From 59927fb984de1703c67bc640c3e522d8b5276c73 Mon Sep 17 00:00:00 2001 From: Hugh Dickins Date: Thu, 15 Mar 2012 15:17:07 -0700 Subject: [PATCH 1/9] memcg: free mem_cgroup by RCU to fix oops After fixing the GPF in mem_cgroup_lru_del_list(), three times one machine running a similar load (moving and removing memcgs while swapping) has oopsed in mem_cgroup_zone_nr_lru_pages(), when retrieving memcg zone numbers for get_scan_count() for shrink_mem_cgroup_zone(): this is where a struct mem_cgroup is first accessed after being chosen by mem_cgroup_iter(). Just what protects a struct mem_cgroup from being freed, in between mem_cgroup_iter()'s css_get_next() and its css_tryget()? css_tryget() fails once css->refcnt is zero with CSS_REMOVED set in flags, yes: but what if that memory is freed and reused for something else, which sets "refcnt" non-zero? Hmm, and scope for an indefinite freeze if refcnt is left at zero but flags are cleared. It's tempting to move the css_tryget() into css_get_next(), to make it really "get" the css, but I don't think that actually solves anything: the same difficulty in moving from css_id found to stable css remains. But we already have rcu_read_lock() around the two, so it's easily fixed if __mem_cgroup_free() just uses kfree_rcu() to free mem_cgroup. However, a big struct mem_cgroup is allocated with vzalloc() instead of kzalloc(), and we're not allowed to vfree() at interrupt time: there doesn't appear to be a general vfree_rcu() to help with this, so roll our own using schedule_work(). The compiler decently removes vfree_work() and vfree_rcu() when the config doesn't need them. Signed-off-by: Hugh Dickins Acked-by: KAMEZAWA Hiroyuki Acked-by: Johannes Weiner Cc: Konstantin Khlebnikov Cc: Tejun Heo Cc: Ying Han Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- mm/memcontrol.c | 53 +++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 47 insertions(+), 6 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index d0e57a3cda1..58a08fc7414 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -230,10 +230,30 @@ struct mem_cgroup { * the counter to account for memory usage */ struct res_counter res; - /* - * the counter to account for mem+swap usage. - */ - struct res_counter memsw; + + union { + /* + * the counter to account for mem+swap usage. + */ + struct res_counter memsw; + + /* + * rcu_freeing is used only when freeing struct mem_cgroup, + * so put it into a union to avoid wasting more memory. + * It must be disjoint from the css field. It could be + * in a union with the res field, but res plays a much + * larger part in mem_cgroup life than memsw, and might + * be of interest, even at time of free, when debugging. + * So share rcu_head with the less interesting memsw. + */ + struct rcu_head rcu_freeing; + /* + * But when using vfree(), that cannot be done at + * interrupt time, so we must then queue the work. + */ + struct work_struct work_freeing; + }; + /* * Per cgroup active and inactive list, similar to the * per zone LRU lists. @@ -4779,6 +4799,27 @@ out_free: return NULL; } +/* + * Helpers for freeing a vzalloc()ed mem_cgroup by RCU, + * but in process context. The work_freeing structure is overlaid + * on the rcu_freeing structure, which itself is overlaid on memsw. + */ +static void vfree_work(struct work_struct *work) +{ + struct mem_cgroup *memcg; + + memcg = container_of(work, struct mem_cgroup, work_freeing); + vfree(memcg); +} +static void vfree_rcu(struct rcu_head *rcu_head) +{ + struct mem_cgroup *memcg; + + memcg = container_of(rcu_head, struct mem_cgroup, rcu_freeing); + INIT_WORK(&memcg->work_freeing, vfree_work); + schedule_work(&memcg->work_freeing); +} + /* * At destroying mem_cgroup, references from swap_cgroup can remain. * (scanning all at force_empty is too costly...) @@ -4802,9 +4843,9 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg) free_percpu(memcg->stat); if (sizeof(struct mem_cgroup) < PAGE_SIZE) - kfree(memcg); + kfree_rcu(memcg, rcu_freeing); else - vfree(memcg); + call_rcu(&memcg->rcu_freeing, vfree_rcu); } static void mem_cgroup_get(struct mem_cgroup *memcg) From fbfa0748d817e98ea28b048c04a1d0341d70127a Mon Sep 17 00:00:00 2001 From: Viresh Kumar Date: Thu, 15 Mar 2012 15:17:09 -0700 Subject: [PATCH 2/9] MAINTAINERS: update ST's Mailing list for SPEAr We have created a ST's Mailing list for SPEAr. This can be accessed from non-st email ids. I want people to cc this list, when they have changes specific to SPEAr. So, its better to get this updated in MAINTAINERS file. linux-arm-kernel@lists.infradead.org is also added for SPEAr. Signed-off-by: Viresh Kumar Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- MAINTAINERS | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index 95e4e43a12b..e192ac9e6c9 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -5859,6 +5859,7 @@ F: drivers/mmc/host/sdhci-s3c.c SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) ST SPEAR DRIVER M: Viresh Kumar +L: spear-devel@list.st.com L: linux-mmc@vger.kernel.org S: Maintained F: drivers/mmc/host/sdhci-spear.c @@ -6201,24 +6202,32 @@ F: drivers/tty/serial/sunzilog.h SPEAR PLATFORM SUPPORT M: Viresh Kumar +L: spear-devel@list.st.com +L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers) W: http://www.st.com/spear S: Maintained F: arch/arm/plat-spear/ SPEAR3XX MACHINE SUPPORT M: Viresh Kumar +L: spear-devel@list.st.com +L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers) W: http://www.st.com/spear S: Maintained F: arch/arm/mach-spear3xx/ SPEAR6XX MACHINE SUPPORT M: Rajeev Kumar +L: spear-devel@list.st.com +L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers) W: http://www.st.com/spear S: Maintained F: arch/arm/mach-spear6xx/ SPEAR CLOCK FRAMEWORK SUPPORT M: Viresh Kumar +L: spear-devel@list.st.com +L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers) W: http://www.st.com/spear S: Maintained F: arch/arm/mach-spear*/clock.c @@ -6227,6 +6236,8 @@ F: arch/arm/plat-spear/include/plat/clock.h SPEAR PAD MULTIPLEXING SUPPORT M: Viresh Kumar +L: spear-devel@list.st.com +L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers) W: http://www.st.com/spear S: Maintained F: arch/arm/plat-spear/include/plat/padmux.h From 9bbad7da76b3dd578fb55c862624366a8c9ccd22 Mon Sep 17 00:00:00 2001 From: Alexandre Bounine Date: Thu, 15 Mar 2012 15:17:09 -0700 Subject: [PATCH 3/9] rapidio/tsi721: fix bug in register offset definitions Fix indexed register offset definitions that use decimal (wrong) instead of hexadecimal (correct) notation for indexing multipliers. Incorrect definitions do not affect Tsi721 driver in its current default configuration because it uses only IDB queue 0. Loss of inbound doorbell functionality should be observed if queue other than 0 is used. Signed-off-by: Alexandre Bounine Cc: Matt Porter Cc: Chul Kim Cc: [3.2+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/rapidio/devices/tsi721.h | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h index 822e54c394d..1c226b31af1 100644 --- a/drivers/rapidio/devices/tsi721.h +++ b/drivers/rapidio/devices/tsi721.h @@ -118,34 +118,34 @@ #define TSI721_IDB_ENTRY_SIZE 64 -#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 1000) +#define TSI721_IDQ_CTL(x) (0x20000 + (x) * 0x1000) #define TSI721_IDQ_SUSPEND 0x00000002 #define TSI721_IDQ_INIT 0x00000001 -#define TSI721_IDQ_STS(x) (0x20004 + (x) * 1000) +#define TSI721_IDQ_STS(x) (0x20004 + (x) * 0x1000) #define TSI721_IDQ_RUN 0x00200000 -#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 1000) +#define TSI721_IDQ_MASK(x) (0x20008 + (x) * 0x1000) #define TSI721_IDQ_MASK_MASK 0xffff0000 #define TSI721_IDQ_MASK_PATT 0x0000ffff -#define TSI721_IDQ_RP(x) (0x2000c + (x) * 1000) +#define TSI721_IDQ_RP(x) (0x2000c + (x) * 0x1000) #define TSI721_IDQ_RP_PTR 0x0007ffff -#define TSI721_IDQ_WP(x) (0x20010 + (x) * 1000) +#define TSI721_IDQ_WP(x) (0x20010 + (x) * 0x1000) #define TSI721_IDQ_WP_PTR 0x0007ffff -#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 1000) +#define TSI721_IDQ_BASEL(x) (0x20014 + (x) * 0x1000) #define TSI721_IDQ_BASEL_ADDR 0xffffffc0 -#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 1000) -#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 1000) +#define TSI721_IDQ_BASEU(x) (0x20018 + (x) * 0x1000) +#define TSI721_IDQ_SIZE(x) (0x2001c + (x) * 0x1000) #define TSI721_IDQ_SIZE_VAL(size) (__fls(size) - 4) #define TSI721_IDQ_SIZE_MIN 512 #define TSI721_IDQ_SIZE_MAX (512 * 1024) -#define TSI721_SR_CHINT(x) (0x20040 + (x) * 1000) -#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 1000) -#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 1000) +#define TSI721_SR_CHINT(x) (0x20040 + (x) * 0x1000) +#define TSI721_SR_CHINTE(x) (0x20044 + (x) * 0x1000) +#define TSI721_SR_CHINTSET(x) (0x20048 + (x) * 0x1000) #define TSI721_SR_CHINT_ODBOK 0x00000020 #define TSI721_SR_CHINT_IDBQRCV 0x00000010 #define TSI721_SR_CHINT_SUSP 0x00000008 @@ -156,7 +156,7 @@ #define TSI721_IBWIN_NUM 8 -#define TSI721_IBWINLB(x) (0x29000 + (x) * 20) +#define TSI721_IBWINLB(x) (0x29000 + (x) * 0x20) #define TSI721_IBWINLB_BA 0xfffff000 #define TSI721_IBWINLB_WEN 0x00000001 @@ -187,13 +187,13 @@ */ #define TSI721_OBWIN_NUM TSI721_PC2SR_WINS -#define TSI721_OBWINLB(x) (0x40000 + (x) * 20) +#define TSI721_OBWINLB(x) (0x40000 + (x) * 0x20) #define TSI721_OBWINLB_BA 0xffff8000 #define TSI721_OBWINLB_WEN 0x00000001 -#define TSI721_OBWINUB(x) (0x40004 + (x) * 20) +#define TSI721_OBWINUB(x) (0x40004 + (x) * 0x20) -#define TSI721_OBWINSZ(x) (0x40008 + (x) * 20) +#define TSI721_OBWINSZ(x) (0x40008 + (x) * 0x20) #define TSI721_OBWINSZ_SIZE 0x00001f00 #define TSI721_OBWIN_SIZE(size) (__fls(size) - 15) From 79f0713d403c800db9d89134e2fd7f846e68d6ee Mon Sep 17 00:00:00 2001 From: Cyrill Gorcunov Date: Thu, 15 Mar 2012 15:17:10 -0700 Subject: [PATCH 4/9] prctl: use CAP_SYS_RESOURCE for PR_SET_MM option CAP_SYS_ADMIN is already overloaded left and right, so to have more fine-grained access control use CAP_SYS_RESOURCE here. The CAP_SYS_RESOUCE is chosen because this prctl option allows a current process to adjust some fields of memory map descriptor which rather represents what the process owns: pointers to code, data, stack segments, command line, auxiliary vector data and etc. Suggested-by: Michael Kerrisk Acked-by: Kees Cook Acked-by: Michael Kerrisk Cc: Pavel Emelyanov Cc: Tejun Heo Cc: Oleg Nesterov Cc: Paul Bolle Cc: KOSAKI Motohiro Signed-off-by: Cyrill Gorcunov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sys.c b/kernel/sys.c index 40701538fbd..888d227fd19 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1706,7 +1706,7 @@ static int prctl_set_mm(int opt, unsigned long addr, if (arg4 | arg5) return -EINVAL; - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_RESOURCE)) return -EPERM; if (addr >= TASK_SIZE) From 960d4d1ba691cdbeb99a3a43a003618362eacc1a Mon Sep 17 00:00:00 2001 From: Gustavo Padovan Date: Thu, 15 Mar 2012 15:17:10 -0700 Subject: [PATCH 5/9] MAINTAINERS: Gustavo has moved This is going to be the primary e-mail for kernel development. Signed-off-by: Gustavo Padovan Cc: Johan Hedberg Cc: Marcel Holtmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index e192ac9e6c9..fe8369da7a6 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1513,7 +1513,7 @@ F: drivers/mtd/devices/block2mtd.c BLUETOOTH DRIVERS M: Marcel Holtmann -M: "Gustavo F. Padovan" +M: Gustavo Padovan L: linux-bluetooth@vger.kernel.org W: http://www.bluez.org/ T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git @@ -1522,7 +1522,7 @@ F: drivers/bluetooth/ BLUETOOTH SUBSYSTEM M: Marcel Holtmann -M: "Gustavo F. Padovan" +M: Gustavo Padovan L: linux-bluetooth@vger.kernel.org W: http://www.bluez.org/ T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git From eb491ecac13fdf4091eaa032a9c6742a7ff80746 Mon Sep 17 00:00:00 2001 From: Johan Hedberg Date: Thu, 15 Mar 2012 15:17:11 -0700 Subject: [PATCH 6/9] MAINTAINERS: add Johan to Bluetooth maintainers I've been coordinating Bluetooth patches in my tree for some time and it's possible I'll do it in the future too, so add myself to the Bluetooth sections as well as mention my tree there. Signed-off-by: Johan Hedberg Cc: Marcel Holtmann Cc: "Gustavo F. Padovan" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- MAINTAINERS | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index fe8369da7a6..15b41141d17 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1514,18 +1514,22 @@ F: drivers/mtd/devices/block2mtd.c BLUETOOTH DRIVERS M: Marcel Holtmann M: Gustavo Padovan +M: Johan Hedberg L: linux-bluetooth@vger.kernel.org W: http://www.bluez.org/ T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git +T: git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git S: Maintained F: drivers/bluetooth/ BLUETOOTH SUBSYSTEM M: Marcel Holtmann M: Gustavo Padovan +M: Johan Hedberg L: linux-bluetooth@vger.kernel.org W: http://www.bluez.org/ T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git +T: git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git S: Maintained F: net/bluetooth/ F: include/net/bluetooth/ From 4c57c7e4af71afd4e9f93af01738eb1216ed270e Mon Sep 17 00:00:00 2001 From: Johan Hedberg Date: Thu, 15 Mar 2012 15:17:11 -0700 Subject: [PATCH 7/9] MAINTAINERS: fix link to Gustavo Padovans tree Gustavo's tree is called just bluetooth.git and not bluetooth-2.6.git anymore. Signed-off-by: Johan Hedberg Cc: Marcel Holtmann Cc: "Gustavo F. Padovan" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index 15b41141d17..8dc270c5ff2 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1517,7 +1517,7 @@ M: Gustavo Padovan M: Johan Hedberg L: linux-bluetooth@vger.kernel.org W: http://www.bluez.org/ -T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git +T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth.git T: git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git S: Maintained F: drivers/bluetooth/ @@ -1528,7 +1528,7 @@ M: Gustavo Padovan M: Johan Hedberg L: linux-bluetooth@vger.kernel.org W: http://www.bluez.org/ -T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git +T: git git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth.git T: git git://git.kernel.org/pub/scm/linux/kernel/git/jh/bluetooth.git S: Maintained F: net/bluetooth/ From 5eb1eb4ea102c9aed8a791892a5b0431b058f20e Mon Sep 17 00:00:00 2001 From: Donghwa Lee Date: Thu, 15 Mar 2012 15:17:11 -0700 Subject: [PATCH 8/9] MAINTAINERS: add entry for exynos mipi display drivers I'd like to add Inki Dae, Donghwa Lee and Kyungmin Park as maintainers who developers for exynos mipi display drivers for video/driver/exynos/exynos_mipi* and include/video/exynos_mipi*. Signed-off-by: Donghwa Lee Signed-off-by: Inki Dae Signed-off-by: Kyungmin Park Cc: Florian Tobias Schandinat Cc: Richard Purdie Cc: Kukjin Kim Cc: Jingoo Han Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index 8dc270c5ff2..03e0b4896bc 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2355,6 +2355,15 @@ S: Supported F: drivers/gpu/drm/exynos F: include/drm/exynos* +EXYNOS MIPI DISPLAY DRIVERS +M: Inki Dae +M: Donghwa Lee +M: Kyungmin Park +L: linux-fbdev@vger.kernel.org +S: Maintained +F: drivers/video/exynos/exynos_mipi* +F: include/video/exynos_mipi* + DSCC4 DRIVER M: Francois Romieu L: netdev@vger.kernel.org From cf2b94daab9f3d21b0a393bef91292622f6a8ca4 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 15 Mar 2012 15:17:12 -0700 Subject: [PATCH 9/9] drivers/video/backlight/s6e63m0.c: fix corruption storing gamma mode strict_strtoul() writes a long but ->gamma_mode only has space to store an int, so on 64 bit systems we end up scribbling over ->gamma_table_count as well. I've changed it to use kstrtouint() instead. Signed-off-by: Dan Carpenter Acked-by: Inki Dae Signed-off-by: Florian Tobias Schandinat Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/video/backlight/s6e63m0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/backlight/s6e63m0.c b/drivers/video/backlight/s6e63m0.c index e132157d854..516db703dd2 100644 --- a/drivers/video/backlight/s6e63m0.c +++ b/drivers/video/backlight/s6e63m0.c @@ -690,7 +690,7 @@ static ssize_t s6e63m0_sysfs_store_gamma_mode(struct device *dev, struct backlight_device *bd = NULL; int brightness, rc; - rc = strict_strtoul(buf, 0, (unsigned long *)&lcd->gamma_mode); + rc = kstrtouint(buf, 0, &lcd->gamma_mode); if (rc < 0) return rc;