From: Greg Kroah-Hartman Date: Mon, 10 Nov 2014 05:34:14 +0000 (+0900) Subject: 3.14-stable patches X-Git-Tag: v3.10.60~33 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=272da1abb6624f5188aea30993582773dc61664f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch mm-free-compound-page-with-correct-order.patch mm-memcontrol-do-not-iterate-uninitialized-memcgs.patch scsi-fix-error-handling-in-scsi_ioctl_send_command.patch sh-fix-sh770x-scif-memory-regions.patch --- diff --git a/queue-3.14/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch b/queue-3.14/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch new file mode 100644 index 00000000000..afe0e6b013e --- /dev/null +++ b/queue-3.14/cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch @@ -0,0 +1,80 @@ +From 401507d67d5c2854f5a88b3f93f64fc6f267bca5 Mon Sep 17 00:00:00 2001 +From: Wang Nan +Date: Wed, 29 Oct 2014 14:50:18 -0700 +Subject: cgroup/kmemleak: add kmemleak_free() for cgroup deallocations. + +From: Wang Nan + +commit 401507d67d5c2854f5a88b3f93f64fc6f267bca5 upstream. + +Commit ff7ee93f4715 ("cgroup/kmemleak: Annotate alloc_page() for cgroup +allocations") introduces kmemleak_alloc() for alloc_page_cgroup(), but +corresponding kmemleak_free() is missing, which makes kmemleak be +wrongly disabled after memory offlining. Log is pasted at the end of +this commit message. + +This patch add kmemleak_free() into free_page_cgroup(). During page +offlining, this patch removes corresponding entries in kmemleak rbtree. +After that, the freed memory can be allocated again by other subsystems +without killing kmemleak. + + bash # for x in 1 2 3 4; do echo offline > /sys/devices/system/memory/memory$x/state ; sleep 1; done ; dmesg | grep leak + + Offlined Pages 32768 + kmemleak: Cannot insert 0xffff880016969000 into the object search tree (overlaps existing) + CPU: 0 PID: 412 Comm: sleep Not tainted 3.17.0-rc5+ #86 + Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 + Call Trace: + dump_stack+0x46/0x58 + create_object+0x266/0x2c0 + kmemleak_alloc+0x26/0x50 + kmem_cache_alloc+0xd3/0x160 + __sigqueue_alloc+0x49/0xd0 + __send_signal+0xcb/0x410 + send_signal+0x45/0x90 + __group_send_sig_info+0x13/0x20 + do_notify_parent+0x1bb/0x260 + do_exit+0x767/0xa40 + do_group_exit+0x44/0xa0 + SyS_exit_group+0x17/0x20 + system_call_fastpath+0x16/0x1b + + kmemleak: Kernel memory leak detector disabled + kmemleak: Object 0xffff880016900000 (size 524288): + kmemleak: comm "swapper/0", pid 0, jiffies 4294667296 + kmemleak: min_count = 0 + kmemleak: count = 0 + kmemleak: flags = 0x1 + kmemleak: checksum = 0 + kmemleak: backtrace: + log_early+0x63/0x77 + kmemleak_alloc+0x4b/0x50 + init_section_page_cgroup+0x7f/0xf5 + page_cgroup_init+0xc5/0xd0 + start_kernel+0x333/0x408 + x86_64_start_reservations+0x2a/0x2c + x86_64_start_kernel+0xf5/0xfc + +Fixes: ff7ee93f4715 (cgroup/kmemleak: Annotate alloc_page() for cgroup allocations) +Signed-off-by: Wang Nan +Acked-by: Johannes Weiner +Acked-by: Michal Hocko +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_cgroup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/page_cgroup.c ++++ b/mm/page_cgroup.c +@@ -171,6 +171,7 @@ static void free_page_cgroup(void *addr) + sizeof(struct page_cgroup) * PAGES_PER_SECTION; + + BUG_ON(PageReserved(page)); ++ kmemleak_free(addr); + free_pages_exact(addr, table_size); + } + } diff --git a/queue-3.14/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch b/queue-3.14/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch new file mode 100644 index 00000000000..5016017ebd3 --- /dev/null +++ b/queue-3.14/lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch @@ -0,0 +1,50 @@ +From ea5d05b34aca25c066e0699512d0ffbd8ee6ac3e Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 29 Oct 2014 14:50:44 -0700 +Subject: lib/bitmap.c: fix undefined shift in __bitmap_shift_{left|right}() + +From: Jan Kara + +commit ea5d05b34aca25c066e0699512d0ffbd8ee6ac3e upstream. + +If __bitmap_shift_left() or __bitmap_shift_right() are asked to shift by +a multiple of BITS_PER_LONG, they will try to shift a long value by +BITS_PER_LONG bits which is undefined. Change the functions to avoid +the undefined shift. + +Coverity id: 1192175 +Coverity id: 1192174 +Signed-off-by: Jan Kara +Cc: Rasmus Villemoes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/bitmap.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long + lower = src[off + k]; + if (left && off + k == lim - 1) + lower &= mask; +- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem; ++ dst[k] = lower >> rem; ++ if (rem) ++ dst[k] |= upper << (BITS_PER_LONG - rem); + if (left && k == lim - 1) + dst[k] &= mask; + } +@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long * + upper = src[k]; + if (left && k == lim - 1) + upper &= (1UL << left) - 1; +- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem; ++ dst[k + off] = upper << rem; ++ if (rem) ++ dst[k + off] |= lower >> (BITS_PER_LONG - rem); + if (left && k + off == lim - 1) + dst[k + off] &= (1UL << left) - 1; + } diff --git a/queue-3.14/mm-free-compound-page-with-correct-order.patch b/queue-3.14/mm-free-compound-page-with-correct-order.patch new file mode 100644 index 00000000000..76ce70d5721 --- /dev/null +++ b/queue-3.14/mm-free-compound-page-with-correct-order.patch @@ -0,0 +1,61 @@ +From 5ddacbe92b806cd5b4f8f154e8e46ac267fff55c Mon Sep 17 00:00:00 2001 +From: Yu Zhao +Date: Wed, 29 Oct 2014 14:50:26 -0700 +Subject: mm: free compound page with correct order + +From: Yu Zhao + +commit 5ddacbe92b806cd5b4f8f154e8e46ac267fff55c upstream. + +Compound page should be freed by put_page() or free_pages() with correct +order. Not doing so will cause tail pages leaked. + +The compound order can be obtained by compound_order() or use +HPAGE_PMD_ORDER in our case. Some people would argue the latter is +faster but I prefer the former which is more general. + +This bug was observed not just on our servers (the worst case we saw is +11G leaked on a 48G machine) but also on our workstations running Ubuntu +based distro. + + $ cat /proc/vmstat | grep thp_zero_page_alloc + thp_zero_page_alloc 55 + thp_zero_page_alloc_failed 0 + +This means there is (thp_zero_page_alloc - 1) * (2M - 4K) memory leaked. + +Fixes: 97ae17497e99 ("thp: implement refcounting for huge zero page") +Signed-off-by: Yu Zhao +Acked-by: Kirill A. Shutemov +Cc: Andrea Arcangeli +Cc: Mel Gorman +Cc: David Rientjes +Cc: Bob Liu +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -199,7 +199,7 @@ retry: + preempt_disable(); + if (cmpxchg(&huge_zero_page, NULL, zero_page)) { + preempt_enable(); +- __free_page(zero_page); ++ __free_pages(zero_page, compound_order(zero_page)); + goto retry; + } + +@@ -231,7 +231,7 @@ static unsigned long shrink_huge_zero_pa + if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) { + struct page *zero_page = xchg(&huge_zero_page, NULL); + BUG_ON(zero_page == NULL); +- __free_page(zero_page); ++ __free_pages(zero_page, compound_order(zero_page)); + return HPAGE_PMD_NR; + } + diff --git a/queue-3.14/mm-memcontrol-do-not-iterate-uninitialized-memcgs.patch b/queue-3.14/mm-memcontrol-do-not-iterate-uninitialized-memcgs.patch new file mode 100644 index 00000000000..eea41ab396c --- /dev/null +++ b/queue-3.14/mm-memcontrol-do-not-iterate-uninitialized-memcgs.patch @@ -0,0 +1,103 @@ +From 2f7dd7a4100ad4affcb141605bef178ab98ccb18 Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Thu, 2 Oct 2014 16:16:57 -0700 +Subject: mm: memcontrol: do not iterate uninitialized memcgs + +From: Johannes Weiner + +commit 2f7dd7a4100ad4affcb141605bef178ab98ccb18 upstream. + +The cgroup iterators yield css objects that have not yet gone through +css_online(), but they are not complete memcgs at this point and so the +memcg iterators should not return them. Commit d8ad30559715 ("mm/memcg: +iteration skip memcgs not yet fully initialized") set out to implement +exactly this, but it uses CSS_ONLINE, a cgroup-internal flag that does +not meet the ordering requirements for memcg, and so the iterator may +skip over initialized groups, or return partially initialized memcgs. + +The cgroup core can not reasonably provide a clear answer on whether the +object around the css has been fully initialized, as that depends on +controller-specific locking and lifetime rules. Thus, introduce a +memcg-specific flag that is set after the memcg has been initialized in +css_online(), and read before mem_cgroup_iter() callers access the memcg +members. + +Signed-off-by: Johannes Weiner +Cc: Tejun Heo +Acked-by: Michal Hocko +Cc: Hugh Dickins +Cc: Peter Zijlstra +Cc: [3.12+] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 35 +++++++++++++++++++++++++++++++---- + 1 file changed, 31 insertions(+), 4 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -292,6 +292,9 @@ struct mem_cgroup { + /* vmpressure notifications */ + struct vmpressure vmpressure; + ++ /* css_online() has been completed */ ++ int initialized; ++ + /* + * the counter to account for mem+swap usage. + */ +@@ -1127,9 +1130,21 @@ skip_node: + * skipping css reference should be safe. + */ + if (next_css) { +- if ((next_css == &root->css) || +- ((next_css->flags & CSS_ONLINE) && css_tryget(next_css))) +- return mem_cgroup_from_css(next_css); ++ struct mem_cgroup *memcg = mem_cgroup_from_css(next_css); ++ ++ if (next_css == &root->css) ++ return memcg; ++ ++ if (css_tryget(next_css)) { ++ /* ++ * Make sure the memcg is initialized: ++ * mem_cgroup_css_online() orders the the ++ * initialization against setting the flag. ++ */ ++ if (smp_load_acquire(&memcg->initialized)) ++ return memcg; ++ css_put(next_css); ++ } + + prev_css = next_css; + goto skip_node; +@@ -6538,6 +6553,7 @@ mem_cgroup_css_online(struct cgroup_subs + { + struct mem_cgroup *memcg = mem_cgroup_from_css(css); + struct mem_cgroup *parent = mem_cgroup_from_css(css_parent(css)); ++ int ret; + + if (css->cgroup->id > MEM_CGROUP_ID_MAX) + return -ENOSPC; +@@ -6574,7 +6590,18 @@ mem_cgroup_css_online(struct cgroup_subs + } + mutex_unlock(&memcg_create_mutex); + +- return memcg_init_kmem(memcg, &mem_cgroup_subsys); ++ ret = memcg_init_kmem(memcg, &mem_cgroup_subsys); ++ if (ret) ++ return ret; ++ ++ /* ++ * Make sure the memcg is initialized: mem_cgroup_iter() ++ * orders reading memcg->initialized against its callers ++ * reading the memcg members. ++ */ ++ smp_store_release(&memcg->initialized, 1); ++ ++ return 0; + } + + /* diff --git a/queue-3.14/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch b/queue-3.14/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch new file mode 100644 index 00000000000..91a387c1889 --- /dev/null +++ b/queue-3.14/scsi-fix-error-handling-in-scsi_ioctl_send_command.patch @@ -0,0 +1,47 @@ +From 84ce0f0e94ac97217398b3b69c21c7a62ebeed05 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 22 Oct 2014 20:13:39 -0600 +Subject: scsi: Fix error handling in SCSI_IOCTL_SEND_COMMAND + +From: Jan Kara + +commit 84ce0f0e94ac97217398b3b69c21c7a62ebeed05 upstream. + +When sg_scsi_ioctl() fails to prepare request to submit in +blk_rq_map_kern() we jump to a label where we just end up copying +(luckily zeroed-out) kernel buffer to userspace instead of reporting +error. Fix the problem by jumping to the right label. + +CC: Jens Axboe +CC: linux-scsi@vger.kernel.org +Coverity-id: 1226871 +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +Fixed up the, now unused, out label. + +Signed-off-by: Jens Axboe + +--- + block/scsi_ioctl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/block/scsi_ioctl.c ++++ b/block/scsi_ioctl.c +@@ -489,7 +489,7 @@ int sg_scsi_ioctl(struct request_queue * + + if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { + err = DRIVER_ERROR << 24; +- goto out; ++ goto error; + } + + memset(sense, 0, sizeof(sense)); +@@ -499,7 +499,6 @@ int sg_scsi_ioctl(struct request_queue * + + blk_execute_rq(q, disk, rq, 0); + +-out: + err = rq->errors & 0xff; /* only 8 bit SCSI status */ + if (err) { + if (rq->sense_len && rq->sense) { diff --git a/queue-3.14/series b/queue-3.14/series index fe8e8ae4712..d08e4292ba5 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -161,3 +161,9 @@ usb-opticon-fix-non-atomic-allocation-in-write-path.patch usb-do-not-allow-usb_alloc_streams-on-unconfigured-devices.patch usb-kobil_sct-fix-non-atomic-allocation-in-write-path.patch usb-remove-references-to-non-existent-plat_s5p-symbol.patch +sh-fix-sh770x-scif-memory-regions.patch +mm-free-compound-page-with-correct-order.patch +cgroup-kmemleak-add-kmemleak_free-for-cgroup-deallocations.patch +mm-memcontrol-do-not-iterate-uninitialized-memcgs.patch +lib-bitmap.c-fix-undefined-shift-in-__bitmap_shift_-left-right.patch +scsi-fix-error-handling-in-scsi_ioctl_send_command.patch diff --git a/queue-3.14/sh-fix-sh770x-scif-memory-regions.patch b/queue-3.14/sh-fix-sh770x-scif-memory-regions.patch new file mode 100644 index 00000000000..88fe3168d1c --- /dev/null +++ b/queue-3.14/sh-fix-sh770x-scif-memory-regions.patch @@ -0,0 +1,55 @@ +From 5417421b270229bfce0795ccc99a4b481e4954ca Mon Sep 17 00:00:00 2001 +From: Andriy Skulysh +Date: Wed, 29 Oct 2014 14:50:59 -0700 +Subject: sh: fix sh770x SCIF memory regions + +From: Andriy Skulysh + +commit 5417421b270229bfce0795ccc99a4b481e4954ca upstream. + +Resources scif1_resources & scif2_resources overlap. Actual SCIF region +size is 0x10. + +This is regression from commit d850acf975be ("sh: Declare SCIF register +base and IRQ as resources") + +Signed-off-by: Andriy Skulysh +Acked-by: Laurent Pinchart +Cc: Geert Uytterhoeven +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/kernel/cpu/sh3/setup-sh770x.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c ++++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c +@@ -118,7 +118,7 @@ static struct plat_sci_port scif0_platfo + }; + + static struct resource scif0_resources[] = { +- DEFINE_RES_MEM(0xfffffe80, 0x100), ++ DEFINE_RES_MEM(0xfffffe80, 0x10), + DEFINE_RES_IRQ(evt2irq(0x4e0)), + }; + +@@ -143,7 +143,7 @@ static struct plat_sci_port scif1_platfo + }; + + static struct resource scif1_resources[] = { +- DEFINE_RES_MEM(0xa4000150, 0x100), ++ DEFINE_RES_MEM(0xa4000150, 0x10), + DEFINE_RES_IRQ(evt2irq(0x900)), + }; + +@@ -169,7 +169,7 @@ static struct plat_sci_port scif2_platfo + }; + + static struct resource scif2_resources[] = { +- DEFINE_RES_MEM(0xa4000140, 0x100), ++ DEFINE_RES_MEM(0xa4000140, 0x10), + DEFINE_RES_IRQ(evt2irq(0x880)), + }; +