{"push_id":1436681598,"size":5,"distinct_size":5,"ref":"refs/heads/new","head":"38df9c75b47c8debde02cdbc47611533e0a69664","before":"73ecd64669411c5cb998b6ffdce9497d0d98cf30","commits":[{"sha":"39a9169ddd0726a2cbd22ebaed1b670e6370c33b","author":{"name":"Daisuke Nishimura","email":"13397d821e9cc52f2b6098f0e0f2b898118fb993@mxp.nes.nec.co.jp"},"message":"sched/fair: Fix small race where child->se.parent,cfs_rq might point to invalid ones\n\nThere is a small race between copy_process() and cgroup_attach_task()\nwhere child->se.parent,cfs_rq points to invalid (old) ones.\n\n        parent doing fork()      | someone moving the parent to another cgroup\n  -------------------------------+---------------------------------------------\n    copy_process()\n      + dup_task_struct()\n        -> parent->se is copied to child->se.\n           se.parent,cfs_rq of them point to old ones.\n\n                                     cgroup_attach_task()\n                                       + cgroup_task_migrate()\n                                         -> parent->cgroup is updated.\n                                       + cpu_cgroup_attach()\n                                         + sched_move_task()\n                                           + task_move_group_fair()\n                                             +- set_task_rq()\n                                                -> se.parent,cfs_rq of parent\n                                                   are updated.\n\n      + cgroup_fork()\n        -> parent->cgroup is copied to child->cgroup. (*1)\n      + sched_fork()\n        + task_fork_fair()\n          -> se.parent,cfs_rq of child are accessed\n             while they point to old ones. (*2)\n\nIn the worst case, this bug can lead to \"use-after-free\" and cause a panic,\nbecause it's new cgroup's refcount that is incremented at (*1),\nso the old cgroup(and related data) can be freed before (*2).\n\nIn fact, a panic caused by this bug was originally caught in RHEL6.4.\n\n    BUG: unable to handle kernel NULL pointer dereference at (null)\n    IP: [<ffffffff81051e3e>] sched_slice+0x6e/0xa0\n    [...]\n    Call Trace:\n     [<ffffffff81051f25>] place_entity+0x75/0xa0\n     [<ffffffff81056a3a>] task_fork_fair+0xaa/0x160\n     [<ffffffff81063c0b>] sched_fork+0x6b/0x140\n     [<ffffffff8106c3c2>] copy_process+0x5b2/0x1450\n     [<ffffffff81063b49>] ? wake_up_new_task+0xd9/0x130\n     [<ffffffff8106d2f4>] do_fork+0x94/0x460\n     [<ffffffff81072a9e>] ? sys_wait4+0xae/0x100\n     [<ffffffff81009598>] sys_clone+0x28/0x30\n     [<ffffffff8100b393>] stub_clone+0x13/0x20\n     [<ffffffff8100b072>] ? system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nCc: <stable@vger.kernel.org>\nLink: http://lkml.kernel.org/r/039601ceae06$733d3130$59b79390$@mxp.nes.nec.co.jp\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/tunturn/android_kernel_aries_concept/commits/39a9169ddd0726a2cbd22ebaed1b670e6370c33b"},{"sha":"721ecfc6f83849288d8fa2e6488ada2e626776ce","author":{"name":"Vladimir Davydov","email":"4e762dc9963bd7dfdd4b8e8ebb6aa86e54f589be@parallels.com"},"message":"sched/balancing: Fix 'local->avg_load > sds->avg_load' case in calculate_imbalance()\n\nIn busiest->group_imb case we can come to calculate_imbalance() with\nlocal->avg_load >= busiest->avg_load >= sds->avg_load. This can result\nin imbalance overflow, because it is calculated as follows\n\nenv->imbalance = min(\n\tmax_pull * busiest->group_power,\n\t(sds->avg_load - local->avg_load) * local->group_power) / SCHED_POWER_SCALE;\n\nAs a result we can end up constantly bouncing tasks from one cpu to\nanother if there are pinned tasks.\n\nFix this by skipping the assignment and assuming imbalance=0 in case\nlocal->avg_load > sds->avg_load.\n\n[ The bug can be caught by running 2*N cpuhogs pinned to two logical cpus\n  belonging to different cores on an HT-enabled machine with N logical\n  cpus: just look at se.nr_migrations growth. ]\n\nSigned-off-by: Vladimir Davydov <vdavydov@parallels.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/8f596cc6bc0e5e655119dc892c9bfcad26e971f4.1379252740.git.vdavydov@parallels.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/tunturn/android_kernel_aries_concept/commits/721ecfc6f83849288d8fa2e6488ada2e626776ce"},{"sha":"13b80fdc5fde1d6e3a8bf0228b61bc17132d717b","author":{"name":"Vladimir Davydov","email":"4e762dc9963bd7dfdd4b8e8ebb6aa86e54f589be@parallels.com"},"message":"sched/balancing: Fix 'local->avg_load > busiest->avg_load' case in fix_small_imbalance()\n\nIn busiest->group_imb case we can come to fix_small_imbalance() with\nlocal->avg_load > busiest->avg_load. This can result in wrong imbalance\nfix-up, because there is the following check there where all the\nmembers are unsigned:\n\nif (busiest->avg_load - local->avg_load + scaled_busy_load_per_task >=\n    (scaled_busy_load_per_task * imbn)) {\n\tenv->imbalance = busiest->load_per_task;\n\treturn;\n}\n\nAs a result we can end up constantly bouncing tasks from one cpu to\nanother if there are pinned tasks.\n\nFix it by substituting the subtraction with an equivalent addition in\nthe check.\n\n[ The bug can be caught by running 2*N cpuhogs pinned to two logical cpus\n  belonging to different cores on an HT-enabled machine with N logical\n  cpus: just look at se.nr_migrations growth. ]\n\nSigned-off-by: Vladimir Davydov <vdavydov@parallels.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/ef167822e5c5b2d96cf5b0e3e4f4bdff3f0414a2.1379252740.git.vdavydov@parallels.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/tunturn/android_kernel_aries_concept/commits/13b80fdc5fde1d6e3a8bf0228b61bc17132d717b"},{"sha":"278907030684c9e97426a1582162ea7c45ec831d","author":{"name":"Vladimir Davydov","email":"4e762dc9963bd7dfdd4b8e8ebb6aa86e54f589be@parallels.com"},"message":"sched/balancing: Prevent the reselection of a previous env.dst_cpu if some tasks are pinned\n\nCurrently new_dst_cpu is prevented from being reselected actually, not\ndst_cpu. This can result in attempting to pull tasks to this_cpu twice.\n\nSigned-off-by: Vladimir Davydov <vdavydov@parallels.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/281f59b6e596c718dd565ad267fc38f5b8e5c995.1379265590.git.vdavydov@parallels.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/tunturn/android_kernel_aries_concept/commits/278907030684c9e97426a1582162ea7c45ec831d"},{"sha":"38df9c75b47c8debde02cdbc47611533e0a69664","author":{"name":"Jason Low","email":"b774111caaaefe100d4447dff0dc3650d7905497@hp.com"},"message":"sched: Reduce overestimating rq->avg_idle\n\nWhen updating avg_idle, if the delta exceeds some max value, then avg_idle\ngets set to the max, regardless of what the previous avg was. This can cause\navg_idle to often be overestimated.\n\nThis patch modifies the way we update avg_idle by always updating it with the\nfunction call to update_avg() first. Then, if avg_idle exceeds the max, we set\nit to the max.\n\nSigned-off-by: Jason Low <jason.low2@hp.com>\nReviewed-by: Rik van Riel <riel@redhat.com>\nReviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/1379096813-3032-2-git-send-email-jason.low2@hp.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/tunturn/android_kernel_aries_concept/commits/38df9c75b47c8debde02cdbc47611533e0a69664"}]}
{"actor":{"display_login":"tunturn"}}