)]}' { "log": [ { "commit": "af15b7691766d99f0f84bae9b3444ab06e9beb29", "tree": "5d22a78374519c3feeabeaddad7e4f0fb58360a6", "parents": [ "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Oct 09 22:23:23 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 20 10:43:19 2013 -0800" }, "message": "tracing: Fix potential out-of-bounds in trace_get_user()\n\ncommit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.\n\nAndrey reported the following report:\n\nERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3\nffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)\nAccessed by thread T13003:\n #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)\n #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)\n #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)\n #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)\n #4 ffffffff812a1065 (__fput+0x155/0x360)\n #5 ffffffff812a12de (____fput+0x1e/0x30)\n #6 ffffffff8111708d (task_work_run+0x10d/0x140)\n #7 ffffffff810ea043 (do_exit+0x433/0x11f0)\n #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)\n #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)\n #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nAllocated by thread T5167:\n #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)\n #1 ffffffff8128337c (__kmalloc+0xbc/0x500)\n #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)\n #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)\n #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)\n #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)\n #6 ffffffff8129b668 (finish_open+0x68/0xa0)\n #7 ffffffff812b66ac (do_last+0xb8c/0x1710)\n #8 ffffffff812b7350 (path_openat+0x120/0xb50)\n #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)\n #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)\n #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)\n #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nShadow bytes around the buggy address:\n ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa\n ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003d\u003effff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb\n ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n Addressable: 00\n Partially addressable: 01 02 03 04 05 06 07\n Heap redzone: fa\n Heap kmalloc redzone: fb\n Freed heap region: fd\n Shadow gap: fe\n\nThe out-of-bounds access happens on \u0027parser-\u003ebuffer[parser-\u003eidx] \u003d 0;\u0027\n\nAlthough the crash happened in ftrace_regex_open() the real bug\noccurred in trace_get_user() where there\u0027s an incrementation to\nparser-\u003eidx without a check against the size. The way it is triggered\nis if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop\nthat reads the last character stores it and then breaks out because\nthere is no more characters. Then the last character is read to determine\nwhat to do next, and the index is incremented without checking size.\n\nThen the caller of trace_get_user() usually nulls out the last character\nwith a zero, but since the index is equal to the size, it writes a nul\ncharacter after the allocated space, which can corrupt memory.\n\nLuckily, only root user has write access to this file.\n\nLink: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home\n\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f81d0a99446a0c4548d5783807529d075b06c64e", "tree": "b0697e8167ee4daf0d8b66f38270670498998f20", "parents": [ "268417aeea96a1941c2cd14f0f8b5b39c374ad25" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Sep 24 21:50:23 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "clockevents: Sanitize ticks to nsec conversion\n\ncommit 97b9410643475d6557d2517c2aff9fd2221141a9 upstream.\n\nMarc Kleine-Budde pointed out, that commit 77cc982 \"clocksource: use\nclockevents_config_and_register() where possible\" caused a regression\nfor some of the converted subarchs.\n\nThe reason is, that the clockevents core code converts the minimal\nhardware tick delta to a nanosecond value for core internal\nusage. This conversion is affected by integer math rounding loss, so\nthe backwards conversion to hardware ticks will likely result in a\nvalue which is less than the configured hardware limitation. The\naffected subarchs used their own workaround (SIGH!) which got lost in\nthe conversion.\n\nThe solution for the issue at hand is simple: adding evt-\u003emult - 1 to\nthe shifted value before the integer divison in the core conversion\nfunction takes care of it. But this only works for the case where for\nthe scaled math mult/shift pair \"mult \u003c\u003d 1 \u003c\u003c shift\" is true. For the\ncase where \"mult \u003e 1 \u003c\u003c shift\" we can apply the rounding add only for\nthe minimum delta value to make sure that the backward conversion is\nnot less than the given hardware limit. For the upper bound we need to\nomit the rounding add, because the backwards conversion is always\nlarger than the original latch value. That would violate the upper\nbound of the hardware device.\n\nThough looking closer at the details of that function reveals another\nbogosity: The upper bounds check is broken as well. Checking for a\nresulting \"clc\" value greater than KTIME_MAX after the conversion is\npointless. The conversion does:\n\n u64 clc \u003d (latch \u003c\u003c evt-\u003eshift) / evt-\u003emult;\n\nSo there is no sanity check for (latch \u003c\u003c evt-\u003eshift) exceeding the\n64bit boundary. The latch argument is \"unsigned long\", so on a 64bit\narch the handed in argument could easily lead to an unnoticed shift\noverflow. With the above rounding fix applied the calculation before\nthe divison is:\n\n u64 clc \u003d (latch \u003c\u003c evt-\u003eshift) + evt-\u003emult - 1;\n\nSo we need to make sure, that neither the shift nor the rounding add\nis overflowing the u64 boundary.\n\n[ukl: move assignment to rnd after eventually changing mult, fix build\n issue and correct comment with the right math]\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Russell King - ARM Linux \u003clinux@arm.linux.org.uk\u003e\nCc: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\nCc: nicolas.ferre@atmel.com\nCc: Marc Pignat \u003cmarc.pignat@hevs.ch\u003e\nCc: john.stultz@linaro.org\nCc: kernel@pengutronix.de\nCc: Ronald Wahl \u003cronald.wahl@raritan.com\u003e\nCc: LAK \u003clinux-arm-kernel@lists.infradead.org\u003e\nCc: Ludovic Desroches \u003cludovic.desroches@atmel.com\u003e\nLink: http://lkml.kernel.org/r/1380052223-24139-1-git-send-email-u.kleine-koenig@pengutronix.de\nSigned-off-by: Uwe Kleine-König \u003cu.kleine-koenig@pengutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1d48ca6f38fa39298474708abebeffef4ef2cd2d", "tree": "54af1961ab8589ebc3e6533c4083c0cdb2581db9", "parents": [ "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Tue Oct 02 15:41:23 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "perf: Fix perf_cgroup_switch for sw-events\n\ncommit 95cf59ea72331d0093010543b8951bb43f262cac upstream.\n\nJiri reported that he could trigger the WARN_ON_ONCE() in\nperf_cgroup_switch() using sw-events. This is because sw-events share\na cpuctx with multiple PMUs.\n\nUse the -\u003eunique_pmu pointer to limit the pmu iteration to unique\ncpuctx instances.\n\nReported-and-Tested-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-so7wi2zf3jjzrwcutm2mkz0j@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2cd21fa1b54efaf6b5912ef2833fa474fdcf92b7", "tree": "17a056e20c3937a5af97acd45ac7792a420d78ab", "parents": [ "2927937899b958de968119856ba659d8a4eff037" ], "author": { "name": "Peter Zijlstra", "email": "a.p.zijlstra@chello.nl", "time": "Tue Oct 02 15:38:52 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "perf: Clarify perf_cpu_context::active_pmu usage by renaming it to ::unique_pmu\n\ncommit 3f1f33206c16c7b3839d71372bc2ac3f305aa802 upstream.\n\nStephane thought the perf_cpu_context::active_pmu name confusing and\nsuggested using \u0027unique_pmu\u0027 instead.\n\nThis pointer is a pointer to a \u0027random\u0027 pmu sharing the cpuctx\ninstance, therefore limiting a for_each_pmu loop to those where\ncpuctx-\u003eunique_pmu matches the pmu we get a loop over unique cpuctx\ninstances.\n\nSuggested-by: Stephane Eranian \u003ceranian@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nLink: http://lkml.kernel.org/n/tip-kxyjqpfj2fn9gt7kwu5ag9ks@git.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2927937899b958de968119856ba659d8a4eff037", "tree": "51489c3f0826002328a8bf68dccd81c8abeccab3", "parents": [ "72417b659ae9c36e1807bc930240aec202970861" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Mon Feb 18 14:13:35 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "cgroup: fail if monitored file and event_control are in different cgroup\n\ncommit f169007b2773f285e098cb84c74aac0154d65ff7 upstream.\n\nIf we pass fd of memory.usage_in_bytes of cgroup A to cgroup.event_control\nof cgroup B, then we won\u0027t get memory usage notification from A but B!\n\nWhat\u0027s worse, if A and B are in different mount hierarchy, we\u0027ll end up\naccessing NULL pointer!\n\nDisallow this kind of invalid usage.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill@shutemov.name\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Weng Meiling \u003cwengmeiling.weng@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "62875332eafea9ee150a6037c0a1a20669e02aa1", "tree": "71c673017dc9991b143ad989e6b3d20802a13719", "parents": [ "ebce1a846aa297022fc372d59e6829d0453125f2" ], "author": { "name": "Daisuke Nishimura", "email": "nishimura@mxp.nes.nec.co.jp", "time": "Tue Sep 10 18:16:36 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:51 2013 -0700" }, "message": "sched/fair: Fix small race where child-\u003ese.parent,cfs_rq might point to invalid ones\n\ncommit 6c9a27f5da9609fca46cb2b183724531b48f71ad upstream.\n\nThere is a small race between copy_process() and cgroup_attach_task()\nwhere child-\u003ese.parent,cfs_rq points to invalid (old) ones.\n\n parent doing fork() | someone moving the parent to another cgroup\n -------------------------------+---------------------------------------------\n copy_process()\n + dup_task_struct()\n -\u003e parent-\u003ese is copied to child-\u003ese.\n se.parent,cfs_rq of them point to old ones.\n\n cgroup_attach_task()\n + cgroup_task_migrate()\n -\u003e parent-\u003ecgroup is updated.\n + cpu_cgroup_attach()\n + sched_move_task()\n + task_move_group_fair()\n +- set_task_rq()\n -\u003e se.parent,cfs_rq of parent\n are updated.\n\n + cgroup_fork()\n -\u003e parent-\u003ecgroup is copied to child-\u003ecgroup. (*1)\n + sched_fork()\n + task_fork_fair()\n -\u003e se.parent,cfs_rq of child are accessed\n while they point to old ones. (*2)\n\nIn the worst case, this bug can lead to \"use-after-free\" and cause a panic,\nbecause it\u0027s new cgroup\u0027s refcount that is incremented at (*1),\nso the old cgroup(and related data) can be freed before (*2).\n\nIn fact, a panic caused by this bug was originally caught in RHEL6.4.\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003cffffffff81051e3e\u003e] sched_slice+0x6e/0xa0\n [...]\n Call Trace:\n [\u003cffffffff81051f25\u003e] place_entity+0x75/0xa0\n [\u003cffffffff81056a3a\u003e] task_fork_fair+0xaa/0x160\n [\u003cffffffff81063c0b\u003e] sched_fork+0x6b/0x140\n [\u003cffffffff8106c3c2\u003e] copy_process+0x5b2/0x1450\n [\u003cffffffff81063b49\u003e] ? wake_up_new_task+0xd9/0x130\n [\u003cffffffff8106d2f4\u003e] do_fork+0x94/0x460\n [\u003cffffffff81072a9e\u003e] ? sys_wait4+0xae/0x100\n [\u003cffffffff81009598\u003e] sys_clone+0x28/0x30\n [\u003cffffffff8100b393\u003e] stub_clone+0x13/0x20\n [\u003cffffffff8100b072\u003e] ? system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Daisuke Nishimura \u003cnishimura@mxp.nes.nec.co.jp\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/039601ceae06$733d3130$59b79390$@mxp.nes.nec.co.jp\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "55e3e1f419f0c387a2b971cc181b8dea1b099d1d", "tree": "79470f040f2886669d9fb0ecce2882e875fb976f", "parents": [ "31eafff4382b0f20edce1afea8e2d288c6c7187c" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Dec 18 10:35:02 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 29 09:50:12 2013 -0700" }, "message": "workqueue: consider work function when searching for busy work items\n\ncommit a2c1c57be8d9fd5b716113c8991d3d702eeacf77 upstream.\n\nTo avoid executing the same work item concurrenlty, workqueue hashes\ncurrently busy workers according to their current work items and looks\nup the the table when it wants to execute a new work item. If there\nalready is a worker which is executing the new work item, the new item\nis queued to the found worker so that it gets executed only after the\ncurrent execution finishes.\n\nUnfortunately, a work item may be freed while being executed and thus\nrecycled for different purposes. If it gets recycled for a different\nwork item and queued while the previous execution is still in\nprogress, workqueue may make the new work item wait for the old one\nalthough the two aren\u0027t really related in any way.\n\nIn extreme cases, this false dependency may lead to deadlock although\nit\u0027s extremely unlikely given that there aren\u0027t too many self-freeing\nwork item users and they usually don\u0027t wait for other work items.\n\nTo alleviate the problem, record the current work function in each\nbusy worker and match it together with the work item address in\nfind_worker_executing_work(). While this isn\u0027t complete, it ensures\nthat unrelated work items don\u0027t interact with each other and in the\nvery unlikely case where a twisted wq user triggers it, it\u0027s always\nonto itself making the culprit easy to spot.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Andrey Isakov \u003candy51@gmx.ru\u003e\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d51701\n[lizf: Backported to 3.4:\n - Adjust context\n - Incorporate earlier logging cleanup in process_one_work() from\n 044c782ce3a9 (\u0027workqueue: fix checkpatch issues\u0027)]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "31eafff4382b0f20edce1afea8e2d288c6c7187c", "tree": "77cbad322913848d13ecd4d0a3707fe86fd255c7", "parents": [ "67db9db0bfd9448feb8e69224dfbb83e5834082b" ], "author": { "name": "Lai Jiangshan", "email": "laijs@cn.fujitsu.com", "time": "Tue Sep 18 10:40:00 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 29 09:50:11 2013 -0700" }, "message": "workqueue: fix possible stall on try_to_grab_pending() of a delayed work item\n\ncommit 3aa62497594430ea522050b75c033f71f2c60ee6 upstream.\n\nCurrently, when try_to_grab_pending() grabs a delayed work item, it\nleaves its linked work items alone on the delayed_works. The linked\nwork items are always NO_COLOR and will cause future\ncwq_activate_first_delayed() increase cwq-\u003enr_active incorrectly, and\nmay cause the whole cwq to stall. For example,\n\nstate: cwq-\u003emax_active \u003d 1, cwq-\u003enr_active \u003d 1\n one work in cwq-\u003epool, many in cwq-\u003edelayed_works.\n\nstep1: try_to_grab_pending() removes a work item from delayed_works\n but leaves its NO_COLOR linked work items on it.\n\nstep2: Later on, cwq_activate_first_delayed() activates the linked\n work item increasing -\u003enr_active.\n\nstep3: cwq-\u003enr_active \u003d 1, but all activated work items of the cwq are\n NO_COLOR. When they finish, cwq-\u003enr_active will not be\n decreased due to NO_COLOR, and no further work items will be\n activated from cwq-\u003edelayed_works. the cwq stalls.\n\nFix it by ensuring the target work item is activated before stealing\nPENDING in try_to_grab_pending(). This ensures that all the linked\nwork items are activated without incorrectly bumping cwq-\u003enr_active.\n\ntj: Updated comment and description.\n\nSigned-off-by: Lai Jiangshan \u003claijs@cn.fujitsu.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n[lizf: backported to 3.4: adjust context]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a42efb79d54d9a13c8f68df122c832bca08b74ae", "tree": "b49010c84b42ccc5407766471bc94c95efe63d83", "parents": [ "4d5b24dd453b4ff44f69756106b029e8961dcb55" ], "author": { "name": "Zhang Yi", "email": "wetpzy@gmail.com", "time": "Tue Jun 25 21:19:31 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:28 2013 -0700" }, "message": "futex: Take hugepages into account when generating futex_key\n\ncommit 13d60f4b6ab5b702dc8d2ee20999f98a93728aec upstream.\n\nThe futex_keys of process shared futexes are generated from the page\noffset, the mapping host and the mapping index of the futex user space\naddress. This should result in an unique identifier for each futex.\n\nThough this is not true when futexes are located in different subpages\nof an hugepage. The reason is, that the mapping index for all those\nfutexes evaluates to the index of the base page of the hugetlbfs\nmapping. So a futex at offset 0 of the hugepage mapping and another\none at offset PAGE_SIZE of the same hugepage mapping have identical\nfutex_keys. This happens because the futex code blindly uses\npage-\u003eindex.\n\nSteps to reproduce the bug:\n\n1. Map a file from hugetlbfs. Initialize pthread_mutex1 at offset 0\n and pthread_mutex2 at offset PAGE_SIZE of the hugetlbfs\n mapping.\n\n The mutexes must be initialized as PTHREAD_PROCESS_SHARED because\n PTHREAD_PROCESS_PRIVATE mutexes are not affected by this issue as\n their keys solely depend on the user space address.\n\n2. Lock mutex1 and mutex2\n\n3. Create thread1 and in the thread function lock mutex1, which\n results in thread1 blocking on the locked mutex1.\n\n4. Create thread2 and in the thread function lock mutex2, which\n results in thread2 blocking on the locked mutex2.\n\n5. Unlock mutex2. Despite the fact that mutex2 got unlocked, thread2\n still blocks on mutex2 because the futex_key points to mutex1.\n\nTo solve this issue we need to take the normal page index of the page\nwhich contains the futex into account, if the futex is in an hugetlbfs\nmapping. In other words, we calculate the normal page mapping index of\nthe subpage in the hugetlbfs mapping.\n\nMappings which are not based on hugetlbfs are not affected and still\nuse page-\u003eindex.\n\nThanks to Mel Gorman who provided a patch for adding proper evaluation\nfunctions to the hugetlbfs code to avoid exposing hugetlbfs specific\ndetails to the futex code.\n\n[ tglx: Massaged changelog ]\n\nSigned-off-by: Zhang Yi \u003czhang.yi20@zte.com.cn\u003e\nReviewed-by: Jiang Biao \u003cjiang.biao2@zte.com.cn\u003e\nTested-by: Ma Chenggong \u003cma.chenggong@zte.com.cn\u003e\nReviewed-by: \u0027Mel Gorman\u0027 \u003cmgorman@suse.de\u003e\nAcked-by: \u0027Darren Hart\u0027 \u003cdvhart@linux.intel.com\u003e\nCc: \u0027Peter Zijlstra\u0027 \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/000101ce71a6%24a83c5880%24f8b50980%24@com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Mike Galbraith \u003cmgalbraith@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "99593eb7ca1dd9bfaa431d96e009eda23f001ace", "tree": "b1412f07fda67143bc2454bbb6f81e124cae3617", "parents": [ "65280b8ed1cca78ff7fe63ecfdb0fff87fe184a3" ], "author": { "name": "Andrew Vagin", "email": "avagin@openvz.org", "time": "Fri Aug 02 21:16:43 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:08 2013 -0700" }, "message": "tracing: Fix fields of struct trace_iterator that are zeroed by mistake\n\ncommit ed5467da0e369e65b247b99eb6403cb79172bcda upstream.\n\ntracing_read_pipe zeros all fields bellow \"seq\". The declaration contains\na comment about that, but it doesn\u0027t help.\n\nThe first field is \"snapshot\", it\u0027s true when current open file is\nsnapshot. Looks obvious, that it should not be zeroed.\n\nThe second field is \"started\". It was converted from cpumask_t to\ncpumask_var_t (v2.6.28-4983-g4462344), in other words it was\nconverted from cpumask to pointer on cpumask.\n\nCurrently the reference on \"started\" memory is lost after the first read\nfrom tracing_read_pipe and a proper object will never be freed.\n\nThe \"started\" is never dereferenced for trace_pipe, because trace_pipe\ncan\u0027t have the TRACE_FILE_ANNOTATE options.\n\nLink: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org\n\nSigned-off-by: Andrew Vagin \u003cavagin@openvz.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2d8be9cf0668fab848b9b7740f0725ae9181b703", "tree": "f0109a7365fc949575a152aaef0d2d0faf17ae67", "parents": [ "be1932db6f0ffc7504f8ef513515c292c466445c" ], "author": { "name": "Salman Qazi", "email": "sqazi@google.com", "time": "Thu Jun 14 15:31:09 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 11 15:38:43 2013 -0700" }, "message": "perf: Use css_tryget() to avoid propping up css refcount\n\ncommit 9c5da09d266ca9b32eb16cf940f8161d949c2fe5 upstream.\n\nAn rmdir pushes css\u0027s ref count to zero. However, if the associated\ndirectory is open at the time, the dentry ref count is non-zero. If\nthe fd for this directory is then passed into perf_event_open, it\ndoes a css_get(). This bounces the ref count back up from zero. This\nis a problem by itself. But what makes it turn into a crash is the\nfact that we end up doing an extra dput, since we perform a dput\nwhen css_put sees the ref count go down to zero.\n\ncss_tryget() does not fall into that trap. So, we use that instead.\n\nReproduction test-case for the bug:\n\n #include \u003cunistd.h\u003e\n #include \u003csys/types.h\u003e\n #include \u003csys/stat.h\u003e\n #include \u003cfcntl.h\u003e\n #include \u003clinux/unistd.h\u003e\n #include \u003clinux/perf_event.h\u003e\n #include \u003cstring.h\u003e\n #include \u003cerrno.h\u003e\n #include \u003cstdio.h\u003e\n\n #define PERF_FLAG_PID_CGROUP (1U \u003c\u003c 2)\n\n int perf_event_open(struct perf_event_attr *hw_event_uptr,\n pid_t pid, int cpu, int group_fd, unsigned long flags) {\n return syscall(__NR_perf_event_open,hw_event_uptr, pid, cpu,\n group_fd, flags);\n }\n\n /*\n * Directly poke at the perf_event bug, since it\u0027s proving hard to repro\n * depending on where in the kernel tree. what moved?\n */\n int main(int argc, char **argv)\n {\n int fd;\n struct perf_event_attr attr;\n memset(\u0026attr, 0, sizeof(attr));\n attr.exclude_kernel \u003d 1;\n attr.size \u003d sizeof(attr);\n mkdir(\"/dev/cgroup/perf_event/blah\", 0777);\n fd \u003d open(\"/dev/cgroup/perf_event/blah\", O_RDONLY);\n perror(\"open\");\n rmdir(\"/dev/cgroup/perf_event/blah\");\n sleep(2);\n perf_event_open(\u0026attr, fd, 0, -1, PERF_FLAG_PID_CGROUP);\n perror(\"perf_event_open\");\n close(fd);\n return 0;\n }\n\nSigned-off-by: Salman Qazi \u003csqazi@google.com\u003e\nSigned-off-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nLink: http://lkml.kernel.org/r/20120614223108.1025.2503.stgit@dungbeetle.mtv.corp.google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5cbff87c00cf1b8e3a077465e4ec501dd21651c8", "tree": "6c002b76a1801778a213b8b4884053488290192a", "parents": [ "6c9ef8363ab2802bb8f418f32bb9f83d48c9da2a" ], "author": { "name": "Jiri Olsa", "email": "jolsa@redhat.com", "time": "Fri Feb 01 11:23:45 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 11 15:38:43 2013 -0700" }, "message": "perf: Fix event group context move\n\ncommit 0231bb5336758426b44ccd798ccd3c5419c95d58 upstream.\n\nWhen we have group with mixed events (hw/sw) we want to end up\nwith group leader being in hw context. So if group leader is\ninitialy sw event, we move all the events under hw context.\n\nThe move is done for each event by removing it from its context\nand adding it back into proper one. As a part of the removal the\nevent is automatically disabled, which is not what we want at\nthis stage of creating groups.\n\nThe fix is to initialize event state after removal from sw\ncontext.\n\nThis fix resulted from the following discussion:\n\n http://thread.gmane.org/gmane.linux.kernel.perf.user/1144\n\nReported-by: Andreas Hollmann \u003chollmann@in.tum.de\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Corey Ashford \u003ccjashfor@linux.vnet.ibm.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nCc: Vince Weaver \u003cvince@deater.net\u003e\nLink: http://lkml.kernel.org/r/1359714225-4231-1-git-send-email-jolsa@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1836cd176170d39f5b1fda9cd47d3c3f0f10dad2", "tree": "6452080dec303b174785e4b68ffaff2673e2a33c", "parents": [ "ee9ef037ac99b542df34848fca2c9765910535e6" ], "author": { "name": "Zhu Yanhai", "email": "gaoyang.zyh@taobao.com", "time": "Tue Jan 08 12:56:52 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 11 15:38:43 2013 -0700" }, "message": "sched: Fix the broken sched_rr_get_interval()\n\ncommit a59f4e079d19464eebb9b06513a1d4f55fdae5ba upstream.\n\nThe caller of sched_sliced() should pass se.cfs_rq and se as the\narguments, however in sched_rr_get_interval() we gave it\nrq.cfs_rq and se, which made the following computation obviously\nwrong.\n\nThe change was introduced by commit:\n\n 77034937dc45 sched: fix crash in sys_sched_rr_get_interval()\n\n... 5 years ago, while it had been the correct \u0027cfs_rq_of\u0027 before\nthe commit. The change seems to be irrelevant to the commit\nmsg, which was to return a 0 timeslice for tasks that are on an\nidle runqueue. So I believe that was just a plain typo.\n\nSigned-off-by: Zhu Yanhai \u003cgaoyang.zyh@taobao.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Paul Turner \u003cpjt@google.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/1357621012-15039-1-git-send-email-gaoyang.zyh@taobao.com\n[ Since this is an ABI and an old bug, we\u0027ll test this via a\n slow upstream route, to hopefully discover any app breakage. ]\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "352b6418a2d14c754b41f23e0698f0006c914b95", "tree": "381768caaaa7dcaa97e24c51ca84830ecd9cca6e", "parents": [ "e5f8b2d71c3b617d2d5ce9568067b1458b47a517" ], "author": { "name": "zhangwei(Jovi)", "email": "jovi.zhangwei@huawei.com", "time": "Mon Jul 29 09:33:58 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:25:45 2013 +0800" }, "message": "tracing: Fix irqs-off tag display in syscall tracing\n\ncommit 11034ae9c20f4057a6127fc965906417978e69b2 upstream\n\nInitialization of variable irq_flags and pc was missed when backport\n11034ae9c to linux-3.0.y and linux-3.4.y, my fault.\n\nSigned-off-by: zhangwei(Jovi) \u003cjovi.zhangwei@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "39367f485b87492a5e51af8496a684eafa4aec86", "tree": "53b728ea867eaaced43fa13a3fd77233b5e997ca", "parents": [ "f36a0d6764dcb33a280dce206f1be4bcaff5714e" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Jul 05 12:09:18 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:47 2013 -0700" }, "message": "hrtimers: Move SMP function call to thread context\n\ncommit 5ec2481b7b47a4005bb446d176e5d0257400c77d upstream.\n\nsmp_call_function_* must not be called from softirq context.\n\nBut clock_was_set() which calls on_each_cpu() is called from softirq\ncontext to implement a delayed clock_was_set() for the timer interrupt\nhandler. Though that almost never gets invoked. A recent change in the\nresume code uses the softirq based delayed clock_was_set to support\nXens resume mechanism.\n\nlinux-next contains a new warning which warns if smp_call_function_*\nis called from softirq context which gets triggered by that Xen\nchange.\n\nFix this by moving the delayed clock_was_set() call to a work context.\n\nReported-and-tested-by: Artem Savkov \u003cartem.savkov@gmail.com\u003e\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nCc: David Vrabel \u003cdavid.vrabel@citrix.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e,\nCc: Konrad Wilk \u003ckonrad.wilk@oracle.com\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: xen-devel@lists.xen.org\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f36a0d6764dcb33a280dce206f1be4bcaff5714e", "tree": "39e30c2832c12b3ad897df6fbf4e97a252887d44", "parents": [ "e2f918414ca99c5321ad352fa6dfa3147e3e31d8" ], "author": { "name": "zhangwei(Jovi)", "email": "jovi.zhangwei@huawei.com", "time": "Wed Apr 10 11:26:23 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:46 2013 -0700" }, "message": "tracing: Fix irqs-off tag display in syscall tracing\n\ncommit 11034ae9c20f4057a6127fc965906417978e69b2 upstream.\n\nAll syscall tracing irqs-off tags are wrong, the syscall enter entry doesn\u0027t\ndisable irqs.\n\n [root@jovi tracing]#echo \"syscalls:sys_enter_open\" \u003e set_event\n [root@jovi tracing]# cat trace\n # tracer: nop\n #\n # entries-in-buffer/entries-written: 13/13 #P:2\n #\n # _-----\u003d\u003e irqs-off\n # / _----\u003d\u003e need-resched\n # | / _---\u003d\u003e hardirq/softirq\n # || / _--\u003d\u003e preempt-depth\n # ||| / delay\n # TASK-PID CPU# |||| TIMESTAMP FUNCTION\n # | | | |||| | |\n irqbalance-513 [000] d... 56115.496766: sys_open(filename: 804e1a6, flags: 0, mode: 1b6)\n irqbalance-513 [000] d... 56115.497008: sys_open(filename: 804e1bb, flags: 0, mode: 1b6)\n sendmail-771 [000] d... 56115.827982: sys_open(filename: b770e6d1, flags: 0, mode: 1b6)\n\nThe reason is syscall tracing doesn\u0027t record irq_flags into buffer.\nThe proper display is:\n\n [root@jovi tracing]#echo \"syscalls:sys_enter_open\" \u003e set_event\n [root@jovi tracing]# cat trace\n # tracer: nop\n #\n # entries-in-buffer/entries-written: 14/14 #P:2\n #\n # _-----\u003d\u003e irqs-off\n # / _----\u003d\u003e need-resched\n # | / _---\u003d\u003e hardirq/softirq\n # || / _--\u003d\u003e preempt-depth\n # ||| / delay\n # TASK-PID CPU# |||| TIMESTAMP FUNCTION\n # | | | |||| | |\n irqbalance-514 [001] .... 46.213921: sys_open(filename: 804e1a6, flags: 0, mode: 1b6)\n irqbalance-514 [001] .... 46.214160: sys_open(filename: 804e1bb, flags: 0, mode: 1b6)\n \u003c...\u003e-920 [001] .... 47.307260: sys_open(filename: 4e82a0c5, flags: 80000, mode: 0)\n\nLink: http://lkml.kernel.org/r/1365564393-10972-3-git-send-email-jovi.zhangwei@huawei.com\n\nCc: stable@vger.kernel.org # 2.6.35\nSigned-off-by: zhangwei(Jovi) \u003cjovi.zhangwei@huawei.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "41154a356f6516ffa266e50ff7d1bf706893dfe3", "tree": "c42911b2319dfe276ebc9e14476ae317ece83020", "parents": [ "1f11f44083bca90ce4f534023658d481b5707d94" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Fri Jul 12 11:08:33 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:48 2013 -0700" }, "message": "perf: Fix perf_lock_task_context() vs RCU\n\ncommit 058ebd0eba3aff16b144eabf4510ed9510e1416e upstream.\n\nJiri managed to trigger this warning:\n\n [] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [] [ INFO: possible circular locking dependency detected ]\n [] 3.10.0+ #228 Tainted: G W\n [] -------------------------------------------------------\n [] p/6613 is trying to acquire lock:\n [] (rcu_node_0){..-...}, at: [\u003cffffffff810ca797\u003e] rcu_read_unlock_special+0xa7/0x250\n []\n [] but task is already holding lock:\n [] (\u0026ctx-\u003elock){-.-...}, at: [\u003cffffffff810f2879\u003e] perf_lock_task_context+0xd9/0x2c0\n []\n [] which lock already depends on the new lock.\n []\n [] the existing dependency chain (in reverse order) is:\n []\n [] -\u003e #4 (\u0026ctx-\u003elock){-.-...}:\n [] -\u003e #3 (\u0026rq-\u003elock){-.-.-.}:\n [] -\u003e #2 (\u0026p-\u003epi_lock){-.-.-.}:\n [] -\u003e #1 (\u0026rnp-\u003enocb_gp_wq[1]){......}:\n [] -\u003e #0 (rcu_node_0){..-...}:\n\nPaul was quick to explain that due to preemptible RCU we cannot call\nrcu_read_unlock() while holding scheduler (or nested) locks when part\nof the read side critical section was preemptible.\n\nTherefore solve it by making the entire RCU read side non-preemptible.\n\nAlso pull out the retry from under the non-preempt to play nice with RT.\n\nReported-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nHelped-out-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1f11f44083bca90ce4f534023658d481b5707d94", "tree": "0813157a3ebf651d5a1e897454dd9f0c18272f53", "parents": [ "c4c6a6ea3adbe790d81ef72f623e22591704fdb9" ], "author": { "name": "Jiri Olsa", "email": "jolsa@redhat.com", "time": "Tue Jul 09 17:44:11 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:48 2013 -0700" }, "message": "perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid scenario\n\ncommit 06f417968beac6e6b614e17b37d347aa6a6b1d30 upstream.\n\nThe \u0027!ctx-\u003eis_active\u0027 check has a valid scenario, so\nthere\u0027s no need for the warning.\n\nThe reason is that there\u0027s a time window between the\n\u0027ctx-\u003eis_active\u0027 check in the perf_event_enable() function\nand the __perf_event_enable() function having:\n\n - IRQs on\n - ctx-\u003elock unlocked\n\nwhere the task could be killed and \u0027ctx\u0027 deactivated by\nperf_event_exit_task(), ending up with the warning below.\n\nSo remove the WARN_ON_ONCE() check and add comments to\nexplain it all.\n\nThis addresses the following warning reported by Vince Weaver:\n\n[ 324.983534] ------------[ cut here ]------------\n[ 324.984420] WARNING: at kernel/events/core.c:1953 __perf_event_enable+0x187/0x190()\n[ 324.984420] Modules linked in:\n[ 324.984420] CPU: 19 PID: 2715 Comm: nmi_bug_snb Not tainted 3.10.0+ #246\n[ 324.984420] Hardware name: Supermicro X8DTN/X8DTN, BIOS 4.6.3 01/08/2010\n[ 324.984420] 0000000000000009 ffff88043fce3ec8 ffffffff8160ea0b ffff88043fce3f00\n[ 324.984420] ffffffff81080ff0 ffff8802314fdc00 ffff880231a8f800 ffff88043fcf7860\n[ 324.984420] 0000000000000286 ffff880231a8f800 ffff88043fce3f10 ffffffff8108103a\n[ 324.984420] Call Trace:\n[ 324.984420] \u003cIRQ\u003e [\u003cffffffff8160ea0b\u003e] dump_stack+0x19/0x1b\n[ 324.984420] [\u003cffffffff81080ff0\u003e] warn_slowpath_common+0x70/0xa0\n[ 324.984420] [\u003cffffffff8108103a\u003e] warn_slowpath_null+0x1a/0x20\n[ 324.984420] [\u003cffffffff81134437\u003e] __perf_event_enable+0x187/0x190\n[ 324.984420] [\u003cffffffff81130030\u003e] remote_function+0x40/0x50\n[ 324.984420] [\u003cffffffff810e51de\u003e] generic_smp_call_function_single_interrupt+0xbe/0x130\n[ 324.984420] [\u003cffffffff81066a47\u003e] smp_call_function_single_interrupt+0x27/0x40\n[ 324.984420] [\u003cffffffff8161fd2f\u003e] call_function_single_interrupt+0x6f/0x80\n[ 324.984420] \u003cEOI\u003e [\u003cffffffff816161a1\u003e] ? _raw_spin_unlock_irqrestore+0x41/0x70\n[ 324.984420] [\u003cffffffff8113799d\u003e] perf_event_exit_task+0x14d/0x210\n[ 324.984420] [\u003cffffffff810acd04\u003e] ? switch_task_namespaces+0x24/0x60\n[ 324.984420] [\u003cffffffff81086946\u003e] do_exit+0x2b6/0xa40\n[ 324.984420] [\u003cffffffff8161615c\u003e] ? _raw_spin_unlock_irq+0x2c/0x30\n[ 324.984420] [\u003cffffffff81087279\u003e] do_group_exit+0x49/0xc0\n[ 324.984420] [\u003cffffffff81096854\u003e] get_signal_to_deliver+0x254/0x620\n[ 324.984420] [\u003cffffffff81043057\u003e] do_signal+0x57/0x5a0\n[ 324.984420] [\u003cffffffff8161a164\u003e] ? __do_page_fault+0x2a4/0x4e0\n[ 324.984420] [\u003cffffffff8161665c\u003e] ? retint_restore_args+0xe/0xe\n[ 324.984420] [\u003cffffffff816166cd\u003e] ? retint_signal+0x11/0x84\n[ 324.984420] [\u003cffffffff81043605\u003e] do_notify_resume+0x65/0x80\n[ 324.984420] [\u003cffffffff81616702\u003e] retint_signal+0x46/0x84\n[ 324.984420] ---[ end trace 442ec2f04db3771a ]---\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nSuggested-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Corey Ashford \u003ccjashfor@linux.vnet.ibm.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1373384651-6109-2-git-send-email-jolsa@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c4c6a6ea3adbe790d81ef72f623e22591704fdb9", "tree": "c5b11f6d4dfa366f85c86e153227a40b4146047b", "parents": [ "ca9c5a9c9bc8bcf8e7308013a08d214df6eee673" ], "author": { "name": "Jiri Olsa", "email": "jolsa@redhat.com", "time": "Tue Jul 09 17:44:10 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:48 2013 -0700" }, "message": "perf: Clone child context from parent context pmu\n\ncommit 734df5ab549ca44f40de0f07af1c8803856dfb18 upstream.\n\nCurrently when the child context for inherited events is\ncreated, it\u0027s based on the pmu object of the first event\nof the parent context.\n\nThis is wrong for the following scenario:\n\n - HW context having HW and SW event\n - HW event got removed (closed)\n - SW event stays in HW context as the only event\n and its pmu is used to clone the child context\n\nThe issue starts when the cpu context object is touched\nbased on the pmu context object (__get_cpu_context). In\nthis case the HW context will work with SW cpu context\nending up with following WARN below.\n\nFixing this by using parent context pmu object to clone\nfrom child context.\n\nAddresses the following warning reported by Vince Weaver:\n\n[ 2716.472065] ------------[ cut here ]------------\n[ 2716.476035] WARNING: at kernel/events/core.c:2122 task_ctx_sched_out+0x3c/0x)\n[ 2716.476035] Modules linked in: nfsd auth_rpcgss oid_registry nfs_acl nfs locn\n[ 2716.476035] CPU: 0 PID: 3164 Comm: perf_fuzzer Not tainted 3.10.0-rc4 #2\n[ 2716.476035] Hardware name: AOpen DE7000/nMCP7ALPx-DE R1.06 Oct.19.2012, BI2\n[ 2716.476035] 0000000000000000 ffffffff8102e215 0000000000000000 ffff88011fc18\n[ 2716.476035] ffff8801175557f0 0000000000000000 ffff880119fda88c ffffffff810ad\n[ 2716.476035] ffff880119fda880 ffffffff810af02a 0000000000000009 ffff880117550\n[ 2716.476035] Call Trace:\n[ 2716.476035] [\u003cffffffff8102e215\u003e] ? warn_slowpath_common+0x5b/0x70\n[ 2716.476035] [\u003cffffffff810ab2bd\u003e] ? task_ctx_sched_out+0x3c/0x5f\n[ 2716.476035] [\u003cffffffff810af02a\u003e] ? perf_event_exit_task+0xbf/0x194\n[ 2716.476035] [\u003cffffffff81032a37\u003e] ? do_exit+0x3e7/0x90c\n[ 2716.476035] [\u003cffffffff810cd5ab\u003e] ? __do_fault+0x359/0x394\n[ 2716.476035] [\u003cffffffff81032fe6\u003e] ? do_group_exit+0x66/0x98\n[ 2716.476035] [\u003cffffffff8103dbcd\u003e] ? get_signal_to_deliver+0x479/0x4ad\n[ 2716.476035] [\u003cffffffff810ac05c\u003e] ? __perf_event_task_sched_out+0x230/0x2d1\n[ 2716.476035] [\u003cffffffff8100205d\u003e] ? do_signal+0x3c/0x432\n[ 2716.476035] [\u003cffffffff810abbf9\u003e] ? ctx_sched_in+0x43/0x141\n[ 2716.476035] [\u003cffffffff810ac2ca\u003e] ? perf_event_context_sched_in+0x7a/0x90\n[ 2716.476035] [\u003cffffffff810ac311\u003e] ? __perf_event_task_sched_in+0x31/0x118\n[ 2716.476035] [\u003cffffffff81050dd9\u003e] ? mmdrop+0xd/0x1c\n[ 2716.476035] [\u003cffffffff81051a39\u003e] ? finish_task_switch+0x7d/0xa6\n[ 2716.476035] [\u003cffffffff81002473\u003e] ? do_notify_resume+0x20/0x5d\n[ 2716.476035] [\u003cffffffff813654f5\u003e] ? retint_signal+0x3d/0x78\n[ 2716.476035] ---[ end trace 827178d8a5966c3d ]---\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Corey Ashford \u003ccjashfor@linux.vnet.ibm.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/1373384651-6109-1-git-send-email-jolsa@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d018274f859ae2cfbe86646948b65a4edd0d335f", "tree": "fe9f668b148a0981ffccee200c9c6da59f86d288", "parents": [ "39d2dd53da0ef0be782387f79fe6bfefc0808629" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Thu May 30 21:10:37 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:47 2013 -0700" }, "message": "tracing: Use current_uid() for critical time tracing\n\ncommit f17a5194859a82afe4164e938b92035b86c55794 upstream.\n\nThe irqsoff tracer records the max time that interrupts are disabled.\nThere are hooks in the assembly code that calls back into the tracer when\ninterrupts are disabled or enabled.\n\nWhen they are enabled, the tracer checks if the amount of time they\nwere disabled is larger than the previous recorded max interrupts off\ntime. If it is, it creates a snapshot of the currently running trace\nto store where the last largest interrupts off time was held and how\nit happened.\n\nDuring testing, this RCU lockdep dump appeared:\n\n[ 1257.829021] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 1257.829021] [ INFO: suspicious RCU usage. ]\n[ 1257.829021] 3.10.0-rc1-test+ #171 Tainted: G W\n[ 1257.829021] -------------------------------\n[ 1257.829021] /home/rostedt/work/git/linux-trace.git/include/linux/rcupdate.h:780 rcu_read_lock() used illegally while idle!\n[ 1257.829021]\n[ 1257.829021] other info that might help us debug this:\n[ 1257.829021]\n[ 1257.829021]\n[ 1257.829021] RCU used illegally from idle CPU!\n[ 1257.829021] rcu_scheduler_active \u003d 1, debug_locks \u003d 0\n[ 1257.829021] RCU used illegally from extended quiescent state!\n[ 1257.829021] 2 locks held by trace-cmd/4831:\n[ 1257.829021] #0: (max_trace_lock){......}, at: [\u003cffffffff810e2b77\u003e] stop_critical_timing+0x1a3/0x209\n[ 1257.829021] #1: (rcu_read_lock){.+.+..}, at: [\u003cffffffff810dae5a\u003e] __update_max_tr+0x88/0x1ee\n[ 1257.829021]\n[ 1257.829021] stack backtrace:\n[ 1257.829021] CPU: 3 PID: 4831 Comm: trace-cmd Tainted: G W 3.10.0-rc1-test+ #171\n[ 1257.829021] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007\n[ 1257.829021] 0000000000000001 ffff880065f49da8 ffffffff8153dd2b ffff880065f49dd8\n[ 1257.829021] ffffffff81092a00 ffff88006bd78680 ffff88007add7500 0000000000000003\n[ 1257.829021] ffff88006bd78680 ffff880065f49e18 ffffffff810daebf ffffffff810dae5a\n[ 1257.829021] Call Trace:\n[ 1257.829021] [\u003cffffffff8153dd2b\u003e] dump_stack+0x19/0x1b\n[ 1257.829021] [\u003cffffffff81092a00\u003e] lockdep_rcu_suspicious+0x109/0x112\n[ 1257.829021] [\u003cffffffff810daebf\u003e] __update_max_tr+0xed/0x1ee\n[ 1257.829021] [\u003cffffffff810dae5a\u003e] ? __update_max_tr+0x88/0x1ee\n[ 1257.829021] [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021] [\u003cffffffff810dbf85\u003e] update_max_tr_single+0x11d/0x12d\n[ 1257.829021] [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021] [\u003cffffffff810e2b15\u003e] stop_critical_timing+0x141/0x209\n[ 1257.829021] [\u003cffffffff8109569a\u003e] ? trace_hardirqs_on+0xd/0xf\n[ 1257.829021] [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021] [\u003cffffffff810e3057\u003e] time_hardirqs_on+0x2a/0x2f\n[ 1257.829021] [\u003cffffffff811002b9\u003e] ? user_enter+0xfd/0x107\n[ 1257.829021] [\u003cffffffff8109550c\u003e] trace_hardirqs_on_caller+0x16/0x197\n[ 1257.829021] [\u003cffffffff8109569a\u003e] trace_hardirqs_on+0xd/0xf\n[ 1257.829021] [\u003cffffffff811002b9\u003e] user_enter+0xfd/0x107\n[ 1257.829021] [\u003cffffffff810029b4\u003e] do_notify_resume+0x92/0x97\n[ 1257.829021] [\u003cffffffff8154bdca\u003e] int_signal+0x12/0x17\n\nWhat happened was entering into the user code, the interrupts were enabled\nand a max interrupts off was recorded. The trace buffer was saved along with\nvarious information about the task: comm, pid, uid, priority, etc.\n\nThe uid is recorded with task_uid(tsk). But this is a macro that uses rcu_read_lock()\nto retrieve the data, and this happened to happen where RCU is blind (user_enter).\n\nAs only the preempt and irqs off tracers can have this happen, and they both\nonly have the tsk \u003d\u003d current, if tsk \u003d\u003d current, use current_uid() instead of\ntask_uid(), as current_uid() does not use RCU as only current can change its uid.\n\nThis fixes the RCU suspicious splat.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "60a0c1a6129d06f1f6bc71acd50c8d289484c7ea", "tree": "ce74c210c62dc509861027b92c1923e44c504f50", "parents": [ "8899476bd4758c47c2e4e4b92bb64fb9177b0c28" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Jul 01 22:14:10 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:44 2013 -0700" }, "message": "tick: Prevent uncontrolled switch to oneshot mode\n\ncommit 1f73a9806bdd07a5106409bbcab3884078bd34fe upstream.\n\nWhen the system switches from periodic to oneshot mode, the broadcast\nlogic causes a possibility that a CPU which has not yet switched to\noneshot mode puts its own clock event device into oneshot mode without\nupdating the state and the timer handler.\n\nCPU0\t\t\t\tCPU1\n\t\t\t\tper cpu tickdev is in periodic mode\n\t\t\t\tand switched to broadcast\n\nSwitch to oneshot mode\n tick_broadcast_switch_to_oneshot()\n cpumask_copy(tick_oneshot_broacast_mask,\n\t tick_broadcast_mask);\n\n broadcast device mode \u003d oneshot\n\n\t\t\t\tTimer interrupt\n\n\t\t\t\tirq_enter()\n\t\t\t\t tick_check_oneshot_broadcast()\n\t\t\t\t dev-\u003eset_mode(ONESHOT);\n\n\t\t\t\ttick_handle_periodic()\n\t\t\t\t if (dev-\u003emode \u003d\u003d ONESHOT)\n\t\t\t\t dev-\u003enext_event +\u003d period;\n\t\t\t\t FAIL.\n\nWe fail, because dev-\u003enext_event contains KTIME_MAX, if the device was\nin periodic mode before the uncontrolled switch to oneshot happened.\n\nWe must copy the broadcast bits over to the oneshot mask, because\notherwise a CPU which relies on the broadcast would not been woken up\nanymore after the broadcast device switched to oneshot mode.\n\nSo we need to verify in tick_check_oneshot_broadcast() whether the CPU\nhas already switched to oneshot mode. If not, leave the device\nuntouched and let the CPU switch controlled into oneshot mode.\n\nThis is a long standing bug, which was never noticed, because the main\nuser of the broadcast x86 cannot run into that scenario, AFAICT. The\nnonarchitected timer mess of ARM creates a gazillion of differently\nbroken abominations which trigger the shortcomings of that broadcast\ncode, which better had never been necessary in the first place.\n\nReported-and-tested-by: Stehle Vincent-B46079 \u003cB46079@freescale.com\u003e\nReviewed-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e,\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nLink: http://lkml.kernel.org/r/alpine.DEB.2.02.1307012153060.4013@ionos.tec.linutronix.de\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7b1648b7dc2f1954a3492e5127a4b6a408814964", "tree": "db0999d2cdd59238bfcf1da4f34598b570061f26", "parents": [ "9d57dc4b0be6fe82b22dc310724a79a728b48147" ], "author": { "name": "Bart Van Assche", "email": "bart.vanassche@gmail.com", "time": "Tue May 21 20:43:50 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:01 2013 -0700" }, "message": "timer: Fix jiffies wrap behavior of round_jiffies_common()\n\ncommit 9e04d3804d3ac97d8c03a41d78d0f0674b5d01e1 upstream.\n\nDirect compare of jiffies related values does not work in the wrap\naround case. Replace it with time_is_after_jiffies().\n\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nCc: Arjan van de Ven \u003carjan@infradead.org\u003e\nCc: Stephen Rothwell \u003csfr@canb.auug.org.au\u003e\nLink: http://lkml.kernel.org/r/519BC066.5080600@acm.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f95bc0f79df33f63a1615d18c92abf829208e2a2", "tree": "a8d60e42979356fdc2569bd88394d87e5ebcd253", "parents": [ "a8fc29c2b3c5c9116f441ce599d7f82acc0f9795" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Fri Jun 28 02:40:30 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:01 2013 -0700" }, "message": "genirq: Fix can_request_irq() for IRQs without an action\n\ncommit 2779db8d37d4b542d9ca2575f5f178dbeaca6c86 upstream.\n\nCommit 02725e7471b8 (\u0027genirq: Use irq_get/put functions\u0027),\ninadvertently changed can_request_irq() to return 0 for IRQs that have\nno action. This causes pcibios_lookup_irq() to select only IRQs that\nalready have an action with IRQF_SHARED set, or to fail if there are\nnone. Change can_request_irq() to return 1 for IRQs that have no\naction (if the first two conditions are met).\n\nReported-by: Bjarni Ingi Gislason \u003cbjarniig@rhi.hi.is\u003e\nTested-by: Bjarni Ingi Gislason \u003cbjarniig@rhi.hi.is\u003e (against 3.2)\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: 709647@bugs.debian.org\nLink: http://bugs.debian.org/709647\nLink: http://lkml.kernel.org/r/1372383630.23847.40.camel@deadeye.wl.decadent.org.uk\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6d96e9394365dfddf5d418d8178ce2a503448c29", "tree": "356dfe3055d85c2198b9351f5c8d3d410000a3ed", "parents": [ "36c982c1c71b5bb35d06d46ffb82593bf8dbe8c7" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 11 14:04:48 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jul 13 11:03:41 2013 -0700" }, "message": "Revert \"sched: Add missing call to calc_load_exit_idle()\"\n\nThis reverts commit 48f0f14ffb6ff4852922994d11fbda418d40100e which was\ncommit 749c8814f08f12baa4a9c2812a7c6ede7d69507d upstream.\n\nIt seems to be misapplied, and not needed for 3.4-stable\n\nReported-by: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nCc: Charles Wang \u003cmuming.wq@taobao.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "703197b61d05f5edae54bad3256901c5a5c8794c", "tree": "68a7a7ea0fbf0348291f74075795fee86566b87c", "parents": [ "535fad87e86d33ea41d4b8580fadf62f5865ae6b" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Jun 04 10:44:21 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:06 2013 -0700" }, "message": "perf: Fix mmap() accounting hole\n\ncommit 9bb5d40cd93c9dd4be74834b1dcb1ba03629716b upstream.\n\nVince\u0027s fuzzer once again found holes. This time it spotted a leak in\nthe locked page accounting.\n\nWhen an event had redirected output and its close() was the last\nreference to the buffer we didn\u0027t have a vm context to undo accounting.\n\nChange the code to destroy the buffer on the last munmap() and detach\nall redirected events at that time. This provides us the right context\nto undo the vm accounting.\n\n[Backporting for 3.4-stable.\nVM_RESERVED flag was replaced with pair \u0027VM_DONTEXPAND | VM_DONTDUMP\u0027 in\n314e51b9 since 3.7.0-rc1, and 314e51b9 comes from a big patchset, we didn\u0027t\nbackport the patchset, so I restored \u0027VM_DNOTEXPAND | VM_DONTDUMP\u0027 as before:\n-\tvma-\u003evm_flags |\u003d VM_DONTCOPY | VM_DONTEXPAND | VM_DONTDUMP;\n+\tvma-\u003evm_flags |\u003d VM_DONTCOPY | VM_RESERVED;\n -- zliu]\n\nReported-and-tested-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20130604084421.GI8923@twins.programming.kicks-ass.net\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Zhouping Liu \u003czliu@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "535fad87e86d33ea41d4b8580fadf62f5865ae6b", "tree": "144c7d400374a57142d4e176c6f0ac34ba926028", "parents": [ "5d2a2c717306c11672aef8ca6a1535ff78f57fa8" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue May 28 10:55:48 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:06 2013 -0700" }, "message": "perf: Fix perf mmap bugs\n\ncommit 26cb63ad11e04047a64309362674bcbbd6a6f246 upstream.\n\nVince reported a problem found by his perf specific trinity\nfuzzer.\n\nAl noticed 2 problems with perf\u0027s mmap():\n\n - it has issues against fork() since we use vma-\u003evm_mm for accounting.\n - it has an rb refcount leak on double mmap().\n\nWe fix the issues against fork() by using VM_DONTCOPY; I don\u0027t\nthink there\u0027s code out there that uses this; we didn\u0027t hear\nabout weird accounting problems/crashes. If we do need this to\nwork, the previously proposed VM_PINNED could make this work.\n\nAside from the rb reference leak spotted by Al, Vince\u0027s example\nprog was indeed doing a double mmap() through the use of\nperf_event_set_output().\n\nThis exposes another problem, since we now have 2 events with\none buffer, the accounting gets screwy because we account per\nevent. Fix this by making the buffer responsible for its own\naccounting.\n\n[Backporting for 3.4-stable.\nVM_RESERVED flag was replaced with pair \u0027VM_DONTEXPAND | VM_DONTDUMP\u0027 in\n314e51b9 since 3.7.0-rc1, and 314e51b9 comes from a big patchset, we didn\u0027t\nbackport the patchset, so I restored \u0027VM_DNOTEXPAND | VM_DONTDUMP\u0027 as before:\n- vma-\u003evm_flags |\u003d VM_DONTCOPY | VM_DONTEXPAND | VM_DONTDUMP;\n+ vma-\u003evm_flags |\u003d VM_DONTCOPY | VM_RESERVED;\n -- zliu]\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nLink: http://lkml.kernel.org/r/20130528085548.GA12193@twins.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Zhouping Liu \u003czliu@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ed0b72ac1e4361d9aaf2922adfba4a263cc37e03", "tree": "a650fbbca90c4af7fd3bc08ca549b6d08995b6bc", "parents": [ "630493e2e96ab876b8085a3352e255d2f56be75c" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Thu Jun 20 17:50:09 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:01 2013 -0700" }, "message": "hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()\n\ncommit c790b0ad23f427c7522ffed264706238c57c007e upstream.\n\nfetch_bp_busy_slots() and toggle_bp_slot() use\nfor_each_online_cpu(), this is obviously wrong wrt cpu_up() or\ncpu_down(), we can over/under account the per-cpu numbers.\n\nFor example:\n\n\t# echo 0 \u003e\u003e /sys/devices/system/cpu/cpu1/online\n\t# perf record -e mem:0x10 -p 1 \u0026\n\t# echo 1 \u003e\u003e /sys/devices/system/cpu/cpu1/online\n\t# perf record -e mem:0x10,mem:0x10,mem:0x10,mem:0x10 -C1 -a \u0026\n\t# taskset -p 0x2 1\n\ntriggers the same WARN_ONCE(\"Can\u0027t find any breakpoint slot\") in\narch_install_hw_breakpoint().\n\nReported-by: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-by: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nLink: http://lkml.kernel.org/r/20130620155009.GA6327@redhat.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fc1cbc74d5de169112578e4479d48408b222e325", "tree": "06735eb64dfd3b9610826f61c668ee1ec12c2e05", "parents": [ "b3cba474228862814480d40554f77e98483f41ed" ], "author": { "name": "Robin Holt", "email": "holt@sgi.com", "time": "Wed Jun 12 14:04:37 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:45 2013 -0700" }, "message": "reboot: rigrate shutdown/reboot to boot cpu\n\ncommit cf7df378aa4ff7da3a44769b7ff6e9eef1a9f3db upstream.\n\nWe recently noticed that reboot of a 1024 cpu machine takes approx 16\nminutes of just stopping the cpus. The slowdown was tracked to commit\nf96972f2dc63 (\"kernel/sys.c: call disable_nonboot_cpus() in\nkernel_restart()\").\n\nThe current implementation does all the work of hot removing the cpus\nbefore halting the system. We are switching to just migrating to the\nboot cpu and then continuing with shutdown/reboot.\n\nThis also has the effect of not breaking x86\u0027s command line parameter\nfor specifying the reboot cpu. Note, this code was shamelessly copied\nfrom arch/x86/kernel/reboot.c with bits removed pertaining to the\nreboot_cpu command line parameter.\n\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nTested-by: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nCc: \"Srivatsa S. Bhat\" \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Russ Anderson \u003crja@sgi.com\u003e\nCc: Robin Holt \u003cholt@sgi.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: Guan Xuetao \u003cgxt@mprc.pku.edu.cn\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b3cba474228862814480d40554f77e98483f41ed", "tree": "ac70cc8e20df21d9f64b27bd5f2318964b204cd1", "parents": [ "91c930674642f4b849d64398db261ad13c3ab354" ], "author": { "name": "Srivatsa S. Bhat", "email": "srivatsa.bhat@linux.vnet.ibm.com", "time": "Wed Jun 12 14:04:36 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:44 2013 -0700" }, "message": "CPU hotplug: provide a generic helper to disable/enable CPU hotplug\n\ncommit 16e53dbf10a2d7e228709a7286310e629ede5e45 upstream.\n\nThere are instances in the kernel where we would like to disable CPU\nhotplug (from sysfs) during some important operation. Today the freezer\ncode depends on this and the code to do it was kinda tailor-made for\nthat.\n\nRestructure the code and make it generic enough to be useful for other\nusecases too.\n\nSigned-off-by: Srivatsa S. Bhat \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nCc: H. Peter Anvin \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Russ Anderson \u003crja@sgi.com\u003e\nCc: Robin Holt \u003cholt@sgi.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nCc: Guan Xuetao \u003cgxt@mprc.pku.edu.cn\u003e\nCc: Shawn Guo \u003cshawn.guo@linaro.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bc4d36c41f16a66c320fd0282110ddc82aa1eb09", "tree": "4d15ef32790902916c0b92b33b299dfeb2834b5d", "parents": [ "3a22cc7f184b77731816e55662cd12f0c3d24d56" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jun 07 17:02:08 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 13 09:45:03 2013 -0700" }, "message": "ftrace: Move ftrace_filter_lseek out of CONFIG_DYNAMIC_FTRACE section\n\ncommit 7f49ef69db6bbf756c0abca7e9b65b32e999eec8 upstream.\n\nAs ftrace_filter_lseek is now used with ftrace_pid_fops, it needs to\nbe moved out of the #ifdef CONFIG_DYNAMIC_FTRACE section as the\nftrace_pid_fops is defined when DYNAMIC_FTRACE is not.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\n[ lizf: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3a22cc7f184b77731816e55662cd12f0c3d24d56", "tree": "ce3612a4ea2ec1ed53d5c98a24b88aa80067129c", "parents": [ "ce840e2f7825bfd240782dc209c2f2b8db514287" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Fri Jun 07 17:01:16 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 13 09:45:03 2013 -0700" }, "message": "tracing: Fix possible NULL pointer dereferences\n\ncommit 6a76f8c0ab19f215af2a3442870eeb5f0e81998d upstream.\n\nCurrently set_ftrace_pid and set_graph_function files use seq_lseek\nfor their fops. However seq_open() is called only for FMODE_READ in\nthe fops-\u003eopen() so that if an user tries to seek one of those file\nwhen she open it for writing, it sees NULL seq_file and then panic.\n\nIt can be easily reproduced with following command:\n\n $ cd /sys/kernel/debug/tracing\n $ echo 1234 | sudo tee -a set_ftrace_pid\n\nIn this example, GNU coreutils\u0027 tee opens the file with fopen(, \"a\")\nand then the fopen() internally calls lseek().\n\nLink:\nhttp://lkml.kernel.org/r/1365663302-2170-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n[ lizf: adjust context ]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "53b4378e4f77b7ab6565d6d40559bd5eb1b34629", "tree": "148210911b9a3072f9c3bc72b464606481e76bbd", "parents": [ "b58f2e1650eafddfdfcff2f4831bf2896f8c9bf6" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Thu May 16 17:43:55 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:50 2013 -0700" }, "message": "usermodehelper: check subprocess_info-\u003epath !\u003d NULL\n\ncommit 264b83c07a84223f0efd0d1db9ccc66d6f88288f upstream.\n\nargv_split(empty_or_all_spaces) happily succeeds, it simply returns\nargc \u003d\u003d 0 and argv[0] \u003d\u003d NULL. Change call_usermodehelper_exec() to\ncheck sub_info-\u003epath !\u003d NULL to avoid the crash.\n\nThis is the minimal fix, todo:\n\n - perhaps we should change argv_split() to return NULL or change the\n callers.\n\n - kill or justify -\u003epath[0] check\n\n - narrow the scope of helper_lock()\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nAcked-By: Lucas De Marchi \u003clucas.demarchi@intel.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cba998b9b3799a5d6861a969d7b7d9b4f4f181f6", "tree": "2fe75a00c6475f4e284dae7a737d0ab5f0f0e84d", "parents": [ "33b7cfcb34b4ae37cde7a8a1c97c9be27677e931" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Tue May 14 15:40:48 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:40 2013 -0700" }, "message": "tracing: Fix leaks of filter preds\n\ncommit 60705c89460fdc7227f2d153b68b3f34814738a4 upstream.\n\nSpecial preds are created when folding a series of preds that\ncan be done in serial. These are allocated in an ops field of\nthe pred structure. But they were never freed, causing memory\nleaks.\n\nThis was discovered using the kmemleak checker:\n\nunreferenced object 0xffff8800797fd5e0 (size 32):\n comm \"swapper/0\", pid 1, jiffies 4294690605 (age 104.608s)\n hex dump (first 32 bytes):\n 00 00 01 00 03 00 05 00 07 00 09 00 0b 00 0d 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003cffffffff814b52af\u003e] kmemleak_alloc+0x73/0x98\n [\u003cffffffff8111ff84\u003e] kmemleak_alloc_recursive.constprop.42+0x16/0x18\n [\u003cffffffff81120e68\u003e] __kmalloc+0xd7/0x125\n [\u003cffffffff810d47eb\u003e] kcalloc.constprop.24+0x2d/0x2f\n [\u003cffffffff810d4896\u003e] fold_pred_tree_cb+0xa9/0xf4\n [\u003cffffffff810d3781\u003e] walk_pred_tree+0x47/0xcc\n [\u003cffffffff810d5030\u003e] replace_preds.isra.20+0x6f8/0x72f\n [\u003cffffffff810d50b5\u003e] create_filter+0x4e/0x8b\n [\u003cffffffff81b1c30d\u003e] ftrace_test_event_filter+0x5a/0x155\n [\u003cffffffff8100028d\u003e] do_one_initcall+0xa0/0x137\n [\u003cffffffff81afbedf\u003e] kernel_init_freeable+0x14d/0x1dc\n [\u003cffffffff814b24b7\u003e] kernel_init+0xe/0xdb\n [\u003cffffffff814d539c\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffffffffffff\u003e] 0xffffffffffffffff\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Tom Zanussi \u003ctzanussi@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "33b7cfcb34b4ae37cde7a8a1c97c9be27677e931", "tree": "79d2091b2bcdfe3fda377633dc0322d0ce903781", "parents": [ "ed032fd4d81041e4002fc55ff1832ee588f103da" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri May 03 15:02:50 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:40 2013 -0700" }, "message": "tick: Cleanup NOHZ per cpu data on cpu down\n\ncommit 4b0c0f294f60abcdd20994a8341a95c8ac5eeb96 upstream.\n\nPrarit reported a crash on CPU offline/online. The reason is that on\nCPU down the NOHZ related per cpu data of the dead cpu is not cleaned\nup. If at cpu online an interrupt happens before the per cpu tick\ndevice is registered the irq_enter() check potentially sees stale data\nand dereferences a NULL pointer.\n\nCleanup the data after the cpu is dead.\n\nReported-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\nCc: Mike Galbraith \u003cbitbucket@online.de\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1305031451561.2886@ionos\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ed032fd4d81041e4002fc55ff1832ee588f103da", "tree": "7c7b9a9a90ea7bd6fb41e03de122b36b3a787e33", "parents": [ "ad86524f948c1914dbd5bc460a5c6fd131ec054a" ], "author": { "name": "Tirupathi Reddy", "email": "tirupath@codeaurora.org", "time": "Tue May 14 13:59:02 2013 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:39 2013 -0700" }, "message": "timer: Don\u0027t reinitialize the cpu base lock during CPU_UP_PREPARE\n\ncommit 42a5cf46cd56f46267d2a9fcf2655f4078cd3042 upstream.\n\nAn inactive timer\u0027s base can refer to a offline cpu\u0027s base.\n\nIn the current code, cpu_base\u0027s lock is blindly reinitialized each\ntime a CPU is brought up. If a CPU is brought online during the period\nthat another thread is trying to modify an inactive timer on that CPU\nwith holding its timer base lock, then the lock will be reinitialized\nunder its feet. This leads to following SPIN_BUG().\n\n\u003c0\u003e BUG: spinlock already unlocked on CPU#3, kworker/u:3/1466\n\u003c0\u003e lock: 0xe3ebe000, .magic: dead4ead, .owner: kworker/u:3/1466, .owner_cpu: 1\n\u003c4\u003e [\u003cc0013dc4\u003e] (unwind_backtrace+0x0/0x11c) from [\u003cc026e794\u003e] (do_raw_spin_unlock+0x40/0xcc)\n\u003c4\u003e [\u003cc026e794\u003e] (do_raw_spin_unlock+0x40/0xcc) from [\u003cc076c160\u003e] (_raw_spin_unlock+0x8/0x30)\n\u003c4\u003e [\u003cc076c160\u003e] (_raw_spin_unlock+0x8/0x30) from [\u003cc009b858\u003e] (mod_timer+0x294/0x310)\n\u003c4\u003e [\u003cc009b858\u003e] (mod_timer+0x294/0x310) from [\u003cc00a5e04\u003e] (queue_delayed_work_on+0x104/0x120)\n\u003c4\u003e [\u003cc00a5e04\u003e] (queue_delayed_work_on+0x104/0x120) from [\u003cc04eae00\u003e] (sdhci_msm_bus_voting+0x88/0x9c)\n\u003c4\u003e [\u003cc04eae00\u003e] (sdhci_msm_bus_voting+0x88/0x9c) from [\u003cc04d8780\u003e] (sdhci_disable+0x40/0x48)\n\u003c4\u003e [\u003cc04d8780\u003e] (sdhci_disable+0x40/0x48) from [\u003cc04bf300\u003e] (mmc_release_host+0x4c/0xb0)\n\u003c4\u003e [\u003cc04bf300\u003e] (mmc_release_host+0x4c/0xb0) from [\u003cc04c7aac\u003e] (mmc_sd_detect+0x90/0xfc)\n\u003c4\u003e [\u003cc04c7aac\u003e] (mmc_sd_detect+0x90/0xfc) from [\u003cc04c2504\u003e] (mmc_rescan+0x7c/0x2c4)\n\u003c4\u003e [\u003cc04c2504\u003e] (mmc_rescan+0x7c/0x2c4) from [\u003cc00a6a7c\u003e] (process_one_work+0x27c/0x484)\n\u003c4\u003e [\u003cc00a6a7c\u003e] (process_one_work+0x27c/0x484) from [\u003cc00a6e94\u003e] (worker_thread+0x210/0x3b0)\n\u003c4\u003e [\u003cc00a6e94\u003e] (worker_thread+0x210/0x3b0) from [\u003cc00aad9c\u003e] (kthread+0x80/0x8c)\n\u003c4\u003e [\u003cc00aad9c\u003e] (kthread+0x80/0x8c) from [\u003cc000ea80\u003e] (kernel_thread_exit+0x0/0x8)\n\nAs an example, this particular crash occurred when CPU #3 is executing\nmod_timer() on an inactive timer whose base is refered to offlined CPU\n#2. The code locked the timer_base corresponding to CPU #2. Before it\ncould proceed, CPU #2 came online and reinitialized the spinlock\ncorresponding to its base. Thus now CPU #3 held a lock which was\nreinitialized. When CPU #3 finally ended up unlocking the old cpu_base\ncorresponding to CPU #2, we hit the above SPIN_BUG().\n\nCPU #0\t\tCPU #3\t\t\t\t CPU #2\n------\t\t-------\t\t\t\t -------\n.....\t\t ......\t\t\t\t \u003cOffline\u003e\n\t\tmod_timer()\n\t\t lock_timer_base\n\t\t spin_lock_irqsave(\u0026base-\u003elock)\n\ncpu_up(2)\t .....\t\t\t\t ......\n\t\t\t\t\t\t\tinit_timers_cpu()\n....\t\t .....\t\t\t\t \tspin_lock_init(\u0026base-\u003elock)\n.....\t\t spin_unlock_irqrestore(\u0026base-\u003elock) ......\n\t\t \u003cspin_bug\u003e\n\nAllocation of per_cpu timer vector bases is done only once under\n\"tvec_base_done[]\" check. In the current code, spinlock_initialization\nof base-\u003elock isn\u0027t under this check. When a CPU is up each time the\nbase lock is reinitialized. Move base spinlock initialization under\nthe check.\n\nSigned-off-by: Tirupathi Reddy \u003ctirupath@codeaurora.org\u003e\nLink: http://lkml.kernel.org/r/1368520142-4136-1-git-send-email-tirupath@codeaurora.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e4727b26cd5c972a1688e23c877538ccdd5513be", "tree": "f600a5c94337ab2ab5c08c0fa6fccc2dfe9c2537", "parents": [ "dcf3dfc3242fffb483a84dede9b3759a9b488c94" ], "author": { "name": "Chen Gang", "email": "gang.chen@asianux.com", "time": "Mon Apr 29 15:05:19 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 11 13:48:14 2013 -0700" }, "message": "kernel/audit_tree.c: tree will leak memory when failure occurs in audit_trim_trees()\n\ncommit 12b2f117f3bf738c1a00a6f64393f1953a740bd4 upstream.\n\naudit_trim_trees() calls get_tree(). If a failure occurs we must call\nput_tree().\n\n[akpm@linux-foundation.org: run put_tree() before mutex_lock() for small scalability improvement]\nSigned-off-by: Chen Gang \u003cgang.chen@asianux.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Jonghwan Choi \u003cjhbird.choi@samsung.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dcf3dfc3242fffb483a84dede9b3759a9b488c94", "tree": "abfbf8826932b6459c7932c61452d5967a1183fc", "parents": [ "22d9af8fbdb154769a9802127d81f61077bf649b" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Fri Mar 15 13:10:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 11 13:48:14 2013 -0700" }, "message": "tracing: Fix ftrace_dump()\n\ncommit 7fe70b579c9e3daba71635e31b6189394e7b79d3 upstream.\n\nftrace_dump() had a lot of issues. What ftrace_dump() does, is when\nftrace_dump_on_oops is set (via a kernel parameter or sysctl), it\nwill dump out the ftrace buffers to the console when either a oops,\npanic, or a sysrq-z occurs.\n\nThis was written a long time ago when ftrace was fragile to recursion.\nBut it wasn\u0027t written well even for that.\n\nThere\u0027s a possible deadlock that can occur if a ftrace_dump() is happening\nand an NMI triggers another dump. This is because it grabs a lock\nbefore checking if the dump ran.\n\nIt also totally disables ftrace, and tracing for no good reasons.\n\nAs the ring_buffer now checks if it is read via a oops or NMI, where\nthere\u0027s a chance that the buffer gets corrupted, it will disable\nitself. No need to have ftrace_dump() do the same.\n\nftrace_dump() is now cleaned up where it uses an atomic counter to\nmake sure only one dump happens at a time. A simple atomic_inc_return()\nis enough that is needed for both other CPUs and NMIs. No need for\na spinlock, as if one CPU is running the dump, no other CPU needs\nto do it too.\n\nThe tracing_on variable is turned off and not turned on. The original\ncode did this, but it wasn\u0027t pretty. By just disabling this variable\nwe get the result of not seeing traces that happen between crashes.\n\nFor sysrq-z, it doesn\u0027t get turned on, but the user can always write\na \u00271\u0027 to the tracing_on file. If they are using sysrq-z, then they should\nknow about tracing_on.\n\nThe new code is much easier to read and less error prone. No more\ndeadlock possibility when an NMI triggers here.\n\nReported-by: zhangwei(Jovi) \u003cjovi.zhangwei@huawei.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "357093a8b82c10e6fff37d3c772ccc0e3b0549c4", "tree": "7dd7440413bebabe4173b2e34574582b28b07e32", "parents": [ "97630ecdbda8138baf35a66b6e59dee940da05e1" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Apr 25 11:45:53 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "clockevents: Set dummy handler on CPU_DEAD shutdown\n\ncommit 6f7a05d7018de222e40ca003721037a530979974 upstream.\n\nVitaliy reported that a per cpu HPET timer interrupt crashes the\nsystem during hibernation. What happens is that the per cpu HPET timer\ngets shut down when the nonboot cpus are stopped. When the nonboot\ncpus are onlined again the HPET code sets up the MSI interrupt which\nfires before the clock event device is registered. The event handler\nis still set to hrtimer_interrupt, which then crashes the machine due\nto highres mode not being active.\n\nSee http://bugs.debian.org/cgi-bin/bugreport.cgi?bug\u003d700333\n\nThere is no real good way to avoid that in the HPET code. The HPET\ncode alrady has a mechanism to detect spurious interrupts when event\nhandler \u003d\u003d NULL for a similar reason.\n\nWe can handle that in the clockevent/tick layer and replace the\nprevious functional handler with a dummy handler like we do in\ntick_setup_new_device().\n\nThe original clockevents code did this in clockevents_exchange_device(),\nbut that got removed by commit 7c1e76897 (clockevents: prevent\nclockevent event_handler ending up handler_noop) which forgot to fix\nit up in tick_shutdown(). Same issue with the broadcast device.\n\nReported-by: Vitaliy Fillipov \u003cvitalif@yourcmc.ru\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: 700333@bugs.debian.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "97630ecdbda8138baf35a66b6e59dee940da05e1", "tree": "455d48c2c0f99103af12d4790c88d52626a63990", "parents": [ "b593b4dc6442a5fd8a569fdbcc8cb5fa2609d1b1" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Tue Mar 12 15:36:00 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "cgroup: fix an off-by-one bug which may trigger BUG_ON()\n\ncommit 3ac1707a13a3da9cfc8f242a15b2fae6df2c5f88 upstream.\n\nThe 3rd parameter of flex_array_prealloc() is the number of elements,\nnot the index of the last element.\n\nThe effect of the bug is, when opening cgroup.procs, a flex array will\nbe allocated and all elements of the array is allocated with\nGFP_KERNEL flag, but the last one is GFP_ATOMIC, and if we fail to\nallocate memory for it, it\u0027ll trigger a BUG_ON().\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "194d30b3996940a012ed8265f3969f1f75ff7ec5", "tree": "868ee65fabc0ec7e028d76b62fd685dd1cb47196", "parents": [ "86a640faa8585b60b2f2f78dd9769e2cc939208f" ], "author": { "name": "Prarit Bhargava", "email": "prarit@redhat.com", "time": "Mon Apr 08 08:47:15 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:55 2013 -0700" }, "message": "hrtimer: Add expiry time overflow check in hrtimer_interrupt\n\ncommit 8f294b5a139ee4b75e890ad5b443c93d1e558a8b upstream.\n\nThe settimeofday01 test in the LTP testsuite effectively does\n\n gettimeofday(current time);\n settimeofday(Jan 1, 1970 + 100 seconds);\n settimeofday(current time);\n\nThis test causes a stack trace to be displayed on the console during the\nsetting of timeofday to Jan 1, 1970 + 100 seconds:\n\n[ 131.066751] ------------[ cut here ]------------\n[ 131.096448] WARNING: at kernel/time/clockevents.c:209 clockevents_program_event+0x135/0x140()\n[ 131.104935] Hardware name: Dinar\n[ 131.108150] Modules linked in: sg nfsv3 nfs_acl nfsv4 auth_rpcgss nfs dns_resolver fscache lockd sunrpc nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables kvm_amd kvm sp5100_tco bnx2 i2c_piix4 crc32c_intel k10temp fam15h_power ghash_clmulni_intel amd64_edac_mod pcspkr serio_raw edac_mce_amd edac_core microcode xfs libcrc32c sr_mod sd_mod cdrom ata_generic crc_t10dif pata_acpi radeon i2c_algo_bit drm_kms_helper ttm drm ahci pata_atiixp libahci libata usb_storage i2c_core dm_mirror dm_region_hash dm_log dm_mod\n[ 131.176784] Pid: 0, comm: swapper/28 Not tainted 3.8.0+ #6\n[ 131.182248] Call Trace:\n[ 131.184684] \u003cIRQ\u003e [\u003cffffffff810612af\u003e] warn_slowpath_common+0x7f/0xc0\n[ 131.191312] [\u003cffffffff8106130a\u003e] warn_slowpath_null+0x1a/0x20\n[ 131.197131] [\u003cffffffff810b9fd5\u003e] clockevents_program_event+0x135/0x140\n[ 131.203721] [\u003cffffffff810bb584\u003e] tick_program_event+0x24/0x30\n[ 131.209534] [\u003cffffffff81089ab1\u003e] hrtimer_interrupt+0x131/0x230\n[ 131.215437] [\u003cffffffff814b9600\u003e] ? cpufreq_p4_target+0x130/0x130\n[ 131.221509] [\u003cffffffff81619119\u003e] smp_apic_timer_interrupt+0x69/0x99\n[ 131.227839] [\u003cffffffff8161805d\u003e] apic_timer_interrupt+0x6d/0x80\n[ 131.233816] \u003cEOI\u003e [\u003cffffffff81099745\u003e] ? sched_clock_cpu+0xc5/0x120\n[ 131.240267] [\u003cffffffff814b9ff0\u003e] ? cpuidle_wrap_enter+0x50/0xa0\n[ 131.246252] [\u003cffffffff814b9fe9\u003e] ? cpuidle_wrap_enter+0x49/0xa0\n[ 131.252238] [\u003cffffffff814ba050\u003e] cpuidle_enter_tk+0x10/0x20\n[ 131.257877] [\u003cffffffff814b9c89\u003e] cpuidle_idle_call+0xa9/0x260\n[ 131.263692] [\u003cffffffff8101c42f\u003e] cpu_idle+0xaf/0x120\n[ 131.268727] [\u003cffffffff815f8971\u003e] start_secondary+0x255/0x257\n[ 131.274449] ---[ end trace 1151a50552231615 ]---\n\nWhen we change the system time to a low value like this, the value of\ntimekeeper-\u003eoffs_real will be a negative value.\n\nIt seems that the WARN occurs because an hrtimer has been started in the time\nbetween the releasing of the timekeeper lock and the IPI call (via a call to\non_each_cpu) in clock_was_set() in the do_settimeofday() code. The end result\nis that a REALTIME_CLOCK timer has been added with softexpires \u003d expires \u003d\nKTIME_MAX. The hrtimer_interrupt() fires/is called and the loop at\nkernel/hrtimer.c:1289 is executed. In this loop the code subtracts the\nclock base\u0027s offset (which was set to timekeeper-\u003eoffs_real in\ndo_settimeofday()) from the current hrtimer_cpu_base-\u003eexpiry value (which\nwas KTIME_MAX):\n\n\tKTIME_MAX - (a negative value) \u003d overflow\n\nA simple check for an overflow can resolve this problem. Using KTIME_MAX\ninstead of the overflow value will result in the hrtimer function being run,\nand the reprogramming of the timer after that.\n\nReviewed-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Prarit Bhargava \u003cprarit@redhat.com\u003e\n[jstultz: Tweaked commit subject]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "86a640faa8585b60b2f2f78dd9769e2cc939208f", "tree": "f91b3b3ee63b94b5b2c97690a1d6131332ce5a7d", "parents": [ "a91a9f1e121a879f742f4c1718d58ba94e046dee" ], "author": { "name": "David Engraf", "email": "david.engraf@sysgo.com", "time": "Tue Mar 19 13:29:55 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:55 2013 -0700" }, "message": "hrtimer: Fix ktime_add_ns() overflow on 32bit architectures\n\ncommit 51fd36f3fad8447c487137ae26b9d0b3ce77bb25 upstream.\n\nOne can trigger an overflow when using ktime_add_ns() on a 32bit\narchitecture not supporting CONFIG_KTIME_SCALAR.\n\nWhen passing a very high value for u64 nsec, e.g. 7881299347898368000\nthe do_div() function converts this value to seconds (7881299347) which\nis still to high to pass to the ktime_set() function as long. The result\nin is a negative value.\n\nThe problem on my system occurs in the tick-sched.c,\ntick_nohz_stop_sched_tick() when time_delta is set to\ntimekeeping_max_deferment(). The check for time_delta \u003c KTIME_MAX is\nvalid, thus ktime_add_ns() is called with a too large value resulting in\na negative expire value. This leads to an endless loop in the ticker code:\n\ntime_delta: 7881299347898368000\nexpires \u003d ktime_add_ns(last_update, time_delta)\nexpires: negative value\n\nThis fix caps the value to KTIME_MAX.\n\nThis error doesn\u0027t occurs on 64bit or architectures supporting\nCONFIG_KTIME_SCALAR (e.g. ARM, x86-32).\n\nSigned-off-by: David Engraf \u003cdavid.engraf@sysgo.com\u003e\n[jstultz: Minor tweaks to commit message \u0026 header]\nSigned-off-by: John Stultz \u003cjohn.stultz@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "761694a0bdc01817d1212b1127234dcaf828fde7", "tree": "cb2c7b2d912bbe675c86f854d86fa137bbdfbf87", "parents": [ "e1672f4e2c9fb1231a6242ca1596806f123da3c5" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Thu Apr 11 16:01:38 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Reset ftrace_graph_filter_enabled if count is zero\n\ncommit 9f50afccfdc15d95d7331acddcb0f7703df089ae upstream.\n\nThe ftrace_graph_count can be decreased with a \"!\" pattern, so that\nthe enabled flag should be updated too.\n\nLink: http://lkml.kernel.org/r/1365663698-2413-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e1672f4e2c9fb1231a6242ca1596806f123da3c5", "tree": "b36e7f377900905a74acc59a60b3b80035a328a6", "parents": [ "226c8ea60cfc71732ff2212fae71077789718e51" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Wed Apr 10 09:18:12 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Check return value of tracing_init_dentry()\n\ncommit ed6f1c996bfe4b6e520cf7a74b51cd6988d84420 upstream.\n\nCheck return value and bail out if it\u0027s NULL.\n\nLink: http://lkml.kernel.org/r/1365553093-10180-2-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "226c8ea60cfc71732ff2212fae71077789718e51", "tree": "2b732acfa2d9c2011645cec8ce97732748fc28fb", "parents": [ "d4ca6ccafc266cefbd004e515695cbeb1e8b8411" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Mon Apr 01 21:46:24 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Fix off-by-one on allocating stat-\u003epages\n\ncommit 39e30cd1537937d3c00ef87e865324e981434e5b upstream.\n\nThe first page was allocated separately, so no need to start from 0.\n\nLink: http://lkml.kernel.org/r/1364820385-32027-2-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d4ca6ccafc266cefbd004e515695cbeb1e8b8411", "tree": "ee4323abe88e7c646ccda4f23255cdfa5fe95eb3", "parents": [ "af1860122000cf090868fb7f7fbba7417e4575bd" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Mar 13 23:34:22 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Remove most or all of stack tracer stack size from stack_max_size\n\ncommit 4df297129f622bdc18935c856f42b9ddd18f9f28 upstream.\n\nCurrently, the depth reported in the stack tracer stack_trace file\ndoes not match the stack_max_size file. This is because the stack_max_size\nincludes the overhead of stack tracer itself while the depth does not.\n\nThe first time a max is triggered, a calculation is not performed that\nfigures out the overhead of the stack tracer and subtracts it from\nthe stack_max_size variable. The overhead is stored and is subtracted\nfrom the reported stack size for comparing for a new max.\n\nNow the stack_max_size corresponds to the reported depth:\n\n # cat stack_max_size\n4640\n\n # cat stack_trace\n Depth Size Location (48 entries)\n ----- ---- --------\n 0) 4640 32 _raw_spin_lock+0x18/0x24\n 1) 4608 112 ____cache_alloc+0xb7/0x22d\n 2) 4496 80 kmem_cache_alloc+0x63/0x12f\n 3) 4416 16 mempool_alloc_slab+0x15/0x17\n[...]\n\nWhile testing against and older gcc on x86 that uses mcount instead\nof fentry, I found that pasing in ip + MCOUNT_INSN_SIZE let the\nstack trace show one more function deep which was missing before.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "af1860122000cf090868fb7f7fbba7417e4575bd", "tree": "7b4b78cfbb68a81cb1463aaac0faa1b46e4052ec", "parents": [ "893238186e35bdd59efde4572bcb6d0653c0ec65" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Mar 13 21:25:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Fix stack tracer with fentry use\n\ncommit d4ecbfc49b4b1d4b597fb5ba9e4fa25d62f105c5 upstream.\n\nWhen gcc 4.6 on x86 is used, the function tracer will use the new\noption -mfentry which does a call to \"fentry\" at every function\ninstead of \"mcount\". The significance of this is that fentry is\ncalled as the first operation of the function instead of the mcount\nusage of being called after the stack.\n\nThis causes the stack tracer to show some bogus results for the size\nof the last function traced, as well as showing \"ftrace_call\" instead\nof the function. This is due to the stack frame not being set up\nby the function that is about to be traced.\n\n # cat stack_trace\n Depth Size Location (48 entries)\n ----- ---- --------\n 0) 4824 216 ftrace_call+0x5/0x2f\n 1) 4608 112 ____cache_alloc+0xb7/0x22d\n 2) 4496 80 kmem_cache_alloc+0x63/0x12f\n\nThe 216 size for ftrace_call includes both the ftrace_call stack\n(which includes the saving of registers it does), as well as the\nstack size of the parent.\n\nTo fix this, if CC_USING_FENTRY is defined, then the stack_tracer\nwill reserve the first item in stack_dump_trace[] array when\ncalling save_stack_trace(), and it will fill it in with the parent ip.\nThen the code will look for the parent pointer on the stack and\ngive the real size of the parent\u0027s stack pointer:\n\n # cat stack_trace\n Depth Size Location (14 entries)\n ----- ---- --------\n 0) 2640 48 update_group_power+0x26/0x187\n 1) 2592 224 update_sd_lb_stats+0x2a5/0x4ac\n 2) 2368 160 find_busiest_group+0x31/0x1f1\n 3) 2208 256 load_balance+0xd9/0x662\n\nI\u0027m Cc\u0027ing stable, although it\u0027s not urgent, as it only shows bogus\nsize for item #0, the rest of the trace is legit. It should still be\ncorrected in previous stable releases.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "893238186e35bdd59efde4572bcb6d0653c0ec65", "tree": "4da26b69bc9c3432a7a77c653f882ccd2ced8424", "parents": [ "a393520aa653a5e1133e14a1984b5e5815e01cf6" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Mar 13 20:43:57 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "tracing: Use stack of calling function for stack tracer\n\ncommit 87889501d0adfae10e3b0f0e6f2d7536eed9ae84 upstream.\n\nUse the stack of stack_trace_call() instead of check_stack() as\nthe test pointer for max stack size. It makes it a bit cleaner\nand a little more accurate.\n\nAdding stable, as a later fix depends on this patch.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "da307d100cd4979e353e8265d0691263aa2a0086", "tree": "616b976a535fa6a9e8fdebcde048c9260d52897b", "parents": [ "a3c21277df060c3c83b2aba4120d0370cf204d36" ], "author": { "name": "Tommi Rantala", "email": "tt.rantala@gmail.com", "time": "Sat Apr 13 22:49:14 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "perf: Treat attr.config as u64 in perf_swevent_init()\n\ncommit 8176cced706b5e5d15887584150764894e94e02f upstream.\n\nTrinity discovered that we fail to check all 64 bits of\nattr.config passed by user space, resulting to out-of-bounds\naccess of the perf_swevent_enabled array in\nsw_perf_event_destroy().\n\nIntroduced in commit b0a873ebb (\"perf: Register PMU\nimplementations\").\n\nSigned-off-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nCc: davej@redhat.com\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@ghostprotocols.net\u003e\nLink: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "410537558144cc886d780a02af9a09a122bff35b", "tree": "4bb0fec2c15698657d1d5929db9ca3f8d5759954", "parents": [ "2a6b0247eee46f424e032fb7431cc4700ad19ea5" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Mar 18 12:22:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:55 2013 -0700" }, "message": "sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s\n\ncommit 383efcd00053ec40023010ce5034bd702e7ab373 upstream.\n\ntry_to_wake_up_local() should only be invoked to wake up another\ntask in the same runqueue and BUG_ON()s are used to enforce the\nrule. Missing try_to_wake_up_local() can stall workqueue\nexecution but such stalls are likely to be finite either by\nanother work item being queued or the one blocked getting\nunblocked. There\u0027s no reason to trigger BUG while holding rq\nlock crashing the whole system.\n\nConvert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20130318192234.GD3042@htj.dyndns.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cf276742f2dcdf5258aac98447e8b4b9fba55aaa", "tree": "6de34c2bd35c7c5756470dabd4c30df3d7fc3b3d", "parents": [ "f42097f7eb860a967d1629c4bb00f2a083edc1dc" ], "author": { "name": "Emese Revfy", "email": "re.emese@gmail.com", "time": "Wed Apr 17 15:58:36 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "kernel/signal.c: stop info leak via the tkill and the tgkill syscalls\n\ncommit b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f upstream.\n\nThis fixes a kernel memory contents leak via the tkill and tgkill syscalls\nfor compat processes.\n\nThis is visible in the siginfo_t-\u003e_sifields._rt.si_sigval.sival_ptr field\nwhen handling signals delivered from tkill.\n\nThe place of the infoleak:\n\nint copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)\n{\n ...\n put_user_ex(ptr_to_compat(from-\u003esi_ptr), \u0026to-\u003esi_ptr);\n ...\n}\n\nSigned-off-by: Emese Revfy \u003cre.emese@gmail.com\u003e\nReviewed-by: PaX Team \u003cpageexec@freemail.hu\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "110360768eb74d67bac851b7c0209a923258a314", "tree": "b51a45e613abfe9c2c27f7d210be22a56103b83b", "parents": [ "816e2bb1b20b734d2e4286c12f0b18ae9dff35ab" ], "author": { "name": "Michael Bohan", "email": "mbohan@codeaurora.org", "time": "Tue Mar 19 19:19:25 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "hrtimer: Don\u0027t reinitialize a cpu_base lock on CPU_UP\n\ncommit 84cc8fd2fe65866e49d70b38b3fdf7219dd92fe0 upstream.\n\nThe current code makes the assumption that a cpu_base lock won\u0027t be\nheld if the CPU corresponding to that cpu_base is offline, which isn\u0027t\nalways true.\n\nIf a hrtimer is not queued, then it will not be migrated by\nmigrate_hrtimers() when a CPU is offlined. Therefore, the hrtimer\u0027s\ncpu_base may still point to a CPU which has subsequently gone offline\nif the timer wasn\u0027t enqueued at the time the CPU went down.\n\nNormally this wouldn\u0027t be a problem, but a cpu_base\u0027s lock is blindly\nreinitialized each time a CPU is brought up. If a CPU is brought\nonline during the period that another thread is performing a hrtimer\noperation on a stale hrtimer, then the lock will be reinitialized\nunder its feet, and a SPIN_BUG() like the following will be observed:\n\n\u003c0\u003e[ 28.082085] BUG: spinlock already unlocked on CPU#0, swapper/0/0\n\u003c0\u003e[ 28.087078] lock: 0xc4780b40, value 0x0 .magic: dead4ead, .owner: \u003cnone\u003e/-1, .owner_cpu: -1\n\u003c4\u003e[ 42.451150] [\u003cc0014398\u003e] (unwind_backtrace+0x0/0x120) from [\u003cc0269220\u003e] (do_raw_spin_unlock+0x44/0xdc)\n\u003c4\u003e[ 42.460430] [\u003cc0269220\u003e] (do_raw_spin_unlock+0x44/0xdc) from [\u003cc071b5bc\u003e] (_raw_spin_unlock+0x8/0x30)\n\u003c4\u003e[ 42.469632] [\u003cc071b5bc\u003e] (_raw_spin_unlock+0x8/0x30) from [\u003cc00a9ce0\u003e] (__hrtimer_start_range_ns+0x1e4/0x4f8)\n\u003c4\u003e[ 42.479521] [\u003cc00a9ce0\u003e] (__hrtimer_start_range_ns+0x1e4/0x4f8) from [\u003cc00aa014\u003e] (hrtimer_start+0x20/0x28)\n\u003c4\u003e[ 42.489247] [\u003cc00aa014\u003e] (hrtimer_start+0x20/0x28) from [\u003cc00e6190\u003e] (rcu_idle_enter_common+0x1ac/0x320)\n\u003c4\u003e[ 42.498709] [\u003cc00e6190\u003e] (rcu_idle_enter_common+0x1ac/0x320) from [\u003cc00e6440\u003e] (rcu_idle_enter+0xa0/0xb8)\n\u003c4\u003e[ 42.508259] [\u003cc00e6440\u003e] (rcu_idle_enter+0xa0/0xb8) from [\u003cc000f268\u003e] (cpu_idle+0x24/0xf0)\n\u003c4\u003e[ 42.516503] [\u003cc000f268\u003e] (cpu_idle+0x24/0xf0) from [\u003cc06ed3c0\u003e] (rest_init+0x88/0xa0)\n\u003c4\u003e[ 42.524319] [\u003cc06ed3c0\u003e] (rest_init+0x88/0xa0) from [\u003cc0c00978\u003e] (start_kernel+0x3d0/0x434)\n\nAs an example, this particular crash occurred when hrtimer_start() was\nexecuted on CPU #0. The code locked the hrtimer\u0027s current cpu_base\ncorresponding to CPU #1. CPU #0 then tried to switch the hrtimer\u0027s\ncpu_base to an optimal CPU which was online. In this case, it selected\nthe cpu_base corresponding to CPU #3.\n\nBefore it could proceed, CPU #1 came online and reinitialized the\nspinlock corresponding to its cpu_base. Thus now CPU #0 held a lock\nwhich was reinitialized. When CPU #0 finally ended up unlocking the\nold cpu_base corresponding to CPU #1 so that it could switch to CPU\n#3, we hit this SPIN_BUG() above while in switch_hrtimer_base().\n\nCPU #0 CPU #1\n---- ----\n... \u003coffline\u003e\nhrtimer_start()\nlock_hrtimer_base(base #1)\n... init_hrtimers_cpu()\nswitch_hrtimer_base() ...\n... raw_spin_lock_init(\u0026cpu_base-\u003elock)\nraw_spin_unlock(\u0026cpu_base-\u003elock) ...\n\u003cspin_bug\u003e\n\nSolve this by statically initializing the lock.\n\nSigned-off-by: Michael Bohan \u003cmbohan@codeaurora.org\u003e\nLink: http://lkml.kernel.org/r/1363745965-23475-1-git-send-email-mbohan@codeaurora.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fdd9ce008f3de39fa7fcd17717f1d7a0895269ea", "tree": "f69986fac5f79f8dc785ef2b490162d17f80c8a7", "parents": [ "bff6627568427d14375d84426f491646fdf71a1f" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat Apr 06 10:10:27 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:27 2013 -0700" }, "message": "sched_clock: Prevent 64bit inatomicity on 32bit systems\n\ncommit a1cbcaa9ea87b87a96b9fc465951dcf36e459ca2 upstream.\n\nThe sched_clock_remote() implementation has the following inatomicity\nproblem on 32bit systems when accessing the remote scd-\u003eclock, which\nis a 64bit value.\n\nCPU0\t\t\tCPU1\n\nsched_clock_local()\tsched_clock_remote(CPU0)\n...\n\t\t\tremote_clock \u003d scd[CPU0]-\u003eclock\n\t\t\t read_low32bit(scd[CPU0]-\u003eclock)\ncmpxchg64(scd-\u003eclock,...)\n\t\t\t read_high32bit(scd[CPU0]-\u003eclock)\n\nWhile the update of scd-\u003eclock is using an atomic64 mechanism, the\nreadout on the remote cpu is not, which can cause completely bogus\nreadouts.\n\nIt is a quite rare problem, because it requires the update to hit the\nnarrow race window between the low/high readout and the update must go\nacross the 32bit boundary.\n\nThe resulting misbehaviour is, that CPU1 will see the sched_clock on\nCPU1 ~4 seconds ahead of it\u0027s own and update CPU1s sched_clock value\nto this bogus timestamp. This stays that way due to the clamping\nimplementation for about 4 seconds until the synchronization with\nCLOCK_MONOTONIC undoes the problem.\n\nThe issue is hard to observe, because it might only result in a less\naccurate SCHED_OTHER timeslicing behaviour. To create observable\ndamage on realtime scheduling classes, it is necessary that the bogus\nupdate of CPU1 sched_clock happens in the context of an realtime\nthread, which then gets charged 4 seconds of RT runtime, which results\nin the RT throttler mechanism to trigger and prevent scheduling of RT\ntasks for a little less than 4 seconds. So this is quite unlikely as\nwell.\n\nThe issue was quite hard to decode as the reproduction time is between\n2 days and 3 weeks and intrusive tracing makes it less likely, but the\nfollowing trace recorded with trace_clock\u003dglobal, which uses\nsched_clock_local(), gave the final hint:\n\n \u003cidle\u003e-0 0d..30 400269.477150: hrtimer_cancel: hrtimer\u003d0xf7061e80\n \u003cidle\u003e-0 0d..30 400269.477151: hrtimer_start: hrtimer\u003d0xf7061e80 ...\nirq/20-S-587 1d..32 400273.772118: sched_wakeup: comm\u003d ... target_cpu\u003d0\n \u003cidle\u003e-0 0dN.30 400273.772118: hrtimer_cancel: hrtimer\u003d0xf7061e80\n\nWhat happens is that CPU0 goes idle and invokes\nsched_clock_idle_sleep_event() which invokes sched_clock_local() and\nCPU1 runs a remote wakeup for CPU0 at the same time, which invokes\nsched_remote_clock(). The time jump gets propagated to CPU0 via\nsched_remote_clock() and stays stale on both cores for ~4 seconds.\n\nThere are only two other possibilities, which could cause a stale\nsched clock:\n\n1) ktime_get() which reads out CLOCK_MONOTONIC returns a sporadic\n wrong value.\n\n2) sched_clock() which reads the TSC returns a sporadic wrong value.\n\n#1 can be excluded because sched_clock would continue to increase for\n one jiffy and then go stale.\n\n#2 can be excluded because it would not make the clock jump\n forward. It would just result in a stale sched_clock for one jiffy.\n\nAfter quite some brain twisting and finding the same pattern on other\ntraces, sched_clock_remote() remained the only place which could cause\nsuch a problem and as explained above it\u0027s indeed racy on 32bit\nsystems.\n\nSo while on 64bit systems the readout is atomic, we need to verify the\nremote readout on 32bit machines. We need to protect the local-\u003eclock\nreadout in sched_clock_remote() on 32bit as well because an NMI could\nhit between the low and the high readout, call sched_clock_local() and\nmodify local-\u003eclock.\n\nThanks to Siegfried Wulsch for bearing with my debug requests and\ngoing through the tedious tasks of running a bunch of reproducer\nsystems to generate the debug information which let me decode the\nissue.\n\nReported-by: Siegfried Wulsch \u003cSiegfried.Wulsch@rovema.de\u003e\nAcked-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1304051544160.21884@ionos\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3573b2133637edf3a6cb39241e9270affa535c7", "tree": "d4ccc29a2ac633ab2b848304acf3446ac018827a", "parents": [ "e264d3cf890eb1ead5200731b9e3dbd1d1b71fa8" ], "author": { "name": "Huacai Chen", "email": "chenhc@lemote.com", "time": "Sun Apr 07 02:14:14 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()\n\ncommit 6f389a8f1dd22a24f3d9afc2812b30d639e94625 upstream.\n\nAs commit 40dc166c (PM / Core: Introduce struct syscore_ops for core\nsubsystems PM) say, syscore_ops operations should be carried with one\nCPU on-line and interrupts disabled. However, after commit f96972f2d\n(kernel/sys.c: call disable_nonboot_cpus() in kernel_restart()),\nsyscore_shutdown() is called before disable_nonboot_cpus(), so break\nthe rules. We have a MIPS machine with a 8259A PIC, and there is an\nexternal timer (HPET) linked at 8259A. Since 8259A has been shutdown\ntoo early (by syscore_shutdown()), disable_nonboot_cpus() runs without\ntimer interrupt, so it hangs and reboot fails. This patch call\nsyscore_shutdown() a little later (after disable_nonboot_cpus()) to\navoid reboot failure, this is the same way as poweroff does.\n\nFor consistency, add disable_nonboot_cpus() to kernel_halt().\n\nSigned-off-by: Huacai Chen \u003cchenhc@lemote.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e264d3cf890eb1ead5200731b9e3dbd1d1b71fa8", "tree": "f0ac71897029ad2ec81178e32aec9eddb24e769e", "parents": [ "b43105dee8480ca5784de5c858d1cccee74ebfb1" ], "author": { "name": "Namhyung Kim", "email": "namhyung.kim@lge.com", "time": "Mon Apr 01 21:46:23 2013 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "tracing: Fix double free when function profile init failed\n\ncommit 83e03b3fe4daffdebbb42151d5410d730ae50bd1 upstream.\n\nOn the failure path, stat-\u003estart and stat-\u003epages will refer same page.\nSo it\u0027ll attempt to free the same page again and get kernel panic.\n\nLink: http://lkml.kernel.org/r/1364820385-32027-1-git-send-email-namhyung@kernel.org\n\nSigned-off-by: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Namhyung Kim \u003cnamhyung.kim@lge.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5592a94b44df6e6d48e34cfe596844637a2976ac", "tree": "75de4b4f29df40c505eefb9627a4149c5a66b125", "parents": [ "ddcd89f15f9e85d5cd37c866a1c5da9a3ca204d1" ], "author": { "name": "Vikram Mulukutla", "email": "markivx@codeaurora.org", "time": "Mon Jul 30 14:39:58 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:47 2013 -0700" }, "message": "panic: fix a possible deadlock in panic()\n\ncommit 190320c3b6640d4104650f55ff69611e050ea06b upstream.\n\npanic_lock is meant to ensure that panic processing takes place only on\none cpu; if any of the other cpus encounter a panic, they will spin\nwaiting to be shut down.\n\nHowever, this causes a regression in this scenario:\n\n1. Cpu 0 encounters a panic and acquires the panic_lock\n and proceeds with the panic processing.\n2. There is an interrupt on cpu 0 that also encounters\n an error condition and invokes panic.\n3. This second invocation fails to acquire the panic_lock\n and enters the infinite while loop in panic_smp_self_stop.\n\nThus all panic processing is stopped, and the cpu is stuck for eternity\nin the while(1) inside panic_smp_self_stop.\n\nTo address this, disable local interrupts with local_irq_disable before\nacquiring the panic_lock. This will prevent interrupt handlers from\nexecuting during the panic processing, thus avoiding this particular\nproblem.\n\nSigned-off-by: Vikram Mulukutla \u003cmarkivx@codeaurora.org\u003e\nReviewed-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nCc: Michael Holzheu \u003cholzheu@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b81d3241838167667fc1ec9bb5670d5f661a3628", "tree": "625e62463a9e8bc060ea8a5b036d5c107bae16c2", "parents": [ "b26bcbe0a7bba3321cefa4c9936e05cb58df03cb" ], "author": { "name": "Jan Kiszka", "email": "jan.kiszka@siemens.com", "time": "Tue Mar 26 17:53:03 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:45 2013 -0700" }, "message": "ftrace: Consistently restore trace function on sysctl enabling\n\ncommit 5000c418840b309251c5887f0b56503aae30f84c upstream.\n\nIf we reenable ftrace via syctl, we currently set ftrace_trace_function\nbased on the previous simplistic algorithm. This is inconsistent with\nwhat update_ftrace_function does. So better call that helper instead.\n\nLink: http://lkml.kernel.org/r/5151D26F.1070702@siemens.com\n\nSigned-off-by: Jan Kiszka \u003cjan.kiszka@siemens.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7b7cf9fa6d3406c1c7410afa861d524f732e4a7c", "tree": "0695fbf0df793cbc91d723893f77eafd60e31d10", "parents": [ "2f6b6e28ca9af9c1f745efa9277e3e7c9ad64883" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Thu Mar 14 15:03:53 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:37 2013 -0700" }, "message": "tracing: Prevent buffer overwrite disabled for latency tracers\n\ncommit 613f04a0f51e6e68ac6fe571ab79da3c0a5eb4da upstream.\n\nThe latency tracers require the buffers to be in overwrite mode,\notherwise they get screwed up. Force the buffers to stay in overwrite\nmode when latency tracers are enabled.\n\nAdded a flag_changed() method to the tracer structure to allow\nthe tracers to see what flags are being changed, and also be able\nto prevent the change from happing.\n\n[Backported for 3.4-stable. Re-added current_trace NULL checks; removed\nallocated_snapshot field; adapted to tracing_trace_options_write without\ntrace_set_options.]\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2f6b6e28ca9af9c1f745efa9277e3e7c9ad64883", "tree": "2e66c696fe47845e4d2f3ed4cd12d02441ddf9b5", "parents": [ "2457a4005a53bd8d9a266ab8f9f6388b57ca133a" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Thu Mar 14 13:50:56 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:37 2013 -0700" }, "message": "tracing: Protect tracer flags with trace_types_lock\n\ncommit 69d34da2984c95b33ea21518227e1f9470f11d95 upstream.\n\nSeems that the tracer flags have never been protected from\nsynchronous writes. Luckily, admins don\u0027t usually modify the\ntracing flags via two different tasks. But if scripts were to\nbe used to modify them, then they could get corrupted.\n\nMove the trace_types_lock that protects against tracers changing\nto also protect the flags being set.\n\n[Backported for 3.4, 3.0-stable. Moved return to after unlock.]\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "30e8f45d7687bcc6ac4010ea37ae78d8e365d2b7", "tree": "c344b733d36fa45ccd430574eebc7227bb014a06", "parents": [ "556ba7075b9b95a0439cd7b52a1284b88b8fa755" ], "author": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 13 14:59:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:14 2013 -0700" }, "message": "kernel/signal.c: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER\n\ncommit 522cff142d7d2f9230839c9e1f21a4d8bcc22a4a upstream.\n\n__ARCH_HAS_SA_RESTORER is the preferred conditional for use in 3.9 and\nlater kernels, per Kees.\n\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: PaX Team \u003cpageexec@freemail.hu\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: Julien Tinnes \u003cjln@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5899ef0b272b58f2927eb3376afaad2b02559180", "tree": "e74731ea62cd7ba183152d23eef8e39a536f207e", "parents": [ "cbff2b6d371dbbae19de1dcfd09051683eca02ca" ], "author": { "name": "Frederic Weisbecker", "email": "fweisbec@gmail.com", "time": "Wed Feb 20 16:15:36 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:27 2013 -0700" }, "message": "nohz: Make tick_nohz_irq_exit() irq safe\n\ncommit e5ab012c3271990e8457055c25cafddc1ae8aa6b upstream.\n\nAs it stands, irq_exit() may or may not be called with\nirqs disabled, depending on __ARCH_IRQ_EXIT_IRQS_DISABLED\nthat the arch can define.\n\nIt makes tick_nohz_irq_exit() unsafe. For example two\ninterrupts can race in tick_nohz_stop_sched_tick(): the inner\nmost one computes the expiring time on top of the timer list,\nthen it\u0027s interrupted right before reprogramming the\nclock. The new interrupt enqueues a new timer list timer,\nit reprogram the clock to take it into account and it exits.\nThe CPUs resumes the inner most interrupt and performs the clock\nreprogramming without considering the new timer list timer.\n\nThis regression has been introduced by:\n 280f06774afedf849f0b34248ed6aff57d0f6908\n (\"nohz: Separate out irq exit and idle loop dyntick logic\")\n\nLet\u0027s fix it right now with the appropriate protections.\n\nA saner long term solution will be to remove\n__ARCH_IRQ_EXIT_IRQS_DISABLED and mandate that irq_exit() is called\nwith interrupts disabled.\n\nSigned-off-by: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linuxfoundation.org\u003e\nLink: http://lkml.kernel.org/r/1361373336-11337-1-git-send-email-fweisbec@gmail.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8d96fcec68c30196fca01a75a911835c7b89a50d", "tree": "1a5524de1f2dda9b4426e941f7955eb854d8bc22", "parents": [ "3d2e7424b3e18dc851a4b0efdc6676c09573f55f" ], "author": { "name": "Mark Rutland", "email": "mark.rutland@arm.com", "time": "Thu Mar 07 15:09:24 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:26 2013 -0700" }, "message": "clockevents: Don\u0027t allow dummy broadcast timers\n\ncommit a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a upstream.\n\nCurrently tick_check_broadcast_device doesn\u0027t reject clock_event_devices\nwith CLOCK_EVT_FEAT_DUMMY, and may select them in preference to real\nhardware if they have a higher rating value. In this situation, the\ndummy timer is responsible for broadcasting to itself, and the core\nclockevents code may attempt to call non-existent callbacks for\nprogramming the dummy, eventually leading to a panic.\n\nThis patch makes tick_check_broadcast_device always reject dummy timers,\npreventing this problem.\n\nSigned-off-by: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: linux-arm-kernel@lists.infradead.org\nCc: Jon Medhurst (Tixy) \u003ctixy@linaro.org\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "52cecaa20589203f08a965af4604acec8a946825", "tree": "0e48ffe412192e158f736d6a7ae3b1d896901b52", "parents": [ "1e3b58b64c6574c9c8e299c68c8c4716f8dd3c21" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Mar 13 11:15:19 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:06 2013 -0700" }, "message": "tracing: Fix free of probe entry by calling call_rcu_sched()\n\ncommit 740466bc89ad8bd5afcc8de220f715f62b21e365 upstream.\n\nBecause function tracing is very invasive, and can even trace\ncalls to rcu_read_lock(), RCU access in function tracing is done\nwith preempt_disable_notrace(). This requires a synchronize_sched()\nfor updates and not a synchronize_rcu().\n\nFunction probes (traceon, traceoff, etc) must be freed after\na synchronize_sched() after its entry has been removed from the\nhash. But call_rcu() is used. Fix this by using call_rcu_sched().\n\nAlso fix the usage to use hlist_del_rcu() instead of hlist_del().\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: Paul McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1e3b58b64c6574c9c8e299c68c8c4716f8dd3c21", "tree": "84e8d63958b4c88068b5f0011160d39f5e305d8e", "parents": [ "74a523fb1759bd3afabf586740041e6d09d731c2" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Tue Mar 12 11:32:32 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:06 2013 -0700" }, "message": "tracing: Fix race in snapshot swapping\n\ncommit 2721e72dd10f71a3ba90f59781becf02638aa0d9 upstream.\n\nAlthough the swap is wrapped with a spin_lock, the assignment\nof the temp buffer used to swap is not within that lock.\nIt needs to be moved into that lock, otherwise two swaps\nhappening on two different CPUs, can end up using the wrong\ntemp buffer to assign in the swap.\n\nLuckily, all current callers of the swap function appear to have\ntheir own locks. But in case something is added that allows two\ndifferent callers to call the swap, then there\u0027s a chance that\nthis race can trigger and corrupt the buffers.\n\nNew code is coming soon that will allow for this race to trigger.\n\nI\u0027ve Cc\u0027d stable, so this bug will not show up if someone backports\none of the changes that can trigger this bug.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "44ddae422775744b49248dff8818a141d3a03820", "tree": "22f91f1b83b72fa8cf4c652b70a30ce0ba7f99a9", "parents": [ "a4371b6605f7b6930ba95df316948be6b306be73" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Wed Mar 13 14:59:33 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Mar 20 13:04:58 2013 -0700" }, "message": "signal: always clear sa_restorer on execve\n\ncommit 2ca39528c01a933f6689cd6505ce65bd6d68a530 upstream.\n\nWhen the new signal handlers are set up, the location of sa_restorer is\nnot cleared, leaking a parent process\u0027s address space location to\nchildren. This allows for a potential bypass of the parent\u0027s ASLR by\nexamining the sa_restorer value returned when calling sigaction().\n\nBased on what should be considered \"secret\" about addresses, it only\nmatters across the exec not the fork (since the VMAs haven\u0027t changed\nuntil the exec). But since exec sets SIG_DFL and keeps sa_restorer,\nthis is where it should be fixed.\n\nGiven the few uses of sa_restorer, a \"set\" function was not written\nsince this would be the only use. Instead, we use\n__ARCH_HAS_SA_RESTORER, as already done in other places.\n\nExample of the leak before applying this patch:\n\n $ cat /proc/$$/maps\n ...\n 7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so\n ...\n $ ./leak\n ...\n 7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so\n ...\n 1 0 (nil) 0x7fb9f30b94a0\n 2 4000000 (nil) 0x7f278bcaa4a0\n 3 4000000 (nil) 0x7f278bcaa4a0\n 4 0 (nil) 0x7fb9f30b94a0\n ...\n\n[akpm@linux-foundation.org: use SA_RESTORER for backportability]\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReported-by: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: PaX Team \u003cpageexec@freemail.hu\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: Julien Tinnes \u003cjln@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "abf73cb191a83045c3cc6f46ea78b94439957585", "tree": "cb88f3a2335ab2db1e92601774312115f230d274", "parents": [ "f39e4f133d52fad48f5c823b6c8a867caf101677" ], "author": { "name": "Steven Rostedt", "email": "srostedt@redhat.com", "time": "Wed Feb 27 21:48:09 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 14 11:29:51 2013 -0700" }, "message": "ftrace: Update the kconfig for DYNAMIC_FTRACE\n\ncommit db05021d49a994ee40a9735d9c3cb0060c9babb8 upstream.\n\nThe prompt to enable DYNAMIC_FTRACE (the ability to nop and\nenable function tracing at run time) had a confusing statement:\n\n \"enable/disable ftrace tracepoints dynamically\"\n\nThis was written before tracepoints were added to the kernel,\nbut now that tracepoints have been added, this is very confusing\nand has confused people enough to give wrong information during\npresentations.\n\nNot only that, I looked at the help text, and it still references\nthat dreaded daemon that use to wake up once a second to update\nthe nop locations and brick NICs, that hasn\u0027t been around for over\nfive years.\n\nTime to bring the text up to the current decade.\n\nReported-by: Ezequiel Garcia \u003celezegarcia@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "916b6c67cd471fafa3e5e53ce8389c36749ed6f1", "tree": "72cc7d232c2d88d38d5475da41c7ae49826649f7", "parents": [ "a74e9a386f6e775f88061f7958b8b34c6742f926" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Thu Jan 24 14:43:28 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:44 2013 +0800" }, "message": "cgroup: fix exit() vs rmdir() race\n\ncommit 71b5707e119653039e6e95213f00479668c79b75 upstream.\n\nIn cgroup_exit() put_css_set_taskexit() is called without any lock,\nwhich might lead to accessing a freed cgroup:\n\nthread1 thread2\n---------------------------------------------\nexit()\n cgroup_exit()\n put_css_set_taskexit()\n atomic_dec(cgrp-\u003ecount);\n rmdir();\n /* not safe !! */\n check_for_release(cgrp);\n\nrcu_read_lock() can be used to make sure the cgroup is alive.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a74e9a386f6e775f88061f7958b8b34c6742f926", "tree": "a71c10ec1690efe570ec1236198f499faa9c661b", "parents": [ "68412b1718c488e58783d1c576d0aeb34012092d" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Fri Jan 25 16:08:01 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:44 2013 +0800" }, "message": "cpuset: fix cpuset_print_task_mems_allowed() vs rename() race\n\ncommit 63f43f55c9bbc14f76b582644019b8a07dc8219a upstream.\n\nrename() will change dentry-\u003ed_name. The result of this race can\nbe worse than seeing partially rewritten name, but we might access\na stale pointer because rename() will re-allocate memory to hold\na longer name.\n\nIt\u0027s safe in the protection of dentry-\u003ed_lock.\n\nv2: check NULL dentry before acquiring dentry lock.\n\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d48e3a8dc45d9eac3e2be330ef4df663a6f54dfc", "tree": "9f7b986eae868c5e7c3c308f2f25099ee8b88a07", "parents": [ "ef7a6c344031cd99e16a116a7984d9428dce8401" ], "author": { "name": "Xi Wang", "email": "xi.wang@gmail.com", "time": "Wed Feb 27 17:05:21 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:41 2013 +0800" }, "message": "sysctl: fix null checking in bin_dn_node_address()\n\ncommit df1778be1a33edffa51d094eeda87c858ded6560 upstream.\n\nThe null check of `strchr() + 1\u0027 is broken, which is always non-null,\nleading to OOB read. Instead, check the result of strchr().\n\nSigned-off-by: Xi Wang \u003cxi.wang@gmail.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e6842472eb7f8091c27eb43ad934097ce04d3fbb", "tree": "1955782375cc0a83a91aa2e849381efa3a161a63", "parents": [ "db3d76a623b8ce429318cc2491881c02b790dab4" ], "author": { "name": "Steven Rostedt (Red Hat)", "email": "rostedt@goodmis.org", "time": "Wed Feb 13 15:18:38 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:38 2013 +0800" }, "message": "ftrace: Call ftrace cleanup module notifier after all other notifiers\n\ncommit 8c189ea64eea01ca20d102ddb74d6936dd16c579 upstream.\n\nCommit: c1bf08ac \"ftrace: Be first to run code modification on modules\"\n\nchanged ftrace module notifier\u0027s priority to INT_MAX in order to\nprocess the ftrace nops before anything else could touch them\n(namely kprobes). This was the correct thing to do.\n\nUnfortunately, the ftrace module notifier also contains the ftrace\nclean up code. As opposed to the set up code, this code should be\nrun *after* all the module notifiers have run in case a module is doing\ncorrect clean-up and unregisters its ftrace hooks. Basically, ftrace\nneeds to do clean up on module removal, as it needs to know about code\nbeing removed so that it doesn\u0027t try to modify that code. But after it\nremoves the module from its records, if a ftrace user tries to remove\na probe, that removal will fail due as the record of that code segment\nno longer exists.\n\nNothing really bad happens if the probe removal is called after ftrace\ndid the clean up, but the ftrace removal function will return an error.\nCorrect code (such as kprobes) will produce a WARN_ON() if it fails\nto remove the probe. As people get annoyed by frivolous warnings, it\u0027s\nbest to do the ftrace clean up after everything else.\n\nBy splitting the ftrace_module_notifier into two notifiers, one that\ndoes the module load setup that is run at high priority, and the other\nthat is called for module clean up that is run at low priority, the\nproblem is solved.\n\nReported-by: Frank Ch. Eigler \u003cfche@redhat.com\u003e\nAcked-by: Masami Hiramatsu \u003cmasami.hiramatsu.pt@hitachi.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "db3d76a623b8ce429318cc2491881c02b790dab4", "tree": "8dd76a8c3267c521b211bd19a0065f45b881182a", "parents": [ "0c8581863389e969dcbf6d9e79971435a1ecf554" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Feb 20 15:24:12 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Mar 04 06:06:38 2013 +0800" }, "message": "posix-timer: Don\u0027t call idr_find() with out-of-range ID\n\ncommit e182bb38d7db7494fa5dcd82da17fe0dedf60ecf upstream.\n\nWhen idr_find() was fed a negative ID, it used to look up the ID\nignoring the sign bit before recent (\"idr: remove MAX_IDR_MASK and\nmove left MAX_IDR_* into idr.c\") patch. Now a negative ID triggers\na WARN_ON_ONCE().\n\n__lock_timer() feeds timer_id from userland directly to idr_find()\nwithout sanitizing it which can trigger the above malfunctions. Add a\nrange check on @timer_id before invoking idr_find() in __lock_timer().\n\nWhile timer_t is defined as int by all archs at the moment, Andrew\nworries that it may be defined as a larger type later on. Make the\ntest cover larger integers too so that it at least is guaranteed to\nnot return the wrong timer.\n\nNote that WARN_ON_ONCE() in idr_find() on id \u003c 0 is transitional\nprecaution while moving away from ignoring MSB. Once it\u0027s gone we can\nremove the guard as long as timer_t isn\u0027t larger than int.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/20130220232412.GL3570@htj.dyndns.org\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "803437207a3e6fef7791adeb7a0c2adb4b012459", "tree": "eec95051fb2e48121d2b7bd57b4c40e96809c879", "parents": [ "e3aa5ed471454f36e99b8d3a960746eb58c07180" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Mon Feb 18 09:52:08 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:59:01 2013 -0800" }, "message": "futex: Revert \"futex: Mark get_robust_list as deprecated\"\n\ncommit fe2b05f7ca9f906be61dced5489f63b8b4d7c770 upstream.\n\nThis reverts commit ec0c4274e33c0373e476b73e01995c53128f1257.\n\nget_robust_list() is in use and a removal would break existing user\nspace. With the permission checks in place it\u0027s not longer a security\nhole. Remove the deprecation warnings.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nCc: Richard Weinberger \u003crichard@nod.at\u003e\nCc: akpm@linux-foundation.org\nCc: paul.gortmaker@windriver.com\nCc: davej@redhat.com\nCc: keescook@chromium.org\nCc: ebiederm@xmission.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dd9c58a90c955ae794c1080156db8d8f64a52a21", "tree": "a232bd8d075111e352edf86dfc9de49b7fcddce3", "parents": [ "7c3e516d99265e4aa915f3c05611b0f426bf8ce3" ], "author": { "name": "Leonid Shatz", "email": "leonid.shatz@ravellosystems.com", "time": "Mon Feb 04 14:33:37 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:58:59 2013 -0800" }, "message": "hrtimer: Prevent hrtimer_enqueue_reprogram race\n\ncommit b22affe0aef429d657bc6505aacb1c569340ddd2 upstream.\n\nhrtimer_enqueue_reprogram contains a race which could result in\ntimer.base switch during unlock/lock sequence.\n\nhrtimer_enqueue_reprogram is releasing the lock protecting the timer\nbase for calling raise_softirq_irqsoff() due to a lock ordering issue\nversus rq-\u003elock.\n\nIf during that time another CPU calls __hrtimer_start_range_ns() on\nthe same hrtimer, the timer base might switch, before the current CPU\ncan lock base-\u003elock again and therefor the unlock_timer_base() call\nwill unlock the wrong lock.\n\n[ tglx: Added comment and massaged changelog ]\n\nSigned-off-by: Leonid Shatz \u003cleonid.shatz@ravellosystems.com\u003e\nSigned-off-by: Izik Eidus \u003cizik.eidus@ravellosystems.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nLink: http://lkml.kernel.org/r/1359981217-389-1-git-send-email-izik.eidus@ravellosystems.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7c3e516d99265e4aa915f3c05611b0f426bf8ce3", "tree": "ca0e3900b725d528910363170a55f591c40fec50", "parents": [ "b3c57f009cfd9ed81737169c4026bfd03191d993" ], "author": { "name": "Stanislaw Gruszka", "email": "sgruszka@redhat.com", "time": "Fri Feb 15 11:08:11 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:58:59 2013 -0800" }, "message": "posix-cpu-timers: Fix nanosleep task_struct leak\n\ncommit e6c42c295e071dd74a66b5a9fcf4f44049888ed8 upstream.\n\nThe trinity fuzzer triggered a task_struct reference leak via\nclock_nanosleep with CPU_TIMERs. do_cpu_nanosleep() calls\nposic_cpu_timer_create(), but misses a corresponding\nposix_cpu_timer_del() which leads to the task_struct reference leak.\n\nReported-and-tested-by: Tommi Rantala \u003ctt.rantala@gmail.com\u003e\nSigned-off-by: Stanislaw Gruszka \u003csgruszka@redhat.com\u003e\nCc: Dave Jones \u003cdavej@redhat.com\u003e\nCc: John Stultz \u003cjohn.stultz@linaro.org\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nLink: http://lkml.kernel.org/r/20130215100810.GF4392@redhat.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b3c57f009cfd9ed81737169c4026bfd03191d993", "tree": "73ae8bf6b8258783eb608f18f4c984d36c2a6fcf", "parents": [ "526a26556b9069238ea7eecb9095cc672daef0e5" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Nov 23 10:08:44 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:58:58 2013 -0800" }, "message": "genirq: Avoid deadlock in spurious handling\n\ncommit e716efde75267eab919cdb2bef5b2cb77f305326 upstream.\n\ncommit 52553ddf(genirq: fix regression in irqfixup, irqpoll)\nintroduced a potential deadlock by calling the action handler with the\nirq descriptor lock held.\n\nRemove the call and let the handling code run even for an interrupt\nwhere only a single action is registered. That matches the goal of\nthe above commit and avoids the deadlock.\n\nDocument the confusing action \u003d desc-\u003eaction reload in the handling\nloop while at it.\n\nReported-and-tested-by: \"Wang, Warner\" \u003cwarner.wang@hp.com\u003e\nTested-by: Edward Donovan \u003cedward.donovan@numble.net\u003e\nCc: \"Wang, Song-Bo (Stoney)\" \u003csong-bo.wang@hp.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "526a26556b9069238ea7eecb9095cc672daef0e5", "tree": "8dc2f9265c4ec28a26528bf8ab37b3af49449f43", "parents": [ "17c2f96bd1de5999900303b3eb923b8cdf6ee2ba" ], "author": { "name": "H. Peter Anvin", "email": "hpa@linux.intel.com", "time": "Thu Feb 07 17:14:08 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 28 06:58:58 2013 -0800" }, "message": "timeconst.pl: Eliminate Perl warning\n\ncommit 63a3f603413ffe82ad775f2d62a5afff87fd94a0 upstream.\n\ndefined(@array) is deprecated in Perl and gives off a warning.\nRestructure the code to remove that warning.\n\n[ hpa: it would be interesting to revert to the timeconst.bc script.\n It appears that the failures reported by akpm during testing of\n that script was due to a known broken version of make, not a problem\n with bc. The Makefile rules could probably be restructured to avoid\n the make bug, or it is probably old enough that it doesn\u0027t matter. ]\n\nReported-by: Andi Kleen \u003cak@linux.intel.com\u003e\nSigned-off-by: H. Peter Anvin \u003chpa@linux.intel.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ce0030c00f95cf9110d9cdcd41e901e1fb814417", "tree": "40b124b99205bd469ed156b682d7f0f4e5726e5a", "parents": [ "9ad3bfb9e26197c378d6c239180ed7bcf7c29fd8" ], "author": { "name": "Alexandre SIMON", "email": "Alexandre.Simon@univ-lorraine.fr", "time": "Fri Feb 01 15:31:54 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 21 10:04:57 2013 -0800" }, "message": "printk: fix buffer overflow when calling log_prefix function from call_console_drivers\n\nThis patch corrects a buffer overflow in kernels from 3.0 to 3.4 when calling\nlog_prefix() function from call_console_drivers().\n\nThis bug existed in previous releases but has been revealed with commit\n162a7e7500f9664636e649ba59defe541b7c2c60 (2.6.39 \u003d\u003e 3.0) that made changes\nabout how to allocate memory for early printk buffer (use of memblock_alloc).\nIt disappears with commit 7ff9554bb578ba02166071d2d487b7fc7d860d62 (3.4 \u003d\u003e 3.5)\nthat does a refactoring of printk buffer management.\n\nIn log_prefix(), the access to \"p[0]\", \"p[1]\", \"p[2]\" or\n\"simple_strtoul(\u0026p[1], \u0026endp, 10)\" may cause a buffer overflow as this\nfunction is called from call_console_drivers by passing \"\u0026LOG_BUF(cur_index)\"\nwhere the index must be masked to do not exceed the buffer\u0027s boundary.\n\nThe trick is to prepare in call_console_drivers() a buffer with the necessary\ndata (PRI field of syslog message) to be safely evaluated in log_prefix().\n\nThis patch can be applied to stable kernel branches 3.0.y, 3.2.y and 3.4.y.\n\nWithout this patch, one can freeze a server running this loop from shell :\n $ export DUMMY\u003d`cat /dev/urandom | tr -dc \u002712345AZERTYUIOPQSDFGHJKLMWXCVBNazertyuiopqsdfghjklmwxcvbn\u0027 | head -c255`\n $ while true do ; echo $DUMMY \u003e /dev/kmsg ; done\n\nThe \"server freeze\" depends on where memblock_alloc does allocate printk buffer :\nif the buffer overflow is inside another kernel allocation the problem may not\nbe revealed, else the server may hangs up.\n\nSigned-off-by: Alexandre SIMON \u003cAlexandre.Simon@univ-lorraine.fr\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7308f843f36c30dd1247989a45611760567ea44f", "tree": "c3a157484b1412916b23a9a9a21a7836e1459089", "parents": [ "0b2d4e113bf714732b041aa879945c4c5ae4b139" ], "author": { "name": "T Makphaibulchoke", "email": "tmac@hp.com", "time": "Thu Oct 04 17:16:55 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 14 10:48:53 2013 -0800" }, "message": "kernel/resource.c: fix stack overflow in __reserve_region_with_split()\n\ncommit 4965f5667f36a95b41cda6638875bc992bd7d18b upstream.\n\nUsing a recursive call add a non-conflicting region in\n__reserve_region_with_split() could result in a stack overflow in the case\nthat the recursive calls are too deep. Convert the recursive calls to an\niterative loop to avoid the problem.\n\nTested on a machine containing 135 regions. The kernel no longer panicked\nwith stack overflow.\n\nAlso tested with code arbitrarily adding regions with no conflict,\nembedding two consecutive conflicts and embedding two non-consecutive\nconflicts.\n\nSigned-off-by: T Makphaibulchoke \u003ctmac@hp.com\u003e\nReviewed-by: Ram Pai \u003clinuxram@us.ibm.com\u003e\nCc: Paul Gortmaker \u003cpaul.gortmaker@gmail.com\u003e\nCc: Wei Yang \u003cweiyang@linux.vnet.ibm.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Jiri Slaby \u003cjslaby@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "89960feebaf4f9a53f93a0ce6888207e4a808799", "tree": "91b4e4224f264e072b047ac636f585a2de98e602", "parents": [ "11151f33ae2b29f8346f5ac1250c1879e3348cbc" ], "author": { "name": "Shawn Bohrer", "email": "sbohrer@rgmadvisors.com", "time": "Mon Jan 14 11:55:31 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 11 08:47:18 2013 -0800" }, "message": "sched/rt: Use root_domain of rt_rq not current processor\n\ncommit aa7f67304d1a03180f463258aa6f15a8b434e77d upstream.\n\nWhen the system has multiple domains do_sched_rt_period_timer()\ncan run on any CPU and may iterate over all rt_rq in\ncpu_online_mask. This means when balance_runtime() is run for a\ngiven rt_rq that rt_rq may be in a different rd than the current\nprocessor. Thus if we use smp_processor_id() to get rd in\ndo_balance_runtime() we may borrow runtime from a rt_rq that is\nnot part of our rd.\n\nThis changes do_balance_runtime to get the rd from the passed in\nrt_rq ensuring that we borrow runtime only from the correct rd\nfor the given rt_rq.\n\nThis fixes a BUG at kernel/sched/rt.c:687! in __disable_runtime\nwhen we try reclaim runtime lent to other rt_rq but runtime has\nbeen lent to a rt_rq in another rd.\n\nSigned-off-by: Shawn Bohrer \u003csbohrer@rgmadvisors.com\u003e\nAcked-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nAcked-by: Mike Galbraith \u003cbitbucket@online.de\u003e\nCc: peterz@infradead.org\nLink: http://lkml.kernel.org/r/1358186131-29494-1-git-send-email-sbohrer@rgmadvisors.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "846c314fd6124b5bd3a3db2624818f29616874a1", "tree": "5c28851f48ed4fcbae68549282a3690fd5b68530", "parents": [ "64fdede97a7c38889dd9b9016aac3e2afc23412b" ], "author": { "name": "Wang YanQing", "email": "udknight@gmail.com", "time": "Sat Jan 26 15:53:57 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Feb 03 18:24:42 2013 -0600" }, "message": "smp: Fix SMP function call empty cpu mask race\n\ncommit f44310b98ddb7f0d06550d73ed67df5865e3eda5 upstream.\n\nI get the following warning every day with v3.7, once or\ntwice a day:\n\n [ 2235.186027] WARNING: at /mnt/sda7/kernel/linux/arch/x86/kernel/apic/ipi.c:109 default_send_IPI_mask_logical+0x2f/0xb8()\n\nAs explained by Linus as well:\n\n |\n | Once we\u0027ve done the \"list_add_rcu()\" to add it to the\n | queue, we can have (another) IPI to the target CPU that can\n | now see it and clear the mask.\n |\n | So by the time we get to actually send the IPI, the mask might\n | have been cleared by another IPI.\n |\n\nThis patch also fixes a system hang problem, if the data-\u003ecpumask\ngets cleared after passing this point:\n\n if (WARN_ONCE(!mask, \"empty IPI mask\"))\n return;\n\nthen the problem in commit 83d349f35e1a (\"x86: don\u0027t send an IPI to\nthe empty set of CPU\u0027s\") will happen again.\n\nSigned-off-by: Wang YanQing \u003cudknight@gmail.com\u003e\nAcked-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nAcked-by: Jan Beulich \u003cjbeulich@suse.com\u003e\nCc: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: peterz@infradead.org\nCc: mina86@mina86.org\nCc: srivatsa.bhat@linux.vnet.ibm.com\nLink: http://lkml.kernel.org/r/20130126075357.GA3205@udknight\n[ Tidied up the changelog and the comment in the code. ]\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "465760c68a4e5037f10a7eab1df3fb2aff1e03a4", "tree": "01412ebaacf8ff07622f0048e2dad45643ba4790", "parents": [ "9b6d794e7e56f3a413c57a15d4e07fb7efe6530a" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Jan 21 20:48:17 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jan 27 20:47:43 2013 -0800" }, "message": "wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task\n\ncommit 9067ac85d533651b98c2ff903182a20cbb361fcb upstream.\n\nwake_up_process() should never wakeup a TASK_STOPPED/TRACED task.\nChange it to use TASK_NORMAL and add the WARN_ON().\n\nTASK_ALL has no other users, probably can be killed.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9b6d794e7e56f3a413c57a15d4e07fb7efe6530a", "tree": "a2842484813ccbf8364312046c03ac40f3e09b50", "parents": [ "b08d81801e151fbcefa81a551eadf2beff554752" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Jan 21 20:48:00 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jan 27 20:47:43 2013 -0800" }, "message": "ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL\n\ncommit 9899d11f654474d2d54ea52ceaa2a1f4db3abd68 upstream.\n\nputreg() assumes that the tracee is not running and pt_regs_access() can\nsafely play with its stack. However a killed tracee can return from\nptrace_stop() to the low-level asm code and do RESTORE_REST, this means\nthat debugger can actually read/modify the kernel stack until the tracee\ndoes SAVE_REST again.\n\nset_task_blockstep() can race with SIGKILL too and in some sense this\nrace is even worse, the very fact the tracee can be woken up breaks the\nlogic.\n\nAs Linus suggested we can clear TASK_WAKEKILL around the arch_ptrace()\ncall, this ensures that nobody can ever wakeup the tracee while the\ndebugger looks at it. Not only this fixes the mentioned problems, we\ncan do some cleanups/simplifications in arch_ptrace() paths.\n\nProbably ptrace_unfreeze_traced() needs more callers, for example it\nmakes sense to make the tracee killable for oom-killer before\naccess_process_vm().\n\nWhile at it, add the comment into may_ptrace_stop() to explain why\nptrace_stop() still can\u0027t rely on SIGKILL and signal_pending_state().\n\nReported-by: Salman Qazi \u003csqazi@google.com\u003e\nReported-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b08d81801e151fbcefa81a551eadf2beff554752", "tree": "0a4c2ea3acdf76c7ac6aa1c8d675314e04d42f1f", "parents": [ "9c5f1b49341154b579851425dabb32cb3aa9b5db" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Mon Jan 21 20:47:41 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jan 27 20:47:43 2013 -0800" }, "message": "ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up()\n\ncommit 910ffdb18a6408e14febbb6e4b6840fd2c928c82 upstream.\n\nCleanup and preparation for the next change.\n\nsignal_wake_up(resume \u003d\u003e true) is overused. None of ptrace/jctl callers\nactually want to wakeup a TASK_WAKEKILL task, but they can\u0027t specify the\nnecessary mask.\n\nTurn signal_wake_up() into signal_wake_up_state(state), reintroduce\nsignal_wake_up() as a trivial helper, and add ptrace_signal_wake_up()\nwhich adds __TASK_TRACED.\n\nThis way ptrace_signal_wake_up() can work \"inside\" ptrace_request()\neven if the tracee doesn\u0027t have the TASK_WAKEKILL bit set.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f2a010040e2c368a76f7ea0ed6533f5779cb6b4b", "tree": "1a8969b4b669d973d2f968b47e8aa3323038c750", "parents": [ "d027bb39240aa55b86738508fb5612b9125a886f" ], "author": { "name": "Steven Rostedt", "email": "srostedt@redhat.com", "time": "Fri Dec 14 09:48:15 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jan 27 20:47:42 2013 -0800" }, "message": "ftrace: Be first to run code modification on modules\n\ncommit c1bf08ac26e92122faab9f6c32ea8aba94612dae upstream.\n\nIf some other kernel subsystem has a module notifier, and adds a kprobe\nto a ftrace mcount point (now that kprobes work on ftrace points),\nwhen the ftrace notifier runs it will fail and disable ftrace, as well\nas kprobes that are attached to ftrace points.\n\nHere\u0027s the error:\n\n WARNING: at kernel/trace/ftrace.c:1618 ftrace_bug+0x239/0x280()\n Hardware name: Bochs\n Modules linked in: fat(+) stap_56d28a51b3fe546293ca0700b10bcb29__8059(F) nfsv4 auth_rpcgss nfs dns_resolver fscache xt_nat iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack lockd sunrpc ppdev parport_pc parport microcode virtio_net i2c_piix4 drm_kms_helper ttm drm i2c_core [last unloaded: bid_shared]\n Pid: 8068, comm: modprobe Tainted: GF 3.7.0-0.rc8.git0.1.fc19.x86_64 #1\n Call Trace:\n [\u003cffffffff8105e70f\u003e] warn_slowpath_common+0x7f/0xc0\n [\u003cffffffff81134106\u003e] ? __probe_kernel_read+0x46/0x70\n [\u003cffffffffa0180000\u003e] ? 0xffffffffa017ffff\n [\u003cffffffffa0180000\u003e] ? 0xffffffffa017ffff\n [\u003cffffffff8105e76a\u003e] warn_slowpath_null+0x1a/0x20\n [\u003cffffffff810fd189\u003e] ftrace_bug+0x239/0x280\n [\u003cffffffff810fd626\u003e] ftrace_process_locs+0x376/0x520\n [\u003cffffffff810fefb7\u003e] ftrace_module_notify+0x47/0x50\n [\u003cffffffff8163912d\u003e] notifier_call_chain+0x4d/0x70\n [\u003cffffffff810882f8\u003e] __blocking_notifier_call_chain+0x58/0x80\n [\u003cffffffff81088336\u003e] blocking_notifier_call_chain+0x16/0x20\n [\u003cffffffff810c2a23\u003e] sys_init_module+0x73/0x220\n [\u003cffffffff8163d719\u003e] system_call_fastpath+0x16/0x1b\n ---[ end trace 9ef46351e53bbf80 ]---\n ftrace failed to modify [\u003cffffffffa0180000\u003e] init_once+0x0/0x20 [fat]\n actual: cc:bb:d2:4b:e1\n\nA kprobe was added to the init_once() function in the fat module on load.\nBut this happened before ftrace could have touched the code. As ftrace\ndidn\u0027t run yet, the kprobe system had no idea it was a ftrace point and\nsimply added a breakpoint to the code (0xcc in the cc:bb:d2:4b:e1).\n\nThen when ftrace went to modify the location from a call to mcount/fentry\ninto a nop, it didn\u0027t see a call op, but instead it saw the breakpoint op\nand not knowing what to do with it, ftrace shut itself down.\n\nThe solution is to simply give the ftrace module notifier the max priority.\nThis should have been done regardless, as the core code ftrace modification\nalso happens very early on in boot up. This makes the module modification\ncloser to core modification.\n\nLink: http://lkml.kernel.org/r/20130107140333.593683061@goodmis.org\n\nAcked-by: Masami Hiramatsu \u003cmasami.hiramatsu.pt@hitachi.com\u003e\nReported-by: Frank Ch. Eigler \u003cfche@redhat.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n\n" }, { "commit": "4d7981bfc21f7b6ef48f9a819d2c9969ad6eea71", "tree": "bcfce7dceeba920d49de2f696b1f12380818bafc", "parents": [ "0d38a8789caf511e5b997caf76eb32fddbff051c" ], "author": { "name": "Steven Rostedt", "email": "srostedt@redhat.com", "time": "Thu Nov 29 22:31:16 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:50:51 2013 -0800" }, "message": "ring-buffer: Fix race between integrity check and readers\n\ncommit 9366c1ba13fbc41bdb57702e75ca4382f209c82f upstream.\n\nThe function rb_check_pages() was added to make sure the ring buffer\u0027s\npages were sane. This check is done when the ring buffer size is modified\nas well as when the iterator is released (closing the \"trace\" file),\nas that was considered a non fast path and a good place to do a sanity\ncheck.\n\nThe problem is that the check does not have any locks around it.\nIf one process were to read the trace file, and another were to read\nthe raw binary file, the check could happen while the reader is reading\nthe file.\n\nThe issues with this is that the check requires to clear the HEAD page\nbefore doing the full check and it restores it afterward. But readers\nrequire the HEAD page to exist before it can read the buffer, otherwise\nit gives a nasty warning and disables the buffer.\n\nBy adding the reader lock around the check, this keeps the race from\nhappening.\n\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "475261dbbf5d85e1a298886385d859ada787ae1f", "tree": "8f6505342bc36ca3d51798e65ea6d71cb4b10dc7", "parents": [ "66f8b956aeeeea9e5b3024f860251687f13f9013" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Nov 19 08:13:35 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:58 2013 -0800" }, "message": "cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()\n\ncommit 175431635ec09b1d1bba04979b006b99e8305a83 upstream.\n\ncgroup_create_dir() does weird dancing with dentry refcnt. On\nsuccess, it gets and then puts it achieving nothing. On failure, it\nputs but there isn\u0027t no matching get anywhere leading to the following\noops if cgroup_create_file() fails for whatever reason.\n\n ------------[ cut here ]------------\n kernel BUG at /work/os/work/fs/dcache.c:552!\n invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n Modules linked in:\n CPU 2\n Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs\n RIP: 0010:[\u003cffffffff811d9c0c\u003e] [\u003cffffffff811d9c0c\u003e] dput+0x1dc/0x1e0\n RSP: 0018:ffff88001a3ebef8 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403\n RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58\n RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001\n R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea\n R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60\n FS: 00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080)\n Stack:\n ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000\n ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8\n ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8\n Call Trace:\n [\u003cffffffff811cc889\u003e] done_path_create+0x19/0x50\n [\u003cffffffff811d1fc9\u003e] sys_mkdirat+0x59/0x80\n [\u003cffffffff811d2009\u003e] sys_mkdir+0x19/0x20\n [\u003cffffffff81be1e02\u003e] system_call_fastpath+0x16/0x1b\n Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 \u003c0f\u003e 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41\n RIP [\u003cffffffff811d9c0c\u003e] dput+0x1dc/0x1e0\n RSP \u003cffff88001a3ebef8\u003e\n ---[ end trace 1277bcfd9561ddb0 ]---\n\nFix it by dropping the unnecessary dget/dput() pair.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "09c4161c8a1fe8900561029a5d1dce8887231afd", "tree": "dde521f62d7a805dfc0ef269bc031e6b46d9af6a", "parents": [ "1a37441ae4ad38d98c39b349137c0fb7f76b32ad" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Sat Nov 03 11:52:09 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jan 11 09:06:56 2013 -0800" }, "message": "genirq: Always force thread affinity\n\ncommit 04aa530ec04f61875b99c12721162e2964e3318c upstream.\n\nSankara reported that the genirq core code fails to adjust the\naffinity of an interrupt thread in several cases:\n\n 1) On request/setup_irq() the call to setup_affinity() happens before\n the new action is registered, so the new thread is not notified.\n\n 2) For secondary shared interrupts nothing notifies the new thread to\n change its affinity.\n\n 3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving\n the thread either.\n\nFix this by setting the thread affinity flag right on thread creation\ntime. This ensures that under all circumstances the thread moves to\nthe right place. Requires a check in irq_thread_check_affinity for an\nexisting affinity mask (CONFIG_CPU_MASK_OFFSTACK\u003dy)\n\nReported-and-tested-by: Sankara Muthukrishnan \u003csankara.m@gmail.com\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1209041738200.2754@ionos\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "29251de53e1712158c29b3626a008d8b93a6e024", "tree": "acbbbf18020a71fd5d01beba87453b70fc24b989", "parents": [ "d5a79aa30b7e6cd68dfee6a76acbe6c7f7905f51" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Oct 18 04:55:36 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 17 10:37:46 2012 -0800" }, "message": "rcu: Fix batch-limit size problem\n\ncommit 878d7439d0f45a95869e417576774673d1fa243f upstream.\n\nCommit 29c00b4a1d9e27 (rcu: Add event-tracing for RCU callback\ninvocation) added a regression in rcu_do_batch()\n\nUnder stress, RCU is supposed to allow to process all items in queue,\ninstead of a batch of 10 items (blimit), but an integer overflow makes\nthe effective limit being 1. So, unless there is frequent idle periods\n(during which RCU ignores batch limits), RCU can be forced into a\nstate where it cannot keep up with the callback-generation rate,\neventually resulting in OOM.\n\nThis commit therefore converts a few variables in rcu_do_batch() from\nint to long to fix this problem, along with the module parameters\ncontrolling the batch limits.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@linux.vnet.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "455d8953951baf0d38673b010100241e508b765c", "tree": "094cf118760740e10acdef2f4edffd425e5a86f4", "parents": [ "31fdb19eb968995b3c5f4337918bd51442f992ec" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Sat Jun 09 19:10:27 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 17 10:37:46 2012 -0800" }, "message": "ftrace: Clear bits properly in reset_iter_read()\n\ncommit 70f77b3f7ec010ff9624c1f2e39a81babc9e2429 upstream.\n\nThere is a typo here where \u0027\u0026\u0027 is used instead of \u0027|\u0027 and it turns the\nstatement into a noop. The original code is equivalent to:\n\n\titer-\u003eflags \u0026\u003d ~((1 \u003c\u003c 2) \u0026 (1 \u003c\u003c 4));\n\nLink: http://lkml.kernel.org/r/20120609161027.GD6488@elgon.mountain\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4afca924c03e95345be979bfb7abbfa85963fada", "tree": "75874997200733af14b43737abd0fd19b0b84ada", "parents": [ "a11bf0aa146b60e917dc30348e301d6a7d13dcbd" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Dec 04 07:40:39 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 17 10:37:43 2012 -0800" }, "message": "workqueue: convert BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s\n\ncommit fc4b514f2727f74a4587c31db87e0e93465518c3 upstream.\n\n8852aac25e (\"workqueue: mod_delayed_work_on() shouldn\u0027t queue timer on\n0 delay\") unexpectedly uncovered a very nasty abuse of delayed_work in\nmegaraid - it allocated work_struct, casted it to delayed_work and\nthen pass that into queue_delayed_work().\n\nPreviously, this was okay because 0 @delay short-circuited to\nqueue_work() before doing anything with delayed_work. 8852aac25e\nmoved 0 @delay test into __queue_delayed_work() after sanity check on\ndelayed_work making megaraid trigger BUG_ON().\n\nAlthough megaraid is already fixed by c1d390d8e6 (\"megaraid: fix\nBUG_ON() from incorrect use of delayed work\"), this patch converts\nBUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s so that such\nabusers, if there are more, trigger warning but don\u0027t crash the\nmachine.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Xiaotian Feng \u003cxtfeng@gmail.com\u003e\nSigned-off-by: Shuah Khan \u003cshuah.khan@hp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3d81da8645585b9c116a7ac20b99ac8909677c80", "tree": "a62c27746288ba6e17666bfa6aa017ec3ff3f576", "parents": [ "43477d60e75490b168627aaafccb7032b28d2574" ], "author": { "name": "Mike Galbraith", "email": "efault@gmx.de", "time": "Mon Dec 03 06:25:25 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 10 10:59:40 2012 -0800" }, "message": "Revert \"sched, autogroup: Stop going ahead if autogroup is disabled\"\n\ncommit fd8ef11730f1d03d5d6555aa53126e9e34f52f12 upstream.\n\nThis reverts commit 800d4d30c8f20bd728e5741a3b77c4859a613f7c.\n\nBetween commits 8323f26ce342 (\"sched: Fix race in task_group()\") and\n800d4d30c8f2 (\"sched, autogroup: Stop going ahead if autogroup is\ndisabled\"), autogroup is a wreck.\n\nWith both applied, all you have to do to crash a box is disable\nautogroup during boot up, then reboot.. boom, NULL pointer dereference\ndue to commit 800d4d30c8f2 not allowing autogroup to move things, and\ncommit 8323f26ce342 making that the only way to switch runqueues:\n\n BUG: unable to handle kernel NULL pointer dereference at (null)\n IP: [\u003cffffffff81063ac0\u003e] effective_load.isra.43+0x50/0x90\n Pid: 7047, comm: systemd-user-se Not tainted 3.6.8-smp #7 MEDIONPC MS-7502/MS-7502\n RIP: effective_load.isra.43+0x50/0x90\n Process systemd-user-se (pid: 7047, threadinfo ffff880221dde000, task ffff88022618b3a0)\n Call Trace:\n select_task_rq_fair+0x255/0x780\n try_to_wake_up+0x156/0x2c0\n wake_up_state+0xb/0x10\n signal_wake_up+0x28/0x40\n complete_signal+0x1d6/0x250\n __send_signal+0x170/0x310\n send_signal+0x40/0x80\n do_send_sig_info+0x47/0x90\n group_send_sig_info+0x4a/0x70\n kill_pid_info+0x3a/0x60\n sys_kill+0x97/0x1a0\n ? vfs_read+0x120/0x160\n ? sys_read+0x45/0x90\n system_call_fastpath+0x16/0x1b\n Code: 49 0f af 41 50 31 d2 49 f7 f0 48 83 f8 01 48 0f 46 c6 48 2b 07 48 8b bf 40 01 00 00 48 85 ff 74 3a 45 31 c0 48 8b 8f 50 01 00 00 \u003c48\u003e 8b 11 4c 8b 89 80 00 00 00 49 89 d2 48 01 d0 45 8b 59 58 4c\n RIP [\u003cffffffff81063ac0\u003e] effective_load.isra.43+0x50/0x90\n RSP \u003cffff880221ddfbd8\u003e\n CR2: 0000000000000000\n\nSigned-off-by: Mike Galbraith \u003cefault@gmx.de\u003e\nAcked-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Yong Zhang \u003cyong.zhang0@gmail.com\u003e\nCc: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dbdd7f0c98e8ee0d49da5e8b462ad2ba07d0f358", "tree": "cda3dbb59914171ff1aee49b7df3c9e6b154ef6e", "parents": [ "1b9dd61a10bed126661645cbf2623965fbbdefb3" ], "author": { "name": "Mike Galbraith", "email": "mgalbraith@suse.de", "time": "Wed Nov 28 07:17:18 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 10 10:59:39 2012 -0800" }, "message": "workqueue: exit rescuer_thread() as TASK_RUNNING\n\ncommit 412d32e6c98527078779e5b515823b2810e40324 upstream.\n\nA rescue thread exiting TASK_INTERRUPTIBLE can lead to a task scheduling\noff, never to be seen again. In the case where this occurred, an exiting\nthread hit reiserfs homebrew conditional resched while holding a mutex,\nbringing the box to its knees.\n\nPID: 18105 TASK: ffff8807fd412180 CPU: 5 COMMAND: \"kdmflush\"\n #0 [ffff8808157e7670] schedule at ffffffff8143f489\n #1 [ffff8808157e77b8] reiserfs_get_block at ffffffffa038ab2d [reiserfs]\n #2 [ffff8808157e79a8] __block_write_begin at ffffffff8117fb14\n #3 [ffff8808157e7a98] reiserfs_write_begin at ffffffffa0388695 [reiserfs]\n #4 [ffff8808157e7ad8] generic_perform_write at ffffffff810ee9e2\n #5 [ffff8808157e7b58] generic_file_buffered_write at ffffffff810eeb41\n #6 [ffff8808157e7ba8] __generic_file_aio_write at ffffffff810f1a3a\n #7 [ffff8808157e7c58] generic_file_aio_write at ffffffff810f1c88\n #8 [ffff8808157e7cc8] do_sync_write at ffffffff8114f850\n #9 [ffff8808157e7dd8] do_acct_process at ffffffff810a268f\n [exception RIP: kernel_thread_helper]\n RIP: ffffffff8144a5c0 RSP: ffff8808157e7f58 RFLAGS: 00000202\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffffffff8107af60 RDI: ffff8803ee491d18\n RBP: 0000000000000000 R8: 0000000000000000 R9: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n\nSigned-off-by: Mike Galbraith \u003cmgalbraith@suse.de\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1103ef8e70a1725b7fd9e0cb18a8b1edb6e5c42d", "tree": "b8380d301e5608d6151d24adb89948b1e972c6e5", "parents": [ "e84ad739d8a2143e5cd284a4c0462278587e4aa3" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Tue Oct 09 10:18:23 2012 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:23 2012 -0800" }, "message": "timekeeping: Cast raw_interval to u64 to avoid shift overflow\n\ncommit 5b3900cd409466c0070b234d941650685ad0c791 upstream.\n\nWe fixed a bunch of integer overflows in timekeeping code during the 3.6\ncycle. I did an audit based on that and found this potential overflow.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: John Stultz \u003cjohnstul@us.ibm.com\u003e\nLink: http://lkml.kernel.org/r/20121009071823.GA19159@elgon.mountain\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[ herton: adapt for 3.5, timekeeper instead of tk pointer ]\nSigned-off-by: Herton Ronaldo Krzesinski \u003cherton.krzesinski@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53b360c604575070c83d2da83636af4e5c5de35a", "tree": "f32a2a1681f43c565b4c36009d8e80ee947c3cd4", "parents": [ "368c8c73d4648843bece41f7c083f11fa4d1aa36" ], "author": { "name": "Chuansheng Liu", "email": "chuansheng.liu@intel.com", "time": "Mon Nov 26 16:29:54 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:17 2012 -0800" }, "message": "watchdog: using u64 in get_sample_period()\n\ncommit 8ffeb9b0e6369135bf03a073514f571ef10606b9 upstream.\n\nIn get_sample_period(), unsigned long is not enough:\n\n watchdog_thresh * 2 * (NSEC_PER_SEC / 5)\n\ncase1:\n watchdog_thresh is 10 by default, the sample value will be: 0xEE6B2800\n\ncase2:\n set watchdog_thresh is 20, the sample value will be: 0x1 DCD6 5000\n\nIn case2, we need use u64 to express the sample period. Otherwise,\nchanging the threshold thru proc often can not be successful.\n\nSigned-off-by: liu chuansheng \u003cchuansheng.liu@intel.com\u003e\nAcked-by: Don Zickus \u003cdzickus@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Shuah Khan \u003cshuah.khan@hp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fceca5e72e787dd0a8ea29e22a874e363389356c", "tree": "240a0c9388448ca7465695204862916afe53d996", "parents": [ "f42513b9fd98a0f3afa8fe9bc23700b4226e1f6f" ], "author": { "name": "Darren Hart", "email": "dvhart@linux.intel.com", "time": "Mon Nov 26 16:29:56 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:07 2012 -0800" }, "message": "futex: avoid wake_futex() for a PI futex_q\n\ncommit aa10990e028cac3d5e255711fb9fb47e00700e35 upstream.\n\nDave Jones reported a bug with futex_lock_pi() that his trinity test\nexposed. Sometime between queue_me() and taking the q.lock_ptr, the\nlock_ptr became NULL, resulting in a crash.\n\nWhile futex_wake() is careful to not call wake_futex() on futex_q\u0027s with\na pi_state or an rt_waiter (which are either waiting for a\nfutex_unlock_pi() or a PI futex_requeue()), futex_wake_op() and\nfutex_requeue() do not perform the same test.\n\nUpdate futex_wake_op() and futex_requeue() to test for q.pi_state and\nq.rt_waiter and abort with -EINVAL if detected. To ensure any future\nbreakage is caught, add a WARN() to wake_futex() if the same condition\nis true.\n\nThis fix has seen 3 hours of testing with \"trinity -c futex\" on an\nx86_64 VM with 4 CPUS.\n\n[akpm@linux-foundation.org: tidy up the WARN()]\nSigned-off-by: Darren Hart \u003cdvhart@linux.intel.com\u003e\nReported-by: Dave Jones \u003cdavej@redat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0de578d014506a662b239708f4a0ded7e083292c", "tree": "310f65499150f1ae2f65472bc18770c667c4e7ea", "parents": [ "a6a19e36b35fcb17d6c2bf9a49014e9461dfcef2" ], "author": { "name": "Rusty Russell", "email": "rusty@rustcorp.com.au", "time": "Thu Oct 25 10:49:25 2012 +1030" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 26 11:37:41 2012 -0800" }, "message": "module: fix out-by-one error in kallsyms\n\ncommit 59ef28b1f14899b10d6b2682c7057ca00a9a3f47 upstream.\n\nMasaki found and patched a kallsyms issue: the last symbol in a\nmodule\u0027s symtab wasn\u0027t transferred. This is because we manually copy\nthe zero\u0027th entry (which is always empty) then copy the rest in a loop\nstarting at 1, though from src[0]. His fix was minimal, I prefer to\nrewrite the loops in more standard form.\n\nThere are two loops: one to get the size, and one to copy. Make these\nidentical: always count entry 0 and any defined symbol in an allocated\nnon-init section.\n\nThis bug exists since the following commit was introduced.\n module: reduce symbol table for loaded modules (v2)\n commit: 4a4962263f07d14660849ec134ee42b63e95ea9a\n\nLKML: http://lkml.org/lkml/2012/10/24/27\nReported-by: Masaki Kimura \u003cmasaki.kimura.kz@hitachi.com\u003e\nSigned-off-by: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c4cbedfda2227df82126c9dd5e7593565bf45d21", "tree": "bdd654f05951bc06e8992ee67310ff7729acae4f", "parents": [ "f0d6767af2ece14b24064258dffbc816c4258ae5" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Tue Oct 23 22:29:38 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Nov 17 13:16:22 2012 -0800" }, "message": "futex: Handle futex_pi OWNER_DIED take over correctly\n\ncommit 59fa6245192159ab5e1e17b8e31f15afa9cff4bf upstream.\n\nSiddhesh analyzed a failure in the take over of pi futexes in case the\nowner died and provided a workaround.\nSee: http://sourceware.org/bugzilla/show_bug.cgi?id\u003d14076\n\nThe detailed problem analysis shows:\n\nFutex F is initialized with PTHREAD_PRIO_INHERIT and\nPTHREAD_MUTEX_ROBUST_NP attributes.\n\nT1 lock_futex_pi(F);\n\nT2 lock_futex_pi(F);\n --\u003e T2 blocks on the futex and creates pi_state which is associated\n to T1.\n\nT1 exits\n --\u003e exit_robust_list() runs\n --\u003e Futex F userspace value TID field is set to 0 and\n FUTEX_OWNER_DIED bit is set.\n\nT3 lock_futex_pi(F);\n --\u003e Succeeds due to the check for F\u0027s userspace TID field \u003d\u003d 0\n --\u003e Claims ownership of the futex and sets its own TID into the\n userspace TID field of futex F\n --\u003e returns to user space\n\nT1 --\u003e exit_pi_state_list()\n --\u003e Transfers pi_state to waiter T2 and wakes T2 via\n \t rt_mutex_unlock(\u0026pi_state-\u003emutex)\n\nT2 --\u003e acquires pi_state-\u003emutex and gains real ownership of the\n pi_state\n --\u003e Claims ownership of the futex and sets its own TID into the\n userspace TID field of futex F\n --\u003e returns to user space\n\nT3 --\u003e observes inconsistent state\n\nThis problem is independent of UP/SMP, preemptible/non preemptible\nkernels, or process shared vs. private. The only difference is that\ncertain configurations are more likely to expose it.\n\nSo as Siddhesh correctly analyzed the following check in\nfutex_lock_pi_atomic() is the culprit:\n\n\tif (unlikely(ownerdied || !(curval \u0026 FUTEX_TID_MASK))) {\n\nWe check the userspace value for a TID value of 0 and take over the\nfutex unconditionally if that\u0027s true.\n\nAFAICT this check is there as it is correct for a different corner\ncase of futexes: the WAITERS bit became stale.\n\nNow the proposed change\n\n-\tif (unlikely(ownerdied || !(curval \u0026 FUTEX_TID_MASK))) {\n+ if (unlikely(ownerdied ||\n+ !(curval \u0026 (FUTEX_TID_MASK | FUTEX_WAITERS)))) {\n\nsolves the problem, but it\u0027s not obvious why and it wreckages the\n\"stale WAITERS bit\" case.\n\nWhat happens is, that due to the WAITERS bit being set (T2 is blocked\non that futex) it enforces T3 to go through lookup_pi_state(), which\nin the above case returns an existing pi_state and therefor forces T3\nto legitimately fight with T2 over the ownership of the pi_state (via\npi_state-\u003emutex). Probelm solved!\n\nThough that does not work for the \"WAITERS bit is stale\" problem\nbecause if lookup_pi_state() does not find existing pi_state it\nreturns -ERSCH (due to TID \u003d\u003d 0) which causes futex_lock_pi() to\nreturn -ESRCH to user space because the OWNER_DIED bit is not set.\n\nNow there is a different solution to that problem. Do not look at the\nuser space value at all and enforce a lookup of possibly available\npi_state. If pi_state can be found, then the new incoming locker T3\nblocks on that pi_state and legitimately races with T2 to acquire the\nrt_mutex and the pi_state and therefor the proper ownership of the\nuser space futex.\n\nlookup_pi_state() has the correct order of checks. It first tries to\nfind a pi_state associated with the user space futex and only if that\nfails it checks for futex TID value \u003d 0. If no pi_state is available\nnothing can create new state at that point because this happens with\nthe hash bucket lock held.\n\nSo the above scenario changes to:\n\nT1 lock_futex_pi(F);\n\nT2 lock_futex_pi(F);\n --\u003e T2 blocks on the futex and creates pi_state which is associated\n to T1.\n\nT1 exits\n --\u003e exit_robust_list() runs\n --\u003e Futex F userspace value TID field is set to 0 and\n FUTEX_OWNER_DIED bit is set.\n\nT3 lock_futex_pi(F);\n --\u003e Finds pi_state and blocks on pi_state-\u003ert_mutex\n\nT1 --\u003e exit_pi_state_list()\n --\u003e Transfers pi_state to waiter T2 and wakes it via\n \t rt_mutex_unlock(\u0026pi_state-\u003emutex)\n\nT2 --\u003e acquires pi_state-\u003emutex and gains ownership of the pi_state\n --\u003e Claims ownership of the futex and sets its own TID into the\n userspace TID field of futex F\n --\u003e returns to user space\n\nThis covers all gazillion points on which T3 might come in between\nT1\u0027s exit_robust_list() clearing the TID field and T2 fixing it up. It\nalso solves the \"WAITERS bit stale\" problem by forcing the take over.\n\nAnother benefit of changing the code this way is that it makes it less\ndependent on untrusted user space values and therefor minimizes the\npossible wreckage which might be inflicted.\n\nAs usual after staring for too long at the futex code my brain hurts\nso much that I really want to ditch that whole optimization of\navoiding the syscall for the non contended case for PI futexes and rip\nout the maze of corner case handling code. Unfortunately we can\u0027t as\nuser space relies on that existing behaviour, but at least thinking\nabout it helps me to preserve my mental sanity. Maybe we should\nnevertheless :)\n\nReported-and-tested-by: Siddhesh Poyarekar \u003csiddhesh.poyarekar@gmail.com\u003e\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1210232138540.2756@ionos\nAcked-by: Darren Hart \u003cdvhart@linux.intel.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "727fa37e405a71dc1c7208ea7352be55e0310eca", "tree": "43de8999a864592379df86384426ad2ebf1038fa", "parents": [ "5993bba302a1a6df9c73690a08346411ff7cd56e" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Oct 18 17:52:07 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:14 2012 -0700" }, "message": "Revert \"cgroup: Drop task_lock(parent) on cgroup_fork()\"\n\ncommit 9bb71308b8133d643648776243e4d5599b1c193d upstream.\n\nThis reverts commit 7e381b0eb1e1a9805c37335562e8dc02e7d7848c.\n\nThe commit incorrectly assumed that fork path always performed\nthreadgroup_change_begin/end() and depended on that for\nsynchronization against task exit and cgroup migration paths instead\nof explicitly grabbing task_lock().\n\nthreadgroup_change is not locked when forking a new process (as\nopposed to a new thread in the same process) and even if it were it\nwouldn\u0027t be effective as different processes use different threadgroup\nlocks.\n\nRevert the incorrect optimization.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nLKML-Reference: \u003c20121008020000.GB2575@localhost\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nBitterly-Acked-by: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5993bba302a1a6df9c73690a08346411ff7cd56e", "tree": "d10d70343dd1df236e6d16d75de9c107c86f82d1", "parents": [ "9a55fef20afb3d7362b0c9d19ba1e78dfe482d3d" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Thu Oct 18 17:40:30 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:14 2012 -0700" }, "message": "Revert \"cgroup: Remove task_lock() from cgroup_post_fork()\"\n\ncommit d87838321124061f6c935069d97f37010fa417e6 upstream.\n\nThis reverts commit 7e3aa30ac8c904a706518b725c451bb486daaae9.\n\nThe commit incorrectly assumed that fork path always performed\nthreadgroup_change_begin/end() and depended on that for\nsynchronization against task exit and cgroup migration paths instead\nof explicitly grabbing task_lock().\n\nthreadgroup_change is not locked when forking a new process (as\nopposed to a new thread in the same process) and even if it were it\nwouldn\u0027t be effective as different processes use different threadgroup\nlocks.\n\nRevert the incorrect optimization.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nLKML-Reference: \u003c20121008020000.GB2575@localhost\u003e\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9a55fef20afb3d7362b0c9d19ba1e78dfe482d3d", "tree": "ee17e4fd3a8b21aa09e66d5bca06bbe349d122b3", "parents": [ "9b1ca55bf3ff5fa1c3ff87bac9c7183bc421dc82" ], "author": { "name": "Daisuke Nishimura", "email": "nishimura@mxp.nes.nec.co.jp", "time": "Thu Oct 04 16:37:16 2012 +0900" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:14 2012 -0700" }, "message": "cgroup: notify_on_release may not be triggered in some cases\n\ncommit 1f5320d5972aa50d3e8d2b227b636b370e608359 upstream.\n\nnotify_on_release must be triggered when the last process in a cgroup is\nmove to another. But if the first(and only) process in a cgroup is moved to\nanother, notify_on_release is not triggered.\n\n\t# mkdir /cgroup/cpu/SRC\n\t# mkdir /cgroup/cpu/DST\n\t#\n\t# echo 1 \u003e/cgroup/cpu/SRC/notify_on_release\n\t# echo 1 \u003e/cgroup/cpu/DST/notify_on_release\n\t#\n\t# sleep 300 \u0026\n\t[1] 8629\n\t#\n\t# echo 8629 \u003e/cgroup/cpu/SRC/tasks\n\t# echo 8629 \u003e/cgroup/cpu/DST/tasks\n\t-\u003e notify_on_release for /SRC must be triggered at this point,\n\t but it isn\u0027t.\n\nThis is because put_css_set() is called before setting CGRP_RELEASABLE\nin cgroup_task_migrate(), and is a regression introduce by the\ncommit:74a1166d(cgroups: make procs file writable), which was merged\ninto v3.0.\n\nAcked-by: Li Zefan \u003clizefan@huawei.com\u003e\nCc: Ben Blum \u003cbblum@andrew.cmu.edu\u003e\nSigned-off-by: Daisuke Nishimura \u003cnishimura@mxp.nes.nec.co.jp\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3680030e9747dfa51fe9c1850361c29ae0ad20fe", "tree": "e48ee344079012b024e949657314f7a184004a28", "parents": [ "643fde8ed4ea75f5d113803084806eff14d97454" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Fri Oct 19 18:45:53 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 28 10:14:13 2012 -0700" }, "message": "use clamp_t in UNAME26 fix\n\ncommit 31fd84b95eb211d5db460a1dda85e004800a7b52 upstream.\n\nThe min/max call needed to have explicit types on some architectures\n(e.g. mn10300). Use clamp_t instead to avoid the warning:\n\n kernel/sys.c: In function \u0027override_release\u0027:\n kernel/sys.c:1287:10: warning: comparison of distinct pointer types lacks a cast [enabled by default]\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "643fde8ed4ea75f5d113803084806eff14d97454" }