1. 05 Mar, 2012 19 commits
    • Hugh Dickins's avatar
      memcg: fix GPF when cgroup removal races with last exit · 7512102c
      Hugh Dickins authored
      When moving tasks from old memcg (with move_charge_at_immigrate on new
      memcg), followed by removal of old memcg, hit General Protection Fault in
      mem_cgroup_lru_del_list() (called from release_pages called from
      free_pages_and_swap_cache from tlb_flush_mmu from tlb_finish_mmu from
      exit_mmap from mmput from exit_mm from do_exit).
      
      Somewhat reproducible, takes a few hours: the old struct mem_cgroup has
      been freed and poisoned by SLAB_DEBUG, but mem_cgroup_lru_del_list() is
      still trying to update its stats, and take page off lru before freeing.
      
      A task, or a charge, or a page on lru: each secures a memcg against
      removal.  In this case, the last task has been moved out of the old memcg,
      and it is exiting: anonymous pages are uncharged one by one from the
      memcg, as they are zapped from its pagetables, so the charge gets down to
      0; but the pages themselves are queued in an mmu_gather for freeing.
      
      Most of those pages will be on lru (and force_empty is careful to
      lru_add_drain_all, to add pages from pagevec to lru first), but not
      necessarily all: perhaps some have been isolated for page reclaim, perhaps
      some isolated for other reasons.  So, force_empty may find no task, no
      charge and no page on lru, and let the removal proceed.
      
      There would still be no problem if these pages were immediately freed; but
      typically (and the put_page_testzero protocol demands it) they have to be
      added back to lru before they are found freeable, then removed from lru
      and freed.  We don't see the issue when adding, because the
      mem_cgroup_iter() loops keep their own reference to the memcg being
      scanned; but when it comes to mem_cgroup_lru_del_list().
      
      I believe this was not an issue in v3.2: there, PageCgroupAcctLRU and
      PageCgroupUsed flags were used (like a trick with mirrors) to deflect view
      of pc->mem_cgroup to the stable root_mem_cgroup when neither set.
      38c5d72f ("memcg: simplify LRU handling by new rule") mercifully
      removed those convolutions, but left this General Protection Fault.
      
      But it's surprisingly easy to restore the old behaviour: just check
      PageCgroupUsed in mem_cgroup_lru_add_list() (which decides on which lruvec
      to add), and reset pc to root_mem_cgroup if page is uncharged.  A risky
      change?  just going back to how it worked before; testing, and an audit of
      uses of pc->mem_cgroup, show no problem.
      
      And there's a nice bonus: with mem_cgroup_lru_add_list() itself making
      sure that an uncharged page goes to root lru, mem_cgroup_reset_owner() no
      longer has any purpose, and we can safely revert 4e5f01c2 ("memcg:
      clear pc->mem_cgroup if necessary").
      
      Calling update_page_reclaim_stat() after add_page_to_lru_list() in swap.c
      is not strictly necessary: the lru_lock there, with RCU before memcg
      structures are freed, makes mem_cgroup_get_reclaim_stat_from_page safe
      without that; but it seems cleaner to rely on one dependency less.
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7512102c
    • Stephen Boyd's avatar
      debugobjects: Fix selftest for static warnings · 9f78ff00
      Stephen Boyd authored
      debugobjects is now printing a warning when a fixup for a NOTAVAILABLE
      object is run.  This causes the selftest to fail like:
      
      	ODEBUG: selftest warnings failed 4 != 5
      
      We could just increase the number of warnings that the selftest is
      expecting to see because that is actually what has changed.  But, it turns
      out that fixup_activate() was written with inverted logic and thus a fixup
      for a static object returned 1 indicating the object had been fixed, and 0
      otherwise.  Fix the logic to be correct and update the counts to reflect
      that nothing needed fixing for a static object.
      Signed-off-by: default avatarStephen Boyd <sboyd@codeaurora.org>
      Reported-by: default avatarThomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9f78ff00
    • Muthu Kumar's avatar
      floppy/scsi: fix setting of BIO flags · 9354f1b8
      Muthu Kumar authored
      Fix setting bio flags in drivers (sd_dif/floppy).
      Signed-off-by: default avatarMuthukumar R <muthur@gmail.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9354f1b8
    • Hugh Dickins's avatar
      memcg: fix deadlock by inverting lrucare nesting · 9ce70c02
      Hugh Dickins authored
      We have forgotten the rules of lock nesting: the irq-safe ones must be
      taken inside the non-irq-safe ones, otherwise we are open to deadlock:
      
      CPU0                          CPU1
      ----                          ----
      lock(&(&pc->lock)->rlock);
                                    local_irq_disable();
                                    lock(&(&zone->lru_lock)->rlock);
                                    lock(&(&pc->lock)->rlock);
      <Interrupt>
      lock(&(&zone->lru_lock)->rlock);
      
      To check a different locking issue, I happened to add a spin_lock to
      memcg's bit_spin_lock in lock_page_cgroup(), and lockdep very quickly
      complained about __mem_cgroup_commit_charge_lrucare() (on CPU1 above).
      
      So delete __mem_cgroup_commit_charge_lrucare(), passing a bool lrucare to
      __mem_cgroup_commit_charge() instead, taking zone->lru_lock under
      lock_page_cgroup() in the lrucare case.
      
      The original was using spin_lock_irqsave, but we'd be in more trouble if
      it were ever called at interrupt time: unconditional _irq is enough.  And
      ClearPageLRU before del from lru, SetPageLRU before add to lru: no strong
      reason, but that is the ordering used consistently elsewhere.
      
      Fixes 36b62ad5 ("memcg: simplify corner case handling
      of LRU").
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
      Acked-by: default avatarKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      9ce70c02
    • Anatolij Gustschin's avatar
      drivers/rtc/rtc-r9701.c: fix crash in r9701_remove() · 73737b87
      Anatolij Gustschin authored
      If probing the RTC didn't succeed due to failed RTC register access, the
      RTC device will be unregistered.  Then, when removing the module
      r9701_remove() causes a kernel crash while trying to unregister a not
      registered RTC device.  Fix this by doing RTC register access test before
      RTC device registration.
      Signed-off-by: default avatarAnatolij Gustschin <agust@denx.de>
      Cc: Alessandro Zummo <a.zummo@towertech.it>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      73737b87
    • Dan Carpenter's avatar
      c2port: class_create() returns an ERR_PTR · 22ea71d7
      Dan Carpenter authored
      class_create() doesn't return a NULL, it only returns ERR_PTRs.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      22ea71d7
    • Dan Carpenter's avatar
      pps: class_create() returns an ERR_PTR, not NULL · 7ad12566
      Dan Carpenter authored
      class_create() never returns NULLs only ERR_PTRs.
      Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
      Cc: Rodolfo Giometti <giometti@enneenne.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7ad12566
    • Oleg Nesterov's avatar
      hung_task: fix the broken rcu_lock_break() logic · 6027ce49
      Oleg Nesterov authored
      check_hung_uninterruptible_tasks()->rcu_lock_break() introduced by
      "softlockup: check all tasks in hung_task" commit ce9dbe24 looks
      absolutely wrong.
      
      	- rcu_lock_break() does put_task_struct(). If the task has exited
      	  it is not safe to even read its ->state, nothing protects this
      	  task_struct.
      
      	- The TASK_DEAD checks are wrong too. Contrary to the comment, we
      	  can't use it to check if the task was unhashed. It can be unhashed
      	  without TASK_DEAD, or it can be valid with TASK_DEAD.
      
      	  For example, an autoreaping task can do release_task(current)
      	  long before it sets TASK_DEAD in do_exit().
      
      	  Or, a zombie task can have ->state == TASK_DEAD but release_task()
      	  was not called, and in this case we must not break the loop.
      
      Change this code to check pid_alive() instead, and do this before we drop
      the reference to the task_struct.
      
      Note: while_each_thread() under rcu_read_lock() is not really safe, it can
      livelock.  This will be fixed later, but fortunately in this case the
      "max_count" logic saves us anyway.
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
      Acked-by: default avatarMandeep Singh Baines <msb@google.com>
      Acked-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
      Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6027ce49
    • Oleg Nesterov's avatar
      vfork: kill PF_STARTING · 6e27f63e
      Oleg Nesterov authored
      Previously it was (ab)used by utrace.  Then it was wrongly used by the
      scheduler code.
      
      Currently it is not used, kill it before it finds the new erroneous user.
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6e27f63e
    • Oleg Nesterov's avatar
      coredump_wait: don't call complete_vfork_done() · 57b59c4a
      Oleg Nesterov authored
      Now that CLONE_VFORK is killable, coredump_wait() no longer needs
      complete_vfork_done().  zap_threads() should find and kill all tasks with
      the same ->mm, this includes our parent if ->vfork_done is set.
      
      mm_release() becomes the only caller, unexport complete_vfork_done().
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      57b59c4a
    • Oleg Nesterov's avatar
      vfork: make it killable · d68b46fe
      Oleg Nesterov authored
      Make vfork() killable.
      
      Change do_fork(CLONE_VFORK) to do wait_for_completion_killable().  If it
      fails we do not return to the user-mode and never touch the memory shared
      with our child.
      
      However, in this case we should clear child->vfork_done before return, we
      use task_lock() in do_fork()->wait_for_vfork_done() and
      complete_vfork_done() to serialize with each other.
      
      Note: now that we use task_lock() we don't really need completion, we
      could turn task->vfork_done into "task_struct *wake_up_me" but this needs
      some complications.
      
      NOTE: this and the next patches do not affect in-kernel users of
      CLONE_VFORK, kernel threads run with all signals ignored including
      SIGKILL/SIGSTOP.
      
      However this is obviously the user-visible change.  Not only a fatal
      signal can kill the vforking parent, a sub-thread can do execve or
      exit_group() and kill the thread sleeping in vfork().
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d68b46fe
    • Oleg Nesterov's avatar
      vfork: introduce complete_vfork_done() · c415c3b4
      Oleg Nesterov authored
      No functional changes.
      
      Move the clear-and-complete-vfork_done code into the new trivial helper,
      complete_vfork_done().
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c415c3b4
    • Jeff Moyer's avatar
      aio: wake up waiters when freeing unused kiocbs · 880641bb
      Jeff Moyer authored
      Bart Van Assche reported a hung fio process when either hot-removing
      storage or when interrupting the fio process itself.  The (pruned) call
      trace for the latter looks like so:
      
        fio             D 0000000000000001     0  6849   6848 0x00000004
         ffff880092541b88 0000000000000046 ffff880000000000 ffff88012fa11dc0
         ffff88012404be70 ffff880092541fd8 ffff880092541fd8 ffff880092541fd8
         ffff880128b894d0 ffff88012404be70 ffff880092541b88 000000018106f24d
        Call Trace:
          schedule+0x3f/0x60
          io_schedule+0x8f/0xd0
          wait_for_all_aios+0xc0/0x100
          exit_aio+0x55/0xc0
          mmput+0x2d/0x110
          exit_mm+0x10d/0x130
          do_exit+0x671/0x860
          do_group_exit+0x44/0xb0
          get_signal_to_deliver+0x218/0x5a0
          do_signal+0x65/0x700
          do_notify_resume+0x65/0x80
          int_signal+0x12/0x17
      
      The problem lies with the allocation batching code.  It will
      opportunistically allocate kiocbs, and then trim back the list of iocbs
      when there is not enough room in the completion ring to hold all of the
      events.
      
      In the case above, what happens is that the pruning back of events ends
      up freeing up the last active request and the context is marked as dead,
      so it is thus responsible for waking up waiters.  Unfortunately, the
      code does not check for this condition, so we end up with a hung task.
      Signed-off-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Reported-by: default avatarBart Van Assche <bvanassche@acm.org>
      Tested-by: default avatarBart Van Assche <bvanassche@acm.org>
      Cc: <stable@kernel.org>		[3.2.x only]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      880641bb
    • Prashanth Nageshappa's avatar
      kprobes: return proper error code from register_kprobe() · f986a499
      Prashanth Nageshappa authored
      register_kprobe() aborts if the address of the new request falls in a
      prohibited area (such as ftrace pouch, __kprobes annotated functions,
      non-kernel text addresses, jump label text).  We however don't return the
      right error on this abort, resulting in a silent failure - incorrect
      adding/reporting of kprobes ('perf probe do_fork+18' or 'perf probe
      mcount' for instance).
      
      In V2 we are incorporating Masami Hiramatsu's  feedback.
      
      This patch fixes it by returning -EINVAL upon failure.
      
      While we are here, rename the label used for exit to be more appropriate.
      Signed-off-by: default avatarAnanth N Mavinakayanahalli <ananth@in.ibm.com>
      Signed-off-by: default avatarPrashanth K Nageshappa <prashanth@linux.vnet.ibm.com>
      Acked-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Cc: Jason Baron <jbaron@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f986a499
    • Matthew Garrett's avatar
      kmsg_dump: don't run on non-error paths by default · c22ab332
      Matthew Garrett authored
      Since commit 04c6862c ("kmsg_dump: add kmsg_dump() calls to the
      reboot, halt, poweroff and emergency_restart paths"), kmsg_dump() gets
      run on normal paths including poweroff and reboot.
      
      This is less than ideal given pstore implementations that can only
      represent single backtraces, since a reboot may overwrite a stored oops
      before it's been picked up by userspace.  In addition, some pstore
      backends may have low performance and provide a significant delay in
      reboot as a result.
      
      This patch adds a printk.always_kmsg_dump kernel parameter (which can also
      be changed from userspace).  Without it, the code will only be run on
      failure paths rather than on normal paths.  The option can be enabled in
      environments where there's a desire to attempt to audit whether or not a
      reboot was cleanly requested or not.
      Signed-off-by: default avatarMatthew Garrett <mjg@redhat.com>
      Acked-by: default avatarSeiji Aguchi <seiji.aguchi@hds.com>
      Cc: Seiji Aguchi <seiji.aguchi@hds.com>
      Cc: David Woodhouse <dwmw2@infradead.org>
      Cc: Marco Stornelli <marco.stornelli@gmail.com>
      Cc: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
      Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Cc: Vivek Goyal <vgoyal@redhat.com>
      Cc: Don Zickus <dzickus@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c22ab332
    • Linus Torvalds's avatar
      Merge tag 'mmc-fixes-for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc · 550cf00d
      Linus Torvalds authored
      MMC fixes from Chris Ball for 3.3:
       - atmel-mci: oops fix against regression introduced in 3.2
       - core: power saving regression fix against 3.3-rc1
       - core: suspend/resume fix for UHS-I cards
       - esdhc-imx: MMC card regression fix against 3.0
       - mmci: oops fix for ARM systems with large (64k) pages
       - MAINTAINERS update for atmel-mci.
      
      * tag 'mmc-fixes-for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc:
        mmc: core: Fixup suspend/resume issues for UHS-I cards
        mmc: mmci: reduce max_blk_count to avoid overflowing max_req_size
        mmc: sdhci-esdhc-imx: fix for mmc cards on i.MX5
        mmc: core: fix regression: set default clock gating delay to 0
        MAINTAINERS: hand over atmel-mci (sd/mmc interface)
        mmc: atmel-mci: don't use dma features when using DMA with no chan available
      550cf00d
    • Linus Torvalds's avatar
      Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · 5d329e24
      Linus Torvalds authored
      Pull from Jiri Kosina:
       "Please pull to receive updates for HID layer.  Nikolai's patch is
        rather important and should still go in for 3.3, as it's a regression
        fix for commit b4b583d4."
      
      * 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: hid-input: allow array fields out of range
        HID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard
      5d329e24
    • Nikolai Kondrashov's avatar
      HID: hid-input: allow array fields out of range · 883e0e36
      Nikolai Kondrashov authored
      Allow array field values out of range as per HID 1.11 specification,
      section 6.2.25:
      
      	Rather than returning a single bit for each button in the group, an
      	array returns an index in each field that corresponds to the pressed
      	button (like keyboard scan codes). An out-of range value in and array
      	field is considered no controls asserted.
      
      Apparently, "and" above is a typo and should be "an".
      
      This fixes at least Waltop tablet pen clicks - otherwise BTN_TOUCH is never
      released.
      
      The relevant part of Waltop tablet report descriptors is this:
      
      	0x09, 0x42,         /*          Usage (Tip Switch),         */
      	0x09, 0x44,         /*          Usage (Barrel Switch),      */
      	0x09, 0x46,         /*          Usage (Tablet Pick),        */
      	0x15, 0x01,         /*          Logical Minimum (1),        */
      	0x25, 0x03,         /*          Logical Maximum (3),        */
      	0x75, 0x04,         /*          Report Size (4),            */
      	0x95, 0x01,         /*          Report Count (1),           */
      	0x80,               /*          Input,                      */
      
      This is a regression fix for commit b4b583d4 ("HID: be more strict when
      ignoring out-of-range fields").
      Signed-off-by: default avatarNikolai Kondrashov <spbnick@gmail.com>
      Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
      883e0e36
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6 · a5939eef
      Linus Torvalds authored
      MFD fixes from Samuel Ortiz:
       "This is the pull request for the MFD fixes for 3.3.  We have a few
        NULL pointer dereferences fixes, an ACPI conflict check fix, and a
        couple of wm8994 fixes."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6:
        mfd: Correct readability of WM8994 DC servo 4E register
        mfd: Initialize tps65912 irq platform data properly
        mfd: Fix ACPI conflict check
        mfd: Fix ab8500 error path bug
        mfd: Test for jack detection when deciding if wm8994 should suspend
        mfd: Initialize tps65910 irq platform data properly
        mfd: Fix possible s5m null pointer dereference
        mfd: wm8350 variable dereferenced before check
      a5939eef
  2. 04 Mar, 2012 9 commits
  3. 03 Mar, 2012 3 commits
  4. 02 Mar, 2012 9 commits