History

Merge branch 'akpm' (Andrew's patch-bomb)

Merge the rest of Andrew's patches for -rc1: "A bunch of fixes and misc missed-out-on things. That'll do for -rc1. I still have a batch of IPC patches which still have a possible bug report which I'm chasing down." * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (25 commits) keys: use keyring_alloc() to create module signing keyring keys: fix unreachable code sendfile: allows bypassing of notifier events SGI-XP: handle non-fatal traps fat: fix incorrect function comment Documentation: ABI: remove testing/sysfs-devices-node proc: fix inconsistent lock state linux/kernel.h: fix DIV_ROUND_CLOSEST with unsigned divisors memcg: don't register hotcpu notifier from ->css_alloc() checkpatch: warn on uapi #includes that #include <uapi/... revert "rtc: recycle id when unloading a rtc driver" mm: clean up transparent hugepage sysfs error messages hfsplus: add error message for the case of failure of sync fs in delayed_sync_fs() method hfsplus: rework processing of hfs_btree_write() returned error hfsplus: rework processing errors in hfsplus_free_extents() hfsplus: avoid crash on failed block map free kcmp: include linux/ptrace.h drivers/rtc/rtc-imxdi.c: must include <linux/spinlock.h> mm: cma: WARN if freed memory is still in use exec: do not leave bprm->interp on stack ...

Linus Torvalds committed 13 years ago

Commit 4c9a44a2 parents 1f0377f cfde81930 files · +261 −88Browse files

Unified · Split

30 files
  1. Documentation/ABI/testing/sysfs-devices-node +0 −7
  2. Documentation/kernel-parameters.txt +0 −6
  3. drivers/firmware/dmi_scan.c +61 −17
  4. drivers/misc/sgi-xp/xpc_main.c +32 −2
  5. drivers/rtc/class.c +0 −1
  6. drivers/rtc/rtc-imxdi.c +1 −0
  7. fs/binfmt_misc.c +4 −1
  8. fs/binfmt_script.c +3 −1
  9. fs/exec.c +15 −0
  10. fs/fat/dir.c +2 −3
  11. fs/fat/inode.c +1 −1
  12. fs/fat/misc.c +4 −0
  13. fs/hfsplus/bitmap.c +12 −1
  14. fs/hfsplus/btree.c +3 −2
  15. fs/hfsplus/extents.c +20 −4
  16. fs/hfsplus/hfsplus_fs.h +1 −1
  17. fs/hfsplus/super.c +12 −3
  18. fs/proc/generic.c +6 −6
  19. fs/read_write.c +2 −0
  20. include/linux/binfmts.h +1 −0
  21. include/linux/kernel.h +4 −2
  22. kernel/kcmp.c +1 −0
  23. kernel/modsign_pubkey.c +6 −9
  24. mm/compaction.c +20 −6
  25. mm/huge_memory.c +3 −3
  26. mm/memcontrol.c +13 −1
  27. mm/page-writeback.c +20 −5
  28. mm/page_alloc.c +9 −2
  29. scripts/checkpatch.pl +5 −2
  30. security/keys/process_keys.c +0 −2
Documentation/ABI/testing/sysfs-devices-node+0−7
@@ -1,7 +0,0 @@
1−What: /sys/devices/system/node/nodeX/compact
2−Date: February 2010
3−Contact: Mel Gorman <mel@csn.ul.ie>
4−Description:
5− When this file is written to, all memory within that node
6− will be compacted. When it completes, memory will be freed
7− into blocks which have as many contiguous pages as possible
Documentation/kernel-parameters.txt+0−6
@@ -446,12 +446,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. · 445 unmodified lines
446446 possible to determine what the correct size should be.
447447 This option provides an override for these situations.
448448
449− capability.disable=
450− [SECURITY] Disable capabilities. This would normally
451− be used only if an alternative security model is to be
452− configured. Potentially dangerous and should only be
453− used if you are entirely sure of the consequences.
454−
455449 ccw_timeout_log [S390]
456450 See Documentation/s390/CommonIO for details.
457451
drivers/firmware/dmi_scan.c+61−17
@@ -16,6 +16,7 @@ · 15 unmodified lines
1616 */
1717 static char dmi_empty_string[] = " ";
1818
19+static u16 __initdata dmi_ver;
1920 /*
2021 * Catch too early calls to dmi_check_system():
2122 */
@@ -118,12 +119,12 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *, · 96 unmodified lines
118119 return 0;
119120 }
120121
121−static int __init dmi_checksum(const u8 *buf)
122+static int __init dmi_checksum(const u8 *buf, u8 len)
122123 {
123124 u8 sum = 0;
124125 int a;
125126
126− for (a = 0; a < 15; a++)
127+ for (a = 0; a < len; a++)
127128 sum += buf[a];
128129
129130 return sum == 0;
@@ -161,8 +162,10 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde · 31 unmodified lines
161162 return;
162163
163164 for (i = 0; i < 16 && (is_ff || is_00); i++) {
164− if(d[i] != 0x00) is_ff = 0;
165− if(d[i] != 0xFF) is_00 = 0;
165+ if (d[i] != 0x00)
166+ is_00 = 0;
167+ if (d[i] != 0xFF)
168+ is_ff = 0;
166169 }
167170
168171 if (is_ff || is_00)
@@ -172,7 +175,15 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde · 3 unmodified lines
172175 if (!s)
173176 return;
174177
175− sprintf(s, "%pUB", d);
178+ /*
179+ * As of version 2.6 of the SMBIOS specification, the first 3 fields of
180+ * the UUID are supposed to be little-endian encoded. The specification
181+ * says that this is the defacto standard.
182+ */
183+ if (dmi_ver >= 0x0206)
184+ sprintf(s, "%pUL", d);
185+ else
186+ sprintf(s, "%pUB", d);
176187
177188 dmi_ident[slot] = s;
178189 }
@@ -404,29 +415,57 @@ static int __init dmi_present(const char __iomem *p) · 225 unmodified lines
404415 u8 buf[15];
405416
406417 memcpy_fromio(buf, p, 15);
407− if ((memcmp(buf, "_DMI_", 5) == 0) && dmi_checksum(buf)) {
418+ if (dmi_checksum(buf, 15)) {
408419 dmi_num = (buf[13] << 8) | buf[12];
409420 dmi_len = (buf[7] << 8) | buf[6];
410421 dmi_base = (buf[11] << 24) | (buf[10] << 16) |
411422 (buf[9] << 8) | buf[8];
412423
413− /*
414− * DMI version 0.0 means that the real version is taken from
415− * the SMBIOS version, which we don't know at this point.
416− */
417− if (buf[14] != 0)
418− printk(KERN_INFO "DMI %d.%d present.\n",
419− buf[14] >> 4, buf[14] & 0xF);
420− else
421− printk(KERN_INFO "DMI present.\n");
422424 if (dmi_walk_early(dmi_decode) == 0) {
425+ if (dmi_ver)
426+ pr_info("SMBIOS %d.%d present.\n",
427+ dmi_ver >> 8, dmi_ver & 0xFF);
428+ else {
429+ dmi_ver = (buf[14] & 0xF0) << 4 |
430+ (buf[14] & 0x0F);
431+ pr_info("Legacy DMI %d.%d present.\n",
432+ dmi_ver >> 8, dmi_ver & 0xFF);
433+ }
423434 dmi_dump_ids();
424435 return 0;
425436 }
426437 }
438+ dmi_ver = 0;
427439 return 1;
428440 }
429441
442+static int __init smbios_present(const char __iomem *p)
443+{
444+ u8 buf[32];
445+ int offset = 0;
446+
447+ memcpy_fromio(buf, p, 32);
448+ if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
449+ dmi_ver = (buf[6] << 8) + buf[7];
450+
451+ /* Some BIOS report weird SMBIOS version, fix that up */
452+ switch (dmi_ver) {
453+ case 0x021F:
454+ case 0x0221:
455+ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
456+ dmi_ver & 0xFF, 3);
457+ dmi_ver = 0x0203;
458+ break;
459+ case 0x0233:
460+ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
461+ dmi_ver = 0x0206;
462+ break;
463+ }
464+ offset = 16;
465+ }
466+ return dmi_present(buf + offset);
467+}
468+
430469 void __init dmi_scan_machine(void)
431470 {
432471 char __iomem *p, *q;
@@ -444,7 +483,7 @@ void __init dmi_scan_machine(void) · 11 unmodified lines
444483 if (p == NULL)
445484 goto error;
446485
447− rc = dmi_present(p + 0x10); /* offset of _DMI_ string */
486+ rc = smbios_present(p);
448487 dmi_iounmap(p, 32);
449488 if (!rc) {
450489 dmi_available = 1;
@@ -462,7 +501,12 @@ void __init dmi_scan_machine(void) · 11 unmodified lines
462501 goto error;
463502
464503 for (q = p; q < p + 0x10000; q += 16) {
465− rc = dmi_present(q);
504+ if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
505+ rc = smbios_present(q);
506+ else if (memcmp(q, "_DMI_", 5) == 0)
507+ rc = dmi_present(q);
508+ else
509+ continue;
466510 if (!rc) {
467511 dmi_available = 1;
468512 dmi_iounmap(p, 0x10000);
drivers/misc/sgi-xp/xpc_main.c+32−2
@@ -53,6 +53,10 @@ · 52 unmodified lines
5353 #include <linux/kthread.h>
5454 #include "xpc.h"
5555
56+#ifdef CONFIG_X86_64
57+#include <asm/traps.h>
58+#endif
59+
5660 /* define two XPC debug device structures to be used with dev_dbg() et al */
5761
5862 struct device_driver xpc_dbg_name = {
@@ -1079,6 +1083,9 @@ xpc_system_reboot(struct notifier_block *nb, unsigned long event, void *unused) · 1020 unmodified lines
10791083 return NOTIFY_DONE;
10801084 }
10811085
1086+/* Used to only allow one cpu to complete disconnect */
1087+static unsigned int xpc_die_disconnecting;
1088+
10821089 /*
10831090 * Notify other partitions to deactivate from us by first disengaging from all
10841091 * references to our memory.
@@ -1092,6 +1099,9 @@ xpc_die_deactivate(void) · 7 unmodified lines
10921099 long keep_waiting;
10931100 long wait_to_print;
10941101
1102+ if (cmpxchg(&xpc_die_disconnecting, 0, 1))
1103+ return;
1104+
10951105 /* keep xpc_hb_checker thread from doing anything (just in case) */
10961106 xpc_exiting = 1;
10971107
@@ -1159,7 +1169,7 @@ xpc_die_deactivate(void) · 61 unmodified lines
11591169 * about the lack of a heartbeat.
11601170 */
11611171 static int
1162−xpc_system_die(struct notifier_block *nb, unsigned long event, void *unused)
1172+xpc_system_die(struct notifier_block *nb, unsigned long event, void *_die_args)
11631173 {
11641174 #ifdef CONFIG_IA64 /* !!! temporary kludge */
11651175 switch (event) {
@@ -1191,7 +1201,27 @@ xpc_system_die(struct notifier_block *nb, unsigned long event, void *unused) · 25 unmodified lines
11911201 break;
11921202 }
11931203 #else
1194− xpc_die_deactivate();
1204+ struct die_args *die_args = _die_args;
1205+
1206+ switch (event) {
1207+ case DIE_TRAP:
1208+ if (die_args->trapnr == X86_TRAP_DF)
1209+ xpc_die_deactivate();
1210+
1211+ if (((die_args->trapnr == X86_TRAP_MF) ||
1212+ (die_args->trapnr == X86_TRAP_XF)) &&
1213+ !user_mode_vm(die_args->regs))
1214+ xpc_die_deactivate();
1215+
1216+ break;
1217+ case DIE_INT3:
1218+ case DIE_DEBUG:
1219+ break;
1220+ case DIE_OOPS:
1221+ case DIE_GPF:
1222+ default:
1223+ xpc_die_deactivate();
1224+ }
11951225 #endif
11961226
11971227 return NOTIFY_DONE;
drivers/rtc/class.c+0−1
@@ -244,7 +244,6 @@ void rtc_device_unregister(struct rtc_device *rtc) · 243 unmodified lines
244244 rtc_proc_del_device(rtc);
245245 device_unregister(&rtc->dev);
246246 rtc->ops = NULL;
247− ida_simple_remove(&rtc_ida, rtc->id);
248247 mutex_unlock(&rtc->ops_lock);
249248 put_device(&rtc->dev);
250249 }
drivers/rtc/rtc-imxdi.c+1−0
@@ -36,6 +36,7 @@ · 35 unmodified lines
3636 #include <linux/platform_device.h>
3737 #include <linux/rtc.h>
3838 #include <linux/sched.h>
39+#include <linux/spinlock.h>
3940 #include <linux/workqueue.h>
4041 #include <linux/of.h>
4142
fs/binfmt_misc.c+4−1
@@ -172,7 +172,10 @@ static int load_misc_binary(struct linux_binprm *bprm) · 171 unmodified lines
172172 goto _error;
173173 bprm->argc ++;
174174
175− bprm->interp = iname; /* for binfmt_script */
175+ /* Update interp in case binfmt_script needs it. */
176+ retval = bprm_change_interp(iname, bprm);
177+ if (retval < 0)
178+ goto _error;
176179
177180 interp_file = open_exec (iname);
178181 retval = PTR_ERR (interp_file);
fs/binfmt_script.c+3−1
@@ -80,7 +80,9 @@ static int load_script(struct linux_binprm *bprm) · 79 unmodified lines
8080 retval = copy_strings_kernel(1, &i_name, bprm);
8181 if (retval) return retval;
8282 bprm->argc++;
83− bprm->interp = interp;
83+ retval = bprm_change_interp(interp, bprm);
84+ if (retval < 0)
85+ return retval;
8486
8587 /*
8688 * OK, now restart the process with the interpreter's dentry.
fs/exec.c+15−0
@@ -1175,9 +1175,24 @@ void free_bprm(struct linux_binprm *bprm) · 1174 unmodified lines
11751175 mutex_unlock(&current->signal->cred_guard_mutex);
11761176 abort_creds(bprm->cred);
11771177 }
1178+ /* If a binfmt changed the interp, free it. */
1179+ if (bprm->interp != bprm->filename)
1180+ kfree(bprm->interp);
11781181 kfree(bprm);
11791182 }
11801183
1184+int bprm_change_interp(char *interp, struct linux_binprm *bprm)
1185+{
1186+ /* If a binfmt changed the interp, free it first. */
1187+ if (bprm->interp != bprm->filename)
1188+ kfree(bprm->interp);
1189+ bprm->interp = kstrdup(interp, GFP_KERNEL);
1190+ if (!bprm->interp)
1191+ return -ENOMEM;
1192+ return 0;
1193+}
1194+EXPORT_SYMBOL(bprm_change_interp);
1195+
11811196 /*
11821197 * install the new credentials for this executable
11831198 */
fs/fat/dir.c+2−3
@@ -461,8 +461,7 @@ static int fat_parse_short(struct super_block *sb, · 460 unmodified lines
461461 }
462462
463463 /*
464− * Return values: negative -> error, 0 -> not found, positive -> found,
465− * value is the total amount of slots, including the shortname entry.
464+ * Return values: negative -> error/not found, 0 -> found.
466465 */
467466 int fat_search_long(struct inode *inode, const unsigned char *name,
468467 int name_len, struct fat_slot_info *sinfo)
@@ -1255,7 +1254,7 @@ int fat_add_entries(struct inode *dir, void *slots, int nr_slots, · 786 unmodified lines
12551254
12561255 sinfo->nr_slots = nr_slots;
12571256
1258− /* First stage: search free direcotry entries */
1257+ /* First stage: search free directory entries */
12591258 free_slots = nr_bhs = 0;
12601259 bh = prev = NULL;
12611260 pos = 0;
fs/fat/inode.c+1−1
@@ -1344,7 +1344,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat, · 1343 unmodified lines
13441344 sbi->dir_entries = get_unaligned_le16(&b->dir_entries);
13451345 if (sbi->dir_entries & (sbi->dir_per_block - 1)) {
13461346 if (!silent)
1347− fat_msg(sb, KERN_ERR, "bogus directroy-entries per block"
1347+ fat_msg(sb, KERN_ERR, "bogus directory-entries per block"
13481348 " (%u)", sbi->dir_entries);
13491349 brelse(bh);
13501350 goto out_invalid;
fs/fat/misc.c+4−0
@@ -135,6 +135,10 @@ int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster) · 134 unmodified lines
135135 }
136136 if (ret < 0)
137137 return ret;
138+ /*
139+ * FIXME:Although we can add this cache, fat_cache_add() is
140+ * assuming to be called after linear search with fat_cache_id.
141+ */
138142 // fat_cache_add(inode, new_fclus, new_dclus);
139143 } else {
140144 MSDOS_I(inode)->i_start = new_dclus;
fs/hfsplus/bitmap.c+12−1
@@ -176,12 +176,14 @@ int hfsplus_block_free(struct super_block *sb, u32 offset, u32 count) · 175 unmodified lines
176176 dprint(DBG_BITMAP, "block_free: %u,%u\n", offset, count);
177177 /* are all of the bits in range? */
178178 if ((offset + count) > sbi->total_blocks)
179− return -2;
179+ return -ENOENT;
180180
181181 mutex_lock(&sbi->alloc_mutex);
182182 mapping = sbi->alloc_file->i_mapping;
183183 pnr = offset / PAGE_CACHE_BITS;
184184 page = read_mapping_page(mapping, pnr, NULL);
185+ if (IS_ERR(page))
186+ goto kaboom;
185187 pptr = kmap(page);
186188 curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
187189 end = pptr + PAGE_CACHE_BITS / 32;
@@ -214,6 +216,8 @@ int hfsplus_block_free(struct super_block *sb, u32 offset, u32 count) · 26 unmodified lines
214216 set_page_dirty(page);
215217 kunmap(page);
216218 page = read_mapping_page(mapping, ++pnr, NULL);
219+ if (IS_ERR(page))
220+ goto kaboom;
217221 pptr = kmap(page);
218222 curr = pptr;
219223 end = pptr + PAGE_CACHE_BITS / 32;
@@ -232,4 +236,11 @@ out: · 12 unmodified lines
232236 mutex_unlock(&sbi->alloc_mutex);
233237
234238 return 0;
239+
240+kaboom:
241+ printk(KERN_CRIT "hfsplus: unable to mark blocks free: error %ld\n",
242+ PTR_ERR(page));
243+ mutex_unlock(&sbi->alloc_mutex);
244+
245+ return -EIO;
235246 }
fs/hfsplus/btree.c+3−2
@@ -159,7 +159,7 @@ void hfs_btree_close(struct hfs_btree *tree) · 158 unmodified lines
159159 kfree(tree);
160160 }
161161
162−void hfs_btree_write(struct hfs_btree *tree)
162+int hfs_btree_write(struct hfs_btree *tree)
163163 {
164164 struct hfs_btree_header_rec *head;
165165 struct hfs_bnode *node;
@@ -168,7 +168,7 @@ void hfs_btree_write(struct hfs_btree *tree) · 2 unmodified lines
168168 node = hfs_bnode_find(tree, 0);
169169 if (IS_ERR(node))
170170 /* panic? */
171− return;
171+ return -EIO;
172172 /* Load the header */
173173 page = node->page[0];
174174 head = (struct hfs_btree_header_rec *)(kmap(page) +
@@ -186,6 +186,7 @@ void hfs_btree_write(struct hfs_btree *tree) · 11 unmodified lines
186186 kunmap(page);
187187 set_page_dirty(page);
188188 hfs_bnode_put(node);
189+ return 0;
189190 }
190191
191192 static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
fs/hfsplus/extents.c+20−4
@@ -329,6 +329,7 @@ static int hfsplus_free_extents(struct super_block *sb, · 328 unmodified lines
329329 {
330330 u32 count, start;
331331 int i;
332+ int err = 0;
332333
333334 hfsplus_dump_extent(extent);
334335 for (i = 0; i < 8; extent++, i++) {
@@ -345,18 +346,33 @@ found: · 10 unmodified lines
345346 for (;;) {
346347 start = be32_to_cpu(extent->start_block);
347348 if (count <= block_nr) {
348− hfsplus_block_free(sb, start, count);
349+ err = hfsplus_block_free(sb, start, count);
350+ if (err) {
351+ printk(KERN_ERR "hfs: can't free extent\n");
352+ dprint(DBG_EXTENT, " start: %u count: %u\n",
353+ start, count);
354+ }
349355 extent->block_count = 0;
350356 extent->start_block = 0;
351357 block_nr -= count;
352358 } else {
353359 count -= block_nr;
354− hfsplus_block_free(sb, start + count, block_nr);
360+ err = hfsplus_block_free(sb, start + count, block_nr);
361+ if (err) {
362+ printk(KERN_ERR "hfs: can't free extent\n");
363+ dprint(DBG_EXTENT, " start: %u count: %u\n",
364+ start, count);
365+ }
355366 extent->block_count = cpu_to_be32(count);
356367 block_nr = 0;
357368 }
358− if (!block_nr || !i)
359− return 0;
369+ if (!block_nr || !i) {
370+ /*
371+ * Try to free all extents and
372+ * return only last error
373+ */
374+ return err;
375+ }
360376 i--;
361377 extent--;
362378 count = be32_to_cpu(extent->block_count);
fs/hfsplus/hfsplus_fs.h+1−1
@@ -335,7 +335,7 @@ int hfsplus_block_free(struct super_block *, u32, u32); · 334 unmodified lines
335335 /* btree.c */
336336 struct hfs_btree *hfs_btree_open(struct super_block *, u32);
337337 void hfs_btree_close(struct hfs_btree *);
338−void hfs_btree_write(struct hfs_btree *);
338+int hfs_btree_write(struct hfs_btree *);
339339 struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *);
340340 void hfs_bmap_free(struct hfs_bnode *);
341341
fs/hfsplus/super.c+12−3
@@ -127,8 +127,14 @@ static int hfsplus_system_write_inode(struct inode *inode) · 126 unmodified lines
127127 hfsplus_mark_mdb_dirty(inode->i_sb);
128128 }
129129 hfsplus_inode_write_fork(inode, fork);
130− if (tree)
131− hfs_btree_write(tree);
130+ if (tree) {
131+ int err = hfs_btree_write(tree);
132+ if (err) {
133+ printk(KERN_ERR "hfs: b-tree write err: %d, ino %lu\n",
134+ err, inode->i_ino);
135+ return err;
136+ }
137+ }
132138 return 0;
133139 }
134140
@@ -226,6 +232,7 @@ out: · 91 unmodified lines
226232
227233 static void delayed_sync_fs(struct work_struct *work)
228234 {
235+ int err;
229236 struct hfsplus_sb_info *sbi;
230237
231238 sbi = container_of(work, struct hfsplus_sb_info, sync_work.work);
@@ -234,7 +241,9 @@ static void delayed_sync_fs(struct work_struct *work) · 2 unmodified lines
234241 sbi->work_queued = 0;
235242 spin_unlock(&sbi->work_lock);
236243
237− hfsplus_sync_fs(sbi->alloc_file->i_sb, 1);
244+ err = hfsplus_sync_fs(sbi->alloc_file->i_sb, 1);
245+ if (err)
246+ printk(KERN_ERR "hfs: delayed sync fs err %d\n", err);
238247 }
239248
240249 void hfsplus_mark_mdb_dirty(struct super_block *sb)
fs/proc/generic.c+6−6
@@ -352,18 +352,18 @@ retry: · 351 unmodified lines
352352 if (!ida_pre_get(&proc_inum_ida, GFP_KERNEL))
353353 return -ENOMEM;
354354
355− spin_lock(&proc_inum_lock);
355+ spin_lock_bh(&proc_inum_lock);
356356 error = ida_get_new(&proc_inum_ida, &i);
357− spin_unlock(&proc_inum_lock);
357+ spin_unlock_bh(&proc_inum_lock);
358358 if (error == -EAGAIN)
359359 goto retry;
360360 else if (error)
361361 return error;
362362
363363 if (i > UINT_MAX - PROC_DYNAMIC_FIRST) {
364− spin_lock(&proc_inum_lock);
364+ spin_lock_bh(&proc_inum_lock);
365365 ida_remove(&proc_inum_ida, i);
366− spin_unlock(&proc_inum_lock);
366+ spin_unlock_bh(&proc_inum_lock);
367367 return -ENOSPC;
368368 }
369369 *inum = PROC_DYNAMIC_FIRST + i;
@@ -372,9 +372,9 @@ retry: · 2 unmodified lines
372372
373373 void proc_free_inum(unsigned int inum)
374374 {
375− spin_lock(&proc_inum_lock);
375+ spin_lock_bh(&proc_inum_lock);
376376 ida_remove(&proc_inum_ida, inum - PROC_DYNAMIC_FIRST);
377− spin_unlock(&proc_inum_lock);
377+ spin_unlock_bh(&proc_inum_lock);
378378 }
379379
380380 static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
fs/read_write.c+2−0
@@ -935,6 +935,8 @@ ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, size_t count, · 934 unmodified lines
935935 if (retval > 0) {
936936 add_rchar(current, retval);
937937 add_wchar(current, retval);
938+ fsnotify_access(in.file);
939+ fsnotify_modify(out.file);
938940 }
939941
940942 inc_syscr(current);
include/linux/binfmts.h+1−0
@@ -112,6 +112,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm, · 111 unmodified lines
112112 unsigned long stack_top,
113113 int executable_stack);
114114 extern int bprm_mm_init(struct linux_binprm *bprm);
115+extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
115116 extern int copy_strings_kernel(int argc, const char *const *argv,
116117 struct linux_binprm *bprm);
117118 extern int prepare_bprm_creds(struct linux_binprm *bprm);
include/linux/kernel.h+4−2
@@ -77,13 +77,15 @@ · 76 unmodified lines
7777
7878 /*
7979 * Divide positive or negative dividend by positive divisor and round
80− * to closest integer. Result is undefined for negative divisors.
80+ * to closest integer. Result is undefined for negative divisors and
81+ * for negative dividends if the divisor variable type is unsigned.
8182 */
8283 #define DIV_ROUND_CLOSEST(x, divisor)( \
8384 { \
8485 typeof(x) __x = x; \
8586 typeof(divisor) __d = divisor; \
86− (((typeof(x))-1) > 0 || (__x) > 0) ? \
87+ (((typeof(x))-1) > 0 || \
88+ ((typeof(divisor))-1) > 0 || (__x) > 0) ? \
8789 (((__x) + ((__d) / 2)) / (__d)) : \
8890 (((__x) - ((__d) / 2)) / (__d)); \
8991 } \
kernel/kcmp.c+1−0
@@ -4,6 +4,7 @@ · 3 unmodified lines
44 #include <linux/string.h>
55 #include <linux/random.h>
66 #include <linux/module.h>
7+#include <linux/ptrace.h>
78 #include <linux/init.h>
89 #include <linux/errno.h>
910 #include <linux/cache.h>
kernel/modsign_pubkey.c+6−9
@@ -34,18 +34,15 @@ static __init int module_verify_init(void) · 33 unmodified lines
3434 {
3535 pr_notice("Initialise module verification\n");
3636
37− modsign_keyring = key_alloc(&key_type_keyring, ".module_sign",
38− KUIDT_INIT(0), KGIDT_INIT(0),
39− current_cred(),
40− (KEY_POS_ALL & ~KEY_POS_SETATTR) |
41− KEY_USR_VIEW | KEY_USR_READ,
42− KEY_ALLOC_NOT_IN_QUOTA);
37+ modsign_keyring = keyring_alloc(".module_sign",
38+ KUIDT_INIT(0), KGIDT_INIT(0),
39+ current_cred(),
40+ ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
41+ KEY_USR_VIEW | KEY_USR_READ),
42+ KEY_ALLOC_NOT_IN_QUOTA, NULL);
4343 if (IS_ERR(modsign_keyring))
4444 panic("Can't allocate module signing keyring\n");
4545
46− if (key_instantiate_and_link(modsign_keyring, NULL, 0, NULL, NULL) < 0)
47− panic("Can't instantiate module signing keyring\n");
48−
4946 return 0;
5047 }
5148
mm/compaction.c+20−6
@@ -17,6 +17,21 @@ · 16 unmodified lines
1717 #include <linux/balloon_compaction.h>
1818 #include "internal.h"
1919
20+#ifdef CONFIG_COMPACTION
21+static inline void count_compact_event(enum vm_event_item item)
22+{
23+ count_vm_event(item);
24+}
25+
26+static inline void count_compact_events(enum vm_event_item item, long delta)
27+{
28+ count_vm_events(item, delta);
29+}
30+#else
31+#define count_compact_event(item) do { } while (0)
32+#define count_compact_events(item, delta) do { } while (0)
33+#endif
34+
2035 #if defined CONFIG_COMPACTION || defined CONFIG_CMA
2136
2237 #define CREATE_TRACE_POINTS
@@ -303,10 +318,9 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, · 280 unmodified lines
303318 if (blockpfn == end_pfn)
304319 update_pageblock_skip(cc, valid_page, total_isolated, false);
305320
306− count_vm_events(COMPACTFREE_SCANNED, nr_scanned);
321+ count_compact_events(COMPACTFREE_SCANNED, nr_scanned);
307322 if (total_isolated)
308− count_vm_events(COMPACTISOLATED, total_isolated);
309−
323+ count_compact_events(COMPACTISOLATED, total_isolated);
310324 return total_isolated;
311325 }
312326
@@ -613,9 +627,9 @@ next_pageblock: · 300 unmodified lines
613627
614628 trace_mm_compaction_isolate_migratepages(nr_scanned, nr_isolated);
615629
616− count_vm_events(COMPACTMIGRATE_SCANNED, nr_scanned);
630+ count_compact_events(COMPACTMIGRATE_SCANNED, nr_scanned);
617631 if (nr_isolated)
618− count_vm_events(COMPACTISOLATED, nr_isolated);
632+ count_compact_events(COMPACTISOLATED, nr_isolated);
619633
620634 return low_pfn;
621635 }
@@ -1110,7 +1124,7 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist, · 488 unmodified lines
11101124 if (!order || !may_enter_fs || !may_perform_io)
11111125 return rc;
11121126
1113− count_vm_event(COMPACTSTALL);
1127+ count_compact_event(COMPACTSTALL);
11141128
11151129 #ifdef CONFIG_CMA
11161130 if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
mm/huge_memory.c+3−3
@@ -574,19 +574,19 @@ static int __init hugepage_init_sysfs(struct kobject **hugepage_kobj) · 573 unmodified lines
574574
575575 *hugepage_kobj = kobject_create_and_add("transparent_hugepage", mm_kobj);
576576 if (unlikely(!*hugepage_kobj)) {
577− printk(KERN_ERR "hugepage: failed kobject create\n");
577+ printk(KERN_ERR "hugepage: failed to create transparent hugepage kobject\n");
578578 return -ENOMEM;
579579 }
580580
581581 err = sysfs_create_group(*hugepage_kobj, &hugepage_attr_group);
582582 if (err) {
583− printk(KERN_ERR "hugepage: failed register hugeage group\n");
583+ printk(KERN_ERR "hugepage: failed to register transparent hugepage group\n");
584584 goto delete_obj;
585585 }
586586
587587 err = sysfs_create_group(*hugepage_kobj, &khugepaged_attr_group);
588588 if (err) {
589− printk(KERN_ERR "hugepage: failed register hugeage group\n");
589+ printk(KERN_ERR "hugepage: failed to register transparent hugepage group\n");
590590 goto remove_hp_group;
591591 }
592592
mm/memcontrol.c+13−1
@@ -6090,7 +6090,6 @@ mem_cgroup_css_alloc(struct cgroup *cont) · 6089 unmodified lines
60906090 &per_cpu(memcg_stock, cpu);
60916091 INIT_WORK(&stock->work, drain_local_stock);
60926092 }
6093− hotcpu_notifier(memcg_cpu_hotplug_callback, 0);
60946093 } else {
60956094 parent = mem_cgroup_from_cont(cont->parent);
60966095 memcg->use_hierarchy = parent->use_hierarchy;
@@ -6756,6 +6755,19 @@ struct cgroup_subsys mem_cgroup_subsys = { · 659 unmodified lines
67566755 .use_id = 1,
67576756 };
67586757
6758+/*
6759+ * The rest of init is performed during ->css_alloc() for root css which
6760+ * happens before initcalls. hotcpu_notifier() can't be done together as
6761+ * it would introduce circular locking by adding cgroup_lock -> cpu hotplug
6762+ * dependency. Do it from a subsys_initcall().
6763+ */
6764+static int __init mem_cgroup_init(void)
6765+{
6766+ hotcpu_notifier(memcg_cpu_hotplug_callback, 0);
6767+ return 0;
6768+}
6769+subsys_initcall(mem_cgroup_init);
6770+
67596771 #ifdef CONFIG_MEMCG_SWAP
67606772 static int __init enable_swap_account(char *s)
67616773 {
mm/page-writeback.c+20−5
@@ -200,6 +200,18 @@ static unsigned long highmem_dirtyable_memory(unsigned long total) · 199 unmodified lines
200200 x += zone_page_state(z, NR_FREE_PAGES) +
201201 zone_reclaimable_pages(z) - z->dirty_balance_reserve;
202202 }
203+ /*
204+ * Unreclaimable memory (kernel memory or anonymous memory
205+ * without swap) can bring down the dirtyable pages below
206+ * the zone's dirty balance reserve and the above calculation
207+ * will underflow. However we still want to add in nodes
208+ * which are below threshold (negative values) to get a more
209+ * accurate calculation but make sure that the total never
210+ * underflows.
211+ */
212+ if ((long)x < 0)
213+ x = 0;
214+
203215 /*
204216 * Make sure that the number of highmem pages is never larger
205217 * than the number of the total dirtyable memory. This can only
@@ -222,8 +234,8 @@ static unsigned long global_dirtyable_memory(void) · 16 unmodified lines
222234 {
223235 unsigned long x;
224236
225− x = global_page_state(NR_FREE_PAGES) + global_reclaimable_pages() -
226− dirty_balance_reserve;
237+ x = global_page_state(NR_FREE_PAGES) + global_reclaimable_pages();
238+ x -= min(x, dirty_balance_reserve);
227239
228240 if (!vm_highmem_is_dirtyable)
229241 x -= highmem_dirtyable_memory(x);
@@ -290,9 +302,12 @@ static unsigned long zone_dirtyable_memory(struct zone *zone) · 60 unmodified lines
290302 * highmem zone can hold its share of dirty pages, so we don't
291303 * care about vm_highmem_is_dirtyable here.
292304 */
293− return zone_page_state(zone, NR_FREE_PAGES) +
294− zone_reclaimable_pages(zone) -
295− zone->dirty_balance_reserve;
305+ unsigned long nr_pages = zone_page_state(zone, NR_FREE_PAGES) +
306+ zone_reclaimable_pages(zone);
307+
308+ /* don't allow this to underflow */
309+ nr_pages -= min(nr_pages, zone->dirty_balance_reserve);
310+ return nr_pages;
296311 }
297312
298313 /**
mm/page_alloc.c+9−2
@@ -5978,8 +5978,15 @@ done: · 5977 unmodified lines
59785978
59795979 void free_contig_range(unsigned long pfn, unsigned nr_pages)
59805980 {
5981− for (; nr_pages--; ++pfn)
5982− __free_page(pfn_to_page(pfn));
5981+ unsigned int count = 0;
5982+
5983+ for (; nr_pages--; pfn++) {
5984+ struct page *page = pfn_to_page(pfn);
5985+
5986+ count += page_count(page) != 1;
5987+ __free_page(page);
5988+ }
5989+ WARN(count != 0, "%d pages are still in use!\n", count);
59835990 }
59845991 #endif
59855992
scripts/checkpatch.pl+5−2
@@ -2226,8 +2226,11 @@ sub process { · 2225 unmodified lines
22262226 my $path = $1;
22272227 if ($path =~ m{//}) {
22282228 ERROR("MALFORMED_INCLUDE",
2229− "malformed #include filename\n" .
2230− $herecurr);
2229+ "malformed #include filename\n" . $herecurr);
2230+ }
2231+ if ($path =~ "^uapi/" && $realfile =~ m@\binclude/uapi/@) {
2232+ ERROR("UAPI_INCLUDE",
2233+ "No #include in ...include/uapi/... should use a uapi/ path prefix\n" . $herecurr);
22312234 }
22322235 }
22332236
security/keys/process_keys.c+0−2
@@ -367,8 +367,6 @@ key_ref_t search_my_process_keyrings(struct key_type *type, · 366 unmodified lines
367367
368368 switch (PTR_ERR(key_ref)) {
369369 case -EAGAIN: /* no key */
370− if (ret)
371− break;
372370 case -ENOKEY: /* negative key */
373371 ret = key_ref;
374372 break;