{"push_id":793301254,"size":229,"distinct_size":229,"ref":"refs/heads/cm-12.1","head":"800e5a8dbe6cc6e5ae5d5220587b5f3fa51f9cff","before":"3bd851e0023cf7360b444fd8458b7ae35180ac6d","commits":[{"sha":"a3a1693814eea3c31fd74026b70d1f1155ea4537","author":{"email":"39ea6a09710987173e32e37c86918024a0f441c1@suse.de","name":"Mel Gorman"},"message":"mm: mempolicy: Let vma_merge and vma_split handle vma->vm_policy linkages\n\ncommit 05f144a0d5c2207a0349348127f996e104ad7404 upstream.\n\nDave Jones' system call fuzz testing tool \"trinity\" triggered the\nfollowing bug error with slab debugging enabled\n\n    =============================================================================\n    BUG numa_policy (Not tainted): Poison overwritten\n    -----------------------------------------------------------------------------\n\n    INFO: 0xffff880146498250-0xffff880146498250. First byte 0x6a instead of 0x6b\n    INFO: Allocated in mpol_new+0xa3/0x140 age=46310 cpu=6 pid=32154\n     __slab_alloc+0x3d3/0x445\n     kmem_cache_alloc+0x29d/0x2b0\n     mpol_new+0xa3/0x140\n     sys_mbind+0x142/0x620\n     system_call_fastpath+0x16/0x1b\n    INFO: Freed in __mpol_put+0x27/0x30 age=46268 cpu=6 pid=32154\n     __slab_free+0x2e/0x1de\n     kmem_cache_free+0x25a/0x260\n     __mpol_put+0x27/0x30\n     remove_vma+0x68/0x90\n     exit_mmap+0x118/0x140\n     mmput+0x73/0x110\n     exit_mm+0x108/0x130\n     do_exit+0x162/0xb90\n     do_group_exit+0x4f/0xc0\n     sys_exit_group+0x17/0x20\n     system_call_fastpath+0x16/0x1b\n    INFO: Slab 0xffffea0005192600 objects=27 used=27 fp=0x          (null) flags=0x20000000004080\n    INFO: Object 0xffff880146498250 @offset=592 fp=0xffff88014649b9d0\n\nThis implied a reference counting bug and the problem happened during\nmbind().\n\nmbind() applies a new memory policy to a range and uses mbind_range() to\nmerge existing VMAs or split them as necessary.  In the event of splits,\nmpol_dup() will allocate a new struct mempolicy and maintain existing\nreference counts whose rules are documented in\nDocumentation/vm/numa_memory_policy.txt .\n\nThe problem occurs with shared memory policies.  The vm_op->set_policy\nincrements the reference count if necessary and split_vma() and\nvma_merge() have already handled the existing reference counts.\nHowever, policy_vma() screws it up by replacing an existing\nvma->vm_policy with one that potentially has the wrong reference count\nleading to a premature free.  This patch removes the damage caused by\npolicy_vma().\n\nWith this patch applied Dave's trinity tool runs an mbind test for 5\nminutes without error.  /proc/slabinfo reported that there are no\nnuma_policy or shared_policy_node objects allocated after the test\ncompleted and the shared memory region was deleted.\n\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nCc: Dave Jones <davej@redhat.com>\nCc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nCc: Stephen Wilson <wilsons@start.ca>\nCc: Christoph Lameter <cl@linux.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/a3a1693814eea3c31fd74026b70d1f1155ea4537"},{"sha":"bbbef05eca2dbf2600bceee50c3b003bc57007bf","author":{"email":"829500b200af6c2a0eca4dfd5c388e6b8fbe8dc6@suse.cz","name":"Michal Hocko"},"message":"mm: consider all swapped back pages in used-once logic\n\ncommit e48982734ea0500d1eba4f9d96195acc5406cad6 upstream.\n\nCommit 645747462435 (\"vmscan: detect mapped file pages used only once\")\nmade mapped pages have another round in inactive list because they might\nbe just short lived and so we could consider them again next time.  This\nheuristic helps to reduce pressure on the active list with a streaming\nIO worklods.\n\nThis patch fixes a regression introduced by this commit for heavy shmem\nbased workloads because unlike Anon pages, which are excluded from this\nheuristic because they are usually long lived, shmem pages are handled\nas a regular page cache.\n\nThis doesn't work quite well, unfortunately, if the workload is mostly\nbacked by shmem (in memory database sitting on 80% of memory) with a\nstreaming IO in the background (backup - up to 20% of memory).  Anon\ninactive list is full of (dirty) shmem pages when watermarks are hit.\nShmem pages are kept in the inactive list (they are referenced) in the\nfirst round and it is hard to reclaim anything else so we reach lower\nscanning priorities very quickly which leads to an excessive swap out.\n\nLet's fix this by excluding all swap backed pages (they tend to be long\nlived wrt.  the regular page cache anyway) from used-once heuristic and\nrather activate them if they are referenced.\n\nThe customer's workload is shmem backed database (80% of RAM) and they\nare measuring transactions/s with an IO in the background (20%).\nTransactions touch more or less random rows in the table.  The\ntransaction rate fell by a factor of 3 (in the worst case) because of\ncommit 64574746.  This patch restores the previous numbers.\n\nSigned-off-by: Michal Hocko <mhocko@suse.cz>\nAcked-by: Johannes Weiner <hannes@cmpxchg.org>\nCc: Mel Gorman <mel@csn.ul.ie>\nCc: Minchan Kim <minchan@kernel.org>\nCc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>\nReviewed-by: Rik van Riel <riel@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/bbbef05eca2dbf2600bceee50c3b003bc57007bf"},{"sha":"3051931d8dfb725ff91d069c23950ade96cfc202","author":{"email":"bfcdf3e6ca6cef45543bfbb57509c92aec9a39fb@linux.vnet.ibm.com","name":"Dave Hansen"},"message":"hugetlb: fix resv_map leak in error path\n\ncommit c50ac050811d6485616a193eb0f37bfbd191cc89 upstream.\n\nWhen called for anonymous (non-shared) mappings, hugetlb_reserve_pages()\ndoes a resv_map_alloc().  It depends on code in hugetlbfs's\nvm_ops->close() to release that allocation.\n\nHowever, in the mmap() failure path, we do a plain unmap_region() without\nthe remove_vma() which actually calls vm_ops->close().\n\nThis is a decent fix.  This leak could get reintroduced if new code (say,\nafter hugetlb_reserve_pages() in hugetlbfs_file_mmap()) decides to return\nan error.  But, I think it would have to unroll the reservation anyway.\n\nChristoph's test case:\n\n\thttp://marc.info/?l=linux-mm&m=133728900729735\n\nThis patch applies to 3.4 and later.  A version for earlier kernels is at\nhttps://lkml.org/lkml/2012/5/22/418.\n\nSigned-off-by: Dave Hansen <dave@linux.vnet.ibm.com>\nAcked-by: Mel Gorman <mel@csn.ul.ie>\nAcked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nReported-by: Christoph Lameter <cl@linux.com>\nTested-by: Christoph Lameter <cl@linux.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/3051931d8dfb725ff91d069c23950ade96cfc202"},{"sha":"833335e2b4da316cb01ff6e47b90ff6f7fc02e33","author":{"email":"bfcdf3e6ca6cef45543bfbb57509c92aec9a39fb@linux.vnet.ibm.com","name":"Dave Hansen"},"message":"mm: fix vma_resv_map() NULL pointer\n\ncommit 4523e1458566a0e8ecfaff90f380dd23acc44d27 upstream.\n\nhugetlb_reserve_pages() can be used for either normal file-backed\nhugetlbfs mappings, or MAP_HUGETLB.  In the MAP_HUGETLB, semi-anonymous\nmode, there is not a VMA around.  The new call to resv_map_put() assumed\nthat there was, and resulted in a NULL pointer dereference:\n\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000030\n  IP: vma_resv_map+0x9/0x30\n  PGD 141453067 PUD 1421e1067 PMD 0\n  Oops: 0000 [#1] PREEMPT SMP\n  ...\n  Pid: 14006, comm: trinity-child6 Not tainted 3.4.0+ #36\n  RIP: vma_resv_map+0x9/0x30\n  ...\n  Process trinity-child6 (pid: 14006, threadinfo ffff8801414e0000, task ffff8801414f26b0)\n  Call Trace:\n    resv_map_put+0xe/0x40\n    hugetlb_reserve_pages+0xa6/0x1d0\n    hugetlb_file_setup+0x102/0x2c0\n    newseg+0x115/0x360\n    ipcget+0x1ce/0x310\n    sys_shmget+0x5a/0x60\n    system_call_fastpath+0x16/0x1b\n\nThis was reported by Dave Jones, but was reproducible with the\nlibhugetlbfs test cases, so shame on me for not running them in the\nfirst place.\n\nWith this, the oops is gone, and the output of libhugetlbfs's\nrun_tests.py is identical to plain 3.4 again.\n\n[ Marked for stable, since this was introduced by commit c50ac050811d\n  (\"hugetlb: fix resv_map leak in error path\") which was also marked for\n  stable ]\n\nReported-by: Dave Jones <davej@redhat.com>\nCc: Mel Gorman <mel@csn.ul.ie>\nCc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nCc: Christoph Lameter <cl@linux.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/833335e2b4da316cb01ff6e47b90ff6f7fc02e33"},{"sha":"8dfe4326e6d083e6336a8a776deeac81b5186a38","author":{"email":"d91a346a9a76eb1627d34d097d6cb4c8e5067100@gmail.com","name":"Joonsoo Kim"},"message":"slub: fix a memory leak in get_partial_node()\n\ncommit 02d7633fa567be7bf55a993b79d2a31b95ce2227 upstream.\n\nIn the case which is below,\n\n1. acquire slab for cpu partial list\n2. free object to it by remote cpu\n3. page->freelist = t\n\nthen memory leak is occurred.\n\nChange acquire_slab() not to zap freelist when it works for cpu partial list.\nI think it is a sufficient solution for fixing a memory leak.\n\nBelow is output of 'slabinfo -r kmalloc-256'\nwhen './perf stat -r 30 hackbench 50 process 4000 > /dev/null' is done.\n\n***Vanilla***\nSizes (bytes)     Slabs              Debug                Memory\n------------------------------------------------------------------------\nObject :     256  Total  :     468   Sanity Checks : Off  Total: 3833856\nSlabObj:     256  Full   :     111   Redzoning     : Off  Used : 2004992\nSlabSiz:    8192  Partial:     302   Poisoning     : Off  Loss : 1828864\nLoss   :       0  CpuSlab:      55   Tracking      : Off  Lalig:       0\nAlign  :       8  Objects:      32   Tracing       : Off  Lpadd:       0\n\n***Patched***\nSizes (bytes)     Slabs              Debug                Memory\n------------------------------------------------------------------------\nObject :     256  Total  :     300   Sanity Checks : Off  Total: 2457600\nSlabObj:     256  Full   :     204   Redzoning     : Off  Used : 2348800\nSlabSiz:    8192  Partial:      33   Poisoning     : Off  Loss :  108800\nLoss   :       0  CpuSlab:      63   Tracking      : Off  Lalig:       0\nAlign  :       8  Objects:      32   Tracing       : Off  Lpadd:       0\n\nTotal and loss number is the impact of this patch.\n\nAcked-by: Christoph Lameter <cl@linux.com>\nSigned-off-by: Joonsoo Kim <js1304@gmail.com>\nSigned-off-by: Pekka Enberg <penberg@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/8dfe4326e6d083e6336a8a776deeac81b5186a38"},{"sha":"e50773be23e8fa1a60b644f88b6426723684a063","author":{"email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com","name":"Hugh Dickins"},"message":"swap: fix shmem swapping when more than 8 areas\n\ncommit 9b15b817f3d62409290fd56fe3cbb076a931bb0a upstream.\n\nMinchan Kim reports that when a system has many swap areas, and tmpfs\nswaps out to the ninth or more, shmem_getpage_gfp()'s attempts to read\nback the page cannot locate it, and the read fails with -ENOMEM.\n\nWhoops.  Yes, I blindly followed read_swap_header()'s pte_to_swp_entry(\nswp_entry_to_pte()) technique for determining maximum usable swap\noffset, without stopping to realize that that actually depends upon the\npte swap encoding shifting swap offset to the higher bits and truncating\nit there.  Whereas our radix_tree swap encoding leaves offset in the\nlower bits: it's swap \"type\" (that is, index of swap area) that was\ntruncated.\n\nFix it by reducing the SWP_TYPE_SHIFT() in swapops.h, and removing the\nbroken radix_to_swp_entry(swp_to_radix_entry()) from read_swap_header().\n\nThis does not reduce the usable size of a swap area any further, it\nleaves it as claimed when making the original commit: no change from 3.0\non x86_64, nor on i386 without PAE; but 3.0's 512GB is reduced to 128GB\nper swapfile on i386 with PAE.  It's not a change I would have risked\nfive years ago, but with x86_64 supported for ten years, I believe it's\nappropriate now.\n\nHmm, and what if some architecture implements its swap pte with offset\nencoded below type? That would equally break the maximum usable swap\noffset check.  Happily, they all follow the same tradition of encoding\noffset above type, but I'll prepare a check on that for next.\n\nReported-and-Reviewed-and-Tested-by: Minchan Kim <minchan@kernel.org>\nSigned-off-by: Hugh Dickins <hughd@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/e50773be23e8fa1a60b644f88b6426723684a063"},{"sha":"da65e9d952e73abb14b32ae7b2d7820948d27305","author":{"email":"4d6e32db2683aba4a3f3669c68ac02b37d1b91cd@linux.vnet.ibm.com","name":"Gavin Shan"},"message":"mm/memblock: cleanup on duplicate VA/PA conversion\n\ncommit 4e2f07750d9a94e8f23e86408df5ab95be88bf11 upstream.\n\nThe overall memblock has been organized into the memory regions and\nreserved regions.  Initially, the memory regions and reserved regions are\nstored in the predetermined arrays of \"struct memblock _region\".  It's\npossible for the arrays to be enlarged when we have newly added regions\nfor them, but no enough space there.  Under the situation, We will created\ndouble-sized array to meet the requirement.  However, the original\nimplementation converted the VA (Virtual Address) of the newly allocated\narray of regions to PA (Physical Address), then translate back when we\nallocates the new array from slab.  That's actually unnecessary.\n\nThe patch removes the duplicate VA/PA conversion.\n\nSigned-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/da65e9d952e73abb14b32ae7b2d7820948d27305"},{"sha":"c6ac12b7ef1dbb9da5a36cf196523cee32be403e","author":{"email":"4d6e32db2683aba4a3f3669c68ac02b37d1b91cd@linux.vnet.ibm.com","name":"Gavin Shan"},"message":"mm/memblock: fix memory leak on extending regions\n\ncommit 181eb39425f2b9275afcb015eaa547d11f71a02f upstream.\n\nThe overall memblock has been organized into the memory regions and\nreserved regions.  Initially, the memory regions and reserved regions are\nstored in the predetermined arrays of \"struct memblock _region\".  It's\npossible for the arrays to be enlarged when we have newly added regions,\nbut no free space left there.  The policy here is to create double-sized\narray either by slab allocator or memblock allocator.  Unfortunately, we\ndidn't free the old array, which might be allocated through slab allocator\nbefore.  That would cause memory leak.\n\nThe patch introduces 2 variables to trace where (slab or memblock) the\nmemory and reserved regions come from.  The memory for the memory or\nreserved regions will be deallocated by kfree() if that was allocated by\nslab allocator.  Thus to fix the memory leak issue.\n\nSigned-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/c6ac12b7ef1dbb9da5a36cf196523cee32be403e"},{"sha":"2bdc6fec7d43b707c53856b1012a82dbb415f56b","author":{"email":"b1e95202550504f8c4c27303f2812e458915533b@hp.com","name":"Greg Pearson"},"message":"mm/memblock: fix overlapping allocation when doubling reserved array\n\ncommit 48c3b583bbddad2220ca4c22319ca5d1f78b2090 upstream.\n\n__alloc_memory_core_early() asks memblock for a range of memory then try\nto reserve it.  If the reserved region array lacks space for the new\nrange, memblock_double_array() is called to allocate more space for the\narray.  If memblock is used to allocate memory for the new array it can\nend up using a range that overlaps with the range originally allocated in\n__alloc_memory_core_early(), leading to possible data corruption.\n\nWith this patch memblock_double_array() now calls memblock_find_in_range()\nwith a narrowed candidate range (in cases where the reserved.regions array\nis being doubled) so any memory allocated will not overlap with the\noriginal range that was being reserved.  The range is narrowed by passing\nin the starting address and size of the previously allocated range.  Then\nthe range above the ending address is searched and if a candidate is not\nfound, the range below the starting address is searched.\n\nSigned-off-by: Greg Pearson <greg.pearson@hp.com>\nSigned-off-by: Yinghai Lu <yinghai@kernel.org>\nAcked-by: Tejun Heo <tj@kernel.org>\nCc: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/2bdc6fec7d43b707c53856b1012a82dbb415f56b"},{"sha":"1754da701c1e4b3a12b5e0c590247acd04c709f1","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"splice: fix racy pipe->buffers uses\n\ncommit 047fe3605235888f3ebcda0c728cb31937eadfe6 upstream.\n\nDave Jones reported a kernel BUG at mm/slub.c:3474! triggered\nby splice_shrink_spd() called from vmsplice_to_pipe()\n\ncommit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)\nadded capability to adjust pipe->buffers.\n\nProblem is some paths don't hold pipe mutex and assume pipe->buffers\ndoesn't change for their duration.\n\nFix this by adding nr_pages_max field in struct splice_pipe_desc, and\nuse it in place of pipe->buffers where appropriate.\n\nsplice_shrink_spd() loses its struct pipe_inode_info argument.\n\nReported-by: Dave Jones <davej@redhat.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Jens Axboe <axboe@kernel.dk>\nCc: Alexander Viro <viro@zeniv.linux.org.uk>\nCc: Tom Herbert <therbert@google.com>\nTested-by: Dave Jones <davej@redhat.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\n[bwh: Backported to 3.2:\n - Adjust context in vmsplice_to_pipe()\n - Update one more call to splice_shrink_spd(), from skb_splice_bits()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/1754da701c1e4b3a12b5e0c590247acd04c709f1"},{"sha":"fc4358870dfb49598c8adda38aaf1f6105347c37","author":{"email":"68ee766e574f18b34b683085865827393efe88bd@huawei.com","name":"Jiang Liu"},"message":"memory hotplug: fix invalid memory access caused by stale kswapd pointer\n\ncommit d8adde17e5f858427504725218c56aef90e90fc7 upstream.\n\nkswapd_stop() is called to destroy the kswapd work thread when all memory\nof a NUMA node has been offlined.  But kswapd_stop() only terminates the\nwork thread without resetting NODE_DATA(nid)->kswapd to NULL.  The stale\npointer will prevent kswapd_run() from creating a new work thread when\nadding memory to the memory-less NUMA node again.  Eventually the stale\npointer may cause invalid memory access.\n\nAn example stack dump as below. It's reproduced with 2.6.32, but latest\nkernel has the same issue.\n\n  BUG: unable to handle kernel NULL pointer dereference at (null)\n  IP: [<ffffffff81051a94>] exit_creds+0x12/0x78\n  PGD 0\n  Oops: 0000 [#1] SMP\n  last sysfs file: /sys/devices/system/memory/memory391/state\n  CPU 11\n  Modules linked in: cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq microcode fuse loop dm_mod tpm_tis rtc_cmos i2c_i801 rtc_core tpm serio_raw pcspkr sg tpm_bios igb i2c_core iTCO_wdt rtc_lib mptctl iTCO_vendor_support button dca bnx2 usbhid hid uhci_hcd ehci_hcd usbcore sd_mod crc_t10dif edd ext3 mbcache jbd fan ide_pci_generic ide_core ata_generic ata_piix libata thermal processor thermal_sys hwmon mptsas mptscsih mptbase scsi_transport_sas scsi_mod\n  Pid: 7949, comm: sh Not tainted 2.6.32.12-qiuxishi-5-default #92 Tecal RH2285\n  RIP: 0010:exit_creds+0x12/0x78\n  RSP: 0018:ffff8806044f1d78  EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: ffff880604f22140 RCX: 0000000000019502\n  RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000\n  RBP: ffff880604f22150 R08: 0000000000000000 R09: ffffffff81a4dc10\n  R10: 00000000000032a0 R11: ffff880006202500 R12: 0000000000000000\n  R13: 0000000000c40000 R14: 0000000000008000 R15: 0000000000000001\n  FS:  00007fbc03d066f0(0000) GS:ffff8800282e0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n  CR2: 0000000000000000 CR3: 000000060f029000 CR4: 00000000000006e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Process sh (pid: 7949, threadinfo ffff8806044f0000, task ffff880603d7c600)\n  Stack:\n   ffff880604f22140 ffffffff8103aac5 ffff880604f22140 ffffffff8104d21e\n   ffff880006202500 0000000000008000 0000000000c38000 ffffffff810bd5b1\n   0000000000000000 ffff880603d7c600 00000000ffffdd29 0000000000000003\n  Call Trace:\n    __put_task_struct+0x5d/0x97\n    kthread_stop+0x50/0x58\n    offline_pages+0x324/0x3da\n    memory_block_change_state+0x179/0x1db\n    store_mem_state+0x9e/0xbb\n    sysfs_write_file+0xd0/0x107\n    vfs_write+0xad/0x169\n    sys_write+0x45/0x6e\n    system_call_fastpath+0x16/0x1b\n  Code: ff 4d 00 0f 94 c0 84 c0 74 08 48 89 ef e8 1f fd ff ff 5b 5d 31 c0 41 5c c3 53 48 8b 87 20 06 00 00 48 89 fb 48 8b bf 18 06 00 00 <8b> 00 48 c7 83 18 06 00 00 00 00 00 00 f0 ff 0f 0f 94 c0 84 c0\n  RIP  exit_creds+0x12/0x78\n   RSP <ffff8806044f1d78>\n  CR2: 0000000000000000\n\n[akpm@linux-foundation.org: add pglist_data.kswapd locking comments]\nSigned-off-by: Xishi Qiu <qiuxishi@huawei.com>\nSigned-off-by: Jiang Liu <jiang.liu@huawei.com>\nAcked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>\nAcked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nAcked-by: Mel Gorman <mgorman@suse.de>\nAcked-by: David Rientjes <rientjes@google.com>\nReviewed-by: Minchan Kim <minchan@kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/fc4358870dfb49598c8adda38aaf1f6105347c37"},{"sha":"2268c48e63866a67612d05220c58951b12c742b4","author":{"email":"d8cd2994e15bc61ddb2b113030bda55eebc3a0fe@google.com","name":"David Rientjes"},"message":"mm, thp: abort compaction if migration page cannot be charged to memcg\n\ncommit 4bf2bba3750f10aa9e62e6949bc7e8329990f01b upstream.\n\nIf page migration cannot charge the temporary page to the memcg,\nmigrate_pages() will return -ENOMEM.  This isn't considered in memory\ncompaction however, and the loop continues to iterate over all\npageblocks trying to isolate and migrate pages.  If a small number of\nvery large memcgs happen to be oom, however, these attempts will mostly\nbe futile leading to an enormous amout of cpu consumption due to the\npage migration failures.\n\nThis patch will short circuit and fail memory compaction if\nmigrate_pages() returns -ENOMEM.  COMPACT_PARTIAL is returned in case\nsome migrations were successful so that the page allocator will retry.\n\nSigned-off-by: David Rientjes <rientjes@google.com>\nAcked-by: Mel Gorman <mgorman@suse.de>\nCc: Minchan Kim <minchan@kernel.org>\nCc: Kamezawa Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>\nCc: Rik van Riel <riel@redhat.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/2268c48e63866a67612d05220c58951b12c742b4"},{"sha":"479380916fcf59db63e618b3ebfeb46657183128","author":{"email":"0674548f4d596393408a51d6287a76ebba2f42aa@kernel.org","name":"Yinghai Lu"},"message":"memblock: free allocated memblock_reserved_regions later\n\ncommit 29f6738609e40227dabcc63bfb3b84b3726a75bd upstream.\n\nmemblock_free_reserved_regions() calls memblock_free(), but\nmemblock_free() would double reserved.regions too, so we could free the\nold range for reserved.regions.\n\nAlso tj said there is another bug which could be related to this.\n\n| I don't think we're saving any noticeable\n| amount by doing this \"free - give it to page allocator - reserve\n| again\" dancing.  We should just allocate regions aligned to page\n| boundaries and free them later when memblock is no longer in use.\n\nin that case, when DEBUG_PAGEALLOC, will get panic:\n\n     memblock_free: [0x0000102febc080-0x0000102febf080] memblock_free_reserved_regions+0x37/0x39\n  BUG: unable to handle kernel paging request at ffff88102febd948\n  IP: [<ffffffff836a5774>] __next_free_mem_range+0x9b/0x155\n  PGD 4826063 PUD cf67a067 PMD cf7fa067 PTE 800000102febd160\n  Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n  CPU 0\n  Pid: 0, comm: swapper Not tainted 3.5.0-rc2-next-20120614-sasha #447\n  RIP: 0010:[<ffffffff836a5774>]  [<ffffffff836a5774>] __next_free_mem_range+0x9b/0x155\n\nSee the discussion at https://lkml.org/lkml/2012/6/13/469\n\nSo try to allocate with PAGE_SIZE alignment and free it later.\n\nReported-by: Sasha Levin <levinsasha928@gmail.com>\nAcked-by: Tejun Heo <tj@kernel.org>\nCc: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nSigned-off-by: Yinghai Lu <yinghai@kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/479380916fcf59db63e618b3ebfeb46657183128"},{"sha":"e7fe17e04a538c67e9ba1674c2bf32b87c57e97e","author":{"email":"10de85239c567bd71bdb3c2406bb233b4937dc8b@gmail.com","name":"Aaditya Kumar"},"message":"mm: fix lost kswapd wakeup in kswapd_stop()\n\ncommit 1c7e7f6c0703d03af6bcd5ccc11fc15d23e5ecbe upstream.\n\nOfflining memory may block forever, waiting for kswapd() to wake up\nbecause kswapd() does not check the event kthread->should_stop before\nsleeping.\n\nThe proper pattern, from Documentation/memory-barriers.txt, is:\n\n   ---  waker  ---\n   event_indicated = 1;\n   wake_up_process(event_daemon);\n\n   ---  sleeper  ---\n   for (;;) {\n      set_current_state(TASK_UNINTERRUPTIBLE);\n      if (event_indicated)\n         break;\n      schedule();\n   }\n\n   set_current_state() may be wrapped by:\n      prepare_to_wait();\n\nIn the kswapd() case, event_indicated is kthread->should_stop.\n\n  === offlining memory (waker) ===\n   kswapd_stop()\n      kthread_stop()\n         kthread->should_stop = 1\n         wake_up_process()\n         wait_for_completion()\n\n  ===  kswapd_try_to_sleep (sleeper) ===\n   kswapd_try_to_sleep()\n      prepare_to_wait()\n           .\n           .\n      schedule()\n           .\n           .\n      finish_wait()\n\nThe schedule() needs to be protected by a test of kthread->should_stop,\nwhich is wrapped by kthread_should_stop().\n\nReproducer:\n   Do heavy file I/O in background.\n   Do a memory offline/online in a tight loop\n\nSigned-off-by: Aaditya Kumar <aaditya.kumar@ap.sony.com>\nAcked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nReviewed-by: Minchan Kim <minchan@kernel.org>\nAcked-by: Mel Gorman <mel@csn.ul.ie>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/e7fe17e04a538c67e9ba1674c2bf32b87c57e97e"},{"sha":"e9e7cbe84adf253be6eaad3343d283c320e5562d","author":{"email":"e7984595ec0368ff920a7b3521dc7093683f6f26@intel.com","name":"Tony Luck"},"message":"x86/mce: Fix siginfo_t->si_addr value for non-recoverable memory faults\n\ncommit 6751ed65dc6642af64f7b8a440a75563c8aab7ae upstream.\n\nIn commit dad1743e5993f1 (\"x86/mce: Only restart instruction after machine\ncheck recovery if it is safe\") we fixed mce_notify_process() to force a\nsignal to the current process if it was not restartable (RIPV bit not\nset in MCG_STATUS). But doing it here means that the process doesn't\nget told the virtual address of the fault via siginfo_t->si_addr. This\nwould prevent application level recovery from the fault.\n\nMake a new MF_MUST_KILL flag bit for memory_failure() et al. to use so\nthat we will provide the right information with the signal.\n\nSigned-off-by: Tony Luck <tony.luck@intel.com>\nAcked-by: Borislav Petkov <borislav.petkov@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/e9e7cbe84adf253be6eaad3343d283c320e5562d"},{"sha":"7ac1990e548df9e777248499a6cea97e2ba235b1","author":{"email":"d91a346a9a76eb1627d34d097d6cb4c8e5067100@gmail.com","name":"Joonsoo Kim"},"message":"mm: fix wrong argument of migrate_huge_pages() in soft_offline_huge_page()\n\ncommit dc32f63453f56d07a1073a697dcd843dd3098c09 upstream.\n\nCommit a6bc32b89922 (\"mm: compaction: introduce sync-light migration for\nuse by compaction\") changed the declaration of migrate_pages() and\nmigrate_huge_pages().\n\nBut it missed changing the argument of migrate_huge_pages() in\nsoft_offline_huge_page().  In this case, we should call\nmigrate_huge_pages() with MIGRATE_SYNC.\n\nAdditionally, there is a mismatch between type the of argument and the\nfunction declaration for migrate_pages().\n\nSigned-off-by: Joonsoo Kim <js1304@gmail.com>\nCc: Christoph Lameter <cl@linux.com>\nCc: Mel Gorman <mgorman@suse.de>\nAcked-by: David Rientjes <rientjes@google.com>\nCc: \"Aneesh Kumar K.V\" <aneesh.kumar@linux.vnet.ibm.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/7ac1990e548df9e777248499a6cea97e2ba235b1"},{"sha":"a7eb7264a7e79dd6ce2a485bd9fb729ea9ad7258","author":{"email":"1e0036c3819c78880ef9e9a8457e99783a5661e3@linux.vnet.ibm.com","name":"Xiao Guangrong"},"message":"mm: mmu_notifier: fix freed page still mapped in secondary MMU\n\ncommit 3ad3d901bbcfb15a5e4690e55350db0899095a68 upstream.\n\nmmu_notifier_release() is called when the process is exiting.  It will\ndelete all the mmu notifiers.  But at this time the page belonging to the\nprocess is still present in page tables and is present on the LRU list, so\nthis race will happen:\n\n      CPU 0                 CPU 1\nmmu_notifier_release:    try_to_unmap:\n   hlist_del_init_rcu(&mn->hlist);\n                            ptep_clear_flush_notify:\n                                  mmu nofifler not found\n                            free page  !!!!!!\n                            /*\n                             * At the point, the page has been\n                             * freed, but it is still mapped in\n                             * the secondary MMU.\n                             */\n\n  mn->ops->release(mn, mm);\n\nThen the box is not stable and sometimes we can get this bug:\n\n[  738.075923] BUG: Bad page state in process migrate-perf  pfn:03bec\n[  738.075931] page:ffffea00000efb00 count:0 mapcount:0 mapping:          (null) index:0x8076\n[  738.075936] page flags: 0x20000000000014(referenced|dirty)\n\nThe same issue is present in mmu_notifier_unregister().\n\nWe can call ->release before deleting the notifier to ensure the page has\nbeen unmapped from the secondary MMU before it is freed.\n\nSigned-off-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>\nCc: Avi Kivity <avi@redhat.com>\nCc: Marcelo Tosatti <mtosatti@redhat.com>\nCc: Paul Gortmaker <paul.gortmaker@windriver.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/a7eb7264a7e79dd6ce2a485bd9fb729ea9ad7258"},{"sha":"86a39c9f01f05bfacc8fc0062a897273d0ef0716","author":{"email":"39ea6a09710987173e32e37c86918024a0f441c1@suse.de","name":"Mel Gorman"},"message":"mm: hugetlbfs: close race during teardown of hugetlbfs shared page tables\n\ncommit d833352a4338dc31295ed832a30c9ccff5c7a183 upstream.\n\nIf a process creates a large hugetlbfs mapping that is eligible for page\ntable sharing and forks heavily with children some of whom fault and\nothers which destroy the mapping then it is possible for page tables to\nget corrupted.  Some teardowns of the mapping encounter a \"bad pmd\" and\noutput a message to the kernel log.  The final teardown will trigger a\nBUG_ON in mm/filemap.c.\n\nThis was reproduced in 3.4 but is known to have existed for a long time\nand goes back at least as far as 2.6.37.  It was probably was introduced\nin 2.6.20 by [39dde65c: shared page table for hugetlb page].  The messages\nlook like this;\n\n[  ..........] Lots of bad pmd messages followed by this\n[  127.164256] mm/memory.c:391: bad pmd ffff880412e04fe8(80000003de4000e7).\n[  127.164257] mm/memory.c:391: bad pmd ffff880412e04ff0(80000003de6000e7).\n[  127.164258] mm/memory.c:391: bad pmd ffff880412e04ff8(80000003de0000e7).\n[  127.186778] ------------[ cut here ]------------\n[  127.186781] kernel BUG at mm/filemap.c:134!\n[  127.186782] invalid opcode: 0000 [#1] SMP\n[  127.186783] CPU 7\n[  127.186784] Modules linked in: af_packet cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq mperf ext3 jbd dm_mod coretemp crc32c_intel usb_storage ghash_clmulni_intel aesni_intel i2c_i801 r8169 mii uas sr_mod cdrom sg iTCO_wdt iTCO_vendor_support shpchp serio_raw cryptd aes_x86_64 e1000e pci_hotplug dcdbas aes_generic container microcode ext4 mbcache jbd2 crc16 sd_mod crc_t10dif i915 drm_kms_helper drm i2c_algo_bit ehci_hcd ahci libahci usbcore rtc_cmos usb_common button i2c_core intel_agp video intel_gtt fan processor thermal thermal_sys hwmon ata_generic pata_atiixp libata scsi_mod\n[  127.186801]\n[  127.186802] Pid: 9017, comm: hugetlbfs-test Not tainted 3.4.0-autobuild #53 Dell Inc. OptiPlex 990/06D7TR\n[  127.186804] RIP: 0010:[<ffffffff810ed6ce>]  [<ffffffff810ed6ce>] __delete_from_page_cache+0x15e/0x160\n[  127.186809] RSP: 0000:ffff8804144b5c08  EFLAGS: 00010002\n[  127.186810] RAX: 0000000000000001 RBX: ffffea000a5c9000 RCX: 00000000ffffffc0\n[  127.186811] RDX: 0000000000000000 RSI: 0000000000000009 RDI: ffff88042dfdad00\n[  127.186812] RBP: ffff8804144b5c18 R08: 0000000000000009 R09: 0000000000000003\n[  127.186813] R10: 0000000000000000 R11: 000000000000002d R12: ffff880412ff83d8\n[  127.186814] R13: ffff880412ff83d8 R14: 0000000000000000 R15: ffff880412ff83d8\n[  127.186815] FS:  00007fe18ed2c700(0000) GS:ffff88042dce0000(0000) knlGS:0000000000000000\n[  127.186816] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[  127.186817] CR2: 00007fe340000503 CR3: 0000000417a14000 CR4: 00000000000407e0\n[  127.186818] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  127.186819] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n[  127.186820] Process hugetlbfs-test (pid: 9017, threadinfo ffff8804144b4000, task ffff880417f803c0)\n[  127.186821] Stack:\n[  127.186822]  ffffea000a5c9000 0000000000000000 ffff8804144b5c48 ffffffff810ed83b\n[  127.186824]  ffff8804144b5c48 000000000000138a 0000000000001387 ffff8804144b5c98\n[  127.186825]  ffff8804144b5d48 ffffffff811bc925 ffff8804144b5cb8 0000000000000000\n[  127.186827] Call Trace:\n[  127.186829]  [<ffffffff810ed83b>] delete_from_page_cache+0x3b/0x80\n[  127.186832]  [<ffffffff811bc925>] truncate_hugepages+0x115/0x220\n[  127.186834]  [<ffffffff811bca43>] hugetlbfs_evict_inode+0x13/0x30\n[  127.186837]  [<ffffffff811655c7>] evict+0xa7/0x1b0\n[  127.186839]  [<ffffffff811657a3>] iput_final+0xd3/0x1f0\n[  127.186840]  [<ffffffff811658f9>] iput+0x39/0x50\n[  127.186842]  [<ffffffff81162708>] d_kill+0xf8/0x130\n[  127.186843]  [<ffffffff81162812>] dput+0xd2/0x1a0\n[  127.186845]  [<ffffffff8114e2d0>] __fput+0x170/0x230\n[  127.186848]  [<ffffffff81236e0e>] ? rb_erase+0xce/0x150\n[  127.186849]  [<ffffffff8114e3ad>] fput+0x1d/0x30\n[  127.186851]  [<ffffffff81117db7>] remove_vma+0x37/0x80\n[  127.186853]  [<ffffffff81119182>] do_munmap+0x2d2/0x360\n[  127.186855]  [<ffffffff811cc639>] sys_shmdt+0xc9/0x170\n[  127.186857]  [<ffffffff81410a39>] system_call_fastpath+0x16/0x1b\n[  127.186858] Code: 0f 1f 44 00 00 48 8b 43 08 48 8b 00 48 8b 40 28 8b b0 40 03 00 00 85 f6 0f 88 df fe ff ff 48 89 df e8 e7 cb 05 00 e9 d2 fe ff ff <0f> 0b 55 83 e2 fd 48 89 e5 48 83 ec 30 48 89 5d d8 4c 89 65 e0\n[  127.186868] RIP  [<ffffffff810ed6ce>] __delete_from_page_cache+0x15e/0x160\n[  127.186870]  RSP <ffff8804144b5c08>\n[  127.186871] ---[ end trace 7cbac5d1db69f426 ]---\n\nThe bug is a race and not always easy to reproduce.  To reproduce it I was\ndoing the following on a single socket I7-based machine with 16G of RAM.\n\n$ hugeadm --pool-pages-max DEFAULT:13G\n$ echo $((18*1048576*1024)) > /proc/sys/kernel/shmmax\n$ echo $((18*1048576*1024)) > /proc/sys/kernel/shmall\n$ for i in `seq 1 9000`; do ./hugetlbfs-test; done\n\nOn my particular machine, it usually triggers within 10 minutes but\nenabling debug options can change the timing such that it never hits.\nOnce the bug is triggered, the machine is in trouble and needs to be\nrebooted.  The machine will respond but processes accessing proc like \"ps\naux\" will hang due to the BUG_ON.  shutdown will also hang and needs a\nhard reset or a sysrq-b.\n\nThe basic problem is a race between page table sharing and teardown.  For\nthe most part page table sharing depends on i_mmap_mutex.  In some cases,\nit is also taking the mm->page_table_lock for the PTE updates but with\nshared page tables, it is the i_mmap_mutex that is more important.\n\nUnfortunately it appears to be also insufficient. Consider the following\nsituation\n\nProcess A\t\t\t\t\tProcess B\n---------\t\t\t\t\t---------\nhugetlb_fault\t\t\t\t\tshmdt\n  \t\t\t\t\t\tLockWrite(mmap_sem)\n    \t\t\t\t\t\t  do_munmap\n\t\t\t\t\t\t    unmap_region\n\t\t\t\t\t\t      unmap_vmas\n\t\t\t\t\t\t        unmap_single_vma\n\t\t\t\t\t\t          unmap_hugepage_range\n      \t\t\t\t\t\t            Lock(i_mmap_mutex)\n\t\t\t\t\t\t\t    Lock(mm->page_table_lock)\n\t\t\t\t\t\t\t    huge_pmd_unshare/unmap tables <--- (1)\n\t\t\t\t\t\t\t    Unlock(mm->page_table_lock)\n      \t\t\t\t\t\t            Unlock(i_mmap_mutex)\n  huge_pte_alloc\t\t\t\t      ...\n    Lock(i_mmap_mutex)\t\t\t\t      ...\n    vma_prio_walk, find svma, spte\t\t      ...\n    Lock(mm->page_table_lock)\t\t\t      ...\n    share spte\t\t\t\t\t      ...\n    Unlock(mm->page_table_lock)\t\t\t      ...\n    Unlock(i_mmap_mutex)\t\t\t      ...\n  hugetlb_no_page\t\t\t\t\t\t\t\t\t  <--- (2)\n\t\t\t\t\t\t      free_pgtables\n\t\t\t\t\t\t        unlink_file_vma\n\t\t\t\t\t\t\thugetlb_free_pgd_range\n\t\t\t\t\t\t    remove_vma_list\n\nIn this scenario, it is possible for Process A to share page tables with\nProcess B that is trying to tear them down.  The i_mmap_mutex on its own\ndoes not prevent Process A walking Process B's page tables.  At (1) above,\nthe page tables are not shared yet so it unmaps the PMDs.  Process A sets\nup page table sharing and at (2) faults a new entry.  Process B then trips\nup on it in free_pgtables.\n\nThis patch fixes the problem by adding a new function\n__unmap_hugepage_range_final that is only called when the VMA is about to\nbe destroyed.  This function clears VM_MAYSHARE during\nunmap_hugepage_range() under the i_mmap_mutex.  This makes the VMA\nineligible for sharing and avoids the race.  Superficially this looks like\nit would then be vunerable to truncate and madvise issues but hugetlbfs\nhas its own truncate handlers so does not use unmap_mapping_range() and\ndoes not support madvise(DONTNEED).\n\nThis should be treated as a -stable candidate if it is merged.\n\nTest program is as follows. The test case was mostly written by Michal\nHocko with a few minor changes to reproduce this bug.\n\n==== CUT HERE ====\n\nstatic size_t huge_page_size = (2UL << 20);\nstatic size_t nr_huge_page_A = 512;\nstatic size_t nr_huge_page_B = 5632;\n\nunsigned int get_random(unsigned int max)\n{\n\tstruct timeval tv;\n\n\tgettimeofday(&tv, NULL);\n\tsrandom(tv.tv_usec);\n\treturn random() % max;\n}\n\nstatic void play(void *addr, size_t size)\n{\n\tunsigned char *start = addr,\n\t\t      *end = start + size,\n\t\t      *a;\n\tstart += get_random(size/2);\n\n\t/* we could itterate on huge pages but let's give it more time. */\n\tfor (a = start; a < end; a += 4096)\n\t\t*a = 0;\n}\n\nint main(int argc, char **argv)\n{\n\tkey_t key = IPC_PRIVATE;\n\tsize_t sizeA = nr_huge_page_A * huge_page_size;\n\tsize_t sizeB = nr_huge_page_B * huge_page_size;\n\tint shmidA, shmidB;\n\tvoid *addrA = NULL, *addrB = NULL;\n\tint nr_children = 300, n = 0;\n\n\tif ((shmidA = shmget(key, sizeA, IPC_CREAT|SHM_HUGETLB|0660)) == -1) {\n\t\tperror(\"shmget:\");\n\t\treturn 1;\n\t}\n\n\tif ((addrA = shmat(shmidA, addrA, SHM_R|SHM_W)) == (void *)-1UL) {\n\t\tperror(\"shmat\");\n\t\treturn 1;\n\t}\n\tif ((shmidB = shmget(key, sizeB, IPC_CREAT|SHM_HUGETLB|0660)) == -1) {\n\t\tperror(\"shmget:\");\n\t\treturn 1;\n\t}\n\n\tif ((addrB = shmat(shmidB, addrB, SHM_R|SHM_W)) == (void *)-1UL) {\n\t\tperror(\"shmat\");\n\t\treturn 1;\n\t}\n\nfork_child:\n\tswitch(fork()) {\n\t\tcase 0:\n\t\t\tswitch (n%3) {\n\t\t\tcase 0:\n\t\t\t\tplay(addrA, sizeA);\n\t\t\t\tbreak;\n\t\t\tcase 1:\n\t\t\t\tplay(addrB, sizeB);\n\t\t\t\tbreak;\n\t\t\tcase 2:\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tbreak;\n\t\tcase -1:\n\t\t\tperror(\"fork:\");\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tif (++n < nr_children)\n\t\t\t\tgoto fork_child;\n\t\t\tplay(addrA, sizeA);\n\t\t\tbreak;\n\t}\n\tshmdt(addrA);\n\tshmdt(addrB);\n\tdo {\n\t\twait(NULL);\n\t} while (--n > 0);\n\tshmctl(shmidA, IPC_RMID, NULL);\n\tshmctl(shmidB, IPC_RMID, NULL);\n\treturn 0;\n}\n\n[akpm@linux-foundation.org: name the declaration's args, fix CONFIG_HUGETLBFS=n build]\nSigned-off-by: Hugh Dickins <hughd@google.com>\nReviewed-by: Michal Hocko <mhocko@suse.cz>\nSigned-off-by: Mel Gorman <mgorman@suse.de>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/86a39c9f01f05bfacc8fc0062a897273d0ef0716"},{"sha":"af11befa45884c312d4cc664b46ec2bfb8c0a8fe","author":{"email":"d5ec0d24602845f6f4b6a35ef729998d1fba5507@redhat.com","name":"Dave Jones"},"message":"Remove user-triggerable BUG from mpol_to_str\n\ncommit 80de7c3138ee9fd86a98696fd2cf7ad89b995d0a upstream.\n\nTrivially triggerable, found by trinity:\n\n  kernel BUG at mm/mempolicy.c:2546!\n  Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670)\n  Call Trace:\n    show_numa_map+0xd5/0x450\n    show_pid_numa_map+0x13/0x20\n    traverse+0xf2/0x230\n    seq_read+0x34b/0x3e0\n    vfs_read+0xac/0x180\n    sys_pread64+0xa2/0xc0\n    system_call_fastpath+0x1a/0x1f\n  RIP: mpol_to_str+0x156/0x360\n\nSigned-off-by: Dave Jones <davej@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/af11befa45884c312d4cc664b46ec2bfb8c0a8fe"},{"sha":"1317b999efbd32cb2083082780abbf8d0900abaa","author":{"email":"42448750d40f101f382f1115ac3f142cd5980f2f@gmail.com","name":"Li Haifeng"},"message":"mm/page_alloc: fix the page address of higher page's buddy calculation\n\ncommit 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac upstream.\n\nThe heuristic method for buddy has been introduced since commit\n43506fad21ca (\"mm/page_alloc.c: simplify calculation of combined index\nof adjacent buddy lists\").  But the page address of higher page's buddy\nwas wrongly calculated, which will lead page_is_buddy to fail for ever.\nIOW, the heuristic method would be disabled with the wrong page address\nof higher page's buddy.\n\nCalculating the page address of higher page's buddy should be based\nhigher_page with the offset between index of higher page and index of\nhigher page's buddy.\n\nSigned-off-by: Haifeng Li <omycle@gmail.com>\nSigned-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>\nReviewed-by: Michal Hocko <mhocko@suse.cz>\nCc: KyongHo Cho <pullip.cho@samsung.com>\nCc: Mel Gorman <mgorman@suse.de>\nCc: Minchan Kim <minchan.kim@gmail.com>\nCc: Johannes Weiner <jweiner@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8960t/commits/1317b999efbd32cb2083082780abbf8d0900abaa"}]}