Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'akpm' (incoming from Andrew)
Merge patches from Andrew Morton:
"Ten fixes"
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
epoll: do not take the nested ep->mtx on EPOLL_CTL_DEL
sh: add EXPORT_SYMBOL(min_low_pfn) and EXPORT_SYMBOL(max_low_pfn) to sh_ksyms_32.c
drivers/dma/ioat/dma.c: check DMA mapping error in ioat_dma_self_test()
mm/memory-failure.c: transfer page count from head page to tail page after split thp
MAINTAINERS: set up proper record for Xilinx Zynq
mm: remove bogus warning in copy_huge_pmd()
memcg: fix memcg_size() calculation
mm: fix use-after-free in sys_remap_file_pages
mm: munlock: fix deadlock in __munlock_pagevec()
mm: munlock: fix a bug where THP tail page is encountered
+66
-24
+3
MAINTAINERS
+3
MAINTAINERS
+5
arch/sh/kernel/sh_ksyms_32.c
+5
arch/sh/kernel/sh_ksyms_32.c
···
20
20
EXPORT_SYMBOL(copy_page);
21
21
EXPORT_SYMBOL(__clear_user);
22
22
EXPORT_SYMBOL(empty_zero_page);
23
+
#ifdef CONFIG_FLATMEM
24
+
/* need in pfn_valid macro */
25
+
EXPORT_SYMBOL(min_low_pfn);
26
+
EXPORT_SYMBOL(max_low_pfn);
27
+
#endif
23
28
24
29
#define DECLARE_EXPORT(name) \
25
30
extern void name(void);EXPORT_SYMBOL(name)
+10
-1
drivers/dma/ioat/dma.c
+10
-1
drivers/dma/ioat/dma.c
···
817
817
}
818
818
819
819
dma_src = dma_map_single(dev, src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
820
+
if (dma_mapping_error(dev, dma_src)) {
821
+
dev_err(dev, "mapping src buffer failed\n");
822
+
goto free_resources;
823
+
}
820
824
dma_dest = dma_map_single(dev, dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
825
+
if (dma_mapping_error(dev, dma_dest)) {
826
+
dev_err(dev, "mapping dest buffer failed\n");
827
+
goto unmap_src;
828
+
}
821
829
flags = DMA_PREP_INTERRUPT;
822
830
tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
823
831
IOAT_TEST_SIZE, flags);
···
863
855
}
864
856
865
857
unmap_dma:
866
-
dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
867
858
dma_unmap_single(dev, dma_dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
859
+
unmap_src:
860
+
dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
868
861
free_resources:
869
862
dma->device_free_chan_resources(dma_chan);
870
863
out:
-4
fs/eventpoll.c
-4
fs/eventpoll.c
+5
-3
mm/fremap.c
+5
-3
mm/fremap.c
···
208
208
if (mapping_cap_account_dirty(mapping)) {
209
209
unsigned long addr;
210
210
struct file *file = get_file(vma->vm_file);
211
+
/* mmap_region may free vma; grab the info now */
212
+
vm_flags = vma->vm_flags;
211
213
212
-
addr = mmap_region(file, start, size,
213
-
vma->vm_flags, pgoff);
214
+
addr = mmap_region(file, start, size, vm_flags, pgoff);
214
215
fput(file);
215
216
if (IS_ERR_VALUE(addr)) {
216
217
err = addr;
···
219
218
BUG_ON(addr != start);
220
219
err = 0;
221
220
}
222
-
goto out;
221
+
goto out_freed;
223
222
}
224
223
mutex_lock(&mapping->i_mmap_mutex);
225
224
flush_dcache_mmap_lock(mapping);
···
254
253
out:
255
254
if (vma)
256
255
vm_flags = vma->vm_flags;
256
+
out_freed:
257
257
if (likely(!has_write_lock))
258
258
up_read(&mm->mmap_sem);
259
259
else
-3
mm/huge_memory.c
-3
mm/huge_memory.c
+1
-1
mm/memcontrol.c
+1
-1
mm/memcontrol.c
···
338
338
static size_t memcg_size(void)
339
339
{
340
340
return sizeof(struct mem_cgroup) +
341
-
nr_node_ids * sizeof(struct mem_cgroup_per_node);
341
+
nr_node_ids * sizeof(struct mem_cgroup_per_node *);
342
342
}
343
343
344
344
/* internal only representation about the status of kmem accounting. */
+10
mm/memory-failure.c
+10
mm/memory-failure.c
···
938
938
BUG_ON(!PageHWPoison(p));
939
939
return SWAP_FAIL;
940
940
}
941
+
/*
942
+
* We pinned the head page for hwpoison handling,
943
+
* now we split the thp and we are interested in
944
+
* the hwpoisoned raw page, so move the refcount
945
+
* to it.
946
+
*/
947
+
if (hpage != p) {
948
+
put_page(hpage);
949
+
get_page(p);
950
+
}
941
951
/* THP is split, so ppage should be the real poisoned page. */
942
952
ppage = p;
943
953
}
+32
-12
mm/mlock.c
+32
-12
mm/mlock.c
···
133
133
134
134
/**
135
135
* munlock_vma_page - munlock a vma page
136
-
* @page - page to be unlocked
136
+
* @page - page to be unlocked, either a normal page or THP page head
137
+
*
138
+
* returns the size of the page as a page mask (0 for normal page,
139
+
* HPAGE_PMD_NR - 1 for THP head page)
137
140
*
138
141
* called from munlock()/munmap() path with page supposedly on the LRU.
139
142
* When we munlock a page, because the vma where we found the page is being
···
151
148
*/
152
149
unsigned int munlock_vma_page(struct page *page)
153
150
{
154
-
unsigned int page_mask = 0;
151
+
unsigned int nr_pages;
155
152
156
153
BUG_ON(!PageLocked(page));
157
154
158
155
if (TestClearPageMlocked(page)) {
159
-
unsigned int nr_pages = hpage_nr_pages(page);
156
+
nr_pages = hpage_nr_pages(page);
160
157
mod_zone_page_state(page_zone(page), NR_MLOCK, -nr_pages);
161
-
page_mask = nr_pages - 1;
162
158
if (!isolate_lru_page(page))
163
159
__munlock_isolated_page(page);
164
160
else
165
161
__munlock_isolation_failed(page);
162
+
} else {
163
+
nr_pages = hpage_nr_pages(page);
166
164
}
167
165
168
-
return page_mask;
166
+
/*
167
+
* Regardless of the original PageMlocked flag, we determine nr_pages
168
+
* after touching the flag. This leaves a possible race with a THP page
169
+
* split, such that a whole THP page was munlocked, but nr_pages == 1.
170
+
* Returning a smaller mask due to that is OK, the worst that can
171
+
* happen is subsequent useless scanning of the former tail pages.
172
+
* The NR_MLOCK accounting can however become broken.
173
+
*/
174
+
return nr_pages - 1;
169
175
}
170
176
171
177
/**
···
298
286
{
299
287
int i;
300
288
int nr = pagevec_count(pvec);
301
-
int delta_munlocked = -nr;
289
+
int delta_munlocked;
302
290
struct pagevec pvec_putback;
303
291
int pgrescued = 0;
292
+
293
+
pagevec_init(&pvec_putback, 0);
304
294
305
295
/* Phase 1: page isolation */
306
296
spin_lock_irq(&zone->lru_lock);
···
332
318
/*
333
319
* We won't be munlocking this page in the next phase
334
320
* but we still need to release the follow_page_mask()
335
-
* pin.
321
+
* pin. We cannot do it under lru_lock however. If it's
322
+
* the last pin, __page_cache_release would deadlock.
336
323
*/
324
+
pagevec_add(&pvec_putback, pvec->pages[i]);
337
325
pvec->pages[i] = NULL;
338
-
put_page(page);
339
-
delta_munlocked++;
340
326
}
341
327
}
328
+
delta_munlocked = -nr + pagevec_count(&pvec_putback);
342
329
__mod_zone_page_state(zone, NR_MLOCK, delta_munlocked);
343
330
spin_unlock_irq(&zone->lru_lock);
344
331
332
+
/* Now we can release pins of pages that we are not munlocking */
333
+
pagevec_release(&pvec_putback);
334
+
345
335
/* Phase 2: page munlock */
346
-
pagevec_init(&pvec_putback, 0);
347
336
for (i = 0; i < nr; i++) {
348
337
struct page *page = pvec->pages[i];
349
338
···
457
440
458
441
while (start < end) {
459
442
struct page *page = NULL;
460
-
unsigned int page_mask, page_increm;
443
+
unsigned int page_mask;
444
+
unsigned long page_increm;
461
445
struct pagevec pvec;
462
446
struct zone *zone;
463
447
int zoneid;
···
508
490
goto next;
509
491
}
510
492
}
511
-
page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask);
493
+
/* It's a bug to munlock in the middle of a THP page */
494
+
VM_BUG_ON((start >> PAGE_SHIFT) & page_mask);
495
+
page_increm = 1 + page_mask;
512
496
start += page_increm * PAGE_SIZE;
513
497
next:
514
498
cond_resched();