: 0000000417a14000 CR4: 00000000000407e0\n[ 127.186818] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 127.186819] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n[ 127.186820] Process hugetlbfs-test (pid: 9017, threadinfo ffff8804144b4000, task ffff880417f803c0)\n[ 127.186821] Stack:\n[ 127.186822] ffffea000a5c9000 0000000000000000 ffff8804144b5c48 ffffffff810ed83b\n[ 127.186824] ffff8804144b5c48 000000000000138a 0000000000001387 ffff8804144b5c98\n[ 127.186825] ffff8804144b5d48 ffffffff811bc925 ffff8804144b5cb8 0000000000000000\n[ 127.186827] Call Trace:\n[ 127.186829] [\u003cffffffff810ed83b\u003e] delete_from_page_cache+0x3b/0x80\n[ 127.186832] [\u003cffffffff811bc925\u003e] truncate_hugepages+0x115/0x220\n[ 127.186834] [\u003cffffffff811bca43\u003e] hugetlbfs_evict_inode+0x13/0x30\n[ 127.186837] [\u003cffffffff811655c7\u003e] evict+0xa7/0x1b0\n[ 127.186839] [\u003cffffffff811657a3\u003e] iput_final+0xd3/0x1f0\n[ 127.186840] [\u003cffffffff811658f9\u003e] iput+0x39/0x50\n[ 127.186842] [\u003cffffffff81162708\u003e] d_kill+0xf8/0x130\n[ 127.186843] [\u003cffffffff81162812\u003e] dput+0xd2/0x1a0\n[ 127.186845] [\u003cffffffff8114e2d0\u003e] __fput+0x170/0x230\n[ 127.186848] [\u003cffffffff81236e0e\u003e] ? rb_erase+0xce/0x150\n[ 127.186849] [\u003cffffffff8114e3ad\u003e] fput+0x1d/0x30\n[ 127.186851] [\u003cffffffff81117db7\u003e] remove_vma+0x37/0x80\n[ 127.186853] [\u003cffffffff81119182\u003e] do_munmap+0x2d2/0x360\n[ 127.186855] [\u003cffffffff811cc639\u003e] sys_shmdt+0xc9/0x170\n[ 127.186857] [\u003cffffffff81410a39\u003e] system_call_fastpath+0x16/0x1b\n[ 127.186858] Code: 0f 1f 44 00 00 48 8b 43 08 48 8b 00 48 8b 40 28 8b b0 40 03 00 00 85 f6 0f 88 df fe ff ff 48 89 df e8 e7 cb 05 00 e9 d2 fe ff ff \u003c0f\u003e 0b 55 83 e2 fd 48 89 e5 48 83 ec 30 48 89 5d d8 4c 89 65 e0\n[ 127.186868] RIP [\u003cffffffff810ed6ce\u003e] __delete_from_page_cache+0x15e/0x160\n[ 127.186870] RSP \u003cffff8804144b5c08\u003e\n[ 127.186871] ---[ end trace 7cbac5d1db69f426 ]---\n\nThe bug is a race and not always easy to reproduce. To reproduce it I was\ndoing the following on a single socket I7-based machine with 16G of RAM.\n\n$ hugeadm --pool-pages-max DEFAULT:13G\n$ echo $((18*1048576*1024)) \u003e /proc/sys/kernel/shmmax\n$ echo $((18*1048576*1024)) \u003e /proc/sys/kernel/shmall\n$ for i in `seq 1 9000`; do ./hugetlbfs-test; done\n\nOn my particular machine, it usually triggers within 10 minutes but\nenabling debug options can change the timing such that it never hits.\nOnce the bug is triggered, the machine is in trouble and needs to be\nrebooted. The machine will respond but processes accessing proc like \"ps\naux\" will hang due to the BUG_ON. shutdown will also hang and needs a\nhard reset or a sysrq-b.\n\nThe basic problem is a race between page table sharing and teardown. For\nthe most part page table sharing depends on i_mmap_mutex. In some cases,\nit is also taking the mm-\u003epage_table_lock for the PTE updates but with\nshared page tables, it is the i_mmap_mutex that is more important.\n\nUnfortunately it appears to be also insufficient. Consider the following\nsituation\n\nProcess A\t\t\t\t\tProcess B\n---------\t\t\t\t\t---------\nhugetlb_fault\t\t\t\t\tshmdt\n \t\t\t\t\t\tLockWrite(mmap_sem)\n \t\t\t\t\t\t do_munmap\n\t\t\t\t\t\t unmap_region\n\t\t\t\t\t\t unmap_vmas\n\t\t\t\t\t\t unmap_single_vma\n\t\t\t\t\t\t unmap_hugepage_range\n \t\t\t\t\t\t Lock(i_mmap_mutex)\n\t\t\t\t\t\t\t Lock(mm-\u003epage_table_lock)\n\t\t\t\t\t\t\t huge_pmd_unshare/unmap tables \u003c--- (1)\n\t\t\t\t\t\t\t Unlock(mm-\u003epage_table_lock)\n \t\t\t\t\t\t Unlock(i_mmap_mutex)\n huge_pte_alloc\t\t\t\t ...\n Lock(i_mmap_mutex)\t\t\t\t ...\n vma_prio_walk, find svma, spte\t\t ...\n Lock(mm-\u003epage_table_lock)\t\t\t ...\n share spte\t\t\t\t\t ...\n Unlock(mm-\u003epage_table_lock)\t\t\t ...\n Unlock(i_mmap_mutex)\t\t\t ...\n hugetlb_no_page\t\t\t\t\t\t\t\t\t \u003c--- (2)\n\t\t\t\t\t\t free_pgtables\n\t\t\t\t\t\t unlink_file_vma\n\t\t\t\t\t\t\thugetlb_free_pgd_range\n\t\t\t\t\t\t remove_vma_list\n\nIn this scenario, it is possible for Process A to share page tables with\nProcess B that is trying to tear them down. The i_mmap_mutex on its own\ndoes not prevent Process A walking Process B\u0027s page tables. At (1) above,\nthe page tables are not shared yet so it unmaps the PMDs. Process A sets\nup page table sharing and at (2) faults a new entry. Process B then trips\nup on it in free_pgtables.\n\nThis patch fixes the problem by adding a new function\n__unmap_hugepage_range_final that is only called when the VMA is about to\nbe destroyed. This function clears VM_MAYSHARE during\nunmap_hugepage_range() under the i_mmap_mutex. This makes the VMA\nineligible for sharing and avoids the race. Superficially this looks like\nit would then be vunerable to truncate and madvise issues but hugetlbfs\nhas its own truncate handlers so does not use unmap_mapping_range() and\ndoes not support madvise(DONTNEED).\n\nThis should be treated as a -stable candidate if it is merged.\n\nTest program is as follows. The test case was mostly written by Michal\nHocko with a few minor changes to reproduce this bug.\n\n\u003d\u003d\u003d\u003d CUT HERE \u003d\u003d\u003d\u003d\n\nstatic size_t huge_page_size \u003d (2UL \u003c\u003c 20);\nstatic size_t nr_huge_page_A \u003d 512;\nstatic size_t nr_huge_page_B \u003d 5632;\n\nunsigned int get_random(unsigned int max)\n{\n\tstruct timeval tv;\n\n\tgettimeofday(\u0026tv, NULL);\n\tsrandom(tv.tv_usec);\n\treturn random() % max;\n}\n\nstatic void play(void *addr, size_t size)\n{\n\tunsigned char *start \u003d addr,\n\t\t *end \u003d start + size,\n\t\t *a;\n\tstart +\u003d get_random(size/2);\n\n\t/* we could itterate on huge pages but let\u0027s give it more time. */\n\tfor (a \u003d start; a \u003c end; a +\u003d 4096)\n\t\t*a \u003d 0;\n}\n\nint main(int argc, char **argv)\n{\n\tkey_t key \u003d IPC_PRIVATE;\n\tsize_t sizeA \u003d nr_huge_page_A * huge_page_size;\n\tsize_t sizeB \u003d nr_huge_page_B * huge_page_size;\n\tint shmidA, shmidB;\n\tvoid *addrA \u003d NULL, *addrB \u003d NULL;\n\tint nr_children \u003d 300, n \u003d 0;\n\n\tif ((shmidA \u003d shmget(key, sizeA, IPC_CREAT|SHM_HUGETLB|0660)) \u003d\u003d -1) {\n\t\tperror(\"shmget:\");\n\t\treturn 1;\n\t}\n\n\tif ((addrA \u003d shmat(shmidA, addrA, SHM_R|SHM_W)) \u003d\u003d (void *)-1UL) {\n\t\tperror(\"shmat\");\n\t\treturn 1;\n\t}\n\tif ((shmidB \u003d shmget(key, sizeB, IPC_CREAT|SHM_HUGETLB|0660)) \u003d\u003d -1) {\n\t\tperror(\"shmget:\");\n\t\treturn 1;\n\t}\n\n\tif ((addrB \u003d shmat(shmidB, addrB, SHM_R|SHM_W)) \u003d\u003d (void *)-1UL) {\n\t\tperror(\"shmat\");\n\t\treturn 1;\n\t}\n\nfork_child:\n\tswitch(fork()) {\n\t\tcase 0:\n\t\t\tswitch (n%3) {\n\t\t\tcase 0:\n\t\t\t\tplay(addrA, sizeA);\n\t\t\t\tbreak;\n\t\t\tcase 1:\n\t\t\t\tplay(addrB, sizeB);\n\t\t\t\tbreak;\n\t\t\tcase 2:\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tbreak;\n\t\tcase -1:\n\t\t\tperror(\"fork:\");\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tif (++n \u003c nr_children)\n\t\t\t\tgoto fork_child;\n\t\t\tplay(addrA, sizeA);\n\t\t\tbreak;\n\t}\n\tshmdt(addrA);\n\tshmdt(addrB);\n\tdo {\n\t\twait(NULL);\n\t} while (--n \u003e 0);\n\tshmctl(shmidA, IPC_RMID, NULL);\n\tshmctl(shmidB, IPC_RMID, NULL);\n\treturn 0;\n}\n\n[akpm@linux-foundation.org: name the declaration\u0027s args, fix CONFIG_HUGETLBFS\u003dn build]\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nReviewed-by: Michal Hocko \u003cmhocko@suse.cz\u003e\nSigned-off-by: Mel Gorman \u003cmgorman@suse.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "cc9fdb9cdde35aafad3b11ce74e244f5da7ac3c0", "tree": "95ecbfb28521113c15ec0ee897efee311a807d6d", "parents": [ "41a2033bf3bc1ecf19c743b452791ba492a6e75d" ], "author": { "name": "Xiao Guangrong", "email": "xiaoguangrong@linux.vnet.ibm.com", "time": "Tue Jul 31 16:45:52 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:08 2012 -0700" }, "message": "mm: mmu_notifier: fix freed page still mapped in secondary MMU\n\ncommit 3ad3d901bbcfb15a5e4690e55350db0899095a68 upstream.\n\nmmu_notifier_release() is called when the process is exiting. It will\ndelete all the mmu notifiers. But at this time the page belonging to the\nprocess is still present in page tables and is present on the LRU list, so\nthis race will happen:\n\n CPU 0 CPU 1\nmmu_notifier_release: try_to_unmap:\n hlist_del_init_rcu(\u0026mn-\u003ehlist);\n ptep_clear_flush_notify:\n mmu nofifler not found\n free page !!!!!!\n /*\n * At the point, the page has been\n * freed, but it is still mapped in\n * the secondary MMU.\n */\n\n mn-\u003eops-\u003erelease(mn, mm);\n\nThen the box is not stable and sometimes we can get this bug:\n\n[ 738.075923] BUG: Bad page state in process migrate-perf pfn:03bec\n[ 738.075931] page:ffffea00000efb00 count:0 mapcount:0 mapping: (null) index:0x8076\n[ 738.075936] page flags: 0x20000000000014(referenced|dirty)\n\nThe same issue is present in mmu_notifier_unregister().\n\nWe can call -\u003erelease before deleting the notifier to ensure the page has\nbeen unmapped from the secondary MMU before it is freed.\n\nSigned-off-by: Xiao Guangrong \u003cxiaoguangrong@linux.vnet.ibm.com\u003e\nCc: Avi Kivity \u003cavi@redhat.com\u003e\nCc: Marcelo Tosatti \u003cmtosatti@redhat.com\u003e\nCc: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ce6f0ff8d1031931df7031a88f4085e5f196a854", "tree": "a7966b18420dd6054df99777f9b79beb373030c0", "parents": [ "603cb88c3a73968a0fa498e252cbb781e62bb5b4" ], "author": { "name": "Joonsoo Kim", "email": "js1304@gmail.com", "time": "Mon Jul 30 14:39:04 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:05 2012 -0700" }, "message": "mm: fix wrong argument of migrate_huge_pages() in soft_offline_huge_page()\n\ncommit dc32f63453f56d07a1073a697dcd843dd3098c09 upstream.\n\nCommit a6bc32b89922 (\"mm: compaction: introduce sync-light migration for\nuse by compaction\") changed the declaration of migrate_pages() and\nmigrate_huge_pages().\n\nBut it missed changing the argument of migrate_huge_pages() in\nsoft_offline_huge_page(). In this case, we should call\nmigrate_huge_pages() with MIGRATE_SYNC.\n\nAdditionally, there is a mismatch between type the of argument and the\nfunction declaration for migrate_pages().\n\nSigned-off-by: Joonsoo Kim \u003cjs1304@gmail.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: \"Aneesh Kumar K.V\" \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7b689c5d930f281e417597af9f817ba03dc9d898", "tree": "75bb26f8fc89a58f25377e60cf2af6879fb795b0", "parents": [ "2830f9a08c084bcf40819942f04d0ca500faf4b8" ], "author": { "name": "Tony Luck", "email": "tony.luck@intel.com", "time": "Wed Jul 11 10:20:47 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:29 2012 -0700" }, "message": "x86/mce: Fix siginfo_t-\u003esi_addr value for non-recoverable memory faults\n\ncommit 6751ed65dc6642af64f7b8a440a75563c8aab7ae upstream.\n\nIn commit dad1743e5993f1 (\"x86/mce: Only restart instruction after machine\ncheck recovery if it is safe\") we fixed mce_notify_process() to force a\nsignal to the current process if it was not restartable (RIPV bit not\nset in MCG_STATUS). But doing it here means that the process doesn\u0027t\nget told the virtual address of the fault via siginfo_t-\u003esi_addr. This\nwould prevent application level recovery from the fault.\n\nMake a new MF_MUST_KILL flag bit for memory_failure() et al. to use so\nthat we will provide the right information with the signal.\n\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nAcked-by: Borislav Petkov \u003cborislav.petkov@amd.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "07aa70120e4be526a468b9c3ea93b45cfbe95013", "tree": "4fa36c98129475d7cd2090375c9604f06edd1559", "parents": [ "2dbbb550c56cbaf9d8353f4546aab9a88786d279" ], "author": { "name": "Aaditya Kumar", "email": "aaditya.kumar.30@gmail.com", "time": "Tue Jul 17 15:48:07 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 29 08:04:19 2012 -0700" }, "message": "mm: fix lost kswapd wakeup in kswapd_stop()\n\ncommit 1c7e7f6c0703d03af6bcd5ccc11fc15d23e5ecbe upstream.\n\nOfflining memory may block forever, waiting for kswapd() to wake up\nbecause kswapd() does not check the event kthread-\u003eshould_stop before\nsleeping.\n\nThe proper pattern, from Documentation/memory-barriers.txt, is:\n\n --- waker ---\n event_indicated \u003d 1;\n wake_up_process(event_daemon);\n\n --- sleeper ---\n for (;;) {\n set_current_state(TASK_UNINTERRUPTIBLE);\n if (event_indicated)\n break;\n schedule();\n }\n\n set_current_state() may be wrapped by:\n prepare_to_wait();\n\nIn the kswapd() case, event_indicated is kthread-\u003eshould_stop.\n\n \u003d\u003d\u003d offlining memory (waker) \u003d\u003d\u003d\n kswapd_stop()\n kthread_stop()\n kthread-\u003eshould_stop \u003d 1\n wake_up_process()\n wait_for_completion()\n\n \u003d\u003d\u003d kswapd_try_to_sleep (sleeper) \u003d\u003d\u003d\n kswapd_try_to_sleep()\n prepare_to_wait()\n .\n .\n schedule()\n .\n .\n finish_wait()\n\nThe schedule() needs to be protected by a test of kthread-\u003eshould_stop,\nwhich is wrapped by kthread_should_stop().\n\nReproducer:\n Do heavy file I/O in background.\n Do a memory offline/online in a tight loop\n\nSigned-off-by: Aaditya Kumar \u003caaditya.kumar@ap.sony.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nReviewed-by: Minchan Kim \u003cminchan@kernel.org\u003e\nAcked-by: Mel Gorman \u003cmel@csn.ul.ie\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fbfcd6fa25e08b96f28527da696a7b3250588df2", "tree": "8f2bf0cf48ef4ebe9fd1c81835fdd2103c73c0e3", "parents": [ "2e781cd43f310a482c7d651a9d38de3459967fba" ], "author": { "name": "Rabin Vincent", "email": "rabin@rab.in", "time": "Thu Jul 05 15:52:23 2012 +0530" }, "committer": { "name": "Laura Abbott", "email": "lauraa@codeaurora.org", "time": "Mon Jul 23 14:48:17 2012 -0700" }, "message": "mm: cma: don\u0027t replace lowmem pages with highmem\n\nThe filesystem layer expects pages in the block device\u0027s mapping to not\nbe in highmem (the mapping\u0027s gfp mask is set in bdget()), but CMA can\ncurrently replace lowmem pages with highmem pages, leading to crashes in\nfilesystem code such as the one below:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00000400\n pgd \u003d c0c98000\n [00000400] *pgd\u003d00c91831, *pte\u003d00000000, *ppte\u003d00000000\n Internal error: Oops: 817 [#1] PREEMPT SMP ARM\n CPU: 0 Not tainted (3.5.0-rc5+ #80)\n PC is at __memzero+0x24/0x80\n ...\n Process fsstress (pid: 323, stack limit \u003d 0xc0cbc2f0)\n Backtrace:\n [\u003cc010e3f0\u003e] (ext4_getblk+0x0/0x180) from [\u003cc010e58c\u003e] (ext4_bread+0x1c/0x98)\n [\u003cc010e570\u003e] (ext4_bread+0x0/0x98) from [\u003cc0117944\u003e] (ext4_mkdir+0x160/0x3bc)\n r4:c15337f0\n [\u003cc01177e4\u003e] (ext4_mkdir+0x0/0x3bc) from [\u003cc00c29e0\u003e] (vfs_mkdir+0x8c/0x98)\n [\u003cc00c2954\u003e] (vfs_mkdir+0x0/0x98) from [\u003cc00c2a60\u003e] (sys_mkdirat+0x74/0xac)\n r6:00000000 r5:c152eb40 r4:000001ff r3:c14b43f0\n [\u003cc00c29ec\u003e] (sys_mkdirat+0x0/0xac) from [\u003cc00c2ab8\u003e] (sys_mkdir+0x20/0x24)\n r6:beccdcf0 r5:00074000 r4:beccdbbc\n [\u003cc00c2a98\u003e] (sys_mkdir+0x0/0x24) from [\u003cc000e3c0\u003e] (ret_fast_syscall+0x0/0x30)\n\nFix this by replacing only highmem pages with highmem.\n\nChange-Id: I6af2d509af48b5a586037be14bd3593b3f269d95\nReported-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\nSigned-off-by: Rabin Vincent \u003crabin@rab.in\u003e\nAcked-by: Michal Nazarewicz \u003cmina86@mina86.com\u003e\nSigned-off-by: Marek Szyprowski \u003cm.szyprowski@samsung.com\u003e\nSigned-off-by: Laura Abbott \u003clauraa@codeaurora.org\u003e\n" }, { "commit": "7ad71f960f0f6e06cbded278809674afc515036a", "tree": "df62cd2fb579dc1ded7ec28c669ed03bf506ffe9", "parents": [ "0fa627b15c842095b5147f381fa1943a6a46bb01" ], "author": { "name": "Yinghai Lu", "email": "yinghai@kernel.org", "time": "Wed Jul 11 14:02:56 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:45 2012 -0700" }, "message": "memblock: free allocated memblock_reserved_regions later\n\ncommit 29f6738609e40227dabcc63bfb3b84b3726a75bd upstream.\n\nmemblock_free_reserved_regions() calls memblock_free(), but\nmemblock_free() would double reserved.regions too, so we could free the\nold range for reserved.regions.\n\nAlso tj said there is another bug which could be related to this.\n\n| I don\u0027t think we\u0027re saving any noticeable\n| amount by doing this \"free - give it to page allocator - reserve\n| again\" dancing. We should just allocate regions aligned to page\n| boundaries and free them later when memblock is no longer in use.\n\nin that case, when DEBUG_PAGEALLOC, will get panic:\n\n memblock_free: [0x0000102febc080-0x0000102febf080] memblock_free_reserved_regions+0x37/0x39\n BUG: unable to handle kernel paging request at ffff88102febd948\n IP: [\u003cffffffff836a5774\u003e] __next_free_mem_range+0x9b/0x155\n PGD 4826063 PUD cf67a067 PMD cf7fa067 PTE 800000102febd160\n Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n CPU 0\n Pid: 0, comm: swapper Not tainted 3.5.0-rc2-next-20120614-sasha #447\n RIP: 0010:[\u003cffffffff836a5774\u003e] [\u003cffffffff836a5774\u003e] __next_free_mem_range+0x9b/0x155\n\nSee the discussion at https://lkml.org/lkml/2012/6/13/469\n\nSo try to allocate with PAGE_SIZE alignment and free it later.\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Yinghai Lu \u003cyinghai@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7a08b440fa93e036968102597c8a2ab809a9bdc4", "tree": "97d9a1b575eb0c18de1649253c8062bfc7d4daa4", "parents": [ "ae555e19b697bc90ea3ec004dc0e5541983593fa" ], "author": { "name": "David Rientjes", "email": "rientjes@google.com", "time": "Wed Jul 11 14:02:13 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:44 2012 -0700" }, "message": "mm, thp: abort compaction if migration page cannot be charged to memcg\n\ncommit 4bf2bba3750f10aa9e62e6949bc7e8329990f01b upstream.\n\nIf page migration cannot charge the temporary page to the memcg,\nmigrate_pages() will return -ENOMEM. This isn\u0027t considered in memory\ncompaction however, and the loop continues to iterate over all\npageblocks trying to isolate and migrate pages. If a small number of\nvery large memcgs happen to be oom, however, these attempts will mostly\nbe futile leading to an enormous amout of cpu consumption due to the\npage migration failures.\n\nThis patch will short circuit and fail memory compaction if\nmigrate_pages() returns -ENOMEM. COMPACT_PARTIAL is returned in case\nsome migrations were successful so that the page allocator will retry.\n\nSigned-off-by: David Rientjes \u003crientjes@google.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Kamezawa Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0e343dbe08acb440f7914d989bcc32c1d1576735", "tree": "224d26c553fc27c2a556cb52ffd8d8b692a64f8f", "parents": [ "a2db97f10ba81ce924323e580a223ce8d17d685c" ], "author": { "name": "Jiang Liu", "email": "jiang.liu@huawei.com", "time": "Wed Jul 11 14:01:52 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:44 2012 -0700" }, "message": "memory hotplug: fix invalid memory access caused by stale kswapd pointer\n\ncommit d8adde17e5f858427504725218c56aef90e90fc7 upstream.\n\nkswapd_stop() is called to destroy the kswapd work thread when all memory\nof a NUMA node has been offlined. But kswapd_stop() only terminates the\nwork thread without resetting NODE_DATA(nid)-\u003ekswapd to NULL. The stale\npointer will prevent kswapd_run() from creating a new work thread when\nadding memory to the memory-less NUMA node again. Eventually the stale\npointer may cause invalid memory access.\n\nAn example stack dump as below. It\u0027s reproduced with 2.6.32, but latest\nkernel has the same issue.\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003cffffffff81051a94\u003e] exit_creds+0x12/0x78\n PGD 0\n Oops: 0000 [#1] SMP\n last sysfs file: /sys/devices/system/memory/memory391/state\n CPU 11\n Modules linked in: cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq microcode fuse loop dm_mod tpm_tis rtc_cmos i2c_i801 rtc_core tpm serio_raw pcspkr sg tpm_bios igb i2c_core iTCO_wdt rtc_lib mptctl iTCO_vendor_support button dca bnx2 usbhid hid uhci_hcd ehci_hcd usbcore sd_mod crc_t10dif edd ext3 mbcache jbd fan ide_pci_generic ide_core ata_generic ata_piix libata thermal processor thermal_sys hwmon mptsas mptscsih mptbase scsi_transport_sas scsi_mod\n Pid: 7949, comm: sh Not tainted 2.6.32.12-qiuxishi-5-default #92 Tecal RH2285\n RIP: 0010:exit_creds+0x12/0x78\n RSP: 0018:ffff8806044f1d78 EFLAGS: 00010202\n RAX: 0000000000000000 RBX: ffff880604f22140 RCX: 0000000000019502\n RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000\n RBP: ffff880604f22150 R08: 0000000000000000 R09: ffffffff81a4dc10\n R10: 00000000000032a0 R11: ffff880006202500 R12: 0000000000000000\n R13: 0000000000c40000 R14: 0000000000008000 R15: 0000000000000001\n FS: 00007fbc03d066f0(0000) GS:ffff8800282e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n CR2: 0000000000000000 CR3: 000000060f029000 CR4: 00000000000006e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process sh (pid: 7949, threadinfo ffff8806044f0000, task ffff880603d7c600)\n Stack:\n ffff880604f22140 ffffffff8103aac5 ffff880604f22140 ffffffff8104d21e\n ffff880006202500 0000000000008000 0000000000c38000 ffffffff810bd5b1\n 0000000000000000 ffff880603d7c600 00000000ffffdd29 0000000000000003\n Call Trace:\n __put_task_struct+0x5d/0x97\n kthread_stop+0x50/0x58\n offline_pages+0x324/0x3da\n memory_block_change_state+0x179/0x1db\n store_mem_state+0x9e/0xbb\n sysfs_write_file+0xd0/0x107\n vfs_write+0xad/0x169\n sys_write+0x45/0x6e\n system_call_fastpath+0x16/0x1b\n Code: ff 4d 00 0f 94 c0 84 c0 74 08 48 89 ef e8 1f fd ff ff 5b 5d 31 c0 41 5c c3 53 48 8b 87 20 06 00 00 48 89 fb 48 8b bf 18 06 00 00 \u003c8b\u003e 00 48 c7 83 18 06 00 00 00 00 00 00 f0 ff 0f 0f 94 c0 84 c0\n RIP exit_creds+0x12/0x78\n RSP \u003cffff8806044f1d78\u003e\n CR2: 0000000000000000\n\n[akpm@linux-foundation.org: add pglist_data.kswapd locking comments]\nSigned-off-by: Xishi Qiu \u003cqiuxishi@huawei.com\u003e\nSigned-off-by: Jiang Liu \u003cjiang.liu@huawei.com\u003e\nAcked-by: KAMEZAWA Hiroyuki \u003ckamezawa.hiroyu@jp.fujitsu.com\u003e\nAcked-by: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nReviewed-by: Minchan Kim \u003cminchan@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "0c4ad5cc8c01f62fe5211b5ce9563c27f795a4ab" }