1. 07 Jan, 2015 5 commits
    • Daniel Forrest's avatar
      mm: fix anon_vma_clone() error treatment · cdc02631
      Daniel Forrest authored
      commit c4ea95d7 upstream.
      
      Andrew Morton noticed that the error return from anon_vma_clone() was
      being dropped and replaced with -ENOMEM (which is not itself a bug
      because the only error return value from anon_vma_clone() is -ENOMEM).
      
      I did an audit of callers of anon_vma_clone() and discovered an actual
      bug where the error return was being lost.  In __split_vma(), between
      Linux 3.11 and 3.12 the code was changed so the err variable is used
      before the call to anon_vma_clone() and the default initial value of
      -ENOMEM is overwritten.  So a failure of anon_vma_clone() will return
      success since err at this point is now zero.
      
      Below is a patch which fixes this bug and also propagates the error
      return value from anon_vma_clone() in all cases.
      
      Fixes: ef0855d3 ("mm: mempolicy: turn vma_set_policy() into vma_dup_policy()")
      Signed-off-by: default avatarDaniel Forrest <dan.forrest@ssec.wisc.edu>
      Reviewed-by: default avatarMichal Hocko <mhocko@suse.cz>
      Cc: Konstantin Khlebnikov <koct9i@gmail.com>
      Cc: Andrea Arcangeli <aarcange@redhat.com>
      Cc: Rik van Riel <riel@redhat.com>
      Cc: Tim Hartrick <tim@edgecast.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Michel Lespinasse <walken@google.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      cdc02631
    • Hugh Dickins's avatar
      mm: fix swapoff hang after page migration and fork · 0315eaed
      Hugh Dickins authored
      commit 2022b4d1 upstream.
      
      I've been seeing swapoff hangs in recent testing: it's cycling around
      trying unsuccessfully to find an mm for some remaining pages of swap.
      
      I have been exercising swap and page migration more heavily recently,
      and now notice a long-standing error in copy_one_pte(): it's trying to
      add dst_mm to swapoff's mmlist when it finds a swap entry, but is doing
      so even when it's a migration entry or an hwpoison entry.
      
      Which wouldn't matter much, except it adds dst_mm next to src_mm,
      assuming src_mm is already on the mmlist: which may not be so.  Then if
      pages are later swapped out from dst_mm, swapoff won't be able to find
      where to replace them.
      
      There's already a !non_swap_entry() test for stats: move that up before
      the swap_duplicate() and the addition to mmlist.
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Cc: Kelley Nielsen <kelleynnn@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      0315eaed
    • Andrew Morton's avatar
      mm/vmpressure.c: fix race in vmpressure_work_fn() · 5a40e10c
      Andrew Morton authored
      commit 91b57191 upstream.
      
      In some android devices, there will be a "divide by zero" exception.
      vmpr->scanned could be zero before spin_lock(&vmpr->sr_lock).
      
      Addresses https://bugzilla.kernel.org/show_bug.cgi?id=88051
      
      [akpm@linux-foundation.org: neaten]
      Reported-by: default avatarji_ang <ji_ang@163.com>
      Cc: Anton Vorontsov <anton.vorontsov@linaro.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      5a40e10c
    • Weijie Yang's avatar
      mm: frontswap: invalidate expired data on a dup-store failure · 94724f27
      Weijie Yang authored
      commit fb993fa1 upstream.
      
      If a frontswap dup-store failed, it should invalidate the expired page
      in the backend, or it could trigger some data corruption issue.
      Such as:
       1. use zswap as the frontswap backend with writeback feature
       2. store a swap page(version_1) to entry A, success
       3. dup-store a newer page(version_2) to the same entry A, fail
       4. use __swap_writepage() write version_2 page to swapfile, success
       5. zswap do shrink, writeback version_1 page to swapfile
       6. version_2 page is overwrited by version_1, data corrupt.
      
      This patch fixes this issue by invalidating expired data immediately
      when meet a dup-store failure.
      Signed-off-by: default avatarWeijie Yang <weijie.yang@samsung.com>
      Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
      Cc: Seth Jennings <sjennings@variantweb.net>
      Cc: Dan Streetman <ddstreet@ieee.org>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Bob Liu <bob.liu@oracle.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      94724f27
    • Francesco Ruggeri's avatar
      tty: Fix pty master poll() after slave closes v2 · 6b96727b
      Francesco Ruggeri authored
      commit c4dc3046 upstream.
      
      Commit f95499c3 ("n_tty: Don't wait for buffer work in read() loop")
      introduces a race window where a pty master can be signalled that the pty
      slave was closed before all the data that the slave wrote is delivered.
      Commit f8747d4a ("tty: Fix pty master read() after slave closes") fixed the
      problem in case of n_tty_read, but the problem still exists for n_tty_poll.
      This can be seen by running 'for ((i=0; i<100;i++));do ./test.py ;done'
      where test.py is:
      
      import os, select, pty
      
      (pid, pty_fd) = pty.fork()
      
      if pid == 0:
         os.write(1, 'This string should be received by parent')
      else:
         poller = select.epoll()
         poller.register( pty_fd, select.EPOLLIN )
         ready = poller.poll( 1 * 1000 )
         for fd, events in ready:
            if not events & select.EPOLLIN:
               print 'missed POLLIN event'
            else:
               print os.read(fd, 100)
         poller.close()
      
      The string from the slave is missed several times.
      This patch takes the same approach as the fix for read and special cases
      this condition for poll.
      Tested on 3.16.
      Signed-off-by: default avatarFrancesco Ruggeri <fruggeri@arista.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
      6b96727b
  2. 06 Jan, 2015 14 commits
  3. 06 Dec, 2014 21 commits