3.10-stable patches

added patches:
	mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch
	xen-console-update-console-event-channel-on-resume.patch

diff --git a/queue-3.10/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch b/queue-3.10/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch
new file mode 100644 (file)
index 0000000..00fdc97
--- /dev/null
+++ b/queue-3.10/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch
@@ -0,0 +1,59 @@
+From 09789e5de18e4e442870b2d700831f5cb802eb05 Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Tue, 5 May 2015 16:23:35 -0700
+Subject: mm/memory-failure: call shake_page() when error hits thp tail page
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit 09789e5de18e4e442870b2d700831f5cb802eb05 upstream.
+
+Currently memory_failure() calls shake_page() to sweep pages out from
+pcplists only when the victim page is 4kB LRU page or thp head page.
+But we should do this for a thp tail page too.
+
+Consider that a memory error hits a thp tail page whose head page is on
+a pcplist when memory_failure() runs.  Then, the current kernel skips
+shake_pages() part, so hwpoison_user_mappings() returns without calling
+split_huge_page() nor try_to_unmap() because PageLRU of the thp head is
+still cleared due to the skip of shake_page().
+
+As a result, me_huge_page() runs for the thp, which is broken behavior.
+
+One effect is a leak of the thp.  And another is to fail to isolate the
+memory error, so later access to the error address causes another MCE,
+which kills the processes which used the thp.
+
+This patch fixes this problem by calling shake_page() for thp tail case.
+
+Fixes: 385de35722c9 ("thp: allow a hwpoisoned head page to be put back to LRU")
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: Dean Nelson <dnelson@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Cc: Jin Dongming <jin.dongming@np.css.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memory-failure.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1117,10 +1117,10 @@ int memory_failure(unsigned long pfn, in
+        * The check (unnecessarily) ignores LRU pages being isolated and
+        * walked by the page reclaim code, however that's not a big loss.
+        */
+-      if (!PageHuge(p) && !PageTransTail(p)) {
+-              if (!PageLRU(p))
+-                      shake_page(p, 0);
+-              if (!PageLRU(p)) {
++      if (!PageHuge(p)) {
++              if (!PageLRU(hpage))
++                      shake_page(hpage, 0);
++              if (!PageLRU(hpage)) {
+                       /*
+                        * shake_page could have turned it free.
+                        */

diff --git a/queue-3.10/series b/queue-3.10/series
index f535084d8d40ae1d6158e5fe641a57826625e39f..0e8e849faa7cfee8430384109cf6bd95ea94b47a 100644 (file)
--- a/queue-3.10/series
+++ b/queue-3.10/series
@@ -1,2 +1,4 @@
 ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch
 nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch
+mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch
+xen-console-update-console-event-channel-on-resume.patch

diff --git a/queue-3.10/xen-console-update-console-event-channel-on-resume.patch b/queue-3.10/xen-console-update-console-event-channel-on-resume.patch
new file mode 100644 (file)
index 0000000..6c8d82b
--- /dev/null
+++ b/queue-3.10/xen-console-update-console-event-channel-on-resume.patch
@@ -0,0 +1,51 @@
+From b9d934f27c91b878c4b2e64299d6e419a4022f8d Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Date: Wed, 29 Apr 2015 17:10:14 -0400
+Subject: xen/console: Update console event channel on resume
+
+From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+
+commit b9d934f27c91b878c4b2e64299d6e419a4022f8d upstream.
+
+After a resume the hypervisor/tools may change console event
+channel number. We should re-query it.
+
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/hvc/hvc_xen.c |   18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -299,11 +299,27 @@ static int xen_initial_domain_console_in
+       return 0;
+ }
+ 
++static void xen_console_update_evtchn(struct xencons_info *info)
++{
++      if (xen_hvm_domain()) {
++              uint64_t v;
++              int err;
++
++              err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
++              if (!err && v)
++                      info->evtchn = v;
++      } else
++              info->evtchn = xen_start_info->console.domU.evtchn;
++}
++
+ void xen_console_resume(void)
+ {
+       struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE);
+-      if (info != NULL && info->irq)
++      if (info != NULL && info->irq) {
++              if (!xen_initial_domain())
++                      xen_console_update_evtchn(info);
+               rebind_evtchn_irq(info->evtchn, info->irq);
++      }
+ }
+ 
+ static void xencons_disconnect_backend(struct xencons_info *info)