From: Greg Kroah-Hartman Date: Fri, 15 May 2015 02:06:34 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.10.79~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=59033f2af3c2a31ad09bead79e0757a2ce891d00;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch xen-console-update-console-event-channel-on-resume.patch --- diff --git a/queue-3.10/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch b/queue-3.10/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch new file mode 100644 index 00000000000..00fdc977278 --- /dev/null +++ b/queue-3.10/mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch @@ -0,0 +1,59 @@ +From 09789e5de18e4e442870b2d700831f5cb802eb05 Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Tue, 5 May 2015 16:23:35 -0700 +Subject: mm/memory-failure: call shake_page() when error hits thp tail page + +From: Naoya Horiguchi + +commit 09789e5de18e4e442870b2d700831f5cb802eb05 upstream. + +Currently memory_failure() calls shake_page() to sweep pages out from +pcplists only when the victim page is 4kB LRU page or thp head page. +But we should do this for a thp tail page too. + +Consider that a memory error hits a thp tail page whose head page is on +a pcplist when memory_failure() runs. Then, the current kernel skips +shake_pages() part, so hwpoison_user_mappings() returns without calling +split_huge_page() nor try_to_unmap() because PageLRU of the thp head is +still cleared due to the skip of shake_page(). + +As a result, me_huge_page() runs for the thp, which is broken behavior. + +One effect is a leak of the thp. And another is to fail to isolate the +memory error, so later access to the error address causes another MCE, +which kills the processes which used the thp. + +This patch fixes this problem by calling shake_page() for thp tail case. + +Fixes: 385de35722c9 ("thp: allow a hwpoisoned head page to be put back to LRU") +Signed-off-by: Naoya Horiguchi +Reviewed-by: Andi Kleen +Acked-by: Dean Nelson +Cc: Andrea Arcangeli +Cc: Hidetoshi Seto +Cc: Jin Dongming +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory-failure.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1117,10 +1117,10 @@ int memory_failure(unsigned long pfn, in + * The check (unnecessarily) ignores LRU pages being isolated and + * walked by the page reclaim code, however that's not a big loss. + */ +- if (!PageHuge(p) && !PageTransTail(p)) { +- if (!PageLRU(p)) +- shake_page(p, 0); +- if (!PageLRU(p)) { ++ if (!PageHuge(p)) { ++ if (!PageLRU(hpage)) ++ shake_page(hpage, 0); ++ if (!PageLRU(hpage)) { + /* + * shake_page could have turned it free. + */ diff --git a/queue-3.10/series b/queue-3.10/series index f535084d8d4..0e8e849faa7 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -1,2 +1,4 @@ ocfs2-dlm-fix-race-between-purge-and-get-lock-resource.patch nilfs2-fix-sanity-check-of-btree-level-in-nilfs_btree_root_broken.patch +mm-memory-failure-call-shake_page-when-error-hits-thp-tail-page.patch +xen-console-update-console-event-channel-on-resume.patch diff --git a/queue-3.10/xen-console-update-console-event-channel-on-resume.patch b/queue-3.10/xen-console-update-console-event-channel-on-resume.patch new file mode 100644 index 00000000000..6c8d82b019f --- /dev/null +++ b/queue-3.10/xen-console-update-console-event-channel-on-resume.patch @@ -0,0 +1,51 @@ +From b9d934f27c91b878c4b2e64299d6e419a4022f8d Mon Sep 17 00:00:00 2001 +From: Boris Ostrovsky +Date: Wed, 29 Apr 2015 17:10:14 -0400 +Subject: xen/console: Update console event channel on resume + +From: Boris Ostrovsky + +commit b9d934f27c91b878c4b2e64299d6e419a4022f8d upstream. + +After a resume the hypervisor/tools may change console event +channel number. We should re-query it. + +Signed-off-by: Boris Ostrovsky +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/hvc/hvc_xen.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -299,11 +299,27 @@ static int xen_initial_domain_console_in + return 0; + } + ++static void xen_console_update_evtchn(struct xencons_info *info) ++{ ++ if (xen_hvm_domain()) { ++ uint64_t v; ++ int err; ++ ++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v); ++ if (!err && v) ++ info->evtchn = v; ++ } else ++ info->evtchn = xen_start_info->console.domU.evtchn; ++} ++ + void xen_console_resume(void) + { + struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE); +- if (info != NULL && info->irq) ++ if (info != NULL && info->irq) { ++ if (!xen_initial_domain()) ++ xen_console_update_evtchn(info); + rebind_evtchn_irq(info->evtchn, info->irq); ++ } + } + + static void xencons_disconnect_backend(struct xencons_info *info)