linux-toradex.git/mm, branch v2.6.29

vmscan: pgmoved should be cleared after updating recent_rotated

2009-03-14T18:57:22+00:00

pgmoved should be cleared after updating recent_rotated.

Signed-off-by: Daisuke Nishimura 
Cc: Rik van Riel 
Cc: Lee Schermerhorn 
Acked-by: KOSAKI Motohiro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

memcg: use correct scan number at reclaim

2009-03-12T23:20:24+00:00

Even when page reclaim is under mem_cgroup, # of scan page is determined by
status of global LRU. Fix that.

Signed-off-by: KOSAKI Motohiro 
Signed-off-by: KAMEZAWA Hiroyuki 
Cc: Daisuke Nishimura 
Cc: Balbir Singh 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: fix lazy vmap purging (use-after-free error)

2009-02-28T00:26:21+00:00

I just got this new warning from kmemcheck:

    WARNING: kmemcheck: Caught 32-bit read from freed memory (c7806a60)
    a06a80c7ecde70c1a04080c700000000a06709c1000000000000000000000000
     f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f
     ^

    Pid: 0, comm: swapper Not tainted (2.6.29-rc4 #230)
    EIP: 0060:[] EFLAGS: 00000286 CPU: 0
    EIP is at __purge_vmap_area_lazy+0x117/0x140
    EAX: 00070f43 EBX: c7806a40 ECX: c1677080 EDX: 00027b66
    ESI: 00002001 EDI: c170df0c EBP: c170df00 ESP: c178830c
     DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
    CR0: 80050033 CR2: c7806b14 CR3: 01775000 CR4: 00000690
    DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
    DR6: 00004000 DR7: 00000000
     [] free_unmap_vmap_area_noflush+0x6e/0x70
     [] remove_vm_area+0x2a/0x70
     [] __vunmap+0x45/0xe0
     [] vunmap+0x1e/0x30
     [] text_poke+0x95/0x150
     [] alternatives_smp_unlock+0x49/0x60
     [] alternative_instructions+0x11b/0x124
     [] check_bugs+0xbd/0xdc
     [] start_kernel+0x2ed/0x360
     [] __init_begin+0x9e/0xa9
     [] 0xffffffff

It happened here:

    $ addr2line -e vmlinux -i c1096df7
    mm/vmalloc.c:540

Code:

	list_for_each_entry(va, &valist, purge_list)
		__free_vmap_area(va);

It's this instruction:

    mov    0x20(%ebx),%edx

Which corresponds to a dereference of va->purge_list.next:

    (gdb) p ((struct vmap_area *) 0)->purge_list.next
    Cannot access memory at address 0x20

It seems that we should use "safe" list traversal here, as the element
is freed inside the loop. Please verify that this is the right fix.

Acked-by: Nick Piggin 
Signed-off-by: Vegard Nossum 
Cc: Pekka Enberg 
Cc: Ingo Molnar 
Cc: "Paul E. McKenney" 
Cc: 		[2.6.28.x]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: vmap fix overflow

2009-02-28T00:26:21+00:00

The new vmap allocator can wrap the address and get confused in the case
of large allocations or VMALLOC_END near the end of address space.

Problem reported by Christoph Hellwig on a 32-bit XFS workload.

Signed-off-by: Nick Piggin 
Reported-by: Christoph Hellwig 
Cc: 		[2.6.28.x]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

shmem: fix shared anonymous accounting

2009-02-25T20:21:42+00:00

Each time I exit Firefox, /proc/meminfo's Committed_AS goes down almost
400 kB: OVERCOMMIT_NEVER would be allowing overcommits it should
prohibit.

Commit fc8744adc870a8d4366908221508bb113d8b72ee "Stop playing silly
games with the VM_ACCOUNT flag" changed shmem_file_setup() to set the
shmem file's VM_ACCOUNT flag according to VM_NORESERVE not being set in
the vma flags; but did so only _after_ the shmem_acct_size(flags, size)
call which is expected to pre-account a shared anonymous object.

It's all clearer if we switch shmem.c over to use VM_NORESERVE
throughout in place of !VM_ACCOUNT.

But I very nearly sent in a patch which mistakenly removed the
accounting from tmpfs files: shmem_get_inode()'s memset was good for not
setting VM_ACCOUNT, but now it needs to set VM_NORESERVE.

Rather than setting that by default, then perhaps clearing it again in
shmem_file_setup(), let's pass it as a flag to shmem_get_inode(): that
allows us to remove the #ifdef CONFIG_SHMEM from shmem_file_setup().

Signed-off-by: Hugh Dickins 
Signed-off-by: Linus Torvalds

Merge branch 'hibernate'

2009-02-21T22:17:26+00:00

* hibernate:
  PM: Fix suspend_console and resume_console to use only one semaphore
  PM: Wait for console in resume
  PM: Fix pm_notifiers during user mode hibernation
  swsusp: clean up shrink_all_zones()
  swsusp: dont fiddle with swappiness
  PM: fix build for CONFIG_PM unset
  PM/hibernate: fix "swap breaks after hibernation failures"
  PM/resume: wait for device probing to finish
  Consolidate driver_probe_done() loops into one place

swsusp: clean up shrink_all_zones()

2009-02-21T22:17:17+00:00

Move local variables to innermost possible scopes and use local
variables to cache calculations/reads done more than once.

No change in functionality (intended).

Signed-off-by: Johannes Weiner 
Reviewed-by: KOSAKI Motohiro 
Signed-off-by: Rafael J. Wysocki 
Cc: Len Brown 
Cc: Greg KH 
Acked-by: Pavel Machek 
Signed-off-by: Linus Torvalds

swsusp: dont fiddle with swappiness

2009-02-21T22:17:17+00:00

sc.swappiness is not used in the swsusp memory shrinking path, do not
set it.

Signed-off-by: Johannes Weiner 
Reviewed-by: KOSAKI Motohiro 
Signed-off-by: Rafael J. Wysocki 
Cc: Len Brown 
Cc: Greg KH 
Signed-off-by: Linus Torvalds

PM/hibernate: fix "swap breaks after hibernation failures"

2009-02-21T22:17:17+00:00

http://bugzilla.kernel.org/show_bug.cgi?id=12239

The image writing code dropped a reference to the current swap device.
This doesn't show up if the hibernation succeeds - because it doesn't
affect the image which gets resumed.  But it means multiple _failed_
hibernations end up freeing the swap device while it is still use!

swsusp_write() finds the block device for the swap file using swap_type_of().
It then uses blkdev_get() / blkdev_put() to open and close the block device.

Unfortunately, blkdev_get() assumes ownership of the inode of the block_device
passed to it.  So blkdev_put() calls iput() on the inode.  This is by design
and other callers expect this behaviour.  The fix is for swap_type_of() to take
a reference on the inode using bdget().

Signed-off-by: Alan Jenkins 
Signed-off-by: Rafael J. Wysocki 
Cc: Len Brown 
Cc: Greg KH 
Signed-off-by: Linus Torvalds

vmalloc: call flush_cache_vunmap() from unmap_kernel_range()

2009-02-21T01:57:49+00:00

Impact: proper vcache flush on unmap_kernel_range()

flush_cache_vunmap() should be called before pages are unmapped.  Add
a call to it in unmap_kernel_range().

Signed-off-by: Tejun Heo 
Acked-by: Nick Piggin 
Acked-by: David S. Miller 
Cc: 		[2.6.28.x]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds