Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'akpm' (patches from Andrew)
Merge fixes from Andrew Morton:
"11 fixes"
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
Update maintainers for DRM STI driver
mm: cma: mark cma_bitmap_maxno() inline in header
zram: fix pool name truncation
memory-hotplug: fix wrong edge when hot add a new node
.mailmap: Andrey Ryabinin has moved
ipc/sem.c: update/correct memory barriers
mm/hwpoison: fix panic due to split huge zero page
ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()
ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
mm/hwpoison: fix fail isolate hugetlbfs page w/ refcount held
mm/hwpoison: fix page refcount of unknown non LRU page
+75
-29
+1
.mailmap
+1
.mailmap
···
17
17
Al Viro <viro@ftp.linux.org.uk>
18
18
Al Viro <viro@zenIV.linux.org.uk>
19
19
Andreas Herrmann <aherrman@de.ibm.com>
20
+
Andrey Ryabinin <ryabinin.a.a@gmail.com> <a.ryabinin@samsung.com>
20
21
Andrew Morton <akpm@linux-foundation.org>
21
22
Andrew Vasquez <andrew.vasquez@qlogic.com>
22
23
Andy Adamson <andros@citi.umich.edu>
+9
MAINTAINERS
+9
MAINTAINERS
···
3587
3587
F: drivers/gpu/drm/rockchip/
3588
3588
F: Documentation/devicetree/bindings/video/rockchip*
3589
3589
3590
+
DRM DRIVERS FOR STI
3591
+
M: Benjamin Gaignard <benjamin.gaignard@linaro.org>
3592
+
M: Vincent Abriou <vincent.abriou@st.com>
3593
+
L: dri-devel@lists.freedesktop.org
3594
+
T: git http://git.linaro.org/people/benjamin.gaignard/kernel.git
3595
+
S: Maintained
3596
+
F: drivers/gpu/drm/sti
3597
+
F: Documentation/devicetree/bindings/gpu/st,stih4xx.txt
3598
+
3590
3599
DSBR100 USB FM RADIO DRIVER
3591
3600
M: Alexey Klimov <klimov.linux@gmail.com>
3592
3601
L: linux-media@vger.kernel.org
+2
-4
drivers/block/zram/zram_drv.c
+2
-4
drivers/block/zram/zram_drv.c
···
496
496
kfree(meta);
497
497
}
498
498
499
-
static struct zram_meta *zram_meta_alloc(int device_id, u64 disksize)
499
+
static struct zram_meta *zram_meta_alloc(char *pool_name, u64 disksize)
500
500
{
501
501
size_t num_pages;
502
-
char pool_name[8];
503
502
struct zram_meta *meta = kmalloc(sizeof(*meta), GFP_KERNEL);
504
503
505
504
if (!meta)
···
511
512
goto out_error;
512
513
}
513
514
514
-
snprintf(pool_name, sizeof(pool_name), "zram%d", device_id);
515
515
meta->mem_pool = zs_create_pool(pool_name, GFP_NOIO | __GFP_HIGHMEM);
516
516
if (!meta->mem_pool) {
517
517
pr_err("Error creating memory pool\n");
···
1029
1031
return -EINVAL;
1030
1032
1031
1033
disksize = PAGE_ALIGN(disksize);
1032
-
meta = zram_meta_alloc(zram->disk->first_minor, disksize);
1034
+
meta = zram_meta_alloc(zram->disk->disk_name, disksize);
1033
1035
if (!meta)
1034
1036
return -ENOMEM;
1035
1037
+36
-13
ipc/sem.c
+36
-13
ipc/sem.c
···
253
253
}
254
254
255
255
/*
256
+
* spin_unlock_wait() and !spin_is_locked() are not memory barriers, they
257
+
* are only control barriers.
258
+
* The code must pair with spin_unlock(&sem->lock) or
259
+
* spin_unlock(&sem_perm.lock), thus just the control barrier is insufficient.
260
+
*
261
+
* smp_rmb() is sufficient, as writes cannot pass the control barrier.
262
+
*/
263
+
#define ipc_smp_acquire__after_spin_is_unlocked() smp_rmb()
264
+
265
+
/*
256
266
* Wait until all currently ongoing simple ops have completed.
257
267
* Caller must own sem_perm.lock.
258
268
* New simple ops cannot start, because simple ops first check
···
285
275
sem = sma->sem_base + i;
286
276
spin_unlock_wait(&sem->lock);
287
277
}
278
+
ipc_smp_acquire__after_spin_is_unlocked();
288
279
}
289
280
290
281
/*
···
338
327
/* Then check that the global lock is free */
339
328
if (!spin_is_locked(&sma->sem_perm.lock)) {
340
329
/*
341
-
* The ipc object lock check must be visible on all
342
-
* cores before rechecking the complex count. Otherwise
343
-
* we can race with another thread that does:
330
+
* We need a memory barrier with acquire semantics,
331
+
* otherwise we can race with another thread that does:
344
332
* complex_count++;
345
333
* spin_unlock(sem_perm.lock);
346
334
*/
347
-
smp_rmb();
335
+
ipc_smp_acquire__after_spin_is_unlocked();
348
336
349
337
/*
350
338
* Now repeat the test of complex_count:
···
2084
2074
rcu_read_lock();
2085
2075
un = list_entry_rcu(ulp->list_proc.next,
2086
2076
struct sem_undo, list_proc);
2087
-
if (&un->list_proc == &ulp->list_proc)
2088
-
semid = -1;
2089
-
else
2090
-
semid = un->semid;
2091
-
2092
-
if (semid == -1) {
2077
+
if (&un->list_proc == &ulp->list_proc) {
2078
+
/*
2079
+
* We must wait for freeary() before freeing this ulp,
2080
+
* in case we raced with last sem_undo. There is a small
2081
+
* possibility where we exit while freeary() didn't
2082
+
* finish unlocking sem_undo_list.
2083
+
*/
2084
+
spin_unlock_wait(&ulp->lock);
2093
2085
rcu_read_unlock();
2094
2086
break;
2095
2087
}
2088
+
spin_lock(&ulp->lock);
2089
+
semid = un->semid;
2090
+
spin_unlock(&ulp->lock);
2096
2091
2097
-
sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, un->semid);
2092
+
/* exit_sem raced with IPC_RMID, nothing to do */
2093
+
if (semid == -1) {
2094
+
rcu_read_unlock();
2095
+
continue;
2096
+
}
2097
+
2098
+
sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, semid);
2098
2099
/* exit_sem raced with IPC_RMID, nothing to do */
2099
2100
if (IS_ERR(sma)) {
2100
2101
rcu_read_unlock();
···
2133
2112
ipc_assert_locked_object(&sma->sem_perm);
2134
2113
list_del(&un->list_id);
2135
2114
2136
-
spin_lock(&ulp->lock);
2115
+
/* we are the last process using this ulp, acquiring ulp->lock
2116
+
* isn't required. Besides that, we are also protected against
2117
+
* IPC_RMID as we hold sma->sem_perm lock now
2118
+
*/
2137
2119
list_del_rcu(&un->list_proc);
2138
-
spin_unlock(&ulp->lock);
2139
2120
2140
2121
/* perform adjustments registered in un */
2141
2122
for (i = 0; i < sma->sem_nsems; i++) {
+1
-1
mm/cma.h
+1
-1
mm/cma.h
+1
-1
mm/kasan/kasan.c
+1
-1
mm/kasan/kasan.c
···
2
2
* This file contains shadow memory manipulation code.
3
3
*
4
4
* Copyright (c) 2014 Samsung Electronics Co., Ltd.
5
-
* Author: Andrey Ryabinin <a.ryabinin@samsung.com>
5
+
* Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
6
6
*
7
7
* Some of code borrowed from https://github.com/xairy/linux by
8
8
* Andrey Konovalov <adech.fo@gmail.com>
+1
-1
mm/kasan/report.c
+1
-1
mm/kasan/report.c
···
2
2
* This file contains error reporting code.
3
3
*
4
4
* Copyright (c) 2014 Samsung Electronics Co., Ltd.
5
-
* Author: Andrey Ryabinin <a.ryabinin@samsung.com>
5
+
* Author: Andrey Ryabinin <ryabinin.a.a@gmail.com>
6
6
*
7
7
* Some of code borrowed from https://github.com/xairy/linux by
8
8
* Andrey Konovalov <adech.fo@gmail.com>
+13
-9
mm/memory-failure.c
+13
-9
mm/memory-failure.c
···
1146
1146
}
1147
1147
1148
1148
if (!PageHuge(p) && PageTransHuge(hpage)) {
1149
-
if (unlikely(split_huge_page(hpage))) {
1150
-
pr_err("MCE: %#lx: thp split failed\n", pfn);
1149
+
if (!PageAnon(hpage) || unlikely(split_huge_page(hpage))) {
1150
+
if (!PageAnon(hpage))
1151
+
pr_err("MCE: %#lx: non anonymous thp\n", pfn);
1152
+
else
1153
+
pr_err("MCE: %#lx: thp split failed\n", pfn);
1151
1154
if (TestClearPageHWPoison(p))
1152
1155
atomic_long_sub(nr_pages, &num_poisoned_pages);
1153
1156
put_page(p);
···
1541
1538
*/
1542
1539
ret = __get_any_page(page, pfn, 0);
1543
1540
if (!PageLRU(page)) {
1541
+
/* Drop page reference which is from __get_any_page() */
1542
+
put_page(page);
1544
1543
pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n",
1545
1544
pfn, page->flags);
1546
1545
return -EIO;
···
1572
1567
unlock_page(hpage);
1573
1568
1574
1569
ret = isolate_huge_page(hpage, &pagelist);
1575
-
if (ret) {
1576
-
/*
1577
-
* get_any_page() and isolate_huge_page() takes a refcount each,
1578
-
* so need to drop one here.
1579
-
*/
1580
-
put_page(hpage);
1581
-
} else {
1570
+
/*
1571
+
* get_any_page() and isolate_huge_page() takes a refcount each,
1572
+
* so need to drop one here.
1573
+
*/
1574
+
put_page(hpage);
1575
+
if (!ret) {
1582
1576
pr_info("soft offline: %#lx hugepage failed to isolate\n", pfn);
1583
1577
return -EBUSY;
1584
1578
}
+3
mm/memory_hotplug.c
+3
mm/memory_hotplug.c
···
1277
1277
1278
1278
/* create new memmap entry */
1279
1279
firmware_map_add_hotplug(start, start + size, "System RAM");
1280
+
memblock_add_node(start, size, nid);
1280
1281
1281
1282
goto out;
1282
1283
···
2014
2013
2015
2014
/* remove memmap entry */
2016
2015
firmware_map_remove(start, start + size, "System RAM");
2016
+
memblock_free(start, size);
2017
+
memblock_remove(start, size);
2017
2018
2018
2019
arch_remove_memory(start, size);
2019
2020
+8
mm/page_alloc.c
+8
mm/page_alloc.c
···
5060
5060
{
5061
5061
unsigned long zone_start_pfn, zone_end_pfn;
5062
5062
5063
+
/* When hotadd a new node, the node should be empty */
5064
+
if (!node_start_pfn && !node_end_pfn)
5065
+
return 0;
5066
+
5063
5067
/* Get the start and end of the zone */
5064
5068
zone_start_pfn = arch_zone_lowest_possible_pfn[zone_type];
5065
5069
zone_end_pfn = arch_zone_highest_possible_pfn[zone_type];
···
5126
5122
unsigned long zone_low = arch_zone_lowest_possible_pfn[zone_type];
5127
5123
unsigned long zone_high = arch_zone_highest_possible_pfn[zone_type];
5128
5124
unsigned long zone_start_pfn, zone_end_pfn;
5125
+
5126
+
/* When hotadd a new node, the node should be empty */
5127
+
if (!node_start_pfn && !node_end_pfn)
5128
+
return 0;
5129
5129
5130
5130
zone_start_pfn = clamp(node_start_pfn, zone_low, zone_high);
5131
5131
zone_end_pfn = clamp(node_end_pfn, zone_low, zone_high);