Merge branch 'akpm' (fixes from Andrew)

Merge patches from Andrew Morton: "13 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: mm: place page->pmd_huge_pte to right union MAINTAINERS: add keyboard driver to Hyper-V file list x86, mm: do not leak page->ptl for pmd page tables ipc,shm: correct error return value in shmctl (SHM_UNLOCK) mm, mempolicy: silence gcc warning block/partitions/efi.c: fix bound check ARM: drivers/rtc/rtc-at91rm9200.c: disable interrupts at shutdown mm: hugetlbfs: fix hugetlbfs optimization kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS cleanly ipc,shm: fix shm_file deletion races mm: thp: give transparent hugepage code a separate copy_page checkpatch: fix "Use of uninitialized value" warnings configfs: fix race between dentry put and lookup

Merge branch 'akpm' (fixes from Andrew)
Merge patches from Andrew Morton: "13 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: mm: place page->pmd_huge_pte to right union MAINTAINERS: add keyboard driver to Hyper-V file list x86, mm: do not leak page->ptl for pmd page tables ipc,shm: correct error return value in shmctl (SHM_UNLOCK) mm, mempolicy: silence gcc warning block/partitions/efi.c: fix bound check ARM: drivers/rtc/rtc-at91rm9200.c: disable interrupts at shutdown mm: hugetlbfs: fix hugetlbfs optimization kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS cleanly ipc,shm: fix shm_file deletion races mm: thp: give transparent hugepage code a separate copy_page checkpatch: fix "Use of uninitialized value" warnings configfs: fix race between dentry put and lookup
Linus Torvalds
2 parents 78dc53c422 7aa555bf26
Showing 16 changed files Side-by-side Diff
Documentation/vm/split_page_table_lock
MAINTAINERS
arch/x86/mm/pgtable.c
block/partitions/efi.c
drivers/block/null_blk.c
drivers/rtc/rtc-at91rm9200.c
fs/configfs/dir.c
include/linux/hugetlb.h
include/linux/mm_types.h
ipc/shm.c
mm/hugetlb.c
mm/mempolicy.c
mm/migrate.c
mm/swap.c
net/Kconfig
scripts/checkpatch.pl
@@ -63,9 +63,9 @@
 PMD split lock enabling requires pgtable_pmd_page_ctor() call on PMD table
 allocation and pgtable_pmd_page_dtor() on freeing.
  
-Allocation usually happens in pmd_alloc_one(), freeing in pmd_free(), but
-make sure you cover all PMD table allocation / freeing paths: i.e X86_PAE
-preallocate few PMDs on pgd_alloc().
+Allocation usually happens in pmd_alloc_one(), freeing in pmd_free() and
+pmd_free_tlb(), but make sure you cover all PMD table allocation / freeing
+paths: i.e X86_PAE preallocate few PMDs on pgd_alloc().
  
 With everything in place you can set CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK.
  
@@ -4065,6 +4065,7 @@
 F:	arch/x86/kernel/cpu/mshyperv.c
 F:	drivers/hid/hid-hyperv.c
 F:	drivers/hv/
+F:	drivers/input/serio/hyperv-keyboard.c
 F:	drivers/net/hyperv/
 F:	drivers/scsi/storvsc_drv.c
 F:	drivers/video/hyperv_fb.c
@@ -61,6 +61,7 @@
 #if PAGETABLE_LEVELS > 2
 void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
 {
+	struct page *page = virt_to_page(pmd);
 	paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
 	/*
 	 * NOTE! For PAE, any changes to the top page-directory-pointer-table
@@ -69,7 +70,8 @@
 #ifdef CONFIG_X86_PAE
 	tlb->need_flush_all = 1;
 #endif
-	tlb_remove_page(tlb, virt_to_page(pmd));
+	pgtable_pmd_page_dtor(page);
+	tlb_remove_page(tlb, page);
 }
  
 #if PAGETABLE_LEVELS > 3
@@ -96,6 +96,7 @@
  * - Code works, detects all the partitions.
  *
  ************************************************************/
+#include <linux/kernel.h>
 #include <linux/crc32.h>
 #include <linux/ctype.h>
 #include <linux/math64.h>
@@ -715,8 +716,8 @@
 		efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);
  
 		/* Naively convert UTF16-LE to 7 bits. */
-		label_max = min(sizeof(info->volname) - 1,
-				sizeof(ptes[i].partition_name));
+		label_max = min(ARRAY_SIZE(info->volname) - 1,
+				ARRAY_SIZE(ptes[i].partition_name));
 		info->volname[label_max] = 0;
 		while (label_count < label_max) {
 			u8 c = ptes[i].partition_name[label_count] & 0xff;
@@ -223,7 +223,7 @@
 	blk_end_request_all(rq, 0);
 }
  
-#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
+#ifdef CONFIG_SMP
  
 static void null_ipi_cmd_end_io(void *data)
 {
@@ -260,7 +260,7 @@
 	put_cpu();
 }
  
-#endif /* CONFIG_SMP && CONFIG_USE_GENERIC_SMP_HELPERS */
+#endif /* CONFIG_SMP */
  
 static inline void null_handle_cmd(struct nullb_cmd *cmd)
 {
@@ -270,7 +270,7 @@
 		end_cmd(cmd);
 		break;
 	case NULL_IRQ_SOFTIRQ:
-#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
+#ifdef CONFIG_SMP
 		null_cmd_end_ipi(cmd);
 #else
 		end_cmd(cmd);
@@ -571,7 +571,7 @@
 {
 	unsigned int i;
  
-#if !defined(CONFIG_SMP) || !defined(CONFIG_USE_GENERIC_SMP_HELPERS)
+#if !defined(CONFIG_SMP)
 	if (irqmode == NULL_IRQ_SOFTIRQ) {
 		pr_warn("null_blk: softirq completions not available.\n");
 		pr_warn("null_blk: using direct completions.\n");
@@ -428,6 +428,14 @@
 	return 0;
 }
  
+static void at91_rtc_shutdown(struct platform_device *pdev)
+{
+	/* Disable all interrupts */
+	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
+					AT91_RTC_SECEV | AT91_RTC_TIMEV |
+					AT91_RTC_CALEV);
+}
+
 #ifdef CONFIG_PM_SLEEP
  
 /* AT91RM9200 RTC Power management control */
@@ -466,6 +474,7 @@
  
 static struct platform_driver at91_rtc_driver = {
 	.remove		= __exit_p(at91_rtc_remove),
+	.shutdown	= at91_rtc_shutdown,
 	.driver		= {
 		.name	= "at91_rtc",
 		.owner	= THIS_MODULE,
@@ -56,10 +56,19 @@
 	struct configfs_dirent *sd = dentry->d_fsdata;
  
 	if (sd) {
-		BUG_ON(sd->s_dentry != dentry);
 		/* Coordinate with configfs_readdir */
 		spin_lock(&configfs_dirent_lock);
-		sd->s_dentry = NULL;
+		/* Coordinate with configfs_attach_attr where will increase
+		 * sd->s_count and update sd->s_dentry to new allocated one.
+		 * Only set sd->dentry to null when this dentry is the only
+		 * sd owner.
+		 * If not do so, configfs_d_iput may run just after
+		 * configfs_attach_attr and set sd->s_dentry to null
+		 * even it's still in use.
+		 */
+		if (atomic_read(&sd->s_count) <= 2)
+			sd->s_dentry = NULL;
+
 		spin_unlock(&configfs_dirent_lock);
 		configfs_put(sd);
 	}
  
@@ -416,8 +425,11 @@
 	struct configfs_attribute * attr = sd->s_element;
 	int error;
  
+	spin_lock(&configfs_dirent_lock);
 	dentry->d_fsdata = configfs_get(sd);
 	sd->s_dentry = dentry;
+	spin_unlock(&configfs_dirent_lock);
+
 	error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG,
 				configfs_init_file);
 	if (error) {
@@ -31,6 +31,7 @@
 void hugepage_put_subpool(struct hugepage_subpool *spool);
  
 int PageHuge(struct page *page);
+int PageHeadHuge(struct page *page_head);
  
 void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
 int hugetlb_sysctl_handler(struct ctl_table *, int, void __user *, size_t *, loff_t *);
@@ -69,7 +70,6 @@
 bool isolate_huge_page(struct page *page, struct list_head *list);
 void putback_active_hugepage(struct page *page);
 bool is_hugepage_active(struct page *page);
-void copy_huge_page(struct page *dst, struct page *src);
  
 #ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
 pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
@@ -104,6 +104,11 @@
 	return 0;
 }
  
+static inline int PageHeadHuge(struct page *page_head)
+{
+	return 0;
+}
+
 static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
 {
 }
@@ -140,9 +145,6 @@
 #define isolate_huge_page(p, l) false
 #define putback_active_hugepage(p)	do {} while (0)
 #define is_hugepage_active(x)	false
-static inline void copy_huge_page(struct page *dst, struct page *src)
-{
-}
  
 static inline unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
 		unsigned long address, unsigned long end, pgprot_t newprot)
@@ -65,9 +65,6 @@
 						 * this page is only used to
 						 * free other pages.
 						 */
-#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
-		pgtable_t pmd_huge_pte; /* protected by page->ptl */
-#endif
 		};
  
 		union {
@@ -135,6 +132,9 @@
  
 		struct list_head list;	/* slobs list of pages */
 		struct slab *slab_page; /* slab fields */
+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
+		pgtable_t pmd_huge_pte; /* protected by page->ptl */
+#endif
 	};
  
 	/* Remainder is not double word aligned */
@@ -208,15 +208,18 @@
  */
 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
 {
+	struct file *shm_file;
+
+	shm_file = shp->shm_file;
+	shp->shm_file = NULL;
 	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
 	shm_rmid(ns, shp);
 	shm_unlock(shp);
-	if (!is_file_hugepages(shp->shm_file))
-		shmem_lock(shp->shm_file, 0, shp->mlock_user);
+	if (!is_file_hugepages(shm_file))
+		shmem_lock(shm_file, 0, shp->mlock_user);
 	else if (shp->mlock_user)
-		user_shm_unlock(file_inode(shp->shm_file)->i_size,
-						shp->mlock_user);
-	fput (shp->shm_file);
+		user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
+	fput(shm_file);
 	ipc_rcu_putref(shp, shm_rcu_free);
 }
  
  
  
  
  
@@ -974,15 +977,25 @@
 		ipc_lock_object(&shp->shm_perm);
 		if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
 			kuid_t euid = current_euid();
-			err = -EPERM;
 			if (!uid_eq(euid, shp->shm_perm.uid) &&
-			    !uid_eq(euid, shp->shm_perm.cuid))
+			    !uid_eq(euid, shp->shm_perm.cuid)) {
+				err = -EPERM;
 				goto out_unlock0;
-			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
+			}
+			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
+				err = -EPERM;
 				goto out_unlock0;
+			}
 		}
  
 		shm_file = shp->shm_file;
+
+		/* check if shm_destroy() is tearing down shp */
+		if (shm_file == NULL) {
+			err = -EIDRM;
+			goto out_unlock0;
+		}
+
 		if (is_file_hugepages(shm_file))
 			goto out_unlock0;
  
@@ -1101,6 +1114,14 @@
 		goto out_unlock;
  
 	ipc_lock_object(&shp->shm_perm);
+
+	/* check if shm_destroy() is tearing down shp */
+	if (shp->shm_file == NULL) {
+		ipc_unlock_object(&shp->shm_perm);
+		err = -EIDRM;
+		goto out_unlock;
+	}
+
 	path = shp->shm_file->f_path;
 	path_get(&path);
 	shp->shm_nattch++;
@@ -476,40 +476,6 @@
 	return 0;
 }
  
-static void copy_gigantic_page(struct page *dst, struct page *src)
-{
-	int i;
-	struct hstate *h = page_hstate(src);
-	struct page *dst_base = dst;
-	struct page *src_base = src;
-
-	for (i = 0; i < pages_per_huge_page(h); ) {
-		cond_resched();
-		copy_highpage(dst, src);
-
-		i++;
-		dst = mem_map_next(dst, dst_base, i);
-		src = mem_map_next(src, src_base, i);
-	}
-}
-
-void copy_huge_page(struct page *dst, struct page *src)
-{
-	int i;
-	struct hstate *h = page_hstate(src);
-
-	if (unlikely(pages_per_huge_page(h) > MAX_ORDER_NR_PAGES)) {
-		copy_gigantic_page(dst, src);
-		return;
-	}
-
-	might_sleep();
-	for (i = 0; i < pages_per_huge_page(h); i++) {
-		cond_resched();
-		copy_highpage(dst + i, src + i);
-	}
-}
-
 static void enqueue_huge_page(struct hstate *h, struct page *page)
 {
 	int nid = page_to_nid(page);
@@ -735,6 +701,23 @@
 	return dtor == free_huge_page;
 }
 EXPORT_SYMBOL_GPL(PageHuge);
+
+/*
+ * PageHeadHuge() only returns true for hugetlbfs head page, but not for
+ * normal or transparent huge pages.
+ */
+int PageHeadHuge(struct page *page_head)
+{
+	compound_page_dtor *dtor;
+
+	if (!PageHead(page_head))
+		return 0;
+
+	dtor = get_compound_page_dtor(page_head);
+
+	return dtor == free_huge_page;
+}
+EXPORT_SYMBOL_GPL(PageHeadHuge);
  
 pgoff_t __basepage_index(struct page *page)
 {
@@ -2950,7 +2950,7 @@
 		return;
 	}
  
-	p += snprintf(p, maxlen, policy_modes[mode]);
+	p += snprintf(p, maxlen, "%s", policy_modes[mode]);
  
 	if (flags & MPOL_MODE_FLAGS) {
 		p += snprintf(p, buffer + maxlen - p, "=");
@@ -442,6 +442,54 @@
 }
  
 /*
+ * Gigantic pages are so large that we do not guarantee that page++ pointer
+ * arithmetic will work across the entire page.  We need something more
+ * specialized.
+ */
+static void __copy_gigantic_page(struct page *dst, struct page *src,
+				int nr_pages)
+{
+	int i;
+	struct page *dst_base = dst;
+	struct page *src_base = src;
+
+	for (i = 0; i < nr_pages; ) {
+		cond_resched();
+		copy_highpage(dst, src);
+
+		i++;
+		dst = mem_map_next(dst, dst_base, i);
+		src = mem_map_next(src, src_base, i);
+	}
+}
+
+static void copy_huge_page(struct page *dst, struct page *src)
+{
+	int i;
+	int nr_pages;
+
+	if (PageHuge(src)) {
+		/* hugetlbfs page */
+		struct hstate *h = page_hstate(src);
+		nr_pages = pages_per_huge_page(h);
+
+		if (unlikely(nr_pages > MAX_ORDER_NR_PAGES)) {
+			__copy_gigantic_page(dst, src, nr_pages);
+			return;
+		}
+	} else {
+		/* thp page */
+		BUG_ON(!PageTransHuge(src));
+		nr_pages = hpage_nr_pages(src);
+	}
+
+	for (i = 0; i < nr_pages; i++) {
+		cond_resched();
+		copy_highpage(dst + i, src + i);
+	}
+}
+
+/*
  * Copy the page to its new location
  */
 void migrate_page_copy(struct page *newpage, struct page *page)
@@ -82,19 +82,6 @@
  
 static void put_compound_page(struct page *page)
 {
-	/*
-	 * hugetlbfs pages cannot be split from under us.  If this is a
-	 * hugetlbfs page, check refcount on head page and release the page if
-	 * the refcount becomes zero.
-	 */
-	if (PageHuge(page)) {
-		page = compound_head(page);
-		if (put_page_testzero(page))
-			__put_compound_page(page);
-
-		return;
-	}
-
 	if (unlikely(PageTail(page))) {
 		/* __split_huge_page_refcount can run under us */
 		struct page *page_head = compound_trans_head(page);
  
  
@@ -111,14 +98,31 @@
 			 * still hot on arches that do not support
 			 * this_cpu_cmpxchg_double().
 			 */
-			if (PageSlab(page_head)) {
-				if (PageTail(page)) {
+			if (PageSlab(page_head) || PageHeadHuge(page_head)) {
+				if (likely(PageTail(page))) {
+					/*
+					 * __split_huge_page_refcount
+					 * cannot race here.
+					 */
+					VM_BUG_ON(!PageHead(page_head));
+					atomic_dec(&page->_mapcount);
 					if (put_page_testzero(page_head))
 						VM_BUG_ON(1);
-
-					atomic_dec(&page->_mapcount);
-					goto skip_lock_tail;
+					if (put_page_testzero(page_head))
+						__put_compound_page(page_head);
+					return;
 				} else
+					/*
+					 * __split_huge_page_refcount
+					 * run before us, "page" was a
+					 * THP tail. The split
+					 * page_head has been freed
+					 * and reallocated as slab or
+					 * hugetlbfs page of smaller
+					 * order (only possible if
+					 * reallocated as slab on
+					 * x86).
+					 */
 					goto skip_lock;
 			}
 			/*
@@ -132,8 +136,27 @@
 				/* __split_huge_page_refcount run before us */
 				compound_unlock_irqrestore(page_head, flags);
 skip_lock:
-				if (put_page_testzero(page_head))
-					__put_single_page(page_head);
+				if (put_page_testzero(page_head)) {
+					/*
+					 * The head page may have been
+					 * freed and reallocated as a
+					 * compound page of smaller
+					 * order and then freed again.
+					 * All we know is that it
+					 * cannot have become: a THP
+					 * page, a compound page of
+					 * higher order, a tail page.
+					 * That is because we still
+					 * hold the refcount of the
+					 * split THP tail and
+					 * page_head was the THP head
+					 * before the split.
+					 */
+					if (PageHead(page_head))
+						__put_compound_page(page_head);
+					else
+						__put_single_page(page_head);
+				}
 out_put_single:
 				if (put_page_testzero(page))
 					__put_single_page(page);
@@ -155,7 +178,6 @@
 			VM_BUG_ON(atomic_read(&page->_count) != 0);
 			compound_unlock_irqrestore(page_head, flags);
  
-skip_lock_tail:
 			if (put_page_testzero(page_head)) {
 				if (PageHead(page_head))
 					__put_compound_page(page_head);
  
  
  
  
  
  
@@ -198,51 +220,52 @@
 	 * proper PT lock that already serializes against
 	 * split_huge_page().
 	 */
+	unsigned long flags;
 	bool got = false;
-	struct page *page_head;
+	struct page *page_head = compound_trans_head(page);
  
-	/*
-	 * If this is a hugetlbfs page it cannot be split under us.  Simply
-	 * increment refcount for the head page.
-	 */
-	if (PageHuge(page)) {
-		page_head = compound_head(page);
-		atomic_inc(&page_head->_count);
-		got = true;
-	} else {
-		unsigned long flags;
-
-		page_head = compound_trans_head(page);
-		if (likely(page != page_head &&
-					get_page_unless_zero(page_head))) {
-
-			/* Ref to put_compound_page() comment. */
-			if (PageSlab(page_head)) {
-				if (likely(PageTail(page))) {
-					__get_page_tail_foll(page, false);
-					return true;
-				} else {
-					put_page(page_head);
-					return false;
-				}
-			}
-
-			/*
-			 * page_head wasn't a dangling pointer but it
-			 * may not be a head page anymore by the time
-			 * we obtain the lock. That is ok as long as it
-			 * can't be freed from under us.
-			 */
-			flags = compound_lock_irqsave(page_head);
-			/* here __split_huge_page_refcount won't run anymore */
+	if (likely(page != page_head && get_page_unless_zero(page_head))) {
+		/* Ref to put_compound_page() comment. */
+		if (PageSlab(page_head) || PageHeadHuge(page_head)) {
 			if (likely(PageTail(page))) {
+				/*
+				 * This is a hugetlbfs page or a slab
+				 * page. __split_huge_page_refcount
+				 * cannot race here.
+				 */
+				VM_BUG_ON(!PageHead(page_head));
 				__get_page_tail_foll(page, false);
-				got = true;
-			}
-			compound_unlock_irqrestore(page_head, flags);
-			if (unlikely(!got))
+				return true;
+			} else {
+				/*
+				 * __split_huge_page_refcount run
+				 * before us, "page" was a THP
+				 * tail. The split page_head has been
+				 * freed and reallocated as slab or
+				 * hugetlbfs page of smaller order
+				 * (only possible if reallocated as
+				 * slab on x86).
+				 */
 				put_page(page_head);
+				return false;
+			}
 		}
+
+		/*
+		 * page_head wasn't a dangling pointer but it
+		 * may not be a head page anymore by the time
+		 * we obtain the lock. That is ok as long as it
+		 * can't be freed from under us.
+		 */
+		flags = compound_lock_irqsave(page_head);
+		/* here __split_huge_page_refcount won't run anymore */
+		if (likely(PageTail(page))) {
+			__get_page_tail_foll(page, false);
+			got = true;
+		}
+		compound_unlock_irqrestore(page_head, flags);
+		if (unlikely(!got))
+			put_page(page_head);
 	}
 	return got;
 }
@@ -224,7 +224,7 @@
  
 config RPS
 	boolean
-	depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
+	depends on SMP && SYSFS
 	default y
  
 config RFS_ACCEL
@@ -235,7 +235,7 @@
  
 config XPS
 	boolean
-	depends on SMP && USE_GENERIC_SMP_HELPERS
+	depends on SMP
 	default y
  
 config NETPRIO_CGROUP
@@ -3289,6 +3289,7 @@
 			}
 		}
 		if (!defined $suppress_whiletrailers{$linenr} &&
+		    defined($stat) && defined($cond) &&
 		    $line =~ /\b(?:if|while|for)\s*\(/ && $line !~ /^.\s*#/) {
 			my ($s, $c) = ($stat, $cond);
...	...	@@ -63,9 +63,9 @@
63	63	PMD split lock enabling requires pgtable_pmd_page_ctor() call on PMD table
64	64	allocation and pgtable_pmd_page_dtor() on freeing.
65	65
66		-Allocation usually happens in pmd_alloc_one(), freeing in pmd_free(), but
67		-make sure you cover all PMD table allocation / freeing paths: i.e X86_PAE
68		-preallocate few PMDs on pgd_alloc().
	66	+Allocation usually happens in pmd_alloc_one(), freeing in pmd_free() and
	67	+pmd_free_tlb(), but make sure you cover all PMD table allocation / freeing
	68	+paths: i.e X86_PAE preallocate few PMDs on pgd_alloc().
69	69
70	70	With everything in place you can set CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK.
71	71
...	...	@@ -4065,6 +4065,7 @@
4065	4065	F: arch/x86/kernel/cpu/mshyperv.c
4066	4066	F: drivers/hid/hid-hyperv.c
4067	4067	F: drivers/hv/
	4068	+F: drivers/input/serio/hyperv-keyboard.c
4068	4069	F: drivers/net/hyperv/
4069	4070	F: drivers/scsi/storvsc_drv.c
4070	4071	F: drivers/video/hyperv_fb.c
...	...	@@ -61,6 +61,7 @@
61	61	#if PAGETABLE_LEVELS > 2
62	62	void ___pmd_free_tlb(struct mmu_gather tlb, pmd_t pmd)
63	63	{
	64	+ struct page *page = virt_to_page(pmd);
64	65	paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
65	66	/*
66	67	* NOTE! For PAE, any changes to the top page-directory-pointer-table
...	...	@@ -69,7 +70,8 @@
69	70	#ifdef CONFIG_X86_PAE
70	71	tlb->need_flush_all = 1;
71	72	#endif
72		- tlb_remove_page(tlb, virt_to_page(pmd));
	73	+ pgtable_pmd_page_dtor(page);
	74	+ tlb_remove_page(tlb, page);
73	75	}
74	76
75	77	#if PAGETABLE_LEVELS > 3
...	...	@@ -96,6 +96,7 @@
96	96	* - Code works, detects all the partitions.
97	97	*
98	98	************************************************************/
	99	+#include <linux/kernel.h>
99	100	#include <linux/crc32.h>
100	101	#include <linux/ctype.h>
101	102	#include <linux/math64.h>
...	...	@@ -715,8 +716,8 @@
715	716	efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);
716	717
717	718	/* Naively convert UTF16-LE to 7 bits. */
718		- label_max = min(sizeof(info->volname) - 1,
719		- sizeof(ptes[i].partition_name));
	719	+ label_max = min(ARRAY_SIZE(info->volname) - 1,
	720	+ ARRAY_SIZE(ptes[i].partition_name));
720	721	info->volname[label_max] = 0;
721	722	while (label_count < label_max) {
722	723	u8 c = ptes[i].partition_name[label_count] & 0xff;
...	...	@@ -223,7 +223,7 @@
223	223	blk_end_request_all(rq, 0);
224	224	}
225	225
226		-#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
	226	+#ifdef CONFIG_SMP
227	227
228	228	static void null_ipi_cmd_end_io(void *data)
229	229	{
...	...	@@ -260,7 +260,7 @@
260	260	put_cpu();
261	261	}
262	262
263		-#endif /* CONFIG_SMP && CONFIG_USE_GENERIC_SMP_HELPERS */
	263	+#endif /* CONFIG_SMP */
264	264
265	265	static inline void null_handle_cmd(struct nullb_cmd *cmd)
266	266	{
...	...	@@ -270,7 +270,7 @@
270	270	end_cmd(cmd);
271	271	break;
272	272	case NULL_IRQ_SOFTIRQ:
273		-#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
	273	+#ifdef CONFIG_SMP
274	274	null_cmd_end_ipi(cmd);
275	275	#else
276	276	end_cmd(cmd);
...	...	@@ -571,7 +571,7 @@
571	571	{
572	572	unsigned int i;
573	573
574		-#if !defined(CONFIG_SMP) \|\| !defined(CONFIG_USE_GENERIC_SMP_HELPERS)
	574	+#if !defined(CONFIG_SMP)
575	575	if (irqmode == NULL_IRQ_SOFTIRQ) {
576	576	pr_warn("null_blk: softirq completions not available.\n");
577	577	pr_warn("null_blk: using direct completions.\n");
...	...	@@ -428,6 +428,14 @@
428	428	return 0;
429	429	}
430	430
	431	+static void at91_rtc_shutdown(struct platform_device *pdev)
	432	+{
	433	+ /* Disable all interrupts */
	434	+ at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD \| AT91_RTC_ALARM \|
	435	+ AT91_RTC_SECEV \| AT91_RTC_TIMEV \|
	436	+ AT91_RTC_CALEV);
	437	+}
	438	+
431	439	#ifdef CONFIG_PM_SLEEP
432	440
433	441	/* AT91RM9200 RTC Power management control */
...	...	@@ -466,6 +474,7 @@
466	474
467	475	static struct platform_driver at91_rtc_driver = {
468	476	.remove = __exit_p(at91_rtc_remove),
	477	+ .shutdown = at91_rtc_shutdown,
469	478	.driver = {
470	479	.name = "at91_rtc",
471	480	.owner = THIS_MODULE,
...	...	@@ -56,10 +56,19 @@
56	56	struct configfs_dirent *sd = dentry->d_fsdata;
57	57
58	58	if (sd) {
59		- BUG_ON(sd->s_dentry != dentry);
60	59	/* Coordinate with configfs_readdir */
61	60	spin_lock(&configfs_dirent_lock);
62		- sd->s_dentry = NULL;
	61	+ /* Coordinate with configfs_attach_attr where will increase
	62	+ * sd->s_count and update sd->s_dentry to new allocated one.
	63	+ * Only set sd->dentry to null when this dentry is the only
	64	+ * sd owner.
	65	+ * If not do so, configfs_d_iput may run just after
	66	+ * configfs_attach_attr and set sd->s_dentry to null
	67	+ * even it's still in use.
	68	+ */
	69	+ if (atomic_read(&sd->s_count) <= 2)
	70	+ sd->s_dentry = NULL;
	71	+
63	72	spin_unlock(&configfs_dirent_lock);
64	73	configfs_put(sd);
65	74	}
66	75
...	...	@@ -416,8 +425,11 @@
416	425	struct configfs_attribute * attr = sd->s_element;
417	426	int error;
418	427
	428	+ spin_lock(&configfs_dirent_lock);
419	429	dentry->d_fsdata = configfs_get(sd);
420	430	sd->s_dentry = dentry;
	431	+ spin_unlock(&configfs_dirent_lock);
	432	+
421	433	error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) \| S_IFREG,
422	434	configfs_init_file);
423	435	if (error) {
...	...	@@ -31,6 +31,7 @@
31	31	void hugepage_put_subpool(struct hugepage_subpool *spool);
32	32
33	33	int PageHuge(struct page *page);
	34	+int PageHeadHuge(struct page *page_head);
34	35
35	36	void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
36	37	int hugetlb_sysctl_handler(struct ctl_table , int, void __user , size_t , loff_t );
...	...	@@ -69,7 +70,6 @@
69	70	bool isolate_huge_page(struct page page, struct list_head list);
70	71	void putback_active_hugepage(struct page *page);
71	72	bool is_hugepage_active(struct page *page);
72		-void copy_huge_page(struct page dst, struct page src);
73	73
74	74	#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
75	75	pte_t huge_pmd_share(struct mm_struct mm, unsigned long addr, pud_t *pud);
...	...	@@ -104,6 +104,11 @@
104	104	return 0;
105	105	}
106	106
	107	+static inline int PageHeadHuge(struct page *page_head)
	108	+{
	109	+ return 0;
	110	+}
	111	+
107	112	static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
108	113	{
109	114	}
...	...	@@ -140,9 +145,6 @@
140	145	#define isolate_huge_page(p, l) false
141	146	#define putback_active_hugepage(p) do {} while (0)
142	147	#define is_hugepage_active(x) false
143		-static inline void copy_huge_page(struct page dst, struct page src)
144		-{
145		-}
146	148
147	149	static inline unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
148	150	unsigned long address, unsigned long end, pgprot_t newprot)
...	...	@@ -65,9 +65,6 @@
65	65	* this page is only used to
66	66	* free other pages.
67	67	*/
68		-#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
69		- pgtable_t pmd_huge_pte; /* protected by page->ptl */
70		-#endif
71	68	};
72	69
73	70	union {
...	...	@@ -135,6 +132,9 @@
135	132
136	133	struct list_head list; /* slobs list of pages */
137	134	struct slab slab_page; / slab fields */
	135	+#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
	136	+ pgtable_t pmd_huge_pte; /* protected by page->ptl */
	137	+#endif
138	138	};
139	139
140	140	/* Remainder is not double word aligned */
...	...	@@ -208,15 +208,18 @@
208	208	*/
209	209	static void shm_destroy(struct ipc_namespace ns, struct shmid_kernel shp)
210	210	{
	211	+ struct file *shm_file;
	212	+
	213	+ shm_file = shp->shm_file;
	214	+ shp->shm_file = NULL;
211	215	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
212	216	shm_rmid(ns, shp);
213	217	shm_unlock(shp);
214		- if (!is_file_hugepages(shp->shm_file))
215		- shmem_lock(shp->shm_file, 0, shp->mlock_user);
	218	+ if (!is_file_hugepages(shm_file))
	219	+ shmem_lock(shm_file, 0, shp->mlock_user);
216	220	else if (shp->mlock_user)
217		- user_shm_unlock(file_inode(shp->shm_file)->i_size,
218		- shp->mlock_user);
219		- fput (shp->shm_file);
	221	+ user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
	222	+ fput(shm_file);
220	223	ipc_rcu_putref(shp, shm_rcu_free);
221	224	}
222	225
223	226
224	227
225	228
226	229
...	...	@@ -974,15 +977,25 @@
974	977	ipc_lock_object(&shp->shm_perm);
975	978	if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
976	979	kuid_t euid = current_euid();
977		- err = -EPERM;
978	980	if (!uid_eq(euid, shp->shm_perm.uid) &&
979		- !uid_eq(euid, shp->shm_perm.cuid))
	981	+ !uid_eq(euid, shp->shm_perm.cuid)) {
	982	+ err = -EPERM;
980	983	goto out_unlock0;
981		- if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
	984	+ }
	985	+ if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
	986	+ err = -EPERM;
982	987	goto out_unlock0;
	988	+ }
983	989	}
984	990
985	991	shm_file = shp->shm_file;
	992	+
	993	+ /* check if shm_destroy() is tearing down shp */
	994	+ if (shm_file == NULL) {
	995	+ err = -EIDRM;
	996	+ goto out_unlock0;
	997	+ }
	998	+
986	999	if (is_file_hugepages(shm_file))
987	1000	goto out_unlock0;
988	1001
...	...	@@ -1101,6 +1114,14 @@
1101	1114	goto out_unlock;
1102	1115
1103	1116	ipc_lock_object(&shp->shm_perm);
	1117	+
	1118	+ /* check if shm_destroy() is tearing down shp */
	1119	+ if (shp->shm_file == NULL) {
	1120	+ ipc_unlock_object(&shp->shm_perm);
	1121	+ err = -EIDRM;
	1122	+ goto out_unlock;
	1123	+ }
	1124	+
1104	1125	path = shp->shm_file->f_path;
1105	1126	path_get(&path);
1106	1127	shp->shm_nattch++;