23 Oct, 2012

22 commits

  • For that purpose we have to temporarily introduce a second tty back
    pointer into tty_port. It is because serial layer, and maybe others,
    still do not use tty_port_tty_set/get. So that we cannot set the
    tty_port->tty to NULL at will now.

    Yes, the fix would be to convert whole serial layer and all its users
    to tty_port_tty_set/get. However we are in the process of removing the
    need of tty in most of the call sites, so this would lead to a
    duplicated work.

    Instead we have now tty_port->itty (internal tty) which will be used
    only in flush_to_ldisc. For that one it is ensured that itty is valid
    wherever the work is run. IOW, the work is synchronously cancelled
    before we set itty to NULL and also before hangup is processed.

    After we need only tty_port and not tty_struct in most code, this
    shall be changed to tty_port_tty_set/get and itty removed completely.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • During the move of tty buffers from tty_struct to tty_port, we will
    need to switch all users of buf to tty->port->buf. There are many
    functions where this is accessed directly in their code many times.
    Cache the tty->buf pointer in such functions now and change only
    single lines in each function in the next patch.

    Not that it is convenient for the next patch, but the code is now also
    more readable.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • They are only TTY buffers specific. And the buffers will go to
    tty_port in the next patches. So to remove the need to have both
    tty_port and tty_struct at some places, let us move the flags to
    tty_port.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • In some funtions we need only n_tty_data, so pass it down directly in
    case tty is not needed there.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • atomic_write_lock is not n_tty specific, so move it up in the
    tty_struct.

    And since these are the last ones to move, remove also the comment
    saying there are some ldisc' members. There are none now.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • All the ring-buffers...

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • Here we move bitmaps and use DECLARE_BITMAP to declare them in the new
    structure. And instead of memset, we use bitmap_zero as it is more
    appropriate.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • Here we start moving all the n_tty related bits from tty_struct to
    the newly defined n_tty_data struct in n_tty proper.

    In this patch primitive members and bits are moved. The rest will be
    done per-partes in the next patches.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • All n_tty related members from tty_struct will be moved here.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • This is a private member of n_tty. Stop accessing it. Instead, take is
    as an argument.

    This is needed to allow clean switch of the private members to a
    separate private structure of n_tty.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • * BUG_ON(!tty) in n_tty_set_termios -- it cannot be called with tty ==
    NULL. It is called from two call sites. First, from n_tty_open where
    we have a valid tty. Second, as ld->ops->set_termios from
    tty_set_termios. But there we have a valid tty too.
    * if (!tty) in n_tty_open -- why would the TTY layer call ldisc's
    open with an invalid TTY? No it indeed does not. All call sites have
    a tty and dereference that.
    * BUG_ON(!tty->read_buf) in n_tty_read -- this used to be a valid
    check. The ldisc handling was broken some time ago when I added the
    check to ensure everything is OK. It still can catch the case, but
    no later than we move the buffer to ldisc data. Then there will be
    no read_buf in tty_struct, i.e. nothing to check for.
    * if (!tty->read_buf) in n_tty_receive_buf -- this should never
    happen. All callers of ldisc->ops->receive_ops should hold a
    reference to an ldisc and close (which frees read_buf) cannot be
    called until the reference is dropped.
    * if (WARN_ON(!tty->read_buf)) in n_tty_read -- the same as in the
    previous case.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • ldisc->open and close are called only once and cannot cross. So the
    tests in open and close are superfluous. Remove them. (But leave sets
    to NULL to ensure there is not a bug somewhere.)

    And when the tests are gone, handle properly failures in open. We
    leaked read_buf if allocation of echo_buf failed before. Now this is
    not the case anymore.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • hci_ldisc's open checks if tty_struct->disc_data is set. And if so it
    returns with an error. But nothing ensures disc_data to be NULL. And
    since ld->ops->open shall be called only once, we do not need the
    check at all. So remove it.

    Note that this is not an issue now, but n_tty will start using the
    disc_data pointer and this invalid 'if' would trigger then rendering
    TTYs over BT unusable.

    Signed-off-by: Jiri Slaby
    Acked-by: Marcel Holtmann
    Cc: Gustavo Padovan
    Cc: Johan Hedberg
    Cc: linux-bluetooth@vger.kernel.org
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • We reintroduced tty_ldisc_wait_idle in 100eeae2c5c (TTY: restore
    tty_ldisc_wait_idle) and used in set_ldisc. Then we added it also to
    the hangup path in 92f6fa09bd453 (TTY: ldisc, do not close until there
    are readers). And we noted that there is one more path:
    ~ Before 65b770468e98 tty_ldisc_wait_idle was called also from
    ~ tty_ldisc_release. It is called from tty_release, so I don't think
    ~ we need to restore that one.

    Well, I was wrong. There might still be holders of an ldisc
    reference. Not from userspace, but drivers. If they take a reference
    and a user closes the device immediately after that, we have a
    problem. ldisc is halted and closed by TTY, but the driver still may
    call some ldisc's operation and cause a crash.

    So restore the tty_ldisc_wait_idle call also to the third location
    where it was before 65b770468e98 (tty-ldisc: turn ldisc user count
    into a proper refcount). Now we should be safe with respect to the
    ldisc reference counting as all* tty_ldisc_close paths are safely
    called with reference count of one.

    * Not the one in tty_ldisc_setup's fail path. But that is called
    before the first open finishes. So userspace does not see it yet.
    Even thought the driver is given the TTY already via ->install, it
    should not take a reference to the ldisc yet. If some driver is to
    do this, we should put one tty_ldisc_wait_idle also in the setup.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • There used to be a single tty_ldisc_ref_wait. But then, when a
    big-tty-mutex (BTM) was introduced, it has to be tty_ldisc_ref +
    tty_unlock + tty_ldisc_ref_wait + tty_lock. Later, BTM was removed
    from that path and tty_ldisc_ref + tty_ldisc_ref_wait remained there.
    But it makes no sense now. So leave there only tty_ldisc_ref_wait.

    And when we have a reference to an ldisc, actually use it in the loop.
    Otherwise it may be racy.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • Now that we have control over tty->driver_data in pty, we can just
    kill the /dev/pts/ in pty code too. Namely, in ->shutdown hook of
    tty. For pty, this is called only once, for whichever end is closed
    last. But we don't care, both driver_data are the inode as it used to
    be till now.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • Add kernel-doc texts for some devpts functions, i.e. document them.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • The goal is to stop setting and using tty->driver_data in devpts code.
    It should be used solely by the driver's code, pty in this case.

    Now driver_data are managed only in the pty driver. devpts_pty_new is
    switched to accept what we used to dig out of tty_struct, i.e. device
    node number and index.

    This also removes a note about driver_data being set outside of the
    driver.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • The goal is to stop setting and using tty->driver_data in devpts code.
    It should be used solely by the driver's code, pty in this case.

    For the cleanup of layering, we will need the inode created in
    devpts_pty_new to be stored into slave's driver_data. So we convert
    devpts_pty_new to return the inode or an ERR_PTR-encoded error in case
    of failure.

    The move of 'inode = new_inode(sb);' from declarators to the code is
    only cosmetical, but it makes the code easier to read.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • The goal is to stop setting and using tty->driver_data in devpts code.
    It should be used solely by the driver's code, pty in this case.

    First, here we remove TTY from devpts_get_tty and rename it to
    devpts_get_priv. Note we do not remove type safety, we just shift the
    [implicit] (void *) cast one layer up.

    index was unused in devpts_get_tty, so remove that from the prototype
    too.

    Signed-off-by: Jiri Slaby
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • When low_latency flag is set the TTY receive flip buffer is copied to the
    line discipline directly instead of using a work queue in the background.
    Therefor only in case a workqueue is actually used for copying data to the
    line discipline we'll have to flush the workqueue.

    This prevents unnecessary spin lock/unlock on the workqueue spin lock that
    can cause additional scheduling overhead on a PREEMPT_RT system. On a 200
    MHz AT91SAM9261 processor setup this fixes about 100us of scheduling
    overhead on the TTY read call.

    Signed-off-by: Ivo Sieben
    Acked-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Ivo Sieben
     
  • Dave Airlie recently discovered a locking bug in the fbcon layer,
    where a timer_del_sync (for the blinking cursor) deadlocks with the
    timer itself, since both (want to) hold the console_lock:

    https://lkml.org/lkml/2012/8/21/36

    Unfortunately the console_lock isn't a plain mutex and hence has no
    lockdep support. Which resulted in a few days wasted of tracking down
    this bug (complicated by the fact that printk doesn't show anything
    when the console is locked) instead of noticing the bug much earlier
    with the lockdep splat.

    Hence I've figured I need to fix that for the next deadlock involving
    console_lock - and with kms/drm growing ever more complex locking
    that'll eventually happen.

    Now the console_lock has rather funky semantics, so after a quick irc
    discussion with Thomas Gleixner and Dave Airlie I've quickly ditched
    the original idead of switching to a real mutex (since it won't work)
    and instead opted to annotate the console_lock with lockdep
    information manually.

    There are a few special cases:
    - The console_lock state is protected by the console_sem, and usually
    grabbed/dropped at _lock/_unlock time. But the suspend/resume code
    drops the semaphore without dropping the console_lock (see
    suspend_console/resume_console). But since the same thread that did
    the suspend will do the resume, we don't need to fix up anything.

    - In the printk code there's a special trylock, only used to kick off
    the logbuffer printk'ing in console_unlock. But all that happens
    while lockdep is disable (since printk does a few other evil
    tricks). So no issue there, either.

    - The console_lock can also be acquired form irq context (but only
    with a trylock). lockdep already handles that.

    This all leaves us with annotating the normal console_lock, _unlock
    and _trylock functions.

    And yes, it works - simply unloading a drm kms driver resulted in
    lockdep complaining about the deadlock in fbcon_deinit:

    ======================================================
    [ INFO: possible circular locking dependency detected ]
    3.6.0-rc2+ #552 Not tainted
    -------------------------------------------------------
    kms-reload/3577 is trying to acquire lock:
    ((&info->queue)){+.+...}, at: [] wait_on_work+0x0/0xa7

    but task is already holding lock:
    (console_lock){+.+.+.}, at: [] bind_con_driver+0x38/0x263

    which lock already depends on the new lock.

    the existing dependency chain (in reverse order) is:

    -> #1 (console_lock){+.+.+.}:
    [] lock_acquire+0x95/0x105
    [] console_lock+0x59/0x5b
    [] fb_flashcursor+0x2e/0x12c
    [] process_one_work+0x1d9/0x3b4
    [] worker_thread+0x1a7/0x24b
    [] kthread+0x7f/0x87
    [] kernel_thread_helper+0x4/0x10

    -> #0 ((&info->queue)){+.+...}:
    [] __lock_acquire+0x999/0xcf6
    [] lock_acquire+0x95/0x105
    [] wait_on_work+0x3b/0xa7
    [] __cancel_work_timer+0xbf/0x102
    [] cancel_work_sync+0xb/0xd
    [] fbcon_deinit+0x11c/0x1dc
    [] bind_con_driver+0x145/0x263
    [] unbind_con_driver+0x14f/0x195
    [] store_bind+0x1ad/0x1c1
    [] dev_attr_store+0x13/0x1f
    [] sysfs_write_file+0xe9/0x121
    [] vfs_write+0x9b/0xfd
    [] sys_write+0x3e/0x6b
    [] system_call_fastpath+0x16/0x1b

    other info that might help us debug this:

    Possible unsafe locking scenario:

    CPU0 CPU1
    ---- ----
    lock(console_lock);
    lock((&info->queue));
    lock(console_lock);
    lock((&info->queue));

    *** DEADLOCK ***

    v2: Mark the lockdep_map static, noticed by Jani Nikula.

    Cc: Dave Airlie
    Cc: Thomas Gleixner
    Cc: Alan Cox
    Cc: Peter Zijlstra
    Signed-off-by: Daniel Vetter
    Signed-off-by: Greg Kroah-Hartman

    Daniel Vetter
     

21 Oct, 2012

2 commits

  • Linus Torvalds
     
  • Pull arm64 fixes from Catalin Marinas:
    "Main changes:
    - AArch64 Linux compilation fixes following 3.7-rc1 changes
    (MODULES_USE_ELF_RELA, update_vsyscall() prototype)
    - Unnecessary register setting in start_thread() (thanks to Al Viro)
    - ptrace fixes"

    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64:
    arm64: fix alignment padding in assembly code
    arm64: ptrace: use HW_BREAKPOINT_EMPTY type for disabled breakpoints
    arm64: ptrace: make structure padding explicit for debug registers
    arm64: No need to set the x0-x2 registers in start_thread()
    arm64: Ignore memory blocks below PHYS_OFFSET
    arm64: Fix the update_vsyscall() prototype
    arm64: Select MODULES_USE_ELF_RELA
    arm64: Remove duplicate inclusion of mmu_context.h in smp.c

    Linus Torvalds
     

20 Oct, 2012

16 commits

  • An interesting effect of using the generic version of linkage.h
    is that the padding is defined in terms of x86 NOPs, which can have
    even more interesting effects when the assembly code looks like this:

    ENTRY(func1)
    mov x0, xzr
    ENDPROC(func1)
    // fall through
    ENTRY(func2)
    mov x0, #1
    ret
    ENDPROC(func2)

    Admittedly, the code is not very nice. But having code from another
    architecture doesn't look completely sane either.

    The fix is to add arm64's version of linkage.h, which causes the insertion
    of proper AArch64 NOPs.

    Signed-off-by: Marc Zyngier
    Signed-off-by: Catalin Marinas

    Marc Zyngier
     
  • The min/max call needed to have explicit types on some architectures
    (e.g. mn10300). Use clamp_t instead to avoid the warning:

    kernel/sys.c: In function 'override_release':
    kernel/sys.c:1287:10: warning: comparison of distinct pointer types lacks a cast [enabled by default]

    Reported-by: Fengguang Wu
    Signed-off-by: Kees Cook
    Signed-off-by: Linus Torvalds

    Kees Cook
     
  • Pull perf fixes from Ingo Molnar:
    "Assorted small fixes"

    * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    perf python: Properly link with libtraceevent
    perf hists browser: Add back callchain folding symbol
    perf tools: Fix build on sparc.
    perf python: Link with libtraceevent
    perf python: Initialize 'page_size' variable
    tools lib traceevent: Fix missed freeing of subargs in free_arg() in filter
    lib tools traceevent: Add back pevent assignment in __pevent_parse_format()
    perf hists browser: Fix off-by-two bug on the first column
    perf tools: Remove warnings on JIT samples for srcline sort key
    perf tools: Fix segfault when using srcline sort key
    perf: Require exclude_guest to use PEBS - kernel side enforcement
    perf tool: Precise mode requires exclude_guest

    Linus Torvalds
     
  • Namhyung Kim reported that the build fails with:

    GEN python/perf.so
    gcc: error: python_ext_build/tmp//../../libtraceevent.a: No such file or directory
    error: command 'gcc' failed with exit status 1
    cp: cannot stat `python_ext_build/lib/perf.so': No such file or directory
    make: *** [python/perf.so] Error 1

    We need to propagate the TE_PATH variable to the setup.py file.

    Reported-by: Namhyung Kim
    Signed-off-by: Arnaldo Carvalho de Melo
    Link: http://lkml.kernel.org/n/tip-8umiPbm4sxpknKivbjgykhut@git.kernel.org
    [ Fixed superfluous variable build error. ]
    Signed-off-by: Ingo Molnar

    Arnaldo Carvalho de Melo
     
  • …it/acme/linux into perf/urgent

    Pull perf/urgent fixes from Arnaldo Carvalho de Melo:

    * The python binding needs to link with libtraceevent and to initialize
    the 'page_size' variable so that mmaping works again.

    * The callchain folding character that appears on the TUI just before
    the overhead had disappeared due to recent changes, add it back.

    * Intel PEBS in VT-x context uses the DS address as a guest linear address,
    even though its programmed by the host as a host linear address. This either
    results in guest memory corruption and or the hardware faulting and 'crashing'
    the virtual machine. Therefore we have to disable PEBS on VT-x enter and
    re-enable on VT-x exit, enforcing a strict exclude_guest.

    Kernel side enforcement fix by Peter Zijlstra, tooling side fix by David Ahern.

    * Fix build on sparc due to UAPI, fix from David Miller.

    * Fixes for the srclike sort key for unresolved symbols and when processing
    samples in JITted code, where we don't have an ELF file, just an special
    symbol table, fixes from Namhyung Kim.

    * Fix some leaks in libtraceevent, from Steven Rostedt.

    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>

    Ingo Molnar
     
  • Pull ARM soc fixes from Olof Johansson:
    "A set of fixes and some minor cleanups for -rc2:

    - A series from Arnd that fixes warnings in drivers and other code
    included by ARM defconfigs. Most have been acked by corresponding
    maintainers (and seem quite hard to argue not picking up anyway in
    the few exception cases).
    - A few misc patches from the list for integrator/vt8500/i.MX
    - A batch of fixes to OMAP platforms, fixing:
    - boot problems on beaglebone,
    - regression fixes for local timers
    - clockdomain locking fixes
    - a few boot/sparse warnings
    - For Tegra:
    - Clock rate calculation overflow fix
    - Revert a change that removed timer clocks and a fix for symbol
    name clashes
    - For Renesas:
    - IO accessor / annotation cleanups to remove warnings
    - For Kirkwood/Dove/mvebu:
    - Fixes for device trees for Dove (some minor cleanups, some fixes)
    - Fixes for the mvebu gpio driver
    - Fix build problem for Feroceon due to missing ifdefs
    - Fix lsxl DTS files"

    * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (31 commits)
    ARM: kirkwood: fix buttons on lsxl boards
    ARM: kirkwood: fix LEDs names for lsxl boards
    ARM: Kirkwood: fix disabling CACHE_FEROCEON_L2
    gpio: mvebu: Add missing breaks in mvebu_gpio_irq_set_type
    ARM: dove: Add crypto engine to DT
    ARM: dove: Remove watchdog from DT
    ARM: dove: Restructure SoC device tree descriptor
    ARM: dove: Fix clock names of sata and gbe
    ARM: dove: Fix tauros2 device tree init
    ARM: dove: Add pcie clock support
    ARM: OMAP2+: Allow kernel to boot even if GPMC fails to reserve memory
    ARM: OMAP: clockdomain: Fix locking on _clkdm_clk_hwmod_enable / disable
    ARM: s3c: mark s3c2440_clk_add as __init_refok
    spi/s3c64xx: use correct dma_transfer_direction type
    ARM: OMAP4: devices: fixup OMAP4 DMIC platform device error message
    ARM: OMAP2+: clock data: Add dev-id for the omap-gpmc dummy fck
    ARM: OMAP: resolve sparse warning concerning debug_card_init()
    ARM: OMAP4: Fix twd_local_timer_register regression
    ARM: tegra: add tegra_timer clock
    ARM: tegra: rename tegra system timer
    ...

    Linus Torvalds
     
  • Emit the magic string that indicates a module has a signature after the
    signature data instead of before it. This allows module_sig_check() to
    be made simpler and faster by the elimination of the search for the
    magic string. Instead we just need to do a single memcmp().

    This works because at the end of the signature data there is the
    fixed-length signature information block. This block then falls
    immediately prior to the magic number.

    From the contents of the information block, it is trivial to calculate
    the size of the signature data and thus the size of the actual module
    data.

    Signed-off-by: David Howells
    Signed-off-by: Linus Torvalds

    David Howells
     
  • From Jason Cooper:
    - improve #ifdef logic to prevent linker errors with CACHE_FEROCEON_L2
    - lsxl board dts fixes

    * tag 'kirkwood_fixes_for_v3.7' of git://git.infradead.org/users/jcooper/linux:
    ARM: kirkwood: fix buttons on lsxl boards
    ARM: kirkwood: fix LEDs names for lsxl boards
    ARM: Kirkwood: fix disabling CACHE_FEROCEON_L2

    Olof Johansson
     
  • The module build process no longer creates intermediate files for module
    signing, so remove them from .gitignore.

    Signed-off-by: David Howells
    Signed-off-by: Linus Torvalds

    David Howells
     
  • Turn sign-file into perl and merge in x509keyid. The latter doesn't
    need to be a separate script as it doesn't actually need to work out the
    SHA1 sum of the X.509 certificate itself, since it can get that from the
    X.509 certificate.

    Signed-off-by: David Howells
    Signed-off-by: Linus Torvalds

    David Howells
     
  • …nel/git/arm/arm-soc into fixes

    A collection of warning fixes on non-ARM code from Arnd Bergmann:

    * 'testing/driver-warnings' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    ARM: s3c: mark s3c2440_clk_add as __init_refok
    spi/s3c64xx: use correct dma_transfer_direction type
    pcmcia: sharpsl: don't discard sharpsl_pcmcia_ops
    USB: EHCI: mark ehci_orion_conf_mbus_windows __devinit
    mm/slob: use min_t() to compare ARCH_SLAB_MINALIGN
    SCSI: ARM: make fas216_dumpinfo function conditional
    SCSI: ARM: ncr5380/oak uses no interrupts

    Olof Johansson
     
  • /proc//numa_maps scans vma and show mempolicy under
    mmap_sem. It sometimes accesses task->mempolicy which can
    be freed without mmap_sem and numa_maps can show some
    garbage while scanning.

    This patch tries to take reference count of task->mempolicy at reading
    numa_maps before calling get_vma_policy(). By this, task->mempolicy
    will not be freed until numa_maps reaches its end.

    V2->v3
    - updated comments to be more verbose.
    - removed task_lock() in numa_maps code.
    V1->V2
    - access task->mempolicy only once and remember it. Becase kernel/exit.c
    can overwrite it.

    Signed-off-by: KAMEZAWA Hiroyuki
    Acked-by: David Rientjes
    Acked-by: KOSAKI Motohiro
    Signed-off-by: Linus Torvalds

    KAMEZAWA Hiroyuki
     
  • Pull miscellaneous x86 fixes from Peter Anvin:
    "The biggest ones are fixing suspend/resume breakage on 32 bits, and an
    interrim fix for mapping over holes that allows AMD kit with more than
    1 TB.

    A final solution for the latter is in the works, but involves some
    fairly invasive changes that will probably mean it will only be
    appropriate for 3.8."

    * 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86, MCE: Remove bios_cmci_threshold sysfs attribute
    x86, amd, mce: Avoid NULL pointer reference on CPU northbridge lookup
    x86: Exclude E820_RESERVED regions and memory holes above 4 GB from direct mapping.
    x86/cache_info: Use ARRAY_SIZE() in amd_l3_attrs()
    x86/reboot: Remove quirk entry for SBC FITPC
    x86, suspend: Correct the restore of CR4, EFER; skip computing EFLAGS.ID

    Linus Torvalds
     
  • Merge misc fixes from Andrew Morton:
    "Seven fixes"

    * emailed patches from Andrew Morton : (7 patches)
    lib/dma-debug.c: fix __hash_bucket_find()
    mm: compaction: correct the nr_strict va isolated check for CMA
    firmware/memmap: avoid type conflicts with the generic memmap_init()
    pidns: remove recursion from free_pid_ns()
    drivers/video/backlight/lm3639_bl.c: return proper error in lm3639_bled_mode_store() error paths
    kernel/sys.c: fix stack memory content leak via UNAME26
    linux/coredump.h needs asm/siginfo.h

    Linus Torvalds
     
  • If there is only one match, the unique matched entry should be returned.

    Without the fix, the upcoming dma debug interfaces ("dma-debug: new
    interfaces to debug dma mapping errors") can't work reliably because
    only device and dma_addr are passed to dma_mapping_error().

    Signed-off-by: Ming Lei
    Reported-by: Wu Fengguang
    Cc: Joerg Roedel
    Tested-by: Shuah Khan
    Cc: Paul Gortmaker
    Cc: Jakub Kicinski
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ming Lei
     
  • Thierry reported that the "iron out" patch for isolate_freepages_block()
    had problems due to the strict check being too strict with "mm:
    compaction: Iron out isolate_freepages_block() and
    isolate_freepages_range() -fix1". It's possible that more pages than
    necessary are isolated but the check still fails and I missed that this
    fix was not picked up before RC1. This same problem has been identified
    in 3.7-RC1 by Tony Prisk and should be addressed by the following patch.

    Signed-off-by: Mel Gorman
    Tested-by: Tony Prisk
    Reported-by: Thierry Reding
    Acked-by: Rik van Riel
    Acked-by: Minchan Kim
    Cc: Richard Davies
    Cc: Shaohua Li
    Cc: Avi Kivity
    Cc: Arnd Bergmann
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mel Gorman