Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'akpm' (patches from Andrew)
Merge fixes from Andrew Morton:
"10 fixes"
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
mm: slab: free kmem_cache_node after destroy sysfs file
ipc/shm: handle removed segments gracefully in shm_mmap()
MAINTAINERS: update Kselftest Framework mailing list
devm_memremap_release(): fix memremap'd addr handling
mm/hugetlb.c: fix incorrect proc nr_hugepages value
mm, x86: fix pte_page() crash in gup_pte_range()
fsnotify: turn fsnotify reaper thread into a workqueue job
Revert "fsnotify: destroy marks with call_srcu instead of dedicated thread"
mm: fix regression in remap_file_pages() emulation
thp, dax: do not try to withdraw pgtable from non-anon VMA
+151
-67
+1
-1
MAINTAINERS
+1
-1
MAINTAINERS
···
6128
6128
6129
6129
KERNEL SELFTEST FRAMEWORK
6130
6130
M: Shuah Khan <shuahkh@osg.samsung.com>
6131
-
L: linux-api@vger.kernel.org
6131
+
L: linux-kselftest@vger.kernel.org
6132
6132
T: git git://git.kernel.org/pub/scm/shuah/linux-kselftest
6133
6133
S: Maintained
6134
6134
F: tools/testing/selftests
+1
-1
arch/x86/mm/gup.c
+1
-1
arch/x86/mm/gup.c
···
102
102
return 0;
103
103
}
104
104
105
-
page = pte_page(pte);
106
105
if (pte_devmap(pte)) {
107
106
pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
108
107
if (unlikely(!pgmap)) {
···
114
115
return 0;
115
116
}
116
117
VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
118
+
page = pte_page(pte);
117
119
get_page(page);
118
120
put_dev_pagemap(pgmap);
119
121
SetPageReferenced(page);
+39
-14
fs/notify/mark.c
+39
-14
fs/notify/mark.c
···
91
91
#include <linux/fsnotify_backend.h>
92
92
#include "fsnotify.h"
93
93
94
+
#define FSNOTIFY_REAPER_DELAY (1) /* 1 jiffy */
95
+
94
96
struct srcu_struct fsnotify_mark_srcu;
97
+
static DEFINE_SPINLOCK(destroy_lock);
98
+
static LIST_HEAD(destroy_list);
99
+
100
+
static void fsnotify_mark_destroy(struct work_struct *work);
101
+
static DECLARE_DELAYED_WORK(reaper_work, fsnotify_mark_destroy);
95
102
96
103
void fsnotify_get_mark(struct fsnotify_mark *mark)
97
104
{
···
172
165
atomic_dec(&group->num_marks);
173
166
}
174
167
175
-
static void
176
-
fsnotify_mark_free_rcu(struct rcu_head *rcu)
177
-
{
178
-
struct fsnotify_mark *mark;
179
-
180
-
mark = container_of(rcu, struct fsnotify_mark, g_rcu);
181
-
fsnotify_put_mark(mark);
182
-
}
183
-
184
168
/*
185
-
* Free fsnotify mark. The freeing is actually happening from a call_srcu
186
-
* callback. Caller must have a reference to the mark or be protected by
187
-
* fsnotify_mark_srcu.
169
+
* Free fsnotify mark. The freeing is actually happening from a kthread which
170
+
* first waits for srcu period end. Caller must have a reference to the mark
171
+
* or be protected by fsnotify_mark_srcu.
188
172
*/
189
173
void fsnotify_free_mark(struct fsnotify_mark *mark)
190
174
{
···
190
192
mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
191
193
spin_unlock(&mark->lock);
192
194
193
-
call_srcu(&fsnotify_mark_srcu, &mark->g_rcu, fsnotify_mark_free_rcu);
195
+
spin_lock(&destroy_lock);
196
+
list_add(&mark->g_list, &destroy_list);
197
+
spin_unlock(&destroy_lock);
198
+
queue_delayed_work(system_unbound_wq, &reaper_work,
199
+
FSNOTIFY_REAPER_DELAY);
194
200
195
201
/*
196
202
* Some groups like to know that marks are being freed. This is a
···
390
388
391
389
spin_unlock(&mark->lock);
392
390
393
-
call_srcu(&fsnotify_mark_srcu, &mark->g_rcu, fsnotify_mark_free_rcu);
391
+
spin_lock(&destroy_lock);
392
+
list_add(&mark->g_list, &destroy_list);
393
+
spin_unlock(&destroy_lock);
394
+
queue_delayed_work(system_unbound_wq, &reaper_work,
395
+
FSNOTIFY_REAPER_DELAY);
396
+
394
397
return ret;
395
398
}
396
399
···
497
490
spin_lock_init(&mark->lock);
498
491
atomic_set(&mark->refcnt, 1);
499
492
mark->free_mark = free_mark;
493
+
}
494
+
495
+
static void fsnotify_mark_destroy(struct work_struct *work)
496
+
{
497
+
struct fsnotify_mark *mark, *next;
498
+
struct list_head private_destroy_list;
499
+
500
+
spin_lock(&destroy_lock);
501
+
/* exchange the list head */
502
+
list_replace_init(&destroy_list, &private_destroy_list);
503
+
spin_unlock(&destroy_lock);
504
+
505
+
synchronize_srcu(&fsnotify_mark_srcu);
506
+
507
+
list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
508
+
list_del_init(&mark->g_list);
509
+
fsnotify_put_mark(mark);
510
+
}
500
511
}
+1
-4
include/linux/fsnotify_backend.h
+1
-4
include/linux/fsnotify_backend.h
···
220
220
/* List of marks by group->i_fsnotify_marks. Also reused for queueing
221
221
* mark into destroy_list when it's waiting for the end of SRCU period
222
222
* before it can be freed. [group->mark_mutex] */
223
-
union {
224
-
struct list_head g_list;
225
-
struct rcu_head g_rcu;
226
-
};
223
+
struct list_head g_list;
227
224
/* Protects inode / mnt pointers, flags, masks */
228
225
spinlock_t lock;
229
226
/* List of marks for inode / vfsmount [obj_lock] */
+44
-11
ipc/shm.c
+44
-11
ipc/shm.c
···
156
156
struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
157
157
158
158
/*
159
-
* We raced in the idr lookup or with shm_destroy(). Either way, the
160
-
* ID is busted.
159
+
* Callers of shm_lock() must validate the status of the returned ipc
160
+
* object pointer (as returned by ipc_lock()), and error out as
161
+
* appropriate.
161
162
*/
162
-
WARN_ON(IS_ERR(ipcp));
163
-
163
+
if (IS_ERR(ipcp))
164
+
return (void *)ipcp;
164
165
return container_of(ipcp, struct shmid_kernel, shm_perm);
165
166
}
166
167
···
187
186
}
188
187
189
188
190
-
/* This is called by fork, once for every shm attach. */
191
-
static void shm_open(struct vm_area_struct *vma)
189
+
static int __shm_open(struct vm_area_struct *vma)
192
190
{
193
191
struct file *file = vma->vm_file;
194
192
struct shm_file_data *sfd = shm_file_data(file);
195
193
struct shmid_kernel *shp;
196
194
197
195
shp = shm_lock(sfd->ns, sfd->id);
196
+
197
+
if (IS_ERR(shp))
198
+
return PTR_ERR(shp);
199
+
198
200
shp->shm_atim = get_seconds();
199
201
shp->shm_lprid = task_tgid_vnr(current);
200
202
shp->shm_nattch++;
201
203
shm_unlock(shp);
204
+
return 0;
205
+
}
206
+
207
+
/* This is called by fork, once for every shm attach. */
208
+
static void shm_open(struct vm_area_struct *vma)
209
+
{
210
+
int err = __shm_open(vma);
211
+
/*
212
+
* We raced in the idr lookup or with shm_destroy().
213
+
* Either way, the ID is busted.
214
+
*/
215
+
WARN_ON_ONCE(err);
202
216
}
203
217
204
218
/*
···
276
260
down_write(&shm_ids(ns).rwsem);
277
261
/* remove from the list of attaches of the shm segment */
278
262
shp = shm_lock(ns, sfd->id);
263
+
264
+
/*
265
+
* We raced in the idr lookup or with shm_destroy().
266
+
* Either way, the ID is busted.
267
+
*/
268
+
if (WARN_ON_ONCE(IS_ERR(shp)))
269
+
goto done; /* no-op */
270
+
279
271
shp->shm_lprid = task_tgid_vnr(current);
280
272
shp->shm_dtim = get_seconds();
281
273
shp->shm_nattch--;
···
291
267
shm_destroy(ns, shp);
292
268
else
293
269
shm_unlock(shp);
270
+
done:
294
271
up_write(&shm_ids(ns).rwsem);
295
272
}
296
273
···
413
388
struct shm_file_data *sfd = shm_file_data(file);
414
389
int ret;
415
390
416
-
ret = sfd->file->f_op->mmap(sfd->file, vma);
417
-
if (ret != 0)
391
+
/*
392
+
* In case of remap_file_pages() emulation, the file can represent
393
+
* removed IPC ID: propogate shm_lock() error to caller.
394
+
*/
395
+
ret =__shm_open(vma);
396
+
if (ret)
418
397
return ret;
398
+
399
+
ret = sfd->file->f_op->mmap(sfd->file, vma);
400
+
if (ret) {
401
+
shm_close(vma);
402
+
return ret;
403
+
}
419
404
sfd->vm_ops = vma->vm_ops;
420
405
#ifdef CONFIG_MMU
421
406
WARN_ON(!sfd->vm_ops->fault);
422
407
#endif
423
408
vma->vm_ops = &shm_vm_ops;
424
-
shm_open(vma);
425
-
426
-
return ret;
409
+
return 0;
427
410
}
428
411
429
412
static int shm_release(struct inode *ino, struct file *file)
+1
-1
kernel/memremap.c
+1
-1
kernel/memremap.c
+2
-1
mm/huge_memory.c
+2
-1
mm/huge_memory.c
···
1700
1700
pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);
1701
1701
VM_BUG_ON(!pmd_none(*new_pmd));
1702
1702
1703
-
if (pmd_move_must_withdraw(new_ptl, old_ptl)) {
1703
+
if (pmd_move_must_withdraw(new_ptl, old_ptl) &&
1704
+
vma_is_anonymous(vma)) {
1704
1705
pgtable_t pgtable;
1705
1706
pgtable = pgtable_trans_huge_withdraw(mm, old_pmd);
1706
1707
pgtable_trans_huge_deposit(mm, new_pmd, pgtable);
+4
-2
mm/hugetlb.c
+4
-2
mm/hugetlb.c
···
2630
2630
hugetlb_add_hstate(HUGETLB_PAGE_ORDER);
2631
2631
}
2632
2632
default_hstate_idx = hstate_index(size_to_hstate(default_hstate_size));
2633
-
if (default_hstate_max_huge_pages)
2634
-
default_hstate.max_huge_pages = default_hstate_max_huge_pages;
2633
+
if (default_hstate_max_huge_pages) {
2634
+
if (!default_hstate.max_huge_pages)
2635
+
default_hstate.max_huge_pages = default_hstate_max_huge_pages;
2636
+
}
2635
2637
2636
2638
hugetlb_init_hstates();
2637
2639
gather_bootmem_prealloc();
+29
-5
mm/mmap.c
+29
-5
mm/mmap.c
···
2664
2664
if (!vma || !(vma->vm_flags & VM_SHARED))
2665
2665
goto out;
2666
2666
2667
-
if (start < vma->vm_start || start + size > vma->vm_end)
2667
+
if (start < vma->vm_start)
2668
2668
goto out;
2669
2669
2670
-
if (pgoff == linear_page_index(vma, start)) {
2671
-
ret = 0;
2672
-
goto out;
2670
+
if (start + size > vma->vm_end) {
2671
+
struct vm_area_struct *next;
2672
+
2673
+
for (next = vma->vm_next; next; next = next->vm_next) {
2674
+
/* hole between vmas ? */
2675
+
if (next->vm_start != next->vm_prev->vm_end)
2676
+
goto out;
2677
+
2678
+
if (next->vm_file != vma->vm_file)
2679
+
goto out;
2680
+
2681
+
if (next->vm_flags != vma->vm_flags)
2682
+
goto out;
2683
+
2684
+
if (start + size <= next->vm_end)
2685
+
break;
2686
+
}
2687
+
2688
+
if (!next)
2689
+
goto out;
2673
2690
}
2674
2691
2675
2692
prot |= vma->vm_flags & VM_READ ? PROT_READ : 0;
···
2696
2679
flags &= MAP_NONBLOCK;
2697
2680
flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;
2698
2681
if (vma->vm_flags & VM_LOCKED) {
2682
+
struct vm_area_struct *tmp;
2699
2683
flags |= MAP_LOCKED;
2684
+
2700
2685
/* drop PG_Mlocked flag for over-mapped range */
2701
-
munlock_vma_pages_range(vma, start, start + size);
2686
+
for (tmp = vma; tmp->vm_start >= start + size;
2687
+
tmp = tmp->vm_next) {
2688
+
munlock_vma_pages_range(tmp,
2689
+
max(tmp->vm_start, start),
2690
+
min(tmp->vm_end, start + size));
2691
+
}
2702
2692
}
2703
2693
2704
2694
file = get_file(vma->vm_file);
+6
-6
mm/slab.c
+6
-6
mm/slab.c
···
2275
2275
2276
2276
err = setup_cpu_cache(cachep, gfp);
2277
2277
if (err) {
2278
-
__kmem_cache_shutdown(cachep);
2278
+
__kmem_cache_release(cachep);
2279
2279
return err;
2280
2280
}
2281
2281
···
2414
2414
2415
2415
int __kmem_cache_shutdown(struct kmem_cache *cachep)
2416
2416
{
2417
+
return __kmem_cache_shrink(cachep, false);
2418
+
}
2419
+
2420
+
void __kmem_cache_release(struct kmem_cache *cachep)
2421
+
{
2417
2422
int i;
2418
2423
struct kmem_cache_node *n;
2419
-
int rc = __kmem_cache_shrink(cachep, false);
2420
-
2421
-
if (rc)
2422
-
return rc;
2423
2424
2424
2425
free_percpu(cachep->cpu_cache);
2425
2426
···
2431
2430
kfree(n);
2432
2431
cachep->node[i] = NULL;
2433
2432
}
2434
-
return 0;
2435
2433
}
2436
2434
2437
2435
/*
+1
mm/slab.h
+1
mm/slab.h
···
140
140
#define CACHE_CREATE_MASK (SLAB_CORE_FLAGS | SLAB_DEBUG_FLAGS | SLAB_CACHE_FLAGS)
141
141
142
142
int __kmem_cache_shutdown(struct kmem_cache *);
143
+
void __kmem_cache_release(struct kmem_cache *);
143
144
int __kmem_cache_shrink(struct kmem_cache *, bool);
144
145
void slab_kmem_cache_release(struct kmem_cache *);
145
146
+1
mm/slab_common.c
+1
mm/slab_common.c
+4
mm/slob.c
+4
mm/slob.c
+17
-21
mm/slub.c
+17
-21
mm/slub.c
···
1592
1592
__add_partial(n, page, tail);
1593
1593
}
1594
1594
1595
-
static inline void
1596
-
__remove_partial(struct kmem_cache_node *n, struct page *page)
1597
-
{
1598
-
list_del(&page->lru);
1599
-
n->nr_partial--;
1600
-
}
1601
-
1602
1595
static inline void remove_partial(struct kmem_cache_node *n,
1603
1596
struct page *page)
1604
1597
{
1605
1598
lockdep_assert_held(&n->list_lock);
1606
-
__remove_partial(n, page);
1599
+
list_del(&page->lru);
1600
+
n->nr_partial--;
1607
1601
}
1608
1602
1609
1603
/*
···
3178
3184
}
3179
3185
}
3180
3186
3187
+
void __kmem_cache_release(struct kmem_cache *s)
3188
+
{
3189
+
free_percpu(s->cpu_slab);
3190
+
free_kmem_cache_nodes(s);
3191
+
}
3192
+
3181
3193
static int init_kmem_cache_nodes(struct kmem_cache *s)
3182
3194
{
3183
3195
int node;
···
3443
3443
3444
3444
/*
3445
3445
* Attempt to free all partial slabs on a node.
3446
-
* This is called from kmem_cache_close(). We must be the last thread
3447
-
* using the cache and therefore we do not need to lock anymore.
3446
+
* This is called from __kmem_cache_shutdown(). We must take list_lock
3447
+
* because sysfs file might still access partial list after the shutdowning.
3448
3448
*/
3449
3449
static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
3450
3450
{
3451
3451
struct page *page, *h;
3452
3452
3453
+
BUG_ON(irqs_disabled());
3454
+
spin_lock_irq(&n->list_lock);
3453
3455
list_for_each_entry_safe(page, h, &n->partial, lru) {
3454
3456
if (!page->inuse) {
3455
-
__remove_partial(n, page);
3457
+
remove_partial(n, page);
3456
3458
discard_slab(s, page);
3457
3459
} else {
3458
3460
list_slab_objects(s, page,
3459
-
"Objects remaining in %s on kmem_cache_close()");
3461
+
"Objects remaining in %s on __kmem_cache_shutdown()");
3460
3462
}
3461
3463
}
3464
+
spin_unlock_irq(&n->list_lock);
3462
3465
}
3463
3466
3464
3467
/*
3465
3468
* Release all resources used by a slab cache.
3466
3469
*/
3467
-
static inline int kmem_cache_close(struct kmem_cache *s)
3470
+
int __kmem_cache_shutdown(struct kmem_cache *s)
3468
3471
{
3469
3472
int node;
3470
3473
struct kmem_cache_node *n;
···
3479
3476
if (n->nr_partial || slabs_node(s, node))
3480
3477
return 1;
3481
3478
}
3482
-
free_percpu(s->cpu_slab);
3483
-
free_kmem_cache_nodes(s);
3484
3479
return 0;
3485
-
}
3486
-
3487
-
int __kmem_cache_shutdown(struct kmem_cache *s)
3488
-
{
3489
-
return kmem_cache_close(s);
3490
3480
}
3491
3481
3492
3482
/********************************************************************
···
3976
3980
memcg_propagate_slab_attrs(s);
3977
3981
err = sysfs_slab_add(s);
3978
3982
if (err)
3979
-
kmem_cache_close(s);
3983
+
__kmem_cache_release(s);
3980
3984
3981
3985
return err;
3982
3986
}