From cf08b87ba0099d04e0a75b2e58048678a0a1f08e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 10 Nov 2014 14:34:08 +0900 Subject: [PATCH] 3.10-stable patches added patches: cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch scsi-fix-error-handling-in-scsi_ioctl_send_command.patch --- ...emleak_free-for-cgroup-deallocations.patch | 80 +++++++++++++++++++ ...-shift-in-__bitmap_shift_-left-right.patch | 50 ++++++++++++ ...-handling-in-scsi_ioctl_send_command.patch | 47 +++++++++++ queue-3.10/series | 3 + 4 files changed, 180 insertions(+) create mode 100644 queue-3.10/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch create mode 100644 queue-3.10/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch create mode 100644 queue-3.10/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch diff --git a/queue-3.10/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch b/queue-3.10/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch new file mode 100644 index 00000000000..2f79cfc0295 --- /dev/null +++ b/queue-3.10/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch @@ -0,0 +1,80 @@ +From 401507d67d5c2854f5a88b3f93f64fc6f267bca5 Mon Sep 17 00:00:00 2001 +From: Wang Nan +Date: Wed, 29 Oct 2014 14:50:18 -0700 +Subject: cgroup/kmemleak: add kmemleak_free() for cgroup deallocations. + +From: Wang Nan + +commit 401507d67d5c2854f5a88b3f93f64fc6f267bca5 upstream. + +Commit ff7ee93f4715 ("cgroup/kmemleak: Annotate alloc_page() for cgroup +allocations") introduces kmemleak_alloc() for alloc_page_cgroup(), but +corresponding kmemleak_free() is missing, which makes kmemleak be +wrongly disabled after memory offlining. Log is pasted at the end of +this commit message. + +This patch add kmemleak_free() into free_page_cgroup(). During page +offlining, this patch removes corresponding entries in kmemleak rbtree. +After that, the freed memory can be allocated again by other subsystems +without killing kmemleak. + + bash # for x in 1 2 3 4; do echo offline > /sys/devices/system/memory/memory$x/state ; sleep 1; done ; dmesg | grep leak + + Offlined Pages 32768 + kmemleak: Cannot insert 0xffff880016969000 into the object search tree (overlaps existing) + CPU: 0 PID: 412 Comm: sleep Not tainted 3.17.0-rc5+ #86 + Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 + Call Trace: + dump_stack+0x46/0x58 + create_object+0x266/0x2c0 + kmemleak_alloc+0x26/0x50 + kmem_cache_alloc+0xd3/0x160 + __sigqueue_alloc+0x49/0xd0 + __send_signal+0xcb/0x410 + send_signal+0x45/0x90 + __group_send_sig_info+0x13/0x20 + do_notify_parent+0x1bb/0x260 + do_exit+0x767/0xa40 + do_group_exit+0x44/0xa0 + SyS_exit_group+0x17/0x20 + system_call_fastpath+0x16/0x1b + + kmemleak: Kernel memory leak detector disabled + kmemleak: Object 0xffff880016900000 (size 524288): + kmemleak: comm "swapper/0", pid 0, jiffies 4294667296 + kmemleak: min_count = 0 + kmemleak: count = 0 + kmemleak: flags = 0x1 + kmemleak: checksum = 0 + kmemleak: backtrace: + log_early+0x63/0x77 + kmemleak_alloc+0x4b/0x50 + init_section_page_cgroup+0x7f/0xf5 + page_cgroup_init+0xc5/0xd0 + start_kernel+0x333/0x408 + x86_64_start_reservations+0x2a/0x2c + x86_64_start_kernel+0xf5/0xfc + +Fixes: ff7ee93f4715 (cgroup/kmemleak: Annotate alloc_page() for cgroup allocations) +Signed-off-by: Wang Nan +Acked-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_cgroup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/page_cgroup.c ++++ b/mm/page_cgroup.c +@@ -170,6 +170,7 @@ static void free_page_cgroup(void *addr) + sizeof(struct page_cgroup) * PAGES_PER_SECTION; + + BUG_ON(PageReserved(page)); ++ kmemleak_free(addr); + free_pages_exact(addr, table_size); + } + } diff --git a/queue-3.10/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch b/queue-3.10/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch new file mode 100644 index 00000000000..5016017ebd3 --- /dev/null +++ b/queue-3.10/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch @@ -0,0 +1,50 @@ +From ea5d05b34aca25c066e0699512d0ffbd8ee6ac3e Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 29 Oct 2014 14:50:44 -0700 +Subject: lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}() + +From: Jan Kara + +commit ea5d05b34aca25c066e0699512d0ffbd8ee6ac3e upstream. + +If __bitmap_shift_left() or __bitmap_shift_right() are asked to shift by +a multiple of BITS_PER_LONG, they will try to shift a long value by +BITS_PER_LONG bits which is undefined. Change the functions to avoid +the undefined shift. + +Coverity id: 1192175 +Coverity id: 1192174 +Signed-off-by: Jan Kara +Cc: Rasmus Villemoes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/bitmap.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long + lower = src[off + k]; + if (left && off + k == lim - 1) + lower &= mask; +- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; ++ dst[k] = lower >> rem; ++ if (rem) ++ dst[k] |= upper << (BITS_PER_LONG - rem); + if (left && k == lim - 1) + dst[k] &= mask; + } +@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long * + upper = src[k]; + if (left && k == lim - 1) + upper &= (1UL << left) - 1; +- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; ++ dst[k + off] = upper << rem; ++ if (rem) ++ dst[k + off] |= lower >> (BITS_PER_LONG - rem); + if (left && k + off == lim - 1) + dst[k + off] &= (1UL << left) - 1; + } diff --git a/queue-3.10/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch b/queue-3.10/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch new file mode 100644 index 00000000000..a7be5720088 --- /dev/null +++ b/queue-3.10/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch @@ -0,0 +1,47 @@ +From 84ce0f0e94ac97217398b3b69c21c7a62ebeed05 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 22 Oct 2014 20:13:39 -0600 +Subject: scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND + +From: Jan Kara + +commit 84ce0f0e94ac97217398b3b69c21c7a62ebeed05 upstream. + +When sg_scsi_ioctl() fails to prepare request to submit in +blk_rq_map_kern() we jump to a label where we just end up copying +(luckily zeroed-out) kernel buffer to userspace instead of reporting +error. Fix the problem by jumping to the right label. + +CC: Jens Axboe +CC: linux-scsi@vger.kernel.org +Coverity-id: 1226871 +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +Fixed up the, now unused, out label. + +Signed-off-by: Jens Axboe + +--- + block/scsi_ioctl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/block/scsi_ioctl.c ++++ b/block/scsi_ioctl.c +@@ -506,7 +506,7 @@ int sg_scsi_ioctl(struct request_queue * + + if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { + err = DRIVER_ERROR << 24; +- goto out; ++ goto error; + } + + memset(sense, 0, sizeof(sense)); +@@ -516,7 +516,6 @@ int sg_scsi_ioctl(struct request_queue * + + blk_execute_rq(q, disk, rq, 0); + +-out: + err = rq->errors & 0xff; /* only 8 bit SCSI status */ + if (err) { + if (rq->sense_len && rq->sense) { diff --git a/queue-3.10/series b/queue-3.10/series index cc696de76af..474b04663bf 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -93,3 +93,6 @@ spi-pxa2xx-toggle-clocks-on-suspend-if-not-disabled-by-runtime-pm.patch usb-storage-handle-a-skipped-data-phase.patch usb-opticon-fix-non-atomic-allocation-in-write-path.patch usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch +cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch +lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch +scsi-fix-error-handling-in-scsi_ioctl_send_command.patch -- 2.47.3