{"push_id":759142620,"size":1,"distinct_size":1,"ref":"refs/heads/lollipop_staging","head":"e818a55648f3ea61f61fd3db8d478359f53da604","before":"207684c26dda48c6e17fd81348f0312dd2d3980d","commits":[{"sha":"e818a55648f3ea61f61fd3db8d478359f53da604","author":{"email":"71bcd3d88361b22cd828f9a350d19d8775f56d4e@linux.intel.com","name":"Dave Hansen"},"message":"mm/slub.c: fix page->_count corruption (again)\n\nCommit abca7c496584 (\"mm: fix slab->page _count corruption when using\nslub\") notes that we can not _set_ a page->counters directly, except\nwhen using a real double-cmpxchg.  Doing so can lose updates to\n->_count.\n\nThat is an absolute rule:\n\n        You may not *set* page->counters except via a cmpxchg.\n\nCommit abca7c496584 fixed this for the folks who have the slub\ncmpxchg_double code turned off at compile time, but it left the bad case\nalone.  It can still be reached, and the same bug triggered in two\ncases:\n\n1. Turning on slub debugging at runtime, which is available on\n   the distro kernels that I looked at.\n2. On 64-bit CPUs with no CMPXCHG16B (some early AMD x86-64\n   cpus, evidently)\n\nThere are at least 3 ways we could fix this:\n\n1. Take all of the exising calls to cmpxchg_double_slab() and\n   __cmpxchg_double_slab() and convert them to take an old, new\n   and target 'struct page'.\n2. Do (1), but with the newly-introduced 'slub_data'.\n3. Do some magic inside the two cmpxchg...slab() functions to\n   pull the counters out of new_counters and only set those\n   fields in page->{inuse,frozen,objects}.\n\nI've done (2) as well, but it's a bunch more code.  This patch is an\nattempt at (3).  This was the most straightforward and foolproof way\nthat I could think to do this.\n\nThis would also technically allow us to get rid of the ugly\n\n#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \\\n       defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE)\n\nin 'struct page', but leaving it alone has the added benefit that\n'counters' stays 'unsigned' instead of 'unsigned long', so all the\ncopies that the slub code does stay a bit smaller.\n\nSigned-off-by: Dave Hansen <dave.hansen@linux.intel.com>\nCc: Christoph Lameter <cl@linux-foundation.org>\nCc: Pekka Enberg <penberg@kernel.org>\nCc: Matt Mackall <mpm@selenic.com>\nCc: Pravin B Shelar <pshelar@nicira.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Starship-Android/android_kernel_moto_shamu/commits/e818a55648f3ea61f61fd3db8d478359f53da604"}]}