1. 19 Aug, 2015 6 commits
    • Grygorii Strashko's avatar
      irqchip/crossbar: Restore set_wake functionality · 8200fe43
      Grygorii Strashko authored
      The TI crossbar irqchip doesn't provides any facility to configure the
      wakeup sources, but the conversion to hierarchical irqdomains set the
      irq_set_wake callback to irq_chip_set_wake_parent. The parent chip
      (OMAP wakeupgen) has no irq_set_wake function either so the call will
      fail with -ENOSYS. As a result the irq_set_wake() call in the resume
      path will trigger an 'Unbalanced wake disable' warning.
      
      Before the conversion the GIC irqchip was the top level irqchip and
      correctly flagged with IRQCHIP_SKIP_SET_WAKE.
      
      Restore the correct behaviour by removing the irq_set_type callback
      from the crossbar irqchip and set the IRQCHIP_SKIP_SET_WAKE flag which
      lets the irq_set_irq_wake() call from the driver succeed.
      
      [ tglx: Massaged changelog ]
      
      Fixes: 783d3186 ('irqchip: crossbar: Convert dra7 crossbar...')
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: <linux@arm.linux.org.uk>
      Cc: <nsekhar@ti.com>
      Cc: <jason@lakedaemon.net>
      Cc: <balbi@ti.com>
      Cc: <linux-arm-kernel@lists.infradead.org>
      Cc: <tony@atomide.com>
      Cc: <marc.zyngier@arm.com>
      Cc: stable@vger.kernel.org # 4.1
      Link: http://lkml.kernel.org/r/1439554830-19502-7-git-send-email-grygorii.strashko@ti.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      8200fe43
    • Grygorii Strashko's avatar
      irqchip/crossbar: Restore the mask on suspend behaviour · 4fd8f47e
      Grygorii Strashko authored
      The ARM GIC requires that all interrupts which are not used as a
      wakeup source have to be masked during suspend.
      
      The conversion of the crossbar irqchip to hierarchical irq domains
      failed to mark the crossbar irqchip with the IRQCHIP_MASK_ON_SUSPEND
      flag and therefor broke the suspend requirement of the GIC.
      
      Before the conversion the flags were visible because the GIC was the
      top level irqchip. After the conversion the crossbar irqchip is the
      top level irq chip whose flags are evaluated in suspend_device_irq().
      As the flag is not set the masking of the non-wakeup irqs is not
      invoked which breaks suspend.
      
      Add the IRQCHIP_MASK_ON_SUSPEND flag to the crossbar irqchip, so the
      GIC interrupts get masked properly.
      
      [ tglx: Massaged changelog ]
      
      Fixes: 783d3186 ('irqchip: crossbar: Convert dra7 crossbar...')
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: <linux@arm.linux.org.uk>
      Cc: <nsekhar@ti.com>
      Cc: <jason@lakedaemon.net>
      Cc: <balbi@ti.com>
      Cc: <linux-arm-kernel@lists.infradead.org>
      Cc: <tony@atomide.com>
      Cc: <marc.zyngier@arm.com>
      Cc: stable@vger.kernel.org # 4.1
      Link: http://lkml.kernel.org/r/1439554830-19502-6-git-send-email-grygorii.strashko@ti.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      4fd8f47e
    • Grygorii Strashko's avatar
      ARM: OMAP: wakeupgen: Restore the irq_set_type() mechanism · 63059a27
      Grygorii Strashko authored
      The conversion of the wakeupgen irqchip to hierarchical irq domains
      failed to provide a mechanism to properly set the trigger type of an
      interrupt.
      
      The wakeupgen irq chip itself has no mechanism and therefor no
      irq_set_type() callback. The code before the conversion relayed the
      trigger configuration directly to the underlying GIC.
      
      Restore the correct behaviour by setting the wakeupgen irq_set_type
      callback to irq_chip_set_type_parent(). This propagates the
      set_trigger() call to the underlying GIC irqchip.
      
      [ tglx: Massaged changelog ]
      
      Fixes: 7136d457 ('ARM: omap: convert wakeupgen to stacked domains')
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Acked-by: default avatarTony Lindgren <tony@atomide.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: <linux@arm.linux.org.uk>
      Cc: <nsekhar@ti.com>
      Cc: <jason@lakedaemon.net>
      Cc: <balbi@ti.com>
      Cc: <linux-arm-kernel@lists.infradead.org>
      Cc: <marc.zyngier@arm.com>
      Cc: stable@vger.kernel.org # 4.1
      Link: http://lkml.kernel.org/r/1439554830-19502-5-git-send-email-grygorii.strashko@ti.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      63059a27
    • Grygorii Strashko's avatar
      irqchip/crossbar: Restore the irq_set_type() mechanism · e269ec42
      Grygorii Strashko authored
      The conversion of the crossbar irqchip to hierarchical irq domains
      failed to provide a mechanism to properly set the trigger type of an
      interrupt.
      
      The crossbar irq chip itself has no mechanism and therefor no
      irq_set_type() callback. The code before the conversion relayed the
      trigger configuration directly to the underlying GIC.
      
      Restore the correct behaviour by setting the crossbar irq_set_type
      callback to irq_chip_set_type_parent(). This propagates the
      set_trigger() call to the underlying GIC irqchip.
      
      [ tglx: Massaged changelog ]
      
      Fixes: 783d3186 ('irqchip: crossbar: Convert dra7 crossbar...')
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: <linux@arm.linux.org.uk>
      Cc: <nsekhar@ti.com>
      Cc: <jason@lakedaemon.net>
      Cc: <balbi@ti.com>
      Cc: <linux-arm-kernel@lists.infradead.org>
      Cc: <tony@atomide.com>
      Cc: <marc.zyngier@arm.com>
      Cc: stable@vger.kernel.org # 4.1
      Link: http://lkml.kernel.org/r/1439554830-19502-4-git-send-email-grygorii.strashko@ti.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      e269ec42
    • Grygorii Strashko's avatar
      genirq: Introduce irq_chip_set_type_parent() helper · b7560de1
      Grygorii Strashko authored
      This helper is required for irq chips which do not implement a
      irq_set_type callback and need to call down the irq domain hierarchy
      for the actual trigger type change.
      
      This helper is required to fix further wreckage caused by the
      conversion of TI OMAP to hierarchical irq domains and therefor tagged
      for stable.
      
      [ tglx: Massaged changelog ]
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: <linux@arm.linux.org.uk>
      Cc: <nsekhar@ti.com>
      Cc: <jason@lakedaemon.net>
      Cc: <balbi@ti.com>
      Cc: <linux-arm-kernel@lists.infradead.org>
      Cc: <tony@atomide.com>
      Cc: <marc.zyngier@arm.com>
      Cc: stable@vger.kernel.org # 4.1
      Link: http://lkml.kernel.org/r/1439554830-19502-3-git-send-email-grygorii.strashko@ti.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      b7560de1
    • Grygorii Strashko's avatar
      genirq: Don't return ENOSYS in irq_chip_retrigger_hierarchy · 6d4affea
      Grygorii Strashko authored
      irq_chip_retrigger_hierarchy() returns -ENOSYS if it was not able to
      find at least one .irq_retrigger() callback implemented in the IRQ
      domain hierarchy.
      
      That's wrong, because check_irq_resend() expects a 0 return value from
      the callback in case that the hardware assisted resend was not
      possible. If the return value is non zero the core code assumes
      hardware resend success and the software resend is not invoked.
      
      This results in lost interrupts on platforms where none of the parent
      irq chips in the hierarchy implements the retrigger callback.
      
      This is observable on TI OMAP, where the hierarchy is:
      
       ARM GIC <- OMAP wakeupgen <- TI Crossbar
      
      Return 0 instead so the software resend mechanism gets invoked.
      
      [ tglx: Massaged changelog ]
      
      Fixes: 85f08c17 ('genirq: Introduce helper functions...')
      Signed-off-by: default avatarGrygorii Strashko <grygorii.strashko@ti.com>
      Reviewed-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
      Reviewed-by: default avatarJiang Liu <jiang.liu@linux.intel.com>
      Cc: Sudeep Holla <sudeep.holla@arm.com>
      Cc: <linux@arm.linux.org.uk>
      Cc: <nsekhar@ti.com>
      Cc: <jason@lakedaemon.net>
      Cc: <balbi@ti.com>
      Cc: <linux-arm-kernel@lists.infradead.org>
      Cc: <tony@atomide.com>
      Cc: stable@vger.kernel.org # 4.1
      Link: http://lkml.kernel.org/r/1439554830-19502-2-git-send-email-grygorii.strashko@ti.comSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      6d4affea
  2. 17 Aug, 2015 1 commit
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · a36304b9
      Linus Torvalds authored
      Pull crypto fixes from Herbert Xu:
       "This fixes the following issues:
      
         - a regression caused by the conversion of IPsec ESP to the new AEAD
           interface: ESN with authencesn no longer works because it relied on
           the AD input SG list having a specific layout which is no longer
           the case.  In linux-next authencesn is fixed properly and no longer
           assumes anything about the SG list format.  While for this release
           a minimal fix is applied to authencesn so that it works with the
           new linear layout.
      
         - fix memory corruption caused by bogus index in the caam hash code.
      
         - fix powerpc nx SHA hashing which could cause module load failures
           if module signature verification is enabled"
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: caam - fix memory corruption in ahash_final_ctx
        crypto: nx - respect sg limit bounds when building sg lists for SHA
        crypto: authencesn - Fix breakage with new ESP code
      a36304b9
  3. 16 Aug, 2015 8 commits
  4. 15 Aug, 2015 3 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 1efdb5f0
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This has two libfc fixes for bugs causing rare crashes, one iscsi fix
        for a potential hang on shutdown, and a fix for an I/O blocksize issue
        which caused a regression"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        sd: Fix maximum I/O size for BLOCK_PC requests
        libfc: Fix fc_fcp_cleanup_each_cmd()
        libfc: Fix fc_exch_recv_req() error path
        libiscsi: Fix host busy blocking during connection teardown
      1efdb5f0
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 45e38cff
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
       "Just two very small & simple patches"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86: Use adjustment in guest cycles when handling MSR_IA32_TSC_ADJUST
        KVM: x86: zero IDT limit on entry to SMM
      45e38cff
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 8394a1b7
      Linus Torvalds authored
      Merge fixes from Andrew Morton:
       "11 fixes"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        Update maintainers for DRM STI driver
        mm: cma: mark cma_bitmap_maxno() inline in header
        zram: fix pool name truncation
        memory-hotplug: fix wrong edge when hot add a new node
        .mailmap: Andrey Ryabinin has moved
        ipc/sem.c: update/correct memory barriers
        mm/hwpoison: fix panic due to split huge zero page
        ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()
        ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
        mm/hwpoison: fix fail isolate hugetlbfs page w/ refcount held
        mm/hwpoison: fix page refcount of unknown non LRU page
      8394a1b7
  5. 14 Aug, 2015 16 commits
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · fbd9163f
      Linus Torvalds authored
      Pull clock fix from Stephen Boyd:
       "A one-liner for a regression found in the PXA clock driver"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: pxa: pxa3xx: fix CKEN register access
      fbd9163f
    • Benjamin Gaignard's avatar
      Update maintainers for DRM STI driver · 7f11c476
      Benjamin Gaignard authored
      Add Vincent Abriou and myself as maintainers.
      Signed-off-by: default avatarBenjamin Gaignard <benjamin.gaignard@linaro.org>
      Cc: Vincent Abriou <vincent.abriou@st.com>
      Cc: Dave Airlie <airlied@linux.ie>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7f11c476
    • Gregory Fong's avatar
      mm: cma: mark cma_bitmap_maxno() inline in header · f21838e0
      Gregory Fong authored
      cma_bitmap_maxno() was marked as static and not static inline, which can
      cause warnings about this function not being used if this file is included
      in a file that does not call that function, and violates the conventions
      used elsewhere.  The two options are to move the function implementation
      back to mm/cma.c or make it inline here, and it's simple enough for the
      latter to make sense.
      Signed-off-by: default avatarGregory Fong <gregory.0xf0@gmail.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Sasha Levin <sasha.levin@oracle.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f21838e0
    • Sergey Senozhatsky's avatar
      zram: fix pool name truncation · 4ce321f5
      Sergey Senozhatsky authored
      zram_meta_alloc() constructs a pool name for zs_create_pool() call as
      
          snprintf(pool_name, sizeof(pool_name), "zram%d", device_id);
      
      However, it defines pool name buffer to be only 8 bytes long (minus
      trailing zero), which means that we can have only 1000 pool names: zram0
      -- zram999.
      
      With CONFIG_ZSMALLOC_STAT enabled an attempt to create a device zram1000
      can fail if device zram100 already exists, because snprintf() will
      truncate new pool name to zram100 and pass it debugfs_create_dir(),
      causing:
      
        debugfs dir <zram100> creation failed
        zram: Error creating memory pool
      
      ... and so on.
      
      Fix it by passing zram->disk->disk_name to zram_meta_alloc() instead of
      divice_id.  We construct zram%d name earlier and keep it as a ->disk_name,
      no need to snprintf() it again.
      Signed-off-by: default avatarSergey Senozhatsky <sergey.senozhatsky@gmail.com>
      Cc: Minchan Kim <minchan@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4ce321f5
    • Xishi Qiu's avatar
      memory-hotplug: fix wrong edge when hot add a new node · f9126ab9
      Xishi Qiu authored
      When we add a new node, the edge of memory may be wrong.
      
      e.g. system has 4 nodes, and node3 is movable, node3 mem:[24G-32G],
      
      1. hotremove the node3,
      2. then hotadd node3 with a part of memory, mem:[26G-30G],
      3. call hotadd_new_pgdat()
              free_area_init_node()
                      get_pfn_range_for_nid()
      4. it will return wrong start_pfn and end_pfn, because we have not
      update the memblock.
      
      This patch also fixes a BUG_ON during hot-addition, please see
      http://marc.info/?l=linux-kernel&m=142961156129456&w=2Signed-off-by: default avatarXishi Qiu <qiuxishi@huawei.com>
      Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
      Cc: Kamezawa Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Cc: Taku Izumi <izumi.taku@jp.fujitsu.com>
      Cc: Tang Chen <tangchen@cn.fujitsu.com>
      Cc: Gu Zheng <guz.fnst@cn.fujitsu.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f9126ab9
    • Andrey Ryabinin's avatar
      .mailmap: Andrey Ryabinin has moved · 2baf9e89
      Andrey Ryabinin authored
      Update my email address.
      Signed-off-by: default avatarAndrey Ryabinin <ryabinin.a.a@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2baf9e89
    • Manfred Spraul's avatar
      ipc/sem.c: update/correct memory barriers · 3ed1f8a9
      Manfred Spraul authored
      sem_lock() did not properly pair memory barriers:
      
      !spin_is_locked() and spin_unlock_wait() are both only control barriers.
      The code needs an acquire barrier, otherwise the cpu might perform read
      operations before the lock test.
      
      As no primitive exists inside <include/spinlock.h> and since it seems
      noone wants another primitive, the code creates a local primitive within
      ipc/sem.c.
      
      With regards to -stable:
      
      The change of sem_wait_array() is a bugfix, the change to sem_lock() is a
      nop (just a preprocessor redefinition to improve the readability).  The
      bugfix is necessary for all kernels that use sem_wait_array() (i.e.:
      starting from 3.10).
      Signed-off-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Reported-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
      Cc: Kirill Tkhai <ktkhai@parallels.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Cc: <stable@vger.kernel.org>	[3.10+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3ed1f8a9
    • Wanpeng Li's avatar
      mm/hwpoison: fix panic due to split huge zero page · 7f6bf39b
      Wanpeng Li authored
      Bug:
      
        ------------[ cut here ]------------
        kernel BUG at mm/huge_memory.c:1957!
        invalid opcode: 0000 [#1] SMP
        Modules linked in: snd_hda_codec_hdmi i915 rpcsec_gss_krb5 snd_hda_codec_realtek snd_hda_codec_generic nfsv4 dns_re
        CPU: 2 PID: 2576 Comm: test_huge Not tainted 4.2.0-rc5-mm1+ #27
        Hardware name: Dell Inc. OptiPlex 7020/0F5C5X, BIOS A03 01/08/2015
        task: ffff880204e3d600 ti: ffff8800db16c000 task.ti: ffff8800db16c000
        RIP: split_huge_page_to_list+0xdb/0x120
        Call Trace:
          memory_failure+0x32e/0x7c0
          madvise_hwpoison+0x8b/0x160
          SyS_madvise+0x40/0x240
          ? do_page_fault+0x37/0x90
          entry_SYSCALL_64_fastpath+0x12/0x71
        Code: ff f0 41 ff 4c 24 30 74 0d 31 c0 48 83 c4 08 5b 41 5c 41 5d c9 c3 4c 89 e7 e8 e2 58 fd ff 48 83 c4 08 31 c0
        RIP  split_huge_page_to_list+0xdb/0x120
         RSP <ffff8800db16fde8>
        ---[ end trace aee7ce0df8e44076 ]---
      
      Testcase:
      
          #define _GNU_SOURCE
          #include <stdlib.h>
          #include <stdio.h>
          #include <sys/mman.h>
          #include <unistd.h>
          #include <fcntl.h>
          #include <sys/types.h>
          #include <errno.h>
          #include <string.h>
      
          #define MB 1024*1024
      
          int main(void)
          {
                  char *mem;
      
                  posix_memalign((void **)&mem, 2 * MB, 200 * MB);
      
                  madvise(mem, 200 * MB, MADV_HWPOISON);
      
                  free(mem);
      
                  return 0;
          }
      
      Huge zero page is allocated if page fault w/o FAULT_FLAG_WRITE flag.
      The get_user_pages_fast() which called in madvise_hwpoison() will get
      huge zero page if the page is not allocated before.  Huge zero page is a
      tranparent huge page, however, it is not an anonymous page.
      memory_failure will split the huge zero page and trigger
      BUG_ON(is_huge_zero_page(page));
      
      After commit 98ed2b00 ("mm/memory-failure: give up error handling
      for non-tail-refcounted thp"), memory_failure will not catch non anon
      thp from madvise_hwpoison path and this bug occur.
      
      Fix it by catching non anon thp in memory_failure in order to not split
      huge zero page in madvise_hwpoison path.
      
      After this patch:
      
        Injecting memory failure for page 0x202800 at 0x7fd8ae800000
        MCE: 0x202800: non anonymous thp
        [...]
      
      [akpm@linux-foundation.org: remove second split, per Wanpeng]
      Signed-off-by: default avatarWanpeng Li <wanpeng.li@hotmail.com>
      Acked-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7f6bf39b
    • Herton R. Krzesinski's avatar
      ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem() · a9795584
      Herton R. Krzesinski authored
      After we acquire the sma->sem_perm lock in exit_sem(), we are protected
      against a racing IPC_RMID operation.  Also at that point, we are the last
      user of sem_undo_list.  Therefore it isn't required that we acquire or use
      ulp->lock.
      Signed-off-by: default avatarHerton R. Krzesinski <herton@redhat.com>
      Acked-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Cc: Rafael Aquini <aquini@redhat.com>
      CC: Aristeu Rozanski <aris@redhat.com>
      Cc: David Jeffery <djeffery@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a9795584
    • Herton R. Krzesinski's avatar
      ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits · 602b8593
      Herton R. Krzesinski authored
      The current semaphore code allows a potential use after free: in
      exit_sem we may free the task's sem_undo_list while there is still
      another task looping through the same semaphore set and cleaning the
      sem_undo list at freeary function (the task called IPC_RMID for the same
      semaphore set).
      
      For example, with a test program [1] running which keeps forking a lot
      of processes (which then do a semop call with SEM_UNDO flag), and with
      the parent right after removing the semaphore set with IPC_RMID, and a
      kernel built with CONFIG_SLAB, CONFIG_SLAB_DEBUG and
      CONFIG_DEBUG_SPINLOCK, you can easily see something like the following
      in the kernel log:
      
         Slab corruption (Not tainted): kmalloc-64 start=ffff88003b45c1c0, len=64
         000: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b 6b 6b 6b 6b  kkkkkkkk.kkkkkkk
         010: ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff  ....kkkk........
         Prev obj: start=ffff88003b45c180, len=64
         000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ
         010: ff ff ff ff ff ff ff ff c0 fb 01 37 00 88 ff ff  ...........7....
         Next obj: start=ffff88003b45c200, len=64
         000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a  .....N......ZZZZ
         010: ff ff ff ff ff ff ff ff 68 29 a7 3c 00 88 ff ff  ........h).<....
         BUG: spinlock wrong CPU on CPU#2, test/18028
         general protection fault: 0000 [#1] SMP
         Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]
         CPU: 2 PID: 18028 Comm: test Not tainted 4.2.0-rc5+ #1
         Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
         RIP: spin_dump+0x53/0xc0
         Call Trace:
           spin_bug+0x30/0x40
           do_raw_spin_unlock+0x71/0xa0
           _raw_spin_unlock+0xe/0x10
           freeary+0x82/0x2a0
           ? _raw_spin_lock+0xe/0x10
           semctl_down.clone.0+0xce/0x160
           ? __do_page_fault+0x19a/0x430
           ? __audit_syscall_entry+0xa8/0x100
           SyS_semctl+0x236/0x2c0
           ? syscall_trace_leave+0xde/0x130
           entry_SYSCALL_64_fastpath+0x12/0x71
         Code: 8b 80 88 03 00 00 48 8d 88 60 05 00 00 48 c7 c7 a0 2c a4 81 31 c0 65 8b 15 eb 40 f3 7e e8 08 31 68 00 4d 85 e4 44 8b 4b 08 74 5e <45> 8b 84 24 88 03 00 00 49 8d 8c 24 60 05 00 00 8b 53 04 48 89
         RIP  [<ffffffff810d6053>] spin_dump+0x53/0xc0
          RSP <ffff88003750fd68>
         ---[ end trace 783ebb76612867a0 ]---
         NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [test:18053]
         Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib]
         CPU: 3 PID: 18053 Comm: test Tainted: G      D         4.2.0-rc5+ #1
         Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
         RIP: native_read_tsc+0x0/0x20
         Call Trace:
           ? delay_tsc+0x40/0x70
           __delay+0xf/0x20
           do_raw_spin_lock+0x96/0x140
           _raw_spin_lock+0xe/0x10
           sem_lock_and_putref+0x11/0x70
           SYSC_semtimedop+0x7bf/0x960
           ? handle_mm_fault+0xbf6/0x1880
           ? dequeue_task_fair+0x79/0x4a0
           ? __do_page_fault+0x19a/0x430
           ? kfree_debugcheck+0x16/0x40
           ? __do_page_fault+0x19a/0x430
           ? __audit_syscall_entry+0xa8/0x100
           ? do_audit_syscall_entry+0x66/0x70
           ? syscall_trace_enter_phase1+0x139/0x160
           SyS_semtimedop+0xe/0x10
           SyS_semop+0x10/0x20
           entry_SYSCALL_64_fastpath+0x12/0x71
         Code: 47 10 83 e8 01 85 c0 89 47 10 75 08 65 48 89 3d 1f 74 ff 7e c9 c3 0f 1f 44 00 00 55 48 89 e5 e8 87 17 04 00 66 90 c9 c3 0f 1f 00 <55> 48 89 e5 0f 31 89 c1 48 89 d0 48 c1 e0 20 89 c9 48 09 c8 c9
         Kernel panic - not syncing: softlockup: hung tasks
      
      I wasn't able to trigger any badness on a recent kernel without the
      proper config debugs enabled, however I have softlockup reports on some
      kernel versions, in the semaphore code, which are similar as above (the
      scenario is seen on some servers running IBM DB2 which uses semaphore
      syscalls).
      
      The patch here fixes the race against freeary, by acquiring or waiting
      on the sem_undo_list lock as necessary (exit_sem can race with freeary,
      while freeary sets un->semid to -1 and removes the same sem_undo from
      list_proc or when it removes the last sem_undo).
      
      After the patch I'm unable to reproduce the problem using the test case
      [1].
      
      [1] Test case used below:
      
          #include <stdio.h>
          #include <sys/types.h>
          #include <sys/ipc.h>
          #include <sys/sem.h>
          #include <sys/wait.h>
          #include <stdlib.h>
          #include <time.h>
          #include <unistd.h>
          #include <errno.h>
      
          #define NSEM 1
          #define NSET 5
      
          int sid[NSET];
      
          void thread()
          {
                  struct sembuf op;
                  int s;
                  uid_t pid = getuid();
      
                  s = rand() % NSET;
                  op.sem_num = pid % NSEM;
                  op.sem_op = 1;
                  op.sem_flg = SEM_UNDO;
      
                  semop(sid[s], &op, 1);
                  exit(EXIT_SUCCESS);
          }
      
          void create_set()
          {
                  int i, j;
                  pid_t p;
                  union {
                          int val;
                          struct semid_ds *buf;
                          unsigned short int *array;
                          struct seminfo *__buf;
                  } un;
      
                  /* Create and initialize semaphore set */
                  for (i = 0; i < NSET; i++) {
                          sid[i] = semget(IPC_PRIVATE , NSEM, 0644 | IPC_CREAT);
                          if (sid[i] < 0) {
                                  perror("semget");
                                  exit(EXIT_FAILURE);
                          }
                  }
                  un.val = 0;
                  for (i = 0; i < NSET; i++) {
                          for (j = 0; j < NSEM; j++) {
                                  if (semctl(sid[i], j, SETVAL, un) < 0)
                                          perror("semctl");
                          }
                  }
      
                  /* Launch threads that operate on semaphore set */
                  for (i = 0; i < NSEM * NSET * NSET; i++) {
                          p = fork();
                          if (p < 0)
                                  perror("fork");
                          if (p == 0)
                                  thread();
                  }
      
                  /* Free semaphore set */
                  for (i = 0; i < NSET; i++) {
                          if (semctl(sid[i], NSEM, IPC_RMID))
                                  perror("IPC_RMID");
                  }
      
                  /* Wait for forked processes to exit */
                  while (wait(NULL)) {
                          if (errno == ECHILD)
                                  break;
                  };
          }
      
          int main(int argc, char **argv)
          {
                  pid_t p;
      
                  srand(time(NULL));
      
                  while (1) {
                          p = fork();
                          if (p < 0) {
                                  perror("fork");
                                  exit(EXIT_FAILURE);
                          }
                          if (p == 0) {
                                  create_set();
                                  goto end;
                          }
      
                          /* Wait for forked processes to exit */
                          while (wait(NULL)) {
                                  if (errno == ECHILD)
                                          break;
                          };
                  }
          end:
                  return 0;
          }
      
      [akpm@linux-foundation.org: use normal comment layout]
      Signed-off-by: default avatarHerton R. Krzesinski <herton@redhat.com>
      Acked-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Cc: Davidlohr Bueso <dave@stgolabs.net>
      Cc: Rafael Aquini <aquini@redhat.com>
      CC: Aristeu Rozanski <aris@redhat.com>
      Cc: David Jeffery <djeffery@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      602b8593
    • Wanpeng Li's avatar
      mm/hwpoison: fix fail isolate hugetlbfs page w/ refcount held · 03613808
      Wanpeng Li authored
      Hugetlbfs pages will get a refcount in get_any_page() or
      madvise_hwpoison() if soft offlining through madvise.  The refcount which
      is held by the soft offline path should be released if we fail to isolate
      hugetlbfs pages.
      
      Fix it by reducing the refcount for both isolation success and failure.
      Signed-off-by: default avatarWanpeng Li <wanpeng.li@hotmail.com>
      Acked-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: <stable@vger.kernel.org>	[3.9+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      03613808
    • Wanpeng Li's avatar
      mm/hwpoison: fix page refcount of unknown non LRU page · 4f32be67
      Wanpeng Li authored
      After trying to drain pages from pagevec/pageset, we try to get reference
      count of the page again, however, the reference count of the page is not
      reduced if the page is still not on LRU list.
      
      Fix it by adding the put_page() to drop the page reference which is from
      __get_any_page().
      Signed-off-by: default avatarWanpeng Li <wanpeng.li@hotmail.com>
      Acked-by: default avatarNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
      Cc: <stable@vger.kernel.org>	[3.9+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4f32be67
    • Linus Torvalds's avatar
      Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 3670901f
      Linus Torvalds authored
      Pull timer fix from Ingo Molnar:
       "A single clocksource driver suspend/resume fix"
      
      * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        clockevents/drivers/sh_cmt: Only perform clocksource suspend/resume if enabled
      3670901f
    • Linus Torvalds's avatar
      Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · b25c6cee
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Misc fixes: PMU driver corner cases, tooling fixes, and an 'AUX'
        (Intel PT) race related core fix"
      
      * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel/cqm: Do not access cpu_data() from CPU_UP_PREPARE handler
        perf/x86/intel: Fix memory leak on hot-plug allocation fail
        perf: Fix PERF_EVENT_IOC_PERIOD migration race
        perf: Fix double-free of the AUX buffer
        perf: Fix fasync handling on inherited events
        perf tools: Fix test build error when bindir contains double slash
        perf stat: Fix transaction lenght metrics
        perf: Fix running time accounting
      b25c6cee
    • Linus Torvalds's avatar
      Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5e5013c6
      Linus Torvalds authored
      Pull locking fix from Ingo Molnar:
       "A single fix for a locking self-test crash"
      
      * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        locking/pvqspinlock: Fix kernel panic in locking-selftest
      5e5013c6
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · c6797654
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Back from holidays, found these in the cracks: one nouveau revert, one
        vmwgfx locking fix and a bunch of exynos fixes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        Revert "drm/nouveau/fifo/gk104: kick channels when deactivating them"
        drm/vmwgfx: Fix execbuf locking issues
        drm/exynos/fimc: fix runtime pm support
        drm/exynos/mixer: always update INT_EN cache
        drm/exynos/mixer: correct vsync configuration sequence
        drm/exynos/mixer: fix interrupt clearing
        drm/exynos/hdmi: fix edid memory leak
        drm/exynos: gsc: fix wrong bitwise operation for swap detection
      c6797654
  6. 13 Aug, 2015 6 commits