)]}' { "log": [ { "commit": "3a72660b07d86d60457ca32080b1ce8c2b628ee2", "tree": "edc6f42a551b165943c4590389482c70d6f6639f", "parents": [ "b7a9f420ed737cb7cd4075ba06ac1a6f0da9f878" ], "author": { "name": "Jesper Nilsson", "email": "jesper.nilsson@axis.com", "time": "Thu Nov 21 14:32:08 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 21 16:42:28 2013 -0800" }, "message": "ipc,shm: correct error return value in shmctl (SHM_UNLOCK)\n\nCommit 2caacaa82a51 (\"ipc,shm: shorten critical region for shmctl\")\nrestructured the ipc shm to shorten critical region, but introduced a\npath where the return value could be -EPERM, even if the operation\nactually was performed.\n\nBefore the commit, the err return value was reset by the return value\nfrom security_shm_shmctl() after the if (!ns_capable(...)) statement.\n\nNow, we still exit the if statement with err set to -EPERM, and in the\ncase of SHM_UNLOCK, it is not reset at all, and used as the return value\nfrom shmctl.\n\nTo fix this, we only set err when errors occur, leaving the fallthrough\ncase alone.\n\nSigned-off-by: Jesper Nilsson \u003cjesper.nilsson@axis.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[3.12.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a399b29dfbaaaf91162b2dc5a5875dd51bbfa2a1", "tree": "dfff401b36b593b284cd21e4051ad7a23a944845", "parents": [ "30b0a105d9f7141e4cbf72ae5511832457d89788" ], "author": { "name": "Greg Thelen", "email": "gthelen@google.com", "time": "Thu Nov 21 14:32:00 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Nov 21 16:42:27 2013 -0800" }, "message": "ipc,shm: fix shm_file deletion races\n\nWhen IPC_RMID races with other shm operations there\u0027s potential for\nuse-after-free of the shm object\u0027s associated file (shm_file).\n\nHere\u0027s the race before this patch:\n\n TASK 1 TASK 2\n ------ ------\n shm_rmid()\n ipc_lock_object()\n shmctl()\n shp \u003d shm_obtain_object_check()\n\n shm_destroy()\n shum_unlock()\n fput(shp-\u003eshm_file)\n ipc_lock_object()\n shmem_lock(shp-\u003eshm_file)\n \u003cOOPS\u003e\n\nThe oops is caused because shm_destroy() calls fput() after dropping the\nipc_lock. fput() clears the file\u0027s f_inode, f_path.dentry, and\nf_path.mnt, which causes various NULL pointer references in task 2. I\nreliably see the oops in task 2 if with shmlock, shmu\n\nThis patch fixes the races by:\n1) set shm_file\u003dNULL in shm_destroy() while holding ipc_object_lock().\n2) modify at risk operations to check shm_file while holding\n ipc_object_lock().\n\nExample workloads, which each trigger oops...\n\nWorkload 1:\n while true; do\n id\u003d$(shmget 1 4096)\n shm_rmid $id \u0026\n shmlock $id \u0026\n wait\n done\n\n The oops stack shows accessing NULL f_inode due to racing fput:\n _raw_spin_lock\n shmem_lock\n SyS_shmctl\n\nWorkload 2:\n while true; do\n id\u003d$(shmget 1 4096)\n shmat $id 4096 \u0026\n shm_rmid $id \u0026\n wait\n done\n\n The oops stack is similar to workload 1 due to NULL f_inode:\n touch_atime\n shmem_mmap\n shm_mmap\n mmap_region\n do_mmap_pgoff\n do_shmat\n SyS_shmat\n\nWorkload 3:\n while true; do\n id\u003d$(shmget 1 4096)\n shmlock $id\n shm_rmid $id \u0026\n shmunlock $id \u0026\n wait\n done\n\n The oops stack shows second fput tripping on an NULL f_inode. The\n first fput() completed via from shm_destroy(), but a racing thread did\n a get_file() and queued this fput():\n locks_remove_flock\n __fput\n ____fput\n task_work_run\n do_notify_resume\n int_signal\n\nFixes: c2c737a0461e (\"ipc,shm: shorten critical region for shmat\")\nFixes: 2caacaa82a51 (\"ipc,shm: shorten critical region for shmctl\")\nSigned-off-by: Greg Thelen \u003cgthelen@google.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # 3.10.17+ 3.11.6+\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5cbb3d216e2041700231bcfc383ee5f8b7fc8b74", "tree": "a738fa82dbcefa9bd283c08bc67f38827be63937", "parents": [ "9bc9ccd7db1c9f043f75380b5a5b94912046a60e", "4e9b45a19241354daec281d7a785739829b52359" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:45:43 2013 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:45:43 2013 +0900" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew Morton)\n\nMerge first patch-bomb from Andrew Morton:\n \"Quite a lot of other stuff is banked up awaiting further\n next-\u003emainline merging, but this batch contains:\n\n - Lots of random misc patches\n - OCFS2\n - Most of MM\n - backlight updates\n - lib/ updates\n - printk updates\n - checkpatch updates\n - epoll tweaking\n - rtc updates\n - hfs\n - hfsplus\n - documentation\n - procfs\n - update gcov to gcc-4.7 format\n - IPC\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e: (269 commits)\n ipc, msg: fix message length check for negative values\n ipc/util.c: remove unnecessary work pending test\n devpts: plug the memory leak in kill_sb\n ./Makefile: export initial ramdisk compression config option\n init/Kconfig: add option to disable kernel compression\n drivers: w1: make w1_slave::flags long to avoid memory corruption\n drivers/w1/masters/ds1wm.cuse dev_get_platdata()\n drivers/memstick/core/ms_block.c: fix unreachable state in h_msb_read_page()\n drivers/memstick/core/mspro_block.c: fix attributes array allocation\n drivers/pps/clients/pps-gpio.c: remove redundant of_match_ptr\n kernel/panic.c: reduce 1 byte usage for print tainted buffer\n gcov: reuse kbasename helper\n kernel/gcov/fs.c: use pr_warn()\n kernel/module.c: use pr_foo()\n gcov: compile specific gcov implementation based on gcc version\n gcov: add support for gcc 4.7 gcov format\n gcov: move gcov structs definitions to a gcc version specific file\n kernel/taskstats.c: return -ENOMEM when alloc memory fails in add_del_listener()\n kernel/taskstats.c: add nla_nest_cancel() for failure processing between nla_nest_start() and nla_nest_end()\n kernel/sysctl_binary.c: use scnprintf() instead of snprintf()\n ...\n" }, { "commit": "9bc9ccd7db1c9f043f75380b5a5b94912046a60e", "tree": "dd0a1b3396ae9414f668b0110cc39d11268ad3ed", "parents": [ "f0230294271f511b41797305b685365a9e569a09", "bdd3536618443809d18868563eeafa63b9d29603" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:34:18 2013 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 15:34:18 2013 +0900" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull vfs updates from Al Viro:\n \"All kinds of stuff this time around; some more notable parts:\n\n - RCU\u0027d vfsmounts handling\n - new primitives for coredump handling\n - files_lock is gone\n - Bruce\u0027s delegations handling series\n - exportfs fixes\n\n plus misc stuff all over the place\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (101 commits)\n ecryptfs: -\u003ef_op is never NULL\n locks: break delegations on any attribute modification\n locks: break delegations on link\n locks: break delegations on rename\n locks: helper functions for delegation breaking\n locks: break delegations on unlink\n namei: minor vfs_unlink cleanup\n locks: implement delegations\n locks: introduce new FL_DELEG lock flag\n vfs: take i_mutex on renamed file\n vfs: rename I_MUTEX_QUOTA now that it\u0027s not used for quotas\n vfs: don\u0027t use PARENT/CHILD lock classes for non-directories\n vfs: pull ext4\u0027s double-i_mutex-locking into common code\n exportfs: fix quadratic behavior in filehandle lookup\n exportfs: better variable name\n exportfs: move most of reconnect_path to helper function\n exportfs: eliminate unused \"noprogress\" counter\n exportfs: stop retrying once we race with rename/remove\n exportfs: clear DISCONNECTED on all parents sooner\n exportfs: more detailed comment for path_reconnect\n ...\n" }, { "commit": "4e9b45a19241354daec281d7a785739829b52359", "tree": "aa06af392271e191e6d9c5e7941cd1edbd8332e9", "parents": [ "206fa940977260ede421151aae067e2509356116" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Tue Nov 12 15:11:47 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 12:09:36 2013 +0900" }, "message": "ipc, msg: fix message length check for negative values\n\nOn 64 bit systems the test for negative message sizes is bogus as the\nsize, which may be positive when evaluated as a long, will get truncated\nto an int when passed to load_msg(). So a long might very well contain a\npositive value but when truncated to an int it would become negative.\n\nThat in combination with a small negative value of msg_ctlmax (which will\nbe promoted to an unsigned type for the comparison against msgsz, making\nit a big positive value and therefore make it pass the check) will lead to\ntwo problems: 1/ The kmalloc() call in alloc_msg() will allocate a too\nsmall buffer as the addition of alen is effectively a subtraction. 2/ The\ncopy_from_user() call in load_msg() will first overflow the buffer with\nuserland data and then, when the userland access generates an access\nviolation, the fixup handler copy_user_handle_tail() will try to fill the\nremainder with zeros -- roughly 4GB. That almost instantly results in a\nsystem crash or reset.\n\n ,-[ Reproducer (needs to be run as root) ]--\n | #include \u003csys/stat.h\u003e\n | #include \u003csys/msg.h\u003e\n | #include \u003cunistd.h\u003e\n | #include \u003cfcntl.h\u003e\n |\n | int main(void) {\n | long msg \u003d 1;\n | int fd;\n |\n | fd \u003d open(\"/proc/sys/kernel/msgmax\", O_WRONLY);\n | write(fd, \"-1\", 2);\n | close(fd);\n |\n | msgsnd(0, \u0026msg, 0xfffffff0, IPC_NOWAIT);\n |\n | return 0;\n | }\n \u0027---\n\nFix the issue by preventing msgsz from getting truncated by consistently\nusing size_t for the message length. This way the size checks in\ndo_msgsnd() could still be passed with a negative value for msg_ctlmax but\nwe would fail on the buffer allocation in that case and error out.\n\nAlso change the type of m_ts from int to size_t to avoid similar nastiness\nin other code paths -- it is used in similar constructs, i.e. signed vs.\nunsigned checks. It should never become negative under normal\ncircumstances, though.\n\nSetting msg_ctlmax to a negative value is an odd configuration and should\nbe prevented. As that might break existing userland, it will be handled\nin a separate commit so it could easily be reverted and reworked without\nreintroducing the above described bug.\n\nHardening mechanisms for user copy operations would have catched that bug\nearly -- e.g. checking slab object sizes on user copy operations as the\nusercopy feature of the PaX patch does. Or, for that matter, detect the\nlong vs. int sign change due to truncation, as the size overflow plugin\nof the very same patch does.\n\n[akpm@linux-foundation.org: fix i386 min() warnings]\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Pax Team \u003cpageexec@freemail.hu\u003e\nCc: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nCc: Brad Spengler \u003cspender@grsecurity.net\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[ v2.3.27+ -- yes, that old ;) ]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "206fa940977260ede421151aae067e2509356116", "tree": "07322ef889d492cf1cfea0ca0a36c86d6e30b026", "parents": [ "66da0e1f9034140ae2f571ef96e254a25083906c" ], "author": { "name": "Xie XiuQi", "email": "xiexiuqi@huawei.com", "time": "Tue Nov 12 15:11:46 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 13 12:09:36 2013 +0900" }, "message": "ipc/util.c: remove unnecessary work pending test\n\nRemove unnecessary work pending test before calling schedule_work(). It\nhas been tested in queue_work_on() already. No functional changed.\n\nSigned-off-by: Xie XiuQi \u003cxiexiuqi@huawei.com\u003e\nCc: Tejun Heo \u003ctj@kernel.org\u003e\nReviewed-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "b21996e36c8e3b92a84e972378bde80b43acd890", "tree": "0ed5eb8a3d11434ad6aa9c7efe24823bdb52b1e7", "parents": [ "9accbb977ab78234b8f298df5f306ed08d06bedb" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Sep 20 09:14:34 2011 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Nov 09 00:16:42 2013 -0500" }, "message": "locks: break delegations on unlink\n\nWe need to break delegations on any operation that changes the set of\nlinks pointing to an inode. Start with unlink.\n\nSuch operations also hold the i_mutex on a parent directory. Breaking a\ndelegation may require waiting for a timeout (by default 90 seconds) in\nthe case of a unresponsive NFS client. To avoid blocking all directory\noperations, we therefore drop locks before waiting for the delegation.\nThe logic then looks like:\n\n\tacquire locks\n\t...\n\ttest for delegation; if found:\n\t\ttake reference on inode\n\t\trelease locks\n\t\twait for delegation break\n\t\tdrop reference on inode\n\t\tretry\n\nIt is possible this could never terminate. (Even if we take precautions\nto prevent another delegation being acquired on the same inode, we could\nget a different inode on each retry.) But this seems very unlikely.\n\nThe initial test for a delegation happens after the lock on the target\ninode is acquired, but the directory inode may have been acquired\nfurther up the call stack. We therefore add a \"struct inode **\"\nargument to any intervening functions, which we use to pass the inode\nback up to the caller in the case it needs a delegation synchronously\nbroken.\n\nCc: David Howells \u003cdhowells@redhat.com\u003e\nCc: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nCc: Dustin Kirkland \u003cdustin.kirkland@gazzang.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "9bf76ca325d5e9208eb343f7bd4cc666f703ed30", "tree": "0c6e992844c24162838013caa4f4f3356d6594dd", "parents": [ "9dc8c89dfbbac5546101379d8d2aa0fa30d39888" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Sun Nov 03 12:36:28 2013 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 03 10:53:11 2013 -0800" }, "message": "ipc, msg: forbid negative values for \"msg{max,mnb,mni}\"\n\nNegative message lengths make no sense -- so don\u0027t do negative queue\nlenghts or identifier counts. Prevent them from getting negative.\n\nAlso change the underlying data types to be unsigned to avoid hairy\nsurprises with sign extensions in cases where those variables get\nevaluated in unsigned expressions with bigger data types, e.g size_t.\n\nIn case a user still wants to have \"unlimited\" sizes she could just use\nINT_MAX instead.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6e224f94597842c5eb17f1fc2208d20b6f7f7d49", "tree": "f2a2ed86aa847b16b0d952411aed975f3a978908", "parents": [ "18ccee263c7e250a57f01c9434658f11f4118a64" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Wed Oct 16 13:46:45 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 16 21:35:52 2013 -0700" }, "message": "ipc/sem.c: synchronize semop and semctl with IPC_RMID\n\nAfter acquiring the semlock spinlock, operations must test that the\narray is still valid.\n\n - semctl() and exit_sem() would walk stale linked lists (ugly, but\n should be ok: all lists are empty)\n\n - semtimedop() would sleep forever - and if woken up due to a signal -\n access memory after free.\n\nThe patch also:\n - standardizes the tests for .deleted, so that all tests in one\n function leave the function with the same approach.\n - unconditionally tests for .deleted immediately after every call to\n sem_lock - even it it means that for semctl(GETALL), .deleted will be\n tested twice.\n\nBoth changes make the review simpler: After every sem_lock, there must\nbe a test of .deleted, followed by a goto to the cleanup code (if the\nfunction uses \"goto cleanup\").\n\nThe only exception is semctl_down(): If sem_ids().rwsem is locked, then\nthe presence in ids-\u003eipcs_idr is equivalent to !.deleted, thus no\nadditional test is required.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nAcked-by: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "18ccee263c7e250a57f01c9434658f11f4118a64", "tree": "1655243afdaed94d9e2bdb50af14e45e1cc92834", "parents": [ "9c56751271e7a917783fb57ec49fe8382e0dc867" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr@hp.com", "time": "Wed Oct 16 13:46:45 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 16 21:35:52 2013 -0700" }, "message": "ipc: update locking scheme comments\n\nThe initial documentation was a bit incomplete, update accordingly.\n\n[akpm@linux-foundation.org: make it more readable in 80 columns]\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nAcked-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4271b05a227dc6175b66c3d9941aeab09048aeb2", "tree": "0c535ee0400940f5ad905128c9ecb405c9d65980", "parents": [ "0e8c665699e953fa58dc1b0b0d09e5dce7343cc7" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr@hp.com", "time": "Mon Sep 30 13:45:26 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 30 14:31:03 2013 -0700" }, "message": "ipc,msg: prevent race with rmid in msgsnd,msgrcv\n\nThis fixes a race in both msgrcv() and msgsnd() between finding the msg\nand actually dealing with the queue, as another thread can delete shmid\nunderneath us if we are preempted before acquiring the\nkern_ipc_perm.lock.\n\nManfred illustrates this nicely:\n\nAssume a preemptible kernel that is preempted just after\n\n msq \u003d msq_obtain_object_check(ns, msqid)\n\nin do_msgrcv(). The only lock that is held is rcu_read_lock().\n\nNow the other thread processes IPC_RMID. When the first task is\nresumed, then it will happily wait for messages on a deleted queue.\n\nFix this by checking for if the queue has been deleted after taking the\nlock.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nReported-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e \t[3.11]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0e8c665699e953fa58dc1b0b0d09e5dce7343cc7", "tree": "43f6f73159d7be2fbd7930315a053e27c4c8d189", "parents": [ "fb31ba30fb10fe0ee11739f51669d581b4a1412c" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Sep 30 13:45:25 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 30 14:31:03 2013 -0700" }, "message": "ipc/sem.c: update sem_otime for all operations\n\nIn commit 0a2b9d4c7967 (\"ipc/sem.c: move wake_up_process out of the\nspinlock section\"), the update of semaphore\u0027s sem_otime(last semop time)\nwas moved to one central position (do_smart_update).\n\nBut since do_smart_update() is only called for operations that modify\nthe array, this means that wait-for-zero semops do not update sem_otime\nanymore.\n\nThe fix is simple:\nNon-alter operations must update sem_otime.\n\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nReported-by: Jia He \u003cjiakernel@gmail.com\u003e\nTested-by: Jia He \u003cjiakernel@gmail.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d8c633766ad88527f25d9f81a5c2f083d78a2b39", "tree": "68d0ce69d04d245b8c4236b84892ea740232d6f2", "parents": [ "6d07b68ce16ae9535955ba2059dedba5309c3ca1" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Sep 30 13:45:07 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 30 14:31:01 2013 -0700" }, "message": "ipc/sem.c: synchronize the proc interface\n\nThe proc interface is not aware of sem_lock(), it instead calls\nipc_lock_object() directly. This means that simple semop() operations\ncan run in parallel with the proc interface. Right now, this is\nuncritical, because the implementation doesn\u0027t do anything that requires\na proper synchronization.\n\nBut it is dangerous and therefore should be fixed.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6d07b68ce16ae9535955ba2059dedba5309c3ca1", "tree": "f8eccb1e9ff34ffb41225d247329d7e73148b6fe", "parents": [ "5e9d527591421ccdb16acb8c23662231135d8686" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Sep 30 13:45:06 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 30 14:31:01 2013 -0700" }, "message": "ipc/sem.c: optimize sem_lock()\n\nOperations that need access to the whole array must guarantee that there\nare no simple operations ongoing. Right now this is achieved by\nspin_unlock_wait(sem-\u003elock) on all semaphores.\n\nIf complex_count is nonzero, then this spin_unlock_wait() is not\nnecessary, because it was already performed in the past by the thread\nthat increased complex_count and even though sem_perm.lock was dropped\ninbetween, no simple operation could have started, because simple\noperations cannot start when complex_count is non-zero.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Mike Galbraith \u003cbitbucket@online.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nReviewed-by: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "5e9d527591421ccdb16acb8c23662231135d8686", "tree": "dbe055ecd0bb6e497dceab2c9c0136151d04063a", "parents": [ "f6ea3adb70b20ae36277a1b0eaaf4da9f6479a28" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Sep 30 13:45:04 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 30 14:31:01 2013 -0700" }, "message": "ipc/sem.c: fix race in sem_lock()\n\nThe exclusion of complex operations in sem_lock() is insufficient: after\nacquiring the per-semaphore lock, a simple op must first check that\nsem_perm.lock is not locked and only after that test check\ncomplex_count. The current code does it the other way around - and that\ncreates a race. Details are below.\n\nThe patch is a complete rewrite of sem_lock(), based in part on the code\nfrom Mike Galbraith. It removes all gotos and all loops and thus the\nrisk of livelocks.\n\nI have tested the patch (together with the next one) on my i3 laptop and\nit didn\u0027t cause any problems.\n\nThe bug is probably also present in 3.10 and 3.11, but for these kernels\nit might be simpler just to move the test of sma-\u003ecomplex_count after\nthe spin_is_locked() test.\n\nDetails of the bug:\n\nAssume:\n - sma-\u003ecomplex_count \u003d 0.\n - Thread 1: semtimedop(complex op that must sleep)\n - Thread 2: semtimedop(simple op).\n\nPseudo-Trace:\n\nThread 1: sem_lock(): acquire sem_perm.lock\nThread 1: sem_lock(): check for ongoing simple ops\n\t\t\tNothing ongoing, thread 2 is still before sem_lock().\nThread 1: try_atomic_semop()\n\t\u003c\u003c\u003c preempted.\n\nThread 2: sem_lock():\n static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,\n int nsops)\n {\n int locknum;\n again:\n if (nsops \u003d\u003d 1 \u0026\u0026 !sma-\u003ecomplex_count) {\n struct sem *sem \u003d sma-\u003esem_base + sops-\u003esem_num;\n\n /* Lock just the semaphore we are interested in. */\n spin_lock(\u0026sem-\u003elock);\n\n /*\n * If sma-\u003ecomplex_count was set while we were spinning,\n * we may need to look at things we did not lock here.\n */\n if (unlikely(sma-\u003ecomplex_count)) {\n spin_unlock(\u0026sem-\u003elock);\n goto lock_array;\n }\n \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\n\t\u003c\u003c\u003c complex_count is still 0.\n\t\u003c\u003c\u003c\n \u003c\u003c\u003c Here it is preempted\n \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\n\nThread 1: try_atomic_semop() returns, notices that it must sleep.\nThread 1: increases sma-\u003ecomplex_count.\nThread 1: drops sem_perm.lock\nThread 2:\n /*\n * Another process is holding the global lock on the\n * sem_array; we cannot enter our critical section,\n * but have to wait for the global lock to be released.\n */\n if (unlikely(spin_is_locked(\u0026sma-\u003esem_perm.lock))) {\n spin_unlock(\u0026sem-\u003elock);\n spin_unlock_wait(\u0026sma-\u003esem_perm.lock);\n goto again;\n }\n\t\u003c\u003c\u003c sem_perm.lock already dropped, thus no \"goto again;\"\n\n locknum \u003d sops-\u003esem_num;\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Mike Galbraith \u003cbitbucket@online.de\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[3.10+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "53dad6d3a8e5ac1af8bacc6ac2134ae1a8b085f1", "tree": "fc9349452c9bae7e86dbbbeed99c07bde4bad0c4", "parents": [ "4a10c2ac2f368583138b774ca41fac4207911983" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr@hp.com", "time": "Mon Sep 23 17:04:45 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 24 09:36:53 2013 -0700" }, "message": "ipc: fix race with LSMs\n\nCurrently, IPC mechanisms do security and auditing related checks under\nRCU. However, since security modules can free the security structure,\nfor example, through selinux_[sem,msg_queue,shm]_free_security(), we can\nrace if the structure is freed before other tasks are done with it,\ncreating a use-after-free condition. Manfred illustrates this nicely,\nfor instance with shared mem and selinux:\n\n -\u003e do_shmat calls rcu_read_lock()\n -\u003e do_shmat calls shm_object_check().\n Checks that the object is still valid - but doesn\u0027t acquire any locks.\n Then it returns.\n -\u003e do_shmat calls security_shm_shmat (e.g. selinux_shm_shmat)\n -\u003e selinux_shm_shmat calls ipc_has_perm()\n -\u003e ipc_has_perm accesses ipc_perms-\u003esecurity\n\nshm_close()\n -\u003e shm_close acquires rw_mutex \u0026 shm_lock\n -\u003e shm_close calls shm_destroy\n -\u003e shm_destroy calls security_shm_free (e.g. selinux_shm_free_security)\n -\u003e selinux_shm_free_security calls ipc_free_security(\u0026shp-\u003eshm_perm)\n -\u003e ipc_free_security calls kfree(ipc_perms-\u003esecurity)\n\nThis patch delays the freeing of the security structures after all RCU\nreaders are done. Furthermore it aligns the security life cycle with\nthat of the rest of IPC - freeing them based on the reference counter.\nFor situations where we need not free security, the current behavior is\nkept. Linus states:\n\n \"... the old behavior was suspect for another reason too: having the\n security blob go away from under a user sounds like it could cause\n various other problems anyway, so I think the old code was at least\n _prone_ to bugs even if it didn\u0027t have catastrophic behavior.\"\n\nI have tested this patch with IPC testcases from LTP on both my\nquad-core laptop and on a 64 core NUMA server. In both cases selinux is\nenabled, and tests pass for both voluntary and forced preemption models.\nWhile the mentioned races are theoretical (at least no one as reported\nthem), I wanted to make sure that this new logic doesn\u0027t break anything\nwe weren\u0027t aware of.\n\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr@hp.com\u003e\nAcked-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "20b8875abcf2daa1dda5cf70bd6369df5e85d4c1", "tree": "c2f22cc30656da1d32ffec2871db887e989cae10", "parents": [ "7a25dd9e042b2b94202a67e5551112f4ac87285a" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:31 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:45 2013 -0700" }, "message": "ipc: drop ipc_lock_check\n\nNo remaining users, we now use ipc_obtain_object_check().\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7a25dd9e042b2b94202a67e5551112f4ac87285a", "tree": "17a51b7eaf606565c6018d46192d1700f8b6a4b8", "parents": [ "32a2750010981216fb788c5190fb0e646abfab30" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:30 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:44 2013 -0700" }, "message": "ipc, shm: drop shm_lock_check\n\nThis function was replaced by a the lockless shm_obtain_object_check(),\nand no longer has any users.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "32a2750010981216fb788c5190fb0e646abfab30", "tree": "8a3d02037101eabc254f2e63836323e4373e18a2", "parents": [ "530fcd16d87cd2417c472a581ba5a1e501556c86" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:29 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:44 2013 -0700" }, "message": "ipc: drop ipc_lock_by_ptr\n\nAfter previous cleanups and optimizations, this function is no longer\nheavily used and we don\u0027t have a good reason to keep it. Update the few\nremaining callers and get rid of it.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "530fcd16d87cd2417c472a581ba5a1e501556c86", "tree": "c741f07d57e5b6fdf5920c6ba87e59b779073aaf", "parents": [ "05603c44a7627793219b0bd9a7b236099dc9cd9d" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:28 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:44 2013 -0700" }, "message": "ipc, shm: guard against non-existant vma in shmdt(2)\n\nWhen !CONFIG_MMU there\u0027s a chance we can derefence a NULL pointer when the\nVM area isn\u0027t found - check the return value of find_vma().\n\nAlso, remove the redundant -EINVAL return: retval is set to the proper\nreturn code and *only* changed to 0, when we actually unmap the segments.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "05603c44a7627793219b0bd9a7b236099dc9cd9d", "tree": "7efa266f81f6b68861bbea6cbda6baec48267408", "parents": [ "4718787d1f626f45ddb239912bc07266b9880044" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:26 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:43 2013 -0700" }, "message": "ipc: document general ipc locking scheme\n\nAs suggested by Andrew, add a generic initial locking scheme used\nthroughout all sysv ipc mechanisms. Documenting the ids rwsem, how rcu\ncan be enough to do the initial checks and when to actually acquire the\nkern_ipc_perm.lock spinlock.\n\nI found that adding it to util.c was generic enough.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4718787d1f626f45ddb239912bc07266b9880044", "tree": "160a8a8b414dac9426518987f3ff15bc679cbdb3", "parents": [ "d9a605e40b1376eb02b067d7690580255a0df68f" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:25 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:42 2013 -0700" }, "message": "ipc,msg: drop msg_unlock\n\nThere is only one user left, drop this function and just call\nipc_unlock_object() and rcu_read_unlock().\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d9a605e40b1376eb02b067d7690580255a0df68f", "tree": "b21254f7172ae8db6faffd9b7941d579fa421478", "parents": [ "c2c737a0461e61a34676bd0bd1bc1a70a1b4e396" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:24 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:42 2013 -0700" }, "message": "ipc: rename ids-\u003erw_mutex\n\nSince in some situations the lock can be shared for readers, we shouldn\u0027t\nbe calling it a mutex, rename it to rwsem.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c2c737a0461e61a34676bd0bd1bc1a70a1b4e396", "tree": "f8d9d21cbc43ac12a67bbc428cab083adb31cd30", "parents": [ "f42569b1388b1408b574a5e93a23a663647d4181" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:23 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:42 2013 -0700" }, "message": "ipc,shm: shorten critical region for shmat\n\nSimilar to other system calls, acquire the kern_ipc_perm lock after doing\nthe initial permission and security checks.\n\n[sasha.levin@oracle.com: dont leave do_shmat with rcu lock held]\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f42569b1388b1408b574a5e93a23a663647d4181", "tree": "cc3a37852d3ad59bfc76988d7c4b31973a468187", "parents": [ "2caacaa82a51b78fc0c800e206473874094287ed" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:22 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:42 2013 -0700" }, "message": "ipc,shm: cleanup do_shmat pasta\n\nClean up some of the messy do_shmat() spaghetti code, getting rid of\nout_free and out_put_dentry labels. This makes shortening the critical\nregion of this function in the next patch a little easier to do and read.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2caacaa82a51b78fc0c800e206473874094287ed", "tree": "07dfe1f340d35d907de80f4a80296c72896cef2c", "parents": [ "c97cb9ccab8c85428ec21eff690642ad2ce1fa8a" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:21 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:41 2013 -0700" }, "message": "ipc,shm: shorten critical region for shmctl\n\nWith the *_INFO, *_STAT, IPC_RMID and IPC_SET commands already optimized,\ndeal with the remaining SHM_LOCK and SHM_UNLOCK commands. Take the\nshm_perm lock after doing the initial auditing and security checks. The\nrest of the logic remains unchanged.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c97cb9ccab8c85428ec21eff690642ad2ce1fa8a", "tree": "c435476a079d3bff28ec8c67377227effba57ca9", "parents": [ "68eccc1dc345539d589ae78ee43b835c1a06a134" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:20 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:39 2013 -0700" }, "message": "ipc,shm: make shmctl_nolock lockless\n\nWhile the INFO cmd doesn\u0027t take the ipc lock, the STAT commands do acquire\nit unnecessarily. We can do the permissions and security checks only\nholding the rcu lock.\n\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "68eccc1dc345539d589ae78ee43b835c1a06a134", "tree": "16943d2674537a5d13a14794763a3df7e51411ab", "parents": [ "3b1c4ad37741e53804ffe0a30dd01e08b2ab6241" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:18 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:39 2013 -0700" }, "message": "ipc,shm: introduce shmctl_nolock\n\nSimilar to semctl and msgctl, when calling msgctl, the *_INFO and *_STAT\ncommands can be performed without acquiring the ipc object.\n\nAdd a shmctl_nolock() function and move the logic of *_INFO and *_STAT out\nof msgctl(). Since we are just moving functionality, this change still\ntakes the lock and it will be properly lockless in the next patch.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3b1c4ad37741e53804ffe0a30dd01e08b2ab6241", "tree": "72bdaef5ae179d87eed60879c75128e2384f6aa4", "parents": [ "79ccf0f8c8e04e8b9eda6645ba0f63b0915a3075" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:17 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:39 2013 -0700" }, "message": "ipc: drop ipcctl_pre_down\n\nNow that sem, msgque and shm, through *_down(), all use the lockless\nvariant of ipcctl_pre_down(), go ahead and delete it.\n\n[akpm@linux-foundation.org: fix function name in kerneldoc, cleanups]\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "79ccf0f8c8e04e8b9eda6645ba0f63b0915a3075", "tree": "7178c7dbb1edd12689359f49da36d4e04de93cf8", "parents": [ "8b8d52ac382b17a19906b930cd69e2edb0aca8ba" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:16 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:39 2013 -0700" }, "message": "ipc,shm: shorten critical region in shmctl_down\n\nInstead of holding the ipc lock for the entire function, use the\nipcctl_pre_down_nolock and only acquire the lock for specific commands:\nRMID and SET.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "8b8d52ac382b17a19906b930cd69e2edb0aca8ba", "tree": "19c4c3afbb5c349e9a6ee570c7dd10c73d2f4a90", "parents": [ "6e19eded3684dc184181093af3bff2ff440f5b53" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Wed Sep 11 14:26:15 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 11 15:59:38 2013 -0700" }, "message": "ipc,shm: introduce lockless functions to obtain the ipc object\n\nThis is the third and final patchset that deals with reducing the amount\nof contention we impose on the ipc lock (kern_ipc_perm.lock). These\nchanges mostly deal with shared memory, previous work has already been\ndone for semaphores and message queues:\n\n http://lkml.org/lkml/2013/3/20/546 (sems)\n http://lkml.org/lkml/2013/5/15/584 (mqueues)\n\nWith these patches applied, a custom shm microbenchmark stressing shmctl\ndoing IPC_STAT with 4 threads a million times, reduces the execution\ntime by 50%. A similar run, this time with IPC_SET, reduces the\nexecution time from 3 mins and 35 secs to 27 seconds.\n\nPatches 1-8: replaces blindly taking the ipc lock for a smarter\ncombination of rcu and ipc_obtain_object, only acquiring the spinlock\nwhen updating.\n\nPatch 9: renames the ids rw_mutex to rwsem, which is what it already was.\n\nPatch 10: is a trivial mqueue leftover cleanup\n\nPatch 11: adds a brief lock scheme description, requested by Andrew.\n\nThis patch:\n\nAdd shm_obtain_object() and shm_obtain_object_check(), which will allow us\nto get the ipc object without acquiring the lock. Just as with other\nforms of ipc, these functions are basically wrappers around\nipc_obtain_object*().\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c7c4591db64dbd1e504bc4e2806d7ef290a3c81b", "tree": "a2fb124f9760eec668d20541383e762822d7cc7b", "parents": [ "11c7b03d42a847db90862d0f9d8be6ce9b2f0553", "c7b96acf1456ef127fef461fcfedb54b81fecfbb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 07 14:35:32 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Sep 07 14:35:32 2013 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace\n\nPull namespace changes from Eric Biederman:\n \"This is an assorted mishmash of small cleanups, enhancements and bug\n fixes.\n\n The major theme is user namespace mount restrictions. nsown_capable\n is killed as it encourages not thinking about details that need to be\n considered. A very hard to hit pid namespace exiting bug was finally\n tracked and fixed. A couple of cleanups to the basic namespace\n infrastructure.\n\n Finally there is an enhancement that makes per user namespace\n capabilities usable as capabilities, and an enhancement that allows\n the per userns root to nice other processes in the user namespace\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:\n userns: Kill nsown_capable it makes the wrong thing easy\n capabilities: allow nice if we are privileged\n pidns: Don\u0027t have unshare(CLONE_NEWPID) imply CLONE_THREAD\n userns: Allow PR_CAPBSET_DROP in a user namespace.\n namespaces: Simplify copy_namespaces so it is clear what is going on.\n pidns: Fix hang in zap_pid_ns_processes by sending a potentially extra wakeup\n sysfs: Restrict mounting sysfs\n userns: Better restrictions on when proc and sysfs can be mounted\n vfs: Don\u0027t copy mount bind mounts of /proc/\u003cpid\u003e/ns/mnt between namespaces\n kernel/nsproxy.c: Improving a snippet of code.\n proc: Restrict mounting the proc filesystem\n vfs: Lock in place mounts from more privileged users\n" }, { "commit": "bebcb928c820d0ee83aca4b192adc195e43e66a2", "tree": "28ad45577c7e65e28938eed04b0459674a11f0e3", "parents": [ "ec1882a9391c55332ebf3d1654f40b76e4a6c010" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Tue Sep 03 16:00:08 2013 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 03 10:42:56 2013 -0700" }, "message": "ipc/msg.c: Fix lost wakeup in msgsnd().\n\nThe check if the queue is full and adding current to the wait queue of\npending msgsnd() operations (ss_add()) must be atomic.\n\nOtherwise:\n - the thread that performs msgsnd() finds a full queue and decides to\n sleep.\n - the thread that performs msgrcv() first reads all messages from the\n queue and then sleeps, because the queue is empty.\n - the msgrcv() calls do not perform any wakeups, because the msgsnd()\n task has not yet called ss_add().\n - then the msgsnd()-thread first calls ss_add() and then sleeps.\n\nNet result: msgsnd() and msgrcv() both sleep forever.\n\nObserved with msgctl08 from ltp with a preemptible kernel.\n\nFix: Call ipc_lock_object() before performing the check.\n\nThe patch also moves security_msg_queue_msgsnd() under ipc_lock_object:\n - msgctl(IPC_SET) explicitely mentions that it tries to expunge any\n pending operations that are not allowed anymore with the new\n permissions. If security_msg_queue_msgsnd() is called without locks,\n then there might be races.\n - it makes the patch much simpler.\n\nReported-and-tested-by: Vineet Gupta \u003cVineet.Gupta1@synopsys.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: stable@vger.kernel.org # for 3.11\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c7b96acf1456ef127fef461fcfedb54b81fecfbb", "tree": "1cc9387d23e96685453e545bda6d5a5efea8fa63", "parents": [ "f54fb863c6bbcbafdfc332b4a4260abb5a002137" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Mar 20 12:49:49 2013 -0700" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Fri Aug 30 23:44:11 2013 -0700" }, "message": "userns: Kill nsown_capable it makes the wrong thing easy\n\nnsown_capable is a special case of ns_capable essentially for just CAP_SETUID and\nCAP_SETGID. For the existing users it doesn\u0027t noticably simplify things and\nfrom the suggested patches I have seen it encourages people to do the wrong\nthing. So remove nsown_capable.\n\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\n" }, { "commit": "368ae537e056acd3f751fa276f48423f06803922", "tree": "c0e8dec82905b231fc74b732fd0966d62d530b22", "parents": [ "aaaafb7f953c60d9c9eeb1b10ecdbe6970421b24" ], "author": { "name": "Svenning Sørensen", "email": "sss@secomea.dk", "time": "Wed Aug 28 16:35:17 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Aug 28 19:26:38 2013 -0700" }, "message": "IPC: bugfix for msgrcv with msgtyp \u003c 0\n\nAccording to \u0027man msgrcv\u0027: \"If msgtyp is less than 0, the first message of\nthe lowest type that is less than or equal to the absolute value of msgtyp\nshall be received.\"\n\nBug: The kernel only returns a message if its type is 1; other messages\nwith type \u003c abs(msgtype) will never get returned.\n\nFix: After having traversed the list to find the first message with the\nlowest type, we need to actually return that message.\n\nThis regression was introduced by commit daaf74cf0867 (\"ipc: refactor\nmsg list search into separate function\")\n\nSigned-off-by: Svenning Soerensen \u003csss@secomea.dk\u003e\nReviewed-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "758a6ba39ef6df4cdc615e5edd7bd86eab81a5f7", "tree": "519c1f2e672e888c04b5447a85ad78aa08c1c693", "parents": [ "d12e1e50e47e0900dbbf52237b7e171f4f15ea1e" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Jul 08 16:01:26 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:28 2013 -0700" }, "message": "ipc/sem.c: rename try_atomic_semop() to perform_atomic_semop(), docu update\n\nCleanup: Some minor points that I noticed while writing the previous\npatches\n\n1) The name try_atomic_semop() is misleading: The function performs the\n operation (if it is possible).\n\n2) Some documentation updates.\n\nNo real code change, a rename and documentation changes.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d12e1e50e47e0900dbbf52237b7e171f4f15ea1e", "tree": "83b54585a883ee062353eb464d93944d08ab4a1c", "parents": [ "f269f40ad5aeee229ed70044926f44318abe41ef" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Jul 08 16:01:25 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:28 2013 -0700" }, "message": "ipc/sem.c: replace shared sem_otime with per-semaphore value\n\nsem_otime contains the time of the last semaphore operation that\ncompleted successfully. Every operation updates this value, thus access\nfrom multiple cpus can cause thrashing.\n\nTherefore the patch replaces the variable with a per-semaphore variable.\nThe per-array sem_otime is only calculated when required.\n\nNo performance improvement on a single-socket i3 - only important for\nlarger systems.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f269f40ad5aeee229ed70044926f44318abe41ef", "tree": "878fd6dabbf34c154809ed21f6d64cb90c7e394c", "parents": [ "1a82e9e1d0f1b45f47a97c9e2349020536ff8987" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Jul 08 16:01:24 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:28 2013 -0700" }, "message": "ipc/sem.c: always use only one queue for alter operations\n\nThere are two places that can contain alter operations:\n - the global queue: sma-\u003epending_alter\n - the per-semaphore queues: sma-\u003esem_base[].pending_alter.\n\nSince one of the queues must be processed first, this causes an odd\npriorization of the wakeups: complex operations have priority over\nsimple ops.\n\nThe patch restores the behavior of linux \u003c\u003d3.0.9: The longest waiting\noperation has the highest priority.\n\nThis is done by using only one queue:\n - if there are complex ops, then sma-\u003epending_alter is used.\n - otherwise, the per-semaphore queues are used.\n\nAs a side effect, do_smart_update_queue() becomes much simpler: no more\ngoto logic.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1a82e9e1d0f1b45f47a97c9e2349020536ff8987", "tree": "956810c32e02f6ae1527db015c6ae622800bd720", "parents": [ "f5c936c0f267ec58641451cf8b8d39b4c207ee4d" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Jul 08 16:01:23 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:28 2013 -0700" }, "message": "ipc/sem: separate wait-for-zero and alter tasks into seperate queues\n\nIntroduce separate queues for operations that do not modify the\nsemaphore values. Advantages:\n\n - Simpler logic in check_restart().\n - Faster update_queue(): Right now, all wait-for-zero operations are\n always tested, even if the semaphore value is not 0.\n - wait-for-zero gets again priority, as in linux \u003c\u003d3.0.9\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f5c936c0f267ec58641451cf8b8d39b4c207ee4d", "tree": "714671efc570653a64e602b70524741b0a488907", "parents": [ "196aa0132fc7261f34b10ae1bfb44abc1bc69b3c" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Jul 08 16:01:22 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:28 2013 -0700" }, "message": "ipc/sem.c: cacheline align the semaphore structures\n\nAs now each semaphore has its own spinlock and parallel operations are\npossible, give each semaphore its own cacheline.\n\nOn a i3 laptop, this gives up to 28% better performance:\n\n #semscale 10 | grep \"interleave 2\"\n - before:\n Cpus 1, interleave 2 delay 0: 36109234 in 10 secs\n Cpus 2, interleave 2 delay 0: 55276317 in 10 secs\n Cpus 3, interleave 2 delay 0: 62411025 in 10 secs\n Cpus 4, interleave 2 delay 0: 81963928 in 10 secs\n\n -after:\n Cpus 1, interleave 2 delay 0: 35527306 in 10 secs\n Cpus 2, interleave 2 delay 0: 70922909 in 10 secs \u003c\u003c\u003c + 28%\n Cpus 3, interleave 2 delay 0: 80518538 in 10 secs\n Cpus 4, interleave 2 delay 0: 89115148 in 10 secs \u003c\u003c\u003c + 8.7%\n\ni3, with 2 cores and with hyperthreading enabled. Interleave 2 in order\nuse first the full cores. HT partially hides the delay from cacheline\ntrashing, thus the improvement is \"only\" 8.7% if 4 threads are running.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "196aa0132fc7261f34b10ae1bfb44abc1bc69b3c", "tree": "022d2de428ef8d8c642017adf448790ab803bd96", "parents": [ "9ad66ae65fc8d3e7e3344310fb0aa835910264fe" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Mon Jul 08 16:01:20 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:28 2013 -0700" }, "message": "ipc/util.c, ipc_rcu_alloc: cacheline align allocation\n\nEnforce that ipc_rcu_alloc returns a cacheline aligned pointer on SMP.\n\nRationale:\n\nThe SysV sem code tries to move the main spinlock into a seperate\ncacheline (____cacheline_aligned_in_smp). This works only if\nipc_rcu_alloc returns cacheline aligned pointers. vmalloc and kmalloc\nreturn cacheline algined pointers, the implementation of ipc_rcu_alloc\nbreaks that.\n\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9ad66ae65fc8d3e7e3344310fb0aa835910264fe", "tree": "25dbc032d43dbc9e5cb85c93408fa06e27e5e29d", "parents": [ "41a0d523d0f626e9da0dc01de47f1b89058033cf" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:19 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc: remove unused functions\n\nWe can now drop the msg_lock and msg_lock_check functions along with a\nbogus comment introduced previously in semctl_down.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "41a0d523d0f626e9da0dc01de47f1b89058033cf", "tree": "af4021f97c49c59784dbab62fb1dad36fe6d6f3c", "parents": [ "3dd1f784ed6603d7ab1043e51e6371235edf2313" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:18 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc,msg: shorten critical region in msgrcv\n\ndo_msgrcv() is the last msg queue function that abuses the ipc lock Take\nit only when needed when actually updating msq.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3dd1f784ed6603d7ab1043e51e6371235edf2313", "tree": "21bd41e3f445ca3ba3b96b24f53e9e4adc2ea1fb", "parents": [ "ac0ba20ea6f2201a1589d6dc26ad1a4f0f967bb8" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:17 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc,msg: shorten critical region in msgsnd\n\ndo_msgsnd() is another function that does too many things with the ipc\nobject lock acquired. Take it only when needed when actually updating\nmsq.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ac0ba20ea6f2201a1589d6dc26ad1a4f0f967bb8", "tree": "bc3e2e4c4140f07ee1861b724ba7e1b295d7bbc6", "parents": [ "a5001a0d9768568de5d613c3b3a5b9c7721299da" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:16 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc,msg: make msgctl_nolock lockless\n\nWhile the INFO cmd doesn\u0027t take the ipc lock, the STAT commands do\nacquire it unnecessarily. We can do the permissions and security checks\nonly holding the rcu lock.\n\nThis function now mimics semctl_nolock().\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a5001a0d9768568de5d613c3b3a5b9c7721299da", "tree": "8bdb9f698da1f9e1469322892ba6f6e7c796533b", "parents": [ "2cafed30f150f7314f98717b372df8173516cae0" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:15 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc,msg: introduce lockless functions to obtain the ipc object\n\nAdd msq_obtain_object() and msq_obtain_object_check(), which will allow\nus to get the ipc object without acquiring the lock. Just as with\nsemaphores, these functions are basically wrappers around\nipc_obtain_object*().\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2cafed30f150f7314f98717b372df8173516cae0", "tree": "21f2440948b12d2905d1c2ded7fcc7f88e980360", "parents": [ "15724ecb7e9bab35fc694c666ad563adba820cc3" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:14 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc,msg: introduce msgctl_nolock\n\nSimilar to semctl, when calling msgctl, the *_INFO and *_STAT commands\ncan be performed without acquiring the ipc object.\n\nAdd a msgctl_nolock() function and move the logic of *_INFO and *_STAT\nout of msgctl(). This change still takes the lock and it will be\nproperly lockless in the next patch\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "15724ecb7e9bab35fc694c666ad563adba820cc3", "tree": "d9ae089252e84327367056a29c0cf6b16f844c2e", "parents": [ "7b4cc5d8411bd4e9d61d8714f53859740cf830c2" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:13 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc,msg: shorten critical region in msgctl_down\n\nInstead of holding the ipc lock for the entire function, use the\nipcctl_pre_down_nolock and only acquire the lock for specific commands:\nRMID and SET.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7b4cc5d8411bd4e9d61d8714f53859740cf830c2", "tree": "b95f3b875a5f4c927b0f27cc3c7ddcba5cc8e1e8", "parents": [ "cf9d5d78d05bca96df7618dfc3a5ee4414dcae58" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:12 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc: move locking out of ipcctl_pre_down_nolock\n\nThis function currently acquires both the rw_mutex and the rcu lock on\nsuccessful lookups, leaving the callers to explicitly unlock them,\ncreating another two level locking situation.\n\nMake the callers (including those that still use ipcctl_pre_down())\nexplicitly lock and unlock the rwsem and rcu lock.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "cf9d5d78d05bca96df7618dfc3a5ee4414dcae58", "tree": "b03375cb8d7a2482ad659bd9b675589f427c2336", "parents": [ "1ca7003ab41152d673d9e359632283d05294f3d6" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:11 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc: close open coded spin lock calls\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1ca7003ab41152d673d9e359632283d05294f3d6", "tree": "b587df3d3a2aecc47acd74712348c2895c292bb6", "parents": [ "dbfcd91f06f0e2d5564b2fd184e9c2a43675f9ab" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:10 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:27 2013 -0700" }, "message": "ipc: introduce ipc object locking helpers\n\nSimple helpers around the (kern_ipc_perm *)-\u003elock spinlock.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "dbfcd91f06f0e2d5564b2fd184e9c2a43675f9ab", "tree": "dff823ad3c61e2b199fb42c71abe81264d60e5dd", "parents": [ "c103a4dc4a32f53f095b66cd798d648c652f05b4" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Mon Jul 08 16:01:09 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:26 2013 -0700" }, "message": "ipc: move rcu lock out of ipc_addid\n\nThis patchset continues the work that began in the sysv ipc semaphore\nscaling series, see\n\n https://lkml.org/lkml/2013/3/20/546\n\nJust like semaphores used to be, sysv shared memory and msg queues also\nabuse the ipc lock, unnecessarily holding it for operations such as\npermission and security checks.\n\nThis patchset mostly deals with mqueues, and while shared mem can be\ndone in a very similar way, I want to get these patches out in the open\nfirst. It also does some pending cleanups, mostly focused on the two\nlevel locking we have in ipc code, taking care of ipc_addid() and\nipcctl_pre_down_nolock() - yes there are still functions that need to be\nupdated as well.\n\nThis patch:\n\nMake all callers explicitly take and release the RCU read lock.\n\nThis addresses the two level locking seen in newary(), newseg() and\nnewqueue(). For the last two, explicitly unlock the ipc object and the\nrcu lock, instead of calling the custom shm_unlock and msg_unlock\nfunctions. The next patch will deal with the open coded locking for\n-\u003eperm.lock\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c103a4dc4a32f53f095b66cd798d648c652f05b4", "tree": "4cc3cbd0007255ab708747b6a5b9c3669e1388a8", "parents": [ "f7da04c9e363e479258135ac825734d78aecd2b0" ], "author": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Mon Jul 08 16:01:08 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:26 2013 -0700" }, "message": "ipc/shmc.c: eliminate ugly 80-col tricks\n\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "79f6530cb59e2a0af6953742a33cc29e98ca631c", "tree": "3778b26699b0f217a3c888853faaf0e15c760fc2", "parents": [ "f9f0a7d0dcbd19e9705e8b96a4b408f035e25c93" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Mon Jul 08 15:59:36 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Jul 09 10:33:19 2013 -0700" }, "message": "audit: fix mq_open and mq_unlink to add the MQ root as a hidden parent audit_names record\n\nThe old audit PATH records for mq_open looked like this:\n\n type\u003dPATH msg\u003daudit(1366282323.982:869): item\u003d1 name\u003d(null) inode\u003d6777\n dev\u003d00:0c mode\u003d041777 ouid\u003d0 ogid\u003d0 rdev\u003d00:00\n obj\u003dsystem_u:object_r:tmpfs_t:s15:c0.c1023\n type\u003dPATH msg\u003daudit(1366282323.982:869): item\u003d0 name\u003d\"test_mq\" inode\u003d26732\n dev\u003d00:0c mode\u003d0100700 ouid\u003d0 ogid\u003d0 rdev\u003d00:00\n obj\u003dstaff_u:object_r:user_tmpfs_t:s15:c0.c1023\n\n...with the audit related changes that went into 3.7, they now look like this:\n\n type\u003dPATH msg\u003daudit(1366282236.776:3606): item\u003d2 name\u003d(null) inode\u003d66655\n dev\u003d00:0c mode\u003d0100700 ouid\u003d0 ogid\u003d0 rdev\u003d00:00\n obj\u003dstaff_u:object_r:user_tmpfs_t:s15:c0.c1023\n type\u003dPATH msg\u003daudit(1366282236.776:3606): item\u003d1 name\u003d(null) inode\u003d6926\n dev\u003d00:0c mode\u003d041777 ouid\u003d0 ogid\u003d0 rdev\u003d00:00\n obj\u003dsystem_u:object_r:tmpfs_t:s15:c0.c1023\n type\u003dPATH msg\u003daudit(1366282236.776:3606): item\u003d0 name\u003d\"test_mq\"\n\nBoth of these look wrong to me. As Steve Grubb pointed out:\n\n \"What we need is 1 PATH record that identifies the MQ. The other PATH\n records probably should not be there.\"\n\nFix it to record the mq root as a parent, and flag it such that it\nshould be hidden from view when the names are logged, since the root of\nthe mq filesystem isn\u0027t terribly interesting. With this change, we get\na single PATH record that looks more like this:\n\n type\u003dPATH msg\u003daudit(1368021604.836:484): item\u003d0 name\u003d\"test_mq\" inode\u003d16914\n dev\u003d00:0c mode\u003d0100644 ouid\u003d0 ogid\u003d0 rdev\u003d00:00\n obj\u003dunconfined_u:object_r:user_tmpfs_t:s0\n\nIn order to do this, a new audit_inode_parent_hidden() function is\nadded. If we do it this way, then we avoid having the existing callers\nof audit_inode needing to do any sort of flag conversion if auditing is\ninactive.\n\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nReported-by: Jiri Jaburek \u003cjjaburek@redhat.com\u003e\nCc: Steve Grubb \u003csgrubb@redhat.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ab465df9dda42a997f7537c875127eeb6a88158c", "tree": "28a1ec28c15f1b59c938b7757c8f56eed0de0ecd", "parents": [ "89ff77837a67994e4a4a20bb648687fbcc3083f2" ], "author": { "name": "Manfred Spraul", "email": "manfred@colorfullife.com", "time": "Sun May 26 11:08:52 2013 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun May 26 15:14:51 2013 -0700" }, "message": "ipc/sem.c: Fix missing wakeups in do_smart_update_queue()\n\ndo_smart_update_queue() is called when an operation (semop,\nsemctl(SETVAL), semctl(SETALL), ...) modified the array. It must check\nwhich of the sleeping tasks can proceed.\n\ndo_smart_update_queue() missed a few wakeups:\n - if a sleeping complex op was completed, then all per-semaphore queues\n must be scanned - not only those that were modified by *sops\n - if a sleeping simple op proceeded, then the global queue must be\n scanned again\n\nAnd:\n - the test for \"|sops \u003d\u003d NULL) before scanning the global queue is not\n required: If the global queue is empty, then it doesn\u0027t need to be\n scanned - regardless of the reason for calling do_smart_update_queue()\n\nThe patch is not optimized, i.e. even completing a wait-for-zero\noperation causes a rescan. This is done to keep the patch as simple as\npossible.\n\nSigned-off-by: Manfred Spraul \u003cmanfred@colorfullife.com\u003e\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "091d0d55b286c9340201b4ed4470be87fc568228", "tree": "5417ab8864fbabe1a9931f3a9a81355cd3d3ebaa", "parents": [ "de2657f94acd4f0df44626db7c4d2b71babc8cd3" ], "author": { "name": "Li Zefan", "email": "lizefan@huawei.com", "time": "Thu May 09 15:08:15 2013 +0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 09 14:22:47 2013 -0700" }, "message": "shm: fix null pointer deref when userspace specifies invalid hugepage size\n\nDave reported an oops triggered by trinity:\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000008\n IP: newseg+0x10d/0x390\n PGD cf8c1067 PUD cf8c2067 PMD 0\n Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n CPU: 2 PID: 7636 Comm: trinity-child2 Not tainted 3.9.0+#67\n ...\n Call Trace:\n ipcget+0x182/0x380\n SyS_shmget+0x5a/0x60\n tracesys+0xdd/0xe2\n\nThis bug was introduced by commit af73e4d9506d (\"hugetlbfs: fix mmap\nfailure in unaligned size request\").\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Li Zefan \u003clizfan@huawei.com\u003e\nReviewed-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "de2657f94acd4f0df44626db7c4d2b71babc8cd3", "tree": "4499951b79ff2d199bca0d87ef379d829cc1e400", "parents": [ "ebc2e5e6a408a0e6ed63c0ba98c2c8a232c6b4f4" ], "author": { "name": "Rik van Riel", "email": "riel@redhat.com", "time": "Thu May 09 16:59:59 2013 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 09 14:17:47 2013 -0700" }, "message": "ipc,sem: fix semctl(..., GETNCNT)\n\nThe semctl GETNCNT returns the number of semops waiting for the\nspecified semaphore to become nonzero. After commit 9f1bc2c9022c\n(\"ipc,sem: have only one list in struct sem_queue\"), the semops waiting\non just one semaphore are waiting on that semaphore\u0027s list.\n\nIn order to return the correct count, we have to walk that list too, in\naddition to the sem_array\u0027s list for complex operations.\n\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ebc2e5e6a408a0e6ed63c0ba98c2c8a232c6b4f4", "tree": "eb376fff2b32ae63b6d5ba8faac2f26a899d51df", "parents": [ "07e074503eba3ee657ab50a8c9497ddf90039e7e" ], "author": { "name": "Rik van Riel", "email": "riel@redhat.com", "time": "Thu May 09 16:53:28 2013 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 09 14:17:47 2013 -0700" }, "message": "ipc,sem: fix semctl(..., GETZCNT)\n\nThe semctl GETZCNT returns the number of semops waiting for the\nspecified semaphore to become zero. After commit 9f1bc2c9022c\n(\"ipc,sem: have only one list in struct sem_queue\"), the semops waiting\non just one semaphore are waiting on that semaphore\u0027s list.\n\nIn order to return the correct count, we have to walk that list too, in\naddition to the sem_array\u0027s list for complex operations.\n\nThis bug broke dbench; it works again with this patch applied.\n\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nReported-by: Kent Overstreet \u003ckoverstreet@google.com\u003e\nTested-by: Kent Overstreet \u003ckoverstreet@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "af73e4d9506d3b797509f3c030e7dcd554f7d9c4", "tree": "f9f1bf7483495b66b6cf2cfb3c676791133733b1", "parents": [ "1ab4ce762370b82870834899e49c08129d7ae271" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Tue May 07 16:18:13 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue May 07 18:38:27 2013 -0700" }, "message": "hugetlbfs: fix mmap failure in unaligned size request\n\nThe current kernel returns -EINVAL unless a given mmap length is\n\"almost\" hugepage aligned. This is because in sys_mmap_pgoff() the\ngiven length is passed to vm_mmap_pgoff() as it is without being aligned\nwith hugepage boundary.\n\nThis is a regression introduced in commit 40716e29243d (\"hugetlbfs: fix\nalignment of huge page requests\"), where alignment code is pushed into\nhugetlb_file_setup() and the variable len in caller side is not changed.\n\nTo fix this, this patch partially reverts that commit, and adds\nalignment code in caller side. And it also introduces hstate_sizelog()\nin order to get proper hstate to specified hugepage size.\n\nAddresses https://bugzilla.kernel.org/show_bug.cgi?id\u003d56881\n\n[akpm@linux-foundation.org: fix warning when CONFIG_HUGETLB_PAGE\u003dn]\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReported-by: \u003ciceman_dvd@yahoo.com\u003e\nCc: Steven Truelove \u003csteven.truelove@utoronto.ca\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "941b0304a74b240c607ff098401fd4ef70c9d1cc", "tree": "92cb88d1851360c5e890b7daf737b264cf3181de", "parents": [ "c728b9c87b59fb943c4cba0552d38152787a4ab6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 11:04:29 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 17:24:59 2013 -0700" }, "message": "ipc: simplify rcu_read_lock() in semctl_nolock()\n\nThis trivially combines two rcu_read_lock() calls in both sides of a\nif-statement into one single one in front of the if-statement.\n\nSplit out as an independent cleanup from the previous commit.\n\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c728b9c87b59fb943c4cba0552d38152787a4ab6", "tree": "072a4bac6686701ef46eca2fabb06306c400391b", "parents": [ "321310ced2d6cc0175c76fa512fa8a829ee35223" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 11:04:29 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 17:21:58 2013 -0700" }, "message": "ipc: simplify semtimedop/semctl_main() common error path handling\n\nWith various straight RCU lock/unlock movements, one common exit path\npattern had become\n\n\trcu_read_unlock();\n\tgoto out_wakeup;\n\nand in fact there were no cases where we wanted to exit to out_wakeup\n_without_ releasing the RCU read lock.\n\nSo replace that pattern with \"goto out_rcu_wakeup\", and remove the old\nout_wakeup.\n\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "321310ced2d6cc0175c76fa512fa8a829ee35223", "tree": "0722d86daa8778a69207965cc6bc005d0def9f08", "parents": [ "fbfd1d2862a8316c7191bc551c6a842e6918abb0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 10:47:57 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 17:20:14 2013 -0700" }, "message": "ipc: move sem_obtain_lock() rcu locking into the only caller\n\nsem_obtain_lock() was another of those functions that returned with the\nRCU lock held for reading in the success case. Move the RCU locking to\nthe caller (semtimedop()), making it more obvious. We already did RCU\nlocking elsewhere in that function.\n\nSide note: why does semtimedop() re-do the semphore lookup after the\nsleep, rather than just getting a reference to the semaphore it already\nlooked up originally?\n\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fbfd1d2862a8316c7191bc551c6a842e6918abb0", "tree": "06c5a391238bcf93bb3d7f2c587d069eeb6809e5", "parents": [ "4091fd942e96af5a0b1dfa6aac5f44153ebf7cdb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 10:25:11 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 17:19:59 2013 -0700" }, "message": "ipc: fix double sem unlock in semctl error path\n\nFix another ipc locking buglet introduced by the scalability patches:\nwhen semctl_down() was changed to delay the semaphore locking, one error\npath for security_sem_semctl() went through the semaphore unlock logic\neven though the semaphore had never been locked.\n\nIntroduced by commit 16df3674efe3 (\"ipc,sem: do not hold ipc lock more\nthan necessary\")\n\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4091fd942e96af5a0b1dfa6aac5f44153ebf7cdb", "tree": "0455a439ad1a9884018286670e49c4e18cfaa359", "parents": [ "73b29505c36eeb4751eccad41f6aad78562521f8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 10:13:40 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 17:19:39 2013 -0700" }, "message": "ipc: move the rcu_read_lock() from sem_lock_and_putref() into callers\n\nThis is another ipc semaphore locking cleanup, trying to make the\nlocking more straightforward. We move the rcu read locking into the\ncallers of sem_lock_and_putref(), which in general means that we now\nmostly do the rcu_read_lock() and rcu_read_unlock() in the same\nfunction.\n\nMostly. We still have the ipc_addid/newary/freeary mess, and things\nlike ipcctl_pre_down_nolock().\n\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "73b29505c36eeb4751eccad41f6aad78562521f8", "tree": "228603617659029e082a0968b2e0a6490c121b0d", "parents": [ "6d49dab8ae06c6d35a4d0967364a9ecbe8fdea2c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 03 15:22:00 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 11:24:21 2013 -0700" }, "message": "ipc: sem_putref() does not need the semaphore lock any more\n\nipc_rcu_putref() uses atomics for the refcount, and the games to lock\nand unlock the semaphore just to try to keep the reference counting\nworking are no longer useful.\n\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6d49dab8ae06c6d35a4d0967364a9ecbe8fdea2c", "tree": "7f28ea59e2c52d912faf696d38e9577ffb1c29c3", "parents": [ "ce857229e0c3adc211944a13a5579ef84fd7b4af" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 03 15:04:40 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 04 11:24:00 2013 -0700" }, "message": "ipc: move rcu_read_unlock() out of sem_unlock() and into callers\n\nThe IPC locking is a mess, and sem_unlock() unlocks not only the\nsemaphore spinlock, it also drops the rcu read lock. Unlike sem_lock(),\nwhich just gets the spin-lock, and expects the caller to get the rcu\nread lock.\n\nThis all makes things very hard to follow, and it\u0027s very confusing when\nyou take the rcu read lock in one function, and then release it in\nanother. And it has caused actual bugs: the sem_obtain_lock() function\nended up dropping the RCU read lock twice in one error path, because it\nfirst did the sem_unlock(), and then did a rcu_read_unlock() to match\nthe rcu_read_lock() it had done.\n\nThis is just a totally mindless \"remove rcu_read_unlock() from\nsem_unlock() and add it immediately after each caller\" (except for the\naforementioned bug where we did too many rcu_read_unlock(), and in\nfind_alloc_undo() where we just got the rcu_read_lock() to correct for\nthe fact that sem_unlock would immediately drop it again).\n\nWe can (and should) clean things up further, but this fixes the bug with\nthe minimal amount of subtlety.\n\nReviewed-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ce857229e0c3adc211944a13a5579ef84fd7b4af", "tree": "f12310c2c6492dd7ef4b25dd0c6052f7a114b9cf", "parents": [ "20a2078ce7705a6e0722ef5184336eb8657a58d8" ], "author": { "name": "Al Viro", "email": "viro@ZenIV.linux.org.uk", "time": "Fri May 03 00:30:49 2013 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 02 19:51:31 2013 -0700" }, "message": "ipc: fix GETALL/IPC_RM race for sysv semaphores\n\nWe can step on WARN_ON_ONCE() in sem_getref() if a semaphore is removed\njust as we are about to call sem_getref() from semctl_main(); results\nare not pretty.\n\nWe should fail with -EIDRM, same as if IPC_RM happened while we\u0027d been\ndoing allocation there. This also expands sem_getref() at its only\ncallsite (and fixed there), while sem_getref_and_unlock() is simply\nkilled off - it has no callers at all.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "600fe9751aeb6f6b72de84076a05c5b8c04152c0", "tree": "3c02f2627ab4dad3cee03d3c03955376830b5065", "parents": [ "4ada8db38a44654446fe35ceb20a1972220e0f69" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Apr 29 12:42:09 2013 -0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 02 08:03:33 2013 -0700" }, "message": "ipc_schedule_free() can do vfree() directly now\n\nCommit 32fcfd40715e (\"make vfree() safe to call from interrupt\ncontexts\") made it safe to do vfree directly from the RCU callback,\nwhich allows us to simplify ipc/util.c a lot by getting rid of the\ndifferences between vmalloc/kmalloc memory.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "20b4fb485227404329e41ad15588afad3df23050", "tree": "f3e099f0ab3da8a93b447203e294d2bb22f6dc05", "parents": [ "b9394d8a657cd3c064fa432aa0905c1b58b38fe9", "ac3e3c5b1164397656df81b9e9ab4991184d3236" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 17:51:54 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 17:51:54 2013 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs\n\nPull VFS updates from Al Viro,\n\nMisc cleanups all over the place, mainly wrt /proc interfaces (switch\ncreate_proc_entry to proc_create(), get rid of the deprecated\ncreate_proc_read_entry() in favor of using proc_create_data() and\nseq_file etc).\n\n7kloc removed.\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits)\n don\u0027t bother with deferred freeing of fdtables\n proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h\n proc: Make the PROC_I() and PDE() macros internal to procfs\n proc: Supply a function to remove a proc entry by PDE\n take cgroup_open() and cpuset_open() to fs/proc/base.c\n ppc: Clean up scanlog\n ppc: Clean up rtas_flash driver somewhat\n hostap: proc: Use remove_proc_subtree()\n drm: proc: Use remove_proc_subtree()\n drm: proc: Use minor-\u003eindex to label things, not PDE-\u003ename\n drm: Constify drm_proc_list[]\n zoran: Don\u0027t print proc_dir_entry data in debug\n reiserfs: Don\u0027t access the proc_dir_entry in r_open(), r_start() r_show()\n proc: Supply an accessor for getting the data from a PDE\u0027s parent\n airo: Use remove_proc_subtree()\n rtl8192u: Don\u0027t need to save device proc dir PDE\n rtl8187se: Use a dir under /proc/net/r8180/\n proc: Add proc_mkdir_data()\n proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h}\n proc: Move PDE_NET() to fs/proc/proc_net.c\n ...\n" }, { "commit": "0bb80f240520c4148b623161e7856858c021696d", "tree": "eeb27af589bc12d5864bd2594e5eea59aabe37db", "parents": [ "c3bef7bcaaa7d9f6704fcd81a171c9f0c91a2259" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Fri Apr 12 01:50:06 2013 +0100" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed May 01 17:29:39 2013 -0400" }, "message": "proc: Split the namespace stuff out into linux/proc_ns.h\n\nSplit the proc namespace stuff out into linux/proc_ns.h.\n\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: netdev@vger.kernel.org\ncc: Serge E. Hallyn \u003cserge.hallyn@ubuntu.com\u003e\ncc: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "d69f3bad4675ac519d41ca2b11e1c00ca115cecd", "tree": "343d1fab484751290b2044b347372f8a8468e762", "parents": [ "41239fe82d85c135684b09f1e65622d6c1dbe8dc" ], "author": { "name": "Robin Holt", "email": "holt@sgi.com", "time": "Tue Apr 30 19:15:54 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc: sysv shared memory limited to 8TiB\n\nTrying to run an application which was trying to put data into half of\nmemory using shmget(), we found that having a shmall value below 8EiB-8TiB\nwould prevent us from using anything more than 8TiB. By setting\nkernel.shmall greater than 8EiB-8TiB would make the job work.\n\nIn the newseg() function, ns-\u003eshm_tot which, at 8TiB is INT_MAX.\n\nipc/shm.c:\n 458 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)\n 459 {\n...\n 465 int numpages \u003d (size + PAGE_SIZE -1) \u003e\u003e PAGE_SHIFT;\n...\n 474 if (ns-\u003eshm_tot + numpages \u003e ns-\u003eshm_ctlall)\n 475 return -ENOSPC;\n\n[akpm@linux-foundation.org: make ipc/shm.c:newseg()\u0027s numpages size_t, not int]\nSigned-off-by: Robin Holt \u003cholt@sgi.com\u003e\nReported-by: Alex Thorlton \u003cathorlton@sgi.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "41239fe82d85c135684b09f1e65622d6c1dbe8dc", "tree": "c7c44c3f87444d9636bc911ce98401ab974c21dd", "parents": [ "6062a8dc0517bce23e3c2f7d2fea5e22411269a3" ], "author": { "name": "Nikola Pajkovsky", "email": "npajkovs@redhat.com", "time": "Tue Apr 30 19:15:49 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc/msg.c: use list_for_each_entry_[safe] for list traversing\n\nThe ipc/msg.c code does its list operations by hand and it open-codes the\naccesses, instead of using for_each_entry_[safe].\n\nSigned-off-by: Nikola Pajkovsky \u003cnpajkovs@redhat.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "6062a8dc0517bce23e3c2f7d2fea5e22411269a3", "tree": "e1dd1553167fccb726a8aa9352b27ba14f188374", "parents": [ "9f1bc2c9022c1d4944c4a1a44c2f365487420aca" ], "author": { "name": "Rik van Riel", "email": "riel@surriel.com", "time": "Tue Apr 30 19:15:44 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc,sem: fine grained locking for semtimedop\n\nIntroduce finer grained locking for semtimedop, to handle the common case\nof a program wanting to manipulate one semaphore from an array with\nmultiple semaphores.\n\nIf the call is a semop manipulating just one semaphore in an array with\nmultiple semaphores, only take the lock for that semaphore itself.\n\nIf the call needs to manipulate multiple semaphores, or another caller is\nin a transaction that manipulates multiple semaphores, the sem_array lock\nis taken, as well as all the locks for the individual semaphores.\n\nOn a 24 CPU system, performance numbers with the semop-multi\ntest with N threads and N semaphores, look like this:\n\n\tvanilla\t\tDavidlohr\u0027s\tDavidlohr\u0027s +\tDavidlohr\u0027s +\nthreads\t\t\tpatches\t\trwlock patches\tv3 patches\n10\t610652\t\t726325\t\t1783589\t\t2142206\n20\t341570\t\t365699\t\t1520453\t\t1977878\n30\t288102\t\t307037\t\t1498167\t\t2037995\n40\t290714\t\t305955\t\t1612665\t\t2256484\n50\t288620\t\t312890\t\t1733453\t\t2650292\n60\t289987\t\t306043\t\t1649360\t\t2388008\n70\t291298\t\t306347\t\t1723167\t\t2717486\n80\t290948\t\t305662\t\t1729545\t\t2763582\n90\t290996\t\t306680\t\t1736021\t\t2757524\n100\t292243\t\t306700\t\t1773700\t\t3059159\n\n[davidlohr.bueso@hp.com: do not call sem_lock when bogus sma]\n[davidlohr.bueso@hp.com: make refcounter atomic]\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nReviewed-by: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "9f1bc2c9022c1d4944c4a1a44c2f365487420aca", "tree": "a1764801b992d87e1c488035135f10ed80413944", "parents": [ "c460b662d5cae467f1c341c59b02a5c5e68fed0b" ], "author": { "name": "Rik van Riel", "email": "riel@surriel.com", "time": "Tue Apr 30 19:15:39 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc,sem: have only one list in struct sem_queue\n\nHaving only one list in struct sem_queue, and only queueing simple\nsemaphore operations on the list for the semaphore involved, allows us to\nintroduce finer grained locking for semtimedop.\n\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nCc: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nCc: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "c460b662d5cae467f1c341c59b02a5c5e68fed0b", "tree": "0cc2f44f5a0abd0a7a143d8bd57630e27bc52311", "parents": [ "16df3674efe39f3ab63e7052f1244dd3d50e7f84" ], "author": { "name": "Rik van Riel", "email": "riel@surriel.com", "time": "Tue Apr 30 19:15:35 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc,sem: open code and rename sem_lock\n\nRename sem_lock() to sem_obtain_lock(), so we can introduce a sem_lock()\nlater that only locks the sem_array and does nothing else.\n\nOpen code the locking from ipc_lock() in sem_obtain_lock() so we can\nintroduce finer grained locking for the sem_array in the next patch.\n\n[akpm@linux-foundation.org: propagate the ipc_obtain_object() errno out of sem_obtain_lock()]\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nAcked-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nCc: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nCc: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nCc: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "16df3674efe39f3ab63e7052f1244dd3d50e7f84", "tree": "45ecd49ba72e0b84dbaac338d79173ba1ea4c972", "parents": [ "444d0f621b64716f7868dcbde448e0c66ece4e61" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Tue Apr 30 19:15:29 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc,sem: do not hold ipc lock more than necessary\n\nInstead of holding the ipc lock for permissions and security checks, among\nothers, only acquire it when necessary.\n\nSome numbers....\n\n1) With Rik\u0027s semop-multi.c microbenchmark we can see the following\n results:\n\nBaseline (3.9-rc1):\ncpus 4, threads: 256, semaphores: 128, test duration: 30 secs\ntotal operations: 151452270, ops/sec 5048409\n\n+ 59.40% a.out [kernel.kallsyms] [k] _raw_spin_lock\n+ 6.14% a.out [kernel.kallsyms] [k] sys_semtimedop\n+ 3.84% a.out [kernel.kallsyms] [k] avc_has_perm_flags\n+ 3.64% a.out [kernel.kallsyms] [k] __audit_syscall_exit\n+ 2.06% a.out [kernel.kallsyms] [k] copy_user_enhanced_fast_string\n+ 1.86% a.out [kernel.kallsyms] [k] ipc_lock\n\nWith this patchset:\ncpus 4, threads: 256, semaphores: 128, test duration: 30 secs\ntotal operations: 273156400, ops/sec 9105213\n\n+ 18.54% a.out [kernel.kallsyms] [k] _raw_spin_lock\n+ 11.72% a.out [kernel.kallsyms] [k] sys_semtimedop\n+ 7.70% a.out [kernel.kallsyms] [k] ipc_has_perm.isra.21\n+ 6.58% a.out [kernel.kallsyms] [k] avc_has_perm_flags\n+ 6.54% a.out [kernel.kallsyms] [k] __audit_syscall_exit\n+ 4.71% a.out [kernel.kallsyms] [k] ipc_obtain_object_check\n\n2) While on an Oracle swingbench DSS (data mining) workload the\n improvements are not as exciting as with Rik\u0027s benchmark, we can see\n some positive numbers. For an 8 socket machine the following are the\n percentages of %sys time incurred in the ipc lock:\n\nBaseline (3.9-rc1):\n100 swingbench users: 8,74%\n400 swingbench users: 21,86%\n800 swingbench users: 84,35%\n\nWith this patchset:\n100 swingbench users: 8,11%\n400 swingbench users: 19,93%\n800 swingbench users: 77,69%\n\n[riel@redhat.com: fix two locking bugs]\n[sasha.levin@oracle.com: prevent releasing RCU read lock twice in semctl_main]\n[akpm@linux-foundation.org: coding-style fixes]\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nReviewed-by: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nAcked-by: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Rik van Riel \u003criel@redhat.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nCc: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "444d0f621b64716f7868dcbde448e0c66ece4e61", "tree": "3947e0fe791c53c81d87a929af6d1b8e18a5c6aa", "parents": [ "4d2bff5eb86e8d7b4a20934cccb93bdeebed3558" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Tue Apr 30 19:15:24 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:58 2013 -0700" }, "message": "ipc: introduce lockless pre_down ipcctl\n\nVarious forms of ipc use ipcctl_pre_down() to retrieve an ipc object and\ncheck permissions, mostly for IPC_RMID and IPC_SET commands.\n\nIntroduce ipcctl_pre_down_nolock(), a lockless version of this function.\nThe locking version is retained, yet modified to call the nolock version\nwithout affecting its semantics, thus transparent to all ipc callers.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nCc: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nCc: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4d2bff5eb86e8d7b4a20934cccb93bdeebed3558", "tree": "3667eec32ddcf8686335f64db553613c319f0625", "parents": [ "7bb4deff61bdab3338534841cb6d0508314a41d6" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Tue Apr 30 19:15:19 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: introduce obtaining a lockless ipc object\n\nThrough ipc_lock() and therefore ipc_lock_check() we currently return the\nlocked ipc object. This is not necessary for all situations and can,\ntherefore, cause unnecessary ipc lock contention.\n\nIntroduce analogous ipc_obtain_object() and ipc_obtain_object_check()\nfunctions that only lookup and return the ipc object.\n\nBoth these functions must be called within the RCU read critical section.\n\n[akpm@linux-foundation.org: propagate the ipc_obtain_object() errno from ipc_lock()]\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nReviewed-by: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nAcked-by: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "7bb4deff61bdab3338534841cb6d0508314a41d6", "tree": "2a3be8bf66313a085b9e7c084bbcee5cad8a9b2a", "parents": [ "1e3c941c52eab70c8acb2f77829c24673445c858" ], "author": { "name": "Davidlohr Bueso", "email": "davidlohr.bueso@hp.com", "time": "Tue Apr 30 19:15:14 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: remove bogus lock comment for ipc_checkid\n\nThis series makes the sysv semaphore code more scalable, by reducing the\ntime the semaphore lock is held, and making the locking more scalable for\nsemaphore arrays with multiple semaphores.\n\nThe first four patches were written by Davidlohr Buesso, and reduce the\nhold time of the semaphore lock.\n\nThe last three patches change the sysv semaphore code locking to be more\nfine grained, providing a performance boost when multiple semaphores in a\nsemaphore array are being manipulated simultaneously.\n\nOn a 24 CPU system, performance numbers with the semop-multi\ntest with N threads and N semaphores, look like this:\n\n\tvanilla\t\tDavidlohr\u0027s\tDavidlohr\u0027s +\tDavidlohr\u0027s +\n\tthreads\t\t\tpatches\t\trwlock patches\tv3 patches\n\t10\t610652\t\t726325\t\t1783589\t\t2142206\n\t20\t341570\t\t365699\t\t1520453\t\t1977878\n\t30\t288102\t\t307037\t\t1498167\t\t2037995\n\t40\t290714\t\t305955\t\t1612665\t\t2256484\n\t50\t288620\t\t312890\t\t1733453\t\t2650292\n\t60\t289987\t\t306043\t\t1649360\t\t2388008\n\t70\t291298\t\t306347\t\t1723167\t\t2717486\n\t80\t290948\t\t305662\t\t1729545\t\t2763582\n\t90\t290996\t\t306680\t\t1736021\t\t2757524\n\t100\t292243\t\t306700\t\t1773700\t\t3059159\n\nThis patch:\n\nThere is no reason to be holding the ipc lock while reading ipcp-\u003eseq,\nhence remove misleading comment.\n\nAlso simplify the return value for the function.\n\nSigned-off-by: Davidlohr Bueso \u003cdavidlohr.bueso@hp.com\u003e\nSigned-off-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: Chegu Vinod \u003cchegu_vinod@hp.com\u003e\nCc: Emmanuel Benisty \u003cbenisty.e@gmail.com\u003e\nCc: Jason Low \u003cjason.low2@hp.com\u003e\nCc: Michel Lespinasse \u003cwalken@google.com\u003e\nCc: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nTested-by: Sedat Dilek \u003csedat.dilek@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1e3c941c52eab70c8acb2f77829c24673445c858", "tree": "a8b35dcd0966bdd5461d327c19439c74eff4ca07", "parents": [ "daaf74cf0867e3042090d56d10b194d6265b4684" ], "author": { "name": "HoSung Jung", "email": "rain6557@gmail.com", "time": "Tue Apr 30 19:15:09 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc/msgutil.c: use linux/uaccess.h\n\nSigned-off-by: HoSung Jung \u003crain6557@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "daaf74cf0867e3042090d56d10b194d6265b4684", "tree": "374a5a8f993417a5a985ba94c3b178ee4e63a389", "parents": [ "d076ac9112797884c0be35f4c93c1517aa352c0c" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:15:04 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: refactor msg list search into separate function\n\n[fengguang.wu@intel.com: find_msg can be static]\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nCc: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d076ac9112797884c0be35f4c93c1517aa352c0c", "tree": "5a39ceeebedd90e3bd4d567449e90678c932ab04", "parents": [ "8ac6ed5857c8d583e0dc2ab2165966ab143930ad" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:59 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: simplify msg list search\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "8ac6ed5857c8d583e0dc2ab2165966ab143930ad", "tree": "d5c7606ce371ff52213915267b8b34898232a7e3", "parents": [ "852028af861ed6c7ab7e73053dd664eb28e55200" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:54 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: implement MSG_COPY as a new receive mode\n\nTeach the helper routines about MSG_COPY so that msgtyp is preserved as\nthe message number to copy.\n\nThe security functions affected by this change were audited and no\nadditional changes are necessary.\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "852028af861ed6c7ab7e73053dd664eb28e55200", "tree": "1b3be153ff8d0f9d25e20417a1edc34659cbf88a", "parents": [ "2b3097a294b6daaf390010de14ca50bfccbc6fb6" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:48 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: remove msg handling from queue scan\n\nIn preparation for refactoring the queue scan into a separate\nfunction, relocate msg copying.\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2b3097a294b6daaf390010de14ca50bfccbc6fb6", "tree": "e6a90cce5782af1922bd7f53b1b13a2b24cb836b", "parents": [ "da085d4591a6fe11eac2e1f659f25b655e9f2e53" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:42 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: set EFAULT as default error in load_msg()\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "da085d4591a6fe11eac2e1f659f25b655e9f2e53", "tree": "3f6ce1efcbf85c4a3752ef848c0fdf1e62381688", "parents": [ "be5f4b335f6e05df1b5c24b7e7d79ff52d7b8dbc" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:37 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: tighten msg copy loops\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "be5f4b335f6e05df1b5c24b7e7d79ff52d7b8dbc", "tree": "5076680c91f139ba8908d7ecd51dd02206e57496", "parents": [ "3d8fa456d5ed22ce8db085a89a037b87568b2b64" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:31 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: separate msg allocation from userspace copy\n\nSeparating msg allocation enables single-block vmalloc\nallocation instead.\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3d8fa456d5ed22ce8db085a89a037b87568b2b64", "tree": "3e8351d43bea10a10a553f10d1029dcb240a1c39", "parents": [ "08d76760832993050ad8c25e63b56773ef2ca303" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Tue Apr 30 19:14:25 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 08:12:57 2013 -0700" }, "message": "ipc: clamp with min()\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "08d76760832993050ad8c25e63b56773ef2ca303", "tree": "abdcf148dfe43cd49f30f204f1dac6978107a508", "parents": [ "5f56886521d6ddd3648777fae44d82382dd8c87f", "99e621f796d7f0341a51e8cdf32b81663b10b448" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 07:21:43 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed May 01 07:21:43 2013 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal\n\nPull compat cleanup from Al Viro:\n \"Mostly about syscall wrappers this time; there will be another pile\n with patches in the same general area from various people, but I\u0027d\n rather push those after both that and vfs.git pile are in.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal:\n syscalls.h: slightly reduce the jungles of macros\n get rid of union semop in sys_semctl(2) arguments\n make do_mremap() static\n sparc: no need to sign-extend in sync_file_range() wrapper\n ppc compat wrappers for add_key(2) and request_key(2) are pointless\n x86: trim sys_ia32.h\n x86: sys32_kill and sys32_mprotect are pointless\n get rid of compat_sys_semctl() and friends in case of ARCH_WANT_OLD_COMPAT_IPC\n merge compat sys_ipc instances\n consolidate compat lookup_dcookie()\n convert vmsplice to COMPAT_SYSCALL_DEFINE\n switch getrusage() to COMPAT_SYSCALL_DEFINE\n switch epoll_pwait to COMPAT_SYSCALL_DEFINE\n convert sendfile{,64} to COMPAT_SYSCALL_DEFINE\n switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE\n make SYSCALL_DEFINE\u003cn\u003e-generated wrappers do asmlinkage_protect\n make HAVE_SYSCALL_WRAPPERS unconditional\n consolidate cond_syscall and SYSCALL_ALIAS declarations\n teach SYSCALL_DEFINE\u003cn\u003e how to deal with long long/unsigned long long\n get rid of duplicate logics in __SC_....[1-6] definitions\n" }, { "commit": "8f68fa2d1908365cb372b1aebf89d6af4b2b3871", "tree": "4885cec0a47e288ea797d07837e31b215425f264", "parents": [ "f02c696800886382198df897b30bb796b46a8dae" ], "author": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Mon Apr 29 15:08:05 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Apr 29 15:54:36 2013 -0700" }, "message": "ipc/util.c: use register_hotmemory_notifier()\n\nSquishes a statement-with-no-effect warning, removes some ifdefs and\nshrinks .text by one byte!\n\nNote that this code fails to check for blocking_notifier_chain_register()\nfailures.\n\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d9dda78bad879595d8c4220a067fc029d6484a16", "tree": "376c47ed566b719009e753e917104b150a639b11", "parents": [ "8510e30b46cd5467b2f930bef68a276dbc2c7d7c" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Mar 31 18:16:14 2013 -0400" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Apr 09 14:13:32 2013 -0400" }, "message": "procfs: new helper - PDE_DATA(inode)\n\nThe only part of proc_dir_entry the code outside of fs/proc\nreally cares about is PDE(inode)-\u003edata. Provide a helper\nfor that; static inline for now, eventually will be moved\nto fs/proc, along with the knowledge of struct proc_dir_entry\nlayout.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "2dc958fa2fe6987e7ab106bd97029a09a82fcd8d", "tree": "c260602e6d7233a0e05f252c0dfcb4dae587b9d2", "parents": [ "118c9a45fdacc6fe57910fa1d048e2d5bbc193f4" ], "author": { "name": "Stanislav Kinsbursky", "email": "skinsbursky@parallels.com", "time": "Mon Apr 01 11:40:51 2013 +0400" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 02 10:09:01 2013 -0700" }, "message": "ipc: set msg back to -EAGAIN if copy wasn\u0027t performed\n\nMake sure that msg pointer is set back to error value in case of\nMSG_COPY flag is set and desired message to copy wasn\u0027t found. This\ngarantees that msg is either a error pointer or a copy address.\n\nOtherwise the last message in queue will be freed without unlinking from\nthe queue (which leads to memory corruption) and the dummy allocated\ncopy won\u0027t be released.\n\nSigned-off-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2c3de1c2d7d68c6ba4c1ecd82c68285f34d9609e", "tree": "6a09ce761173a966718f9009514dcc90bd9947b7", "parents": [ "9064171268d838b8f283fe111ef086b9479d059a", "87a8ebd637dafc255070f503909a053cf0d98d3f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 28 13:43:46 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 28 13:43:46 2013 -0700" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace\n\nPull userns fixes from Eric W Biederman:\n \"The bulk of the changes are fixing the worst consequences of the user\n namespace design oversight in not considering what happens when one\n namespace starts off as a clone of another namespace, as happens with\n the mount namespace.\n\n The rest of the changes are just plain bug fixes.\n\n Many thanks to Andy Lutomirski for pointing out many of these issues.\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:\n userns: Restrict when proc and sysfs can be mounted\n ipc: Restrict mounting the mqueue filesystem\n vfs: Carefully propogate mounts across user namespaces\n vfs: Add a mount flag to lock read only bind mounts\n userns: Don\u0027t allow creation if the user is chrooted\n yama: Better permission check for ptraceme\n pid: Handle the exit of a multi-threaded init.\n scm: Require CAP_SYS_ADMIN over the current pidns to spoof pids.\n" }, { "commit": "a636b702ed1805e988ad3d8ff8b52c060f8b341c", "tree": "6144e89780172adc58cea3cab7d75000ae31fa04", "parents": [ "132c94e31b8bca8ea921f9f96a57d684fa4ae0a9" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Thu Mar 21 18:13:15 2013 -0700" }, "committer": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Mar 27 07:50:06 2013 -0700" }, "message": "ipc: Restrict mounting the mqueue filesystem\n\nOnly allow mounting the mqueue filesystem if the caller has CAP_SYS_ADMIN\nrights over the ipc namespace. The principle here is if you create\nor have capabilities over it you can mount it, otherwise you get to live\nwith what other people have mounted.\n\nThis information is not particularly sensitive and mqueue essentially\nonly reports which posix messages queues exist. Still when creating a\nrestricted environment for an application to live any extra\ninformation may be of use to someone with sufficient creativity. The\nhistorical if imperfect way this information has been restricted has\nbeen not to allow mounts and restricting this to ipc namespace\ncreators maintains the spirit of the historical restriction.\n\nCc: stable@vger.kernel.org\nAcked-by: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\n" }, { "commit": "38d78e587d4960d0db94add518d27ee74bad2301", "tree": "3022cdde7ae5acd60be295f3d3fd9c78814e41c4", "parents": [ "ca4b3f302c90de5e516296e581c31c80125cd24b" ], "author": { "name": "Vladimir Davydov", "email": "vdavydov@parallels.com", "time": "Fri Mar 22 15:04:51 2013 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 22 16:41:21 2013 -0700" }, "message": "mqueue: sys_mq_open: do not call mnt_drop_write() if read-only\n\nmnt_drop_write() must be called only if mnt_want_write() succeeded,\notherwise the mnt_writers counter will diverge.\n\nmnt_writers counters are used to check if remounting FS as read-only is\nOK, so after an extra mnt_drop_write() call, it would be impossible to\nremount mqueue FS as read-only. Besides, on umount a warning would be\nprinted like this one:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ BUG: bad unlock balance detected! ]\n 3.9.0-rc3 #5 Not tainted\n -------------------------------------\n a.out/12486 is trying to release lock (sb_writers) at:\n mnt_drop_write+0x1f/0x30\n but there are no more locks to release!\n\nSigned-off-by: Vladimir Davydov \u003cvdavydov@parallels.com\u003e\nCc: Doug Ledford \u003cdledford@redhat.com\u003e\nCc: KOSAKI Motohiro \u003ckosaki.motohiro@jp.fujitsu.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "88b9e456b1649722673ffa147914299799dc9041", "tree": "cb2c12ee6fc4ad53e1a15c4e19f676b1d0058183", "parents": [ "e1082f45f1e2bbf6e25f6b614fc6616ebf709d19" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Fri Mar 08 12:43:27 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 08 15:05:33 2013 -0800" }, "message": "ipc: don\u0027t allocate a copy larger than max\n\nWhen MSG_COPY is set, a duplicate message must be allocated for the copy\nbefore locking the queue. However, the copy could not be larger than was\nsent which is limited to msg_ctlmax.\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e1082f45f1e2bbf6e25f6b614fc6616ebf709d19", "tree": "f9d3e4326eed088acfe4cd1e9a8caf9c2138da55", "parents": [ "47b3bc907328db968bc9b43c41f48f8d1e140750" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Fri Mar 08 12:43:26 2013 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 08 15:05:33 2013 -0800" }, "message": "ipc: fix potential oops when src msg \u003e 4k w/ MSG_COPY\n\nIf the src msg is \u003e 4k, then dest-\u003enext points to the\nnext allocated segment; resetting it just prior to dereferencing\nis bad.\n\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nAcked-by: Stanislav Kinsbursky \u003cskinsbursky@parallels.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e1fd1f490fa4213bd3060efa823a39d299538f72", "tree": "8bed18bdf003822ef1a4946e734418cf88546c24", "parents": [ "4b377bab29e6a241db42f27541e7fb63713ee178" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 05 15:04:55 2013 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Tue Mar 05 15:14:16 2013 -0500" }, "message": "get rid of union semop in sys_semctl(2) arguments\n\njust have the bugger take unsigned long and deal with SETVAL\ncase (when we use an int member in the union) explicitly.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "0e65a81b105a3f646793d46740ad90fa5c067986", "tree": "3ebab1b2110a978c1e86ee2ee378d33b4a191826", "parents": [ "56e41d3c5aa84d679eebdb3cb8a70b03c5fbd6c3" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Feb 03 14:36:44 2013 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Mar 03 23:00:27 2013 -0500" }, "message": "get rid of compat_sys_semctl() and friends in case of ARCH_WANT_OLD_COMPAT_IPC\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "56e41d3c5aa84d679eebdb3cb8a70b03c5fbd6c3", "tree": "62ede9a6cc31ed46d78632b65c4a66485fd5d1ad", "parents": [ "d5dc77bfeeab0b03a32e3db5e31e2f64605634ab" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Jan 21 23:15:25 2013 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Mar 03 23:00:27 2013 -0500" }, "message": "merge compat sys_ipc instances\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" } ], "next": "22d1a35da0e247a006c286842a1846acb4ffed4f" }