{"push_id":1376014838,"size":19,"distinct_size":19,"ref":"refs/heads/cm-14.1","head":"962c228c51d9cddb0eb8711ff2ce029609e882a0","before":"267c1c611069b1afa577fbb086c9a4e7bcd41531","commits":[{"sha":"4cd1e856c2ddb23155be7d25f6c52b593a5161a7","author":{"name":"Krishnankutty Kolathappilly","email":"1fab8e5813896befecf86829f2d9c8a8d9576a49@codeaurora.org"},"message":"ALSA: compress: Memset timestamp structure to zero.\n\nsnd_compr_tstamp is initialized using aggregate initialization\nthat does not zero out the padded bytes. Initialize timestamp\nstructure to zero using memset to avoid this.\n\nBug: 28770164\nCRs-Fixed: 568717\nChange-Id: I7a7d188705161f06201f1a1f2945bb6acd633d5d\nSigned-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/4cd1e856c2ddb23155be7d25f6c52b593a5161a7"},{"sha":"f71a24bca94b297ad7a7303696c9d965404b6e3e","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"BACKPORT: perf tools: Document the perf sysctls\n\nperf_event_paranoid was only documented in source code and a perf error\nmessage.  Copy the documentation from the error message to\nDocumentation/sysctl/kernel.txt.\n\nBACKPORT notes:\nThe error printing from upstream does not exist in the 3.4 kernel.\nOnly backporting the documentation update from this commit.\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: linux-doc@vger.kernel.org\nLink: http://lkml.kernel.org/r/20160119213515.GG2637@decadent.org.uk\n[ Remove reference to external Documentation file, provide info inline, as before ]\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\n\nBug: 29054680\nChange-Id: I13e73cfb2ad761c94762d0c8196df7725abdf5c5","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/f71a24bca94b297ad7a7303696c9d965404b6e3e"},{"sha":"f2258ef7c5dd33fa9141eb7c09746f9b897c3d36","author":{"name":"Zhao Wei Liew","email":"253f3717312c1bfbdbf2baa671d02018f93d0a79@gmail.com"},"message":"sunrpc: Fix possibly uninitialized variable warnings\n\nThese warnings are encountered when building with GCC 4.9.\n\nChange-Id: I58b0c4f8c2d1724e42bb8037104ef93337c46f3d\nSigned-off-by: Zhao Wei Liew <zhaoweiliew@gmail.com>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/f2258ef7c5dd33fa9141eb7c09746f9b897c3d36"},{"sha":"b800c8955158df8237fc0154f4c4a038b03b3873","author":{"name":"David Engraf","email":"d9d6d7eddfcbe707fd8f2fd347ce148d8efd30a8@sysgo.com"},"message":"hrtimer: Fix ktime_add_ns() overflow on 32bit architectures\n\ncommit 51fd36f3fad8447c487137ae26b9d0b3ce77bb25 upstream.\n\nOne can trigger an overflow when using ktime_add_ns() on a 32bit\narchitecture not supporting CONFIG_KTIME_SCALAR.\n\nWhen passing a very high value for u64 nsec, e.g. 7881299347898368000\nthe do_div() function converts this value to seconds (7881299347) which\nis still to high to pass to the ktime_set() function as long. The result\nin is a negative value.\n\nThe problem on my system occurs in the tick-sched.c,\ntick_nohz_stop_sched_tick() when time_delta is set to\ntimekeeping_max_deferment(). The check for time_delta < KTIME_MAX is\nvalid, thus ktime_add_ns() is called with a too large value resulting in\na negative expire value. This leads to an endless loop in the ticker code:\n\ntime_delta: 7881299347898368000\nexpires = ktime_add_ns(last_update, time_delta)\nexpires: negative value\n\nThis fix caps the value to KTIME_MAX.\n\nThis error doesn't occurs on 64bit or architectures supporting\nCONFIG_KTIME_SCALAR (e.g. ARM, x86-32).\n\nChange-Id: I4e377ba739ca8476fa07001b67539130440dcad7\nSigned-off-by: David Engraf <david.engraf@sysgo.com>\n[jstultz: Minor tweaks to commit message & header]\nSigned-off-by: John Stultz <john.stultz@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/b800c8955158df8237fc0154f4c4a038b03b3873"},{"sha":"fb7d619addae670b1c42d907b69c7c689291c863","author":{"name":"Prarit Bhargava","email":"57afa0c35fd38a11b51d30edc3a65ab805a2449c@redhat.com"},"message":"hrtimer: Add expiry time overflow check in hrtimer_interrupt\n\ncommit 8f294b5a139ee4b75e890ad5b443c93d1e558a8b upstream.\n\nThe settimeofday01 test in the LTP testsuite effectively does\n\n        gettimeofday(current time);\n        settimeofday(Jan 1, 1970 + 100 seconds);\n        settimeofday(current time);\n\nThis test causes a stack trace to be displayed on the console during the\nsetting of timeofday to Jan 1, 1970 + 100 seconds:\n\n[  131.066751] ------------[ cut here ]------------\n[  131.096448] WARNING: at kernel/time/clockevents.c:209 clockevents_program_event+0x135/0x140()\n[  131.104935] Hardware name: Dinar\n[  131.108150] Modules linked in: sg nfsv3 nfs_acl nfsv4 auth_rpcgss nfs dns_resolver fscache lockd sunrpc nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables kvm_amd kvm sp5100_tco bnx2 i2c_piix4 crc32c_intel k10temp fam15h_power ghash_clmulni_intel amd64_edac_mod pcspkr serio_raw edac_mce_amd edac_core microcode xfs libcrc32c sr_mod sd_mod cdrom ata_generic crc_t10dif pata_acpi radeon i2c_algo_bit drm_kms_helper ttm drm ahci pata_atiixp libahci libata usb_storage i2c_core dm_mirror dm_region_hash dm_log dm_mod\n[  131.176784] Pid: 0, comm: swapper/28 Not tainted 3.8.0+ #6\n[  131.182248] Call Trace:\n[  131.184684]  <IRQ>  [<ffffffff810612af>] warn_slowpath_common+0x7f/0xc0\n[  131.191312]  [<ffffffff8106130a>] warn_slowpath_null+0x1a/0x20\n[  131.197131]  [<ffffffff810b9fd5>] clockevents_program_event+0x135/0x140\n[  131.203721]  [<ffffffff810bb584>] tick_program_event+0x24/0x30\n[  131.209534]  [<ffffffff81089ab1>] hrtimer_interrupt+0x131/0x230\n[  131.215437]  [<ffffffff814b9600>] ? cpufreq_p4_target+0x130/0x130\n[  131.221509]  [<ffffffff81619119>] smp_apic_timer_interrupt+0x69/0x99\n[  131.227839]  [<ffffffff8161805d>] apic_timer_interrupt+0x6d/0x80\n[  131.233816]  <EOI>  [<ffffffff81099745>] ? sched_clock_cpu+0xc5/0x120\n[  131.240267]  [<ffffffff814b9ff0>] ? cpuidle_wrap_enter+0x50/0xa0\n[  131.246252]  [<ffffffff814b9fe9>] ? cpuidle_wrap_enter+0x49/0xa0\n[  131.252238]  [<ffffffff814ba050>] cpuidle_enter_tk+0x10/0x20\n[  131.257877]  [<ffffffff814b9c89>] cpuidle_idle_call+0xa9/0x260\n[  131.263692]  [<ffffffff8101c42f>] cpu_idle+0xaf/0x120\n[  131.268727]  [<ffffffff815f8971>] start_secondary+0x255/0x257\n[  131.274449] ---[ end trace 1151a50552231615 ]---\n\nWhen we change the system time to a low value like this, the value of\ntimekeeper->offs_real will be a negative value.\n\nIt seems that the WARN occurs because an hrtimer has been started in the time\nbetween the releasing of the timekeeper lock and the IPI call (via a call to\non_each_cpu) in clock_was_set() in the do_settimeofday() code.  The end result\nis that a REALTIME_CLOCK timer has been added with softexpires = expires =\nKTIME_MAX.  The hrtimer_interrupt() fires/is called and the loop at\nkernel/hrtimer.c:1289 is executed.  In this loop the code subtracts the\nclock base's offset (which was set to timekeeper->offs_real in\ndo_settimeofday()) from the current hrtimer_cpu_base->expiry value (which\nwas KTIME_MAX):\n\n\tKTIME_MAX - (a negative value) = overflow\n\nA simple check for an overflow can resolve this problem.  Using KTIME_MAX\ninstead of the overflow value will result in the hrtimer function being run,\nand the reprogramming of the timer after that.\n\nChange-Id: If2361e19ab23a68a97b4d0fa76db945c47a7c3fe\nReviewed-by: Rik van Riel <riel@redhat.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Prarit Bhargava <prarit@redhat.com>\n[jstultz: Tweaked commit subject]\nSigned-off-by: John Stultz <john.stultz@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/fb7d619addae670b1c42d907b69c7c689291c863"},{"sha":"efe8faa6525905bcf748b628ece415d9a8c5d6bc","author":{"name":"Stuart Hayes","email":"c8971857d66d7bf43409f1f5ebe91a224267676a@gmail.com"},"message":"hrtimer: Prevent all reprogramming if hang detected\n\ncommit 6c6c0d5a1c949d2e084706f9e5fb1fccc175b265 upstream.\n\nIf the last hrtimer interrupt detected a hang it sets hang_detected=1\nand programs the clock event device with a delay to let the system\nmake progress.\n\nIf hang_detected == 1, we prevent reprogramming of the clock event\ndevice in hrtimer_reprogram() but not in hrtimer_force_reprogram().\n\nThis can lead to the following situation:\n\nhrtimer_interrupt()\n   hang_detected = 1;\n   program ce device to Xms from now (hang delay)\n\nWe have two timers pending:\n   T1 expires 50ms from now\n   T2 expires 5s from now\n\nNow T1 gets canceled, which causes hrtimer_force_reprogram() to be\ninvoked, which in turn programs the clock event device to T2 (5\nseconds from now).\n\nAny hrtimer_start after that will not reprogram the hardware due to\nhang_detected still being set. So we effectivly block all timers until\nthe T2 event fires and cleans up the hang situation.\n\nAdd a check for hang_detected to hrtimer_force_reprogram() which\nprevents the reprogramming of the hang delay in the hardware\ntimer. The subsequent hrtimer_interrupt will resolve all outstanding\nissues.\n\n[ tglx: Rewrote subject and changelog and fixed up the comment in\n  \thrtimer_force_reprogram() ]\n\nChange-Id: I85860e256cc09e0162281726922940526dd99959\nSigned-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>\nLink: http://lkml.kernel.org/r/53602DC6.2060101@gmail.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/efe8faa6525905bcf748b628ece415d9a8c5d6bc"},{"sha":"4ab6c5e4430843ee9ca3f7d54304e396a247ea07","author":{"name":"Viresh Kumar","email":"4ca49bc1dcfdfc376d29da1eb07a3e0b3cd46daa@linaro.org"},"message":"hrtimer: Set expiry time before switch_hrtimer_base()\n\ncommit 84ea7fe37908254c3bd90910921f6e1045c1747a upstream.\n\nswitch_hrtimer_base() calls hrtimer_check_target() which ensures that\nwe do not migrate a timer to a remote cpu if the timer expires before\nthe current programmed expiry time on that remote cpu.\n\nBut __hrtimer_start_range_ns() calls switch_hrtimer_base() before the\nnew expiry time is set. So the sanity check in hrtimer_check_target()\nis operating on stale or even uninitialized data.\n\nUpdate expiry time before calling switch_hrtimer_base().\n\n[ tglx: Rewrote changelog once again ]\n\nChange-Id: Ie01d86856a3c4495404e8b35d05275efaa317531\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>\nCc: linaro-kernel@lists.linaro.org\nCc: linaro-networking@linaro.org\nCc: fweisbec@gmail.com\nCc: arvind.chauhan@arm.com\nLink: http://lkml.kernel.org/r/81999e148745fc51bbcd0615823fbab9b2e87e23.1399882253.git.viresh.kumar@linaro.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/4ab6c5e4430843ee9ca3f7d54304e396a247ea07"},{"sha":"b75836dcd7a333dad5ba7be3e6c019dc01f97070","author":{"name":"syphyr","email":"592575b7e3ad8b3b1a59e56bd1c6dbcd4174c9c8@gmail.com"},"message":"awifi: defconfig: Enable RCU_FAST_NO_HZ\n\nRCU_FAST_NO_HZ has been shown to improve power consumption\nthanks to CPUs entering nohz idle mode more quickly.","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/b75836dcd7a333dad5ba7be3e6c019dc01f97070"},{"sha":"bfb94fb0b126bacbe35bf0a65072923d0ca60026","author":{"name":"Paul E. McKenney","email":"54db74b147e8d38a5646b91b8f7eb5b54f123fc4@linaro.org"},"message":"rcu: Fix day-one dyntick-idle stall-warning bug\n\nEach grace period is supposed to have at least one callback waiting\nfor that grace period to complete.  However, if CONFIG_NO_HZ=n, an\nextra callback-free grace period is no big problem -- it will chew up\na tiny bit of CPU time, but it will complete normally.  In contrast,\nCONFIG_NO_HZ=y kernels have the potential for all the CPUs to go to\nsleep indefinitely, in turn indefinitely delaying completion of the\ncallback-free grace period.  Given that nothing is waiting on this grace\nperiod, this is also not a problem.\n\nThat is, unless RCU CPU stall warnings are also enabled, as they are\nin recent kernels.  In this case, if a CPU wakes up after at least one\nminute of inactivity, an RCU CPU stall warning will result.  The reason\nthat no one noticed until quite recently is that most systems have enough\nOS noise that they will never remain absolutely idle for a full minute.\nBut there are some embedded systems with cut-down userspace configurations\nthat consistently get into this situation.\n\nAll this begs the question of exactly how a callback-free grace period\ngets started in the first place.  This can happen due to the fact that\nCPUs do not necessarily agree on which grace period is in progress.\nIf a CPU still believes that the grace period that just completed is\nstill ongoing, it will believe that it has callbacks that need to wait for\nanother grace period, never mind the fact that the grace period that they\nwere waiting for just completed.  This CPU can therefore erroneously\ndecide to start a new grace period.  Note that this can happen in\nTREE_RCU and TREE_PREEMPT_RCU even on a single-CPU system:  Deadlock\nconsiderations mean that the CPU that detected the end of the grace\nperiod is not necessarily officially informed of this fact for some time.\n\nOnce this CPU notices that the earlier grace period completed, it will\ninvoke its callbacks.  It then won't have any callbacks left.  If no\nother CPU has any callbacks, we now have a callback-free grace period.\n\nThis commit therefore makes CPUs check more carefully before starting a\nnew grace period.  This new check relies on an array of tail pointers\ninto each CPU's list of callbacks.  If the CPU is up to date on which\ngrace periods have completed, it checks to see if any callbacks follow\nthe RCU_DONE_TAIL segment, otherwise it checks to see if any callbacks\nfollow the RCU_WAIT_TAIL segment.  The reason that this works is that\nthe RCU_WAIT_TAIL segment will be promoted to the RCU_DONE_TAIL segment\nas soon as the CPU is officially notified that the old grace period\nhas ended.\n\nThis change is to cpu_needs_another_gp(), which is called in a number\nof places.  The only one that really matters is in rcu_start_gp(), where\nthe root rcu_node structure's ->lock is held, which prevents any\nother CPU from starting or completing a grace period, so that the\ncomparison that determines whether the CPU is missing the completion\nof a grace period is stable.\n\nChange-Id: Ic77e2bbe865059aa6f363db284473e9adcf8797e\nReported-by: Becky Bruce <bgillbruce@gmail.com>\nReported-by: Subodh Nijsure <snijsure@grid-net.com>\nReported-by: Paul Walmsley <paul@pwsan.com>\nSigned-off-by: Paul E. McKenney <paul.mckenney@linaro.org>\nSigned-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nTested-by: Paul Walmsley <paul@pwsan.com>  # OMAP3730, OMAP4430\nCc: stable@vger.kernel.org\nSigned-off-by: Jin Hong <jinh@codeaurora.org>\n(cherry picked from commit a389ade9175fa41dd1513a8ba049f0d3b80ad372)","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/bfb94fb0b126bacbe35bf0a65072923d0ca60026"},{"sha":"c1c90a96f855c27c0c710d39c24e35027e5bfab5","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"rcu: Fix batch-limit size problem\n\ncommit 878d7439d0f45a95869e417576774673d1fa243f upstream.\n\nCommit 29c00b4a1d9e27 (rcu: Add event-tracing for RCU callback\ninvocation) added a regression in rcu_do_batch()\n\nUnder stress, RCU is supposed to allow to process all items in queue,\ninstead of a batch of 10 items (blimit), but an integer overflow makes\nthe effective limit being 1.  So, unless there is frequent idle periods\n(during which RCU ignores batch limits), RCU can be forced into a\nstate where it cannot keep up with the callback-generation rate,\neventually resulting in OOM.\n\nThis commit therefore converts a few variables in rcu_do_batch() from\nint to long to fix this problem, along with the module parameters\ncontrolling the batch limits.\n\nChange-Id: I6d6dcb94d2a31f0cf00d3121a7b92e49aa7ab108\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/c1c90a96f855c27c0c710d39c24e35027e5bfab5"},{"sha":"6f6901296010a47094de0887a357b5611c82ff24","author":{"name":"Frederic Weisbecker","email":"fe7fea42e1cb0b94cea2acd3bec755592d0c9ba0@gmail.com"},"message":"nohz: Make tick_nohz_irq_exit() irq safe\n\ncommit e5ab012c3271990e8457055c25cafddc1ae8aa6b upstream.\n\nAs it stands, irq_exit() may or may not be called with\nirqs disabled, depending on __ARCH_IRQ_EXIT_IRQS_DISABLED\nthat the arch can define.\n\nIt makes tick_nohz_irq_exit() unsafe. For example two\ninterrupts can race in tick_nohz_stop_sched_tick(): the inner\nmost one computes the expiring time on top of the timer list,\nthen it's interrupted right before reprogramming the\nclock. The new interrupt enqueues a new timer list timer,\nit reprogram the clock to take it into account and it exits.\nThe CPUs resumes the inner most interrupt and performs the clock\nreprogramming without considering the new timer list timer.\n\nThis regression has been introduced by:\n     280f06774afedf849f0b34248ed6aff57d0f6908\n     (\"nohz: Separate out irq exit and idle loop dyntick logic\")\n\nLet's fix it right now with the appropriate protections.\n\nA saner long term solution will be to remove\n__ARCH_IRQ_EXIT_IRQS_DISABLED and mandate that irq_exit() is called\nwith interrupts disabled.\n\nChange-Id: Ib453b14a1bdaac53b6c685ba3eac92dbd0985b2a\nSigned-off-by: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: Linus Torvalds <torvalds@linuxfoundation.org>\nLink: http://lkml.kernel.org/r/1361373336-11337-1-git-send-email-fweisbec@gmail.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Lingzhu Xiang <lxiang@redhat.com>\nReviewed-by: CAI Qian <caiqian@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/6f6901296010a47094de0887a357b5611c82ff24"},{"sha":"6c43dea3141ac56857f53e8a06318858f1421b27","author":{"name":"Thomas Gleixner","email":"352b5f5ba0189d2583768a9bb8247f98115b9038@linutronix.de"},"message":"tick: Cleanup NOHZ per cpu data on cpu down\n\ncommit 4b0c0f294f60abcdd20994a8341a95c8ac5eeb96 upstream.\n\nPrarit reported a crash on CPU offline/online. The reason is that on\nCPU down the NOHZ related per cpu data of the dead cpu is not cleaned\nup. If at cpu online an interrupt happens before the per cpu tick\ndevice is registered the irq_enter() check potentially sees stale data\nand dereferences a NULL pointer.\n\nCleanup the data after the cpu is dead.\n\nChange-Id: I5f2be7afd398bc97b997ab2143f9d71230c44dd5\nReported-by: Prarit Bhargava <prarit@redhat.com>\nCc: Mike Galbraith <bitbucket@online.de>\nLink: http://lkml.kernel.org/r/alpine.LFD.2.02.1305031451561.2886@ionos\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/6c43dea3141ac56857f53e8a06318858f1421b27"},{"sha":"779717afe87643668e892de71121d1af96a6d378","author":{"name":"Jiang Liu","email":"92555a816b2d471b13593d44f0a8df7dfb6c5623@huawei.com"},"message":"memory hotplug: fix invalid memory access caused by stale kswapd pointer\n\ncommit d8adde17e5f858427504725218c56aef90e90fc7 upstream.\n\nkswapd_stop() is called to destroy the kswapd work thread when all memory\nof a NUMA node has been offlined.  But kswapd_stop() only terminates the\nwork thread without resetting NODE_DATA(nid)->kswapd to NULL.  The stale\npointer will prevent kswapd_run() from creating a new work thread when\nadding memory to the memory-less NUMA node again.  Eventually the stale\npointer may cause invalid memory access.\n\nAn example stack dump as below. It's reproduced with 2.6.32, but latest\nkernel has the same issue.\n\n  BUG: unable to handle kernel NULL pointer dereference at (null)\n  IP: [<ffffffff81051a94>] exit_creds+0x12/0x78\n  PGD 0\n  Oops: 0000 [#1] SMP\n  last sysfs file: /sys/devices/system/memory/memory391/state\n  CPU 11\n  Modules linked in: cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq microcode fuse loop dm_mod tpm_tis rtc_cmos i2c_i801 rtc_core tpm serio_raw pcspkr sg tpm_bios igb i2c_core iTCO_wdt rtc_lib mptctl iTCO_vendor_support button dca bnx2 usbhid hid uhci_hcd ehci_hcd usbcore sd_mod crc_t10dif edd ext3 mbcache jbd fan ide_pci_generic ide_core ata_generic ata_piix libata thermal processor thermal_sys hwmon mptsas mptscsih mptbase scsi_transport_sas scsi_mod\n  Pid: 7949, comm: sh Not tainted 2.6.32.12-qiuxishi-5-default #92 Tecal RH2285\n  RIP: 0010:exit_creds+0x12/0x78\n  RSP: 0018:ffff8806044f1d78  EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: ffff880604f22140 RCX: 0000000000019502\n  RDX: 0000000000000000 RSI: 0000000000000202 RDI: 0000000000000000\n  RBP: ffff880604f22150 R08: 0000000000000000 R09: ffffffff81a4dc10\n  R10: 00000000000032a0 R11: ffff880006202500 R12: 0000000000000000\n  R13: 0000000000c40000 R14: 0000000000008000 R15: 0000000000000001\n  FS:  00007fbc03d066f0(0000) GS:ffff8800282e0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n  CR2: 0000000000000000 CR3: 000000060f029000 CR4: 00000000000006e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Process sh (pid: 7949, threadinfo ffff8806044f0000, task ffff880603d7c600)\n  Stack:\n   ffff880604f22140 ffffffff8103aac5 ffff880604f22140 ffffffff8104d21e\n   ffff880006202500 0000000000008000 0000000000c38000 ffffffff810bd5b1\n   0000000000000000 ffff880603d7c600 00000000ffffdd29 0000000000000003\n  Call Trace:\n    __put_task_struct+0x5d/0x97\n    kthread_stop+0x50/0x58\n    offline_pages+0x324/0x3da\n    memory_block_change_state+0x179/0x1db\n    store_mem_state+0x9e/0xbb\n    sysfs_write_file+0xd0/0x107\n    vfs_write+0xad/0x169\n    sys_write+0x45/0x6e\n    system_call_fastpath+0x16/0x1b\n  Code: ff 4d 00 0f 94 c0 84 c0 74 08 48 89 ef e8 1f fd ff ff 5b 5d 31 c0 41 5c c3 53 48 8b 87 20 06 00 00 48 89 fb 48 8b bf 18 06 00 00 <8b> 00 48 c7 83 18 06 00 00 00 00 00 00 f0 ff 0f 0f 94 c0 84 c0\n  RIP  exit_creds+0x12/0x78\n   RSP <ffff8806044f1d78>\n  CR2: 0000000000000000\n\n[akpm@linux-foundation.org: add pglist_data.kswapd locking comments]\nSigned-off-by: Xishi Qiu <qiuxishi@huawei.com>\nSigned-off-by: Jiang Liu <jiang.liu@huawei.com>\nAcked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>\nAcked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nAcked-by: Mel Gorman <mgorman@suse.de>\nAcked-by: David Rientjes <rientjes@google.com>\nReviewed-by: Minchan Kim <minchan@kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: I8ca11163c73636fee7d5550ddc8aaca99b4e02bf","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/779717afe87643668e892de71121d1af96a6d378"},{"sha":"ded51bf533feaf2489b5400f23c9721bfcc17f8f","author":{"name":"Michal Hocko","email":"549a3b539eb67715c6526d830d82ed0bec455278@suse.cz"},"message":"mm: consider all swapped back pages in used-once logic\n\ncommit e48982734ea0500d1eba4f9d96195acc5406cad6 upstream.\n\nCommit 645747462435 (\"vmscan: detect mapped file pages used only once\")\nmade mapped pages have another round in inactive list because they might\nbe just short lived and so we could consider them again next time.  This\nheuristic helps to reduce pressure on the active list with a streaming\nIO worklods.\n\nThis patch fixes a regression introduced by this commit for heavy shmem\nbased workloads because unlike Anon pages, which are excluded from this\nheuristic because they are usually long lived, shmem pages are handled\nas a regular page cache.\n\nThis doesn't work quite well, unfortunately, if the workload is mostly\nbacked by shmem (in memory database sitting on 80% of memory) with a\nstreaming IO in the background (backup - up to 20% of memory).  Anon\ninactive list is full of (dirty) shmem pages when watermarks are hit.\nShmem pages are kept in the inactive list (they are referenced) in the\nfirst round and it is hard to reclaim anything else so we reach lower\nscanning priorities very quickly which leads to an excessive swap out.\n\nLet's fix this by excluding all swap backed pages (they tend to be long\nlived wrt.  the regular page cache anyway) from used-once heuristic and\nrather activate them if they are referenced.\n\nThe customer's workload is shmem backed database (80% of RAM) and they\nare measuring transactions/s with an IO in the background (20%).\nTransactions touch more or less random rows in the table.  The\ntransaction rate fell by a factor of 3 (in the worst case) because of\ncommit 64574746.  This patch restores the previous numbers.\n\nChange-Id: Id6696030f349217d40d22cd8c17b3ffad1c4253f\nSigned-off-by: Michal Hocko <mhocko@suse.cz>\nAcked-by: Johannes Weiner <hannes@cmpxchg.org>\nCc: Mel Gorman <mel@csn.ul.ie>\nCc: Minchan Kim <minchan@kernel.org>\nCc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>\nReviewed-by: Rik van Riel <riel@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/ded51bf533feaf2489b5400f23c9721bfcc17f8f"},{"sha":"4492a0132f7debf96faa4091aa1c02124f3ae5dc","author":{"name":"Takamori Yamaguchi","email":"ae1e5869bd2cfe3efe06c49af012ad11918fee65@jp.sony.com"},"message":"mm: bugfix: set current->reclaim_state to NULL while returning from kswapd()\n\ncommit b0a8cc58e6b9aaae3045752059e5e6260c0b94bc upstream.\n\nIn kswapd(), set current->reclaim_state to NULL before returning, as\ncurrent->reclaim_state holds reference to variable on kswapd()'s stack.\n\nIn rare cases, while returning from kswapd() during memory offlining,\n__free_slab() and freepages() can access the dangling pointer of\ncurrent->reclaim_state.\n\nChange-Id: I49f69977895442b3a8328c9c39877369b4554ba5\nSigned-off-by: Takamori Yamaguchi <takamori.yamaguchi@jp.sony.com>\nSigned-off-by: Aaditya Kumar <aaditya.kumar@ap.sony.com>\nAcked-by: David Rientjes <rientjes@google.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/4492a0132f7debf96faa4091aa1c02124f3ae5dc"},{"sha":"e6f722e00e97f2ff9df0f411c5a8170def43b639","author":{"name":"Johannes Weiner","email":"384333b8ca49bccf53afadd43ca0007cb9efc1df@cmpxchg.org"},"message":"mm: vmscan: clear kswapd's special reclaim powers before exiting\n\ncommit 71abdc15adf8c702a1dd535f8e30df50758848d2 upstream.\n\nWhen kswapd exits, it can end up taking locks that were previously held\nby allocating tasks while they waited for reclaim.  Lockdep currently\nwarns about this:\n\nOn Wed, May 28, 2014 at 06:06:34PM +0800, Gu Zheng wrote:\n>  inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-R} usage.\n>  kswapd2/1151 [HC0[0]:SC0[0]:HE1:SE1] takes:\n>   (&sig->group_rwsem){+++++?}, at: exit_signals+0x24/0x130\n>  {RECLAIM_FS-ON-W} state was registered at:\n>     mark_held_locks+0xb9/0x140\n>     lockdep_trace_alloc+0x7a/0xe0\n>     kmem_cache_alloc_trace+0x37/0x240\n>     flex_array_alloc+0x99/0x1a0\n>     cgroup_attach_task+0x63/0x430\n>     attach_task_by_pid+0x210/0x280\n>     cgroup_procs_write+0x16/0x20\n>     cgroup_file_write+0x120/0x2c0\n>     vfs_write+0xc0/0x1f0\n>     SyS_write+0x4c/0xa0\n>     tracesys+0xdd/0xe2\n>  irq event stamp: 49\n>  hardirqs last  enabled at (49):  _raw_spin_unlock_irqrestore+0x36/0x70\n>  hardirqs last disabled at (48):  _raw_spin_lock_irqsave+0x2b/0xa0\n>  softirqs last  enabled at (0):  copy_process.part.24+0x627/0x15f0\n>  softirqs last disabled at (0):            (null)\n>\n>  other info that might help us debug this:\n>   Possible unsafe locking scenario:\n>\n>         CPU0\n>         ----\n>    lock(&sig->group_rwsem);\n>    <Interrupt>\n>      lock(&sig->group_rwsem);\n>\n>   *** DEADLOCK ***\n>\n>  no locks held by kswapd2/1151.\n>\n>  stack backtrace:\n>  CPU: 30 PID: 1151 Comm: kswapd2 Not tainted 3.10.39+ #4\n>  Call Trace:\n>    dump_stack+0x19/0x1b\n>    print_usage_bug+0x1f7/0x208\n>    mark_lock+0x21d/0x2a0\n>    __lock_acquire+0x52a/0xb60\n>    lock_acquire+0xa2/0x140\n>    down_read+0x51/0xa0\n>    exit_signals+0x24/0x130\n>    do_exit+0xb5/0xa50\n>    kthread+0xdb/0x100\n>    ret_from_fork+0x7c/0xb0\n\nThis is because the kswapd thread is still marked as a reclaimer at the\ntime of exit.  But because it is exiting, nobody is actually waiting on\nit to make reclaim progress anymore, and it's nothing but a regular\nthread at this point.  Be tidy and strip it of all its powers\n(PF_MEMALLOC, PF_SWAPWRITE, PF_KSWAPD, and the lockdep reclaim state)\nbefore returning from the thread function.\n\nChange-Id: I51cc36b913919dbaeb56322d7afe71e0c36f36bc\nSigned-off-by: Johannes Weiner <hannes@cmpxchg.org>\nReported-by: Gu Zheng <guz.fnst@cn.fujitsu.com>\nCc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>\nCc: Tang Chen <tangchen@cn.fujitsu.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/e6f722e00e97f2ff9df0f411c5a8170def43b639"},{"sha":"029e2677dec60ca13559f7f24a4011fddcb329ef","author":{"name":"Leon Ma","email":"456d48e2708ef47eb690613775ec7e1d8f5f2e74@intel.com"},"message":"hrtimer: Prevent remote enqueue of leftmost timers\n\ncommit 012a45e3f4af68e86d85cce060c6c2fed56498b2 upstream.\n\nIf a cpu is idle and starts an hrtimer which is not pinned on that\nsame cpu, the nohz code might target the timer to a different cpu.\n\nIn the case that we switch the cpu base of the timer we already have a\nsanity check in place, which determines whether the timer is earlier\nthan the current leftmost timer on the target cpu. In that case we\nenqueue the timer on the current cpu because we cannot reprogram the\nclock event device on the target.\n\nIf the timers base is already the target CPU we do not have this\nsanity check in place so we enqueue the timer as the leftmost timer in\nthe target cpus rb tree, but we cannot reprogram the clock event\ndevice on the target cpu. So the timer expires late and subsequently\nprevents the reprogramming of the target cpu clock event device until\nthe previously programmed event fires or a timer with an earlier\nexpiry time gets enqueued on the target cpu itself.\n\nAdd the same target check as we have for the switch base case and\nstart the timer on the current cpu if it would become the leftmost\ntimer on the target.\n\n[ tglx: Rewrote subject and changelog ]\n\nChange-Id: I18754822387ae503ec460f95203567c5b25597c0\nSigned-off-by: Leon Ma <xindong.ma@intel.com>\nLink: http://lkml.kernel.org/r/1398847391-5994-1-git-send-email-xindong.ma@intel.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/029e2677dec60ca13559f7f24a4011fddcb329ef"},{"sha":"bfab73ec933dbfc327d4376bc57eba9f0cfa8d35","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"Turn off -Wmaybe-uninitialized when building with -Os\n\ngcc-4.7 and higher add a lot of false positive warnings about\npotential uses of uninitialized warnings, but only when optimizing\nfor size (-Os). This is the default when building allyesconfig,\nwhich turns on CONFIG_CC_OPTIMIZE_FOR_SIZE.\n\nIn order to avoid getting a lot of patches that initialize such\nvariables and accidentally hide real errors along the way, let's\njust turn off this warning on the respective gcc versions\nwhen building with size optimizations. The -Wmaybe-uninitialized\noption was introduced in the same gcc version (4.7) that is now\ncausing the false positives, so there is no effect on older compilers.\n\nA side effect is that when building with CONFIG_CC_OPTIMIZE_FOR_SIZE,\nwe might now see /fewer/ warnings about possibly uninitialized\nwarnings than with -O2, but that is still much better than seeing\nwarnings known to be bogus.\n\nChange-Id: I5a863923ad347526e6dc58c0bbbc259eb20bfe5c\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nGit-commit: e74fc973b6e531fef1fce8b101ffff05ecfb774c\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Bryan Huntsman <bryanh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/bfab73ec933dbfc327d4376bc57eba9f0cfa8d35"},{"sha":"962c228c51d9cddb0eb8711ff2ce029609e882a0","author":{"name":"Rusty Russell","email":"69f5932eb9977dcad4aeec4104f9f99d5dd1ae66@rustcorp.com.au"},"message":"PTR_RET is now PTR_ERR_OR_ZERO\n\nTrue, it's often used in return statements, but after much bikeshedding\nit's probably better to have an explicit name.\n\n(I tried just putting the IS_ERR check inside PTR_ERR itself and gcc\nusually generated no more code.  But that clashes current expectations\nof how PTR_ERR behaves, so having a separate function is better).\n\nChange-Id: I8379ab1f9517703e51c5a94b213ba9c66013f858\nSuggested-by: Julia Lawall <julia.lawall@lip6.fr>\nSuggested-by: \"Michael S. Tsirkin\" <mst@redhat.com>\nCc: Julia Lawall <julia.lawall@lip6.fr>\nCc: \"Michael S. Tsirkin\" <mst@redhat.com>\nSigned-off-by: Rusty Russell <rusty@rustcorp.com.au>","distinct":true,"url":"https://api.github.com/repos/syphyr/android_kernel_lge_awifi/commits/962c228c51d9cddb0eb8711ff2ce029609e882a0"}]}
{"actor":{"display_login":"syphyr"}}