slub: fix a memory leak in get_partial_node()

In the case which is below,

1. acquire slab for cpu partial list
2. free object to it by remote cpu
3. page->freelist = t

then memory leak is occurred.

Change acquire_slab() not to zap freelist when it works for cpu partial list.
I think it is a sufficient solution for fixing a memory leak.

Below is output of 'slabinfo -r kmalloc-256'
when './perf stat -r 30 hackbench 50 process 4000 > /dev/null' is done.

***Vanilla***
Sizes (bytes)     Slabs              Debug                Memory
------------------------------------------------------------------------
Object :     256  Total  :     468   Sanity Checks : Off  Total: 3833856
SlabObj:     256  Full   :     111   Redzoning     : Off  Used : 2004992
SlabSiz:    8192  Partial:     302   Poisoning     : Off  Loss : 1828864
Loss   :       0  CpuSlab:      55   Tracking      : Off  Lalig:       0
Align  :       8  Objects:      32   Tracing       : Off  Lpadd:       0

***Patched***
Sizes (bytes)     Slabs              Debug                Memory
------------------------------------------------------------------------
Object :     256  Total  :     300   Sanity Checks : Off  Total: 2457600
SlabObj:     256  Full   :     204   Redzoning     : Off  Used : 2348800
SlabSiz:    8192  Partial:      33   Poisoning     : Off  Loss :  108800
Loss   :       0  CpuSlab:      63   Tracking      : Off  Lalig:       0
Align  :       8  Objects:      32   Tracing       : Off  Lpadd:       0

Total and loss number is the impact of this patch.

Cc: <stable@vger.kernel.org>
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: engstk <eng.stk@sapo.pt>
cgroup: fix exit() vs rmdir() race

In cgroup_exit() put_css_set_taskexit() is called without any lock,
which might lead to accessing a freed cgroup:

thread1                           thread2
---------------------------------------------
exit()
  cgroup_exit()
    put_css_set_taskexit()
      atomic_dec(cgrp->count);
                                   rmdir();
      /* not safe !! */
      check_for_release(cgrp);

rcu_read_lock() can be used to make sure the cgroup is alive.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: Chet Kener <Cl3Kener@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
futex: Prevent attaching to kernel threads

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: flar2 <asegaert@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
msm: kgsl: Fix Z180 memory leak

Decerement entry refcount, which incremented
in kgsl_sharedmem_find_region.

CRs-Fixed: 635747
Change-Id: I621ba8f8e119a9ab8ba5455b28a565e3cae2f7cd
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
qup_i2c: Handle scenario if runtime PM is disable

If  runtime PM is not supported, make sure
the I2C clock and GPIOs enabled at the start
of the transfer(RD/WR)
This is done by i2c_qup_pm_resume_runtime()

CRs-Fixed: 492194
Change-Id: Iaa901a0f0d0cd58318e3f6dd64e1db73c73b630f
Signed-off-by: Dilip Kota <c_dkota@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
i2c_qup: Improve implementation of PM callbacks

Refactor PM callbacks and remove redundant variable.
Add support for configuration of clockcontrol event.
Now the clock's state may be set by pm calls (as before)
or by a transfer's begining and ending.
Runtime-PM is still used in autosuspend configuration for
expensive NoC voting/unvoting since that may go to remote
processor.

CRs-Fixed: 592435
Change-Id: I54f7c67f768336f66765a04006b4c8e4734ac277
Signed-off-by: Gilad Avidov <gavidov@codeaurora.org>
Signed-off-by: Sagar Dharia <sdharia@codeaurora.org>
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
i2c_qup: Fix for unhandled IRQ

I2C qup driver handle scenario where runtime
PM is not enabled and enables clocks explicitly.
But it checks runtime PM suspended state in ISR
routine before processing further which can lead to issue
of unhandled valid IRQ sometimes because I2C client
can initiate transaction very early after system
resume and runtime PM is not enabled.

Add atomic flag to synchronize between active transaction
request when clocks are enabled and ISR.

CRs-Fixed: 670480
Change-Id: I175bc29a7b5b6e713ab6ec28deb34b2b0d23fa8a
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>
Signed-off-by: Alok Chauhan <alokc@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>
qup_i2c: Initialize I2C resource before registering.

Due to mismatch in sequence of initializing the
I2C resources  and registering device,  issues seen
while probing clients. This patch corrects the sequence.

CRs-Fixed: 581007
Change-Id: I98f0e73ce1ed1213409d5700f7a78e722e451ec0
Signed-off-by: Sana Venkat Raju <c_vsana@codeaurora.org>

qup_i2c: Correct free memory call

Correct freeing of memory, which is allocated using
the devm prefixed API, to free it using devm_kfree rather
then kfree.

CRs-Fixed: 582597
Change-Id: If1aa9bcd86bb3a7d35adc5630ff19ad08bbdf762
Signed-off-by: Gilad Avidov <gavidov@codeaurora.org>

qup_i2c: dump gpio config on error

Dump the configuration of relevant GPIOs
on timeout error.

Change-Id: Iab5aa57befc146c232d12759990b0b8a23a68fe1
Signed-off-by: Gilad Avidov <gavidov@codeaurora.org>

qup_i2c: export qup_i2c_init_driver

Drivers like onsemi-ncp6335d and fan53555 are clients of i2c-qup driver.
In some targets, these clients have to initialize and probe early before
the i2c-qup driver is ready. Hence export qup_i2c_init_driver to make sure
i2c-qup driver is ready when its clients need to probe.

Change-Id: I0f866d1c4239f9c72f6753674c2283e97f3a3691
Signed-off-by: Ke Liu <keliu@codeaurora.org>

qup_i2c: improve PM functionality

Move system-PM functionality to noirq stage. Remove
the incorrect active-only clock path-voting setting.
Resolve synchronization of concurent transition of
system and runtime PM.

Change-Id: I2753557482da7a48a596e4b660165b4e2af0f854
Signed-off-by: Gilad Avidov <gavidov@codeaurora.org>

qup_i2c: support for configuarable noise rejection

allow to configure noise rejection value from device tree
which helps filter spikes in the i2c lines.

CRs-Fixed: 626250
Change-Id: If66132c8cc444294e4e6e275ece8b85108cf7abb
Signed-off-by: Ankit Gupta <ankgupta@codeaurora.org>

qup_i2c: Improve recovery from core and slave bad state

Unexpected noise, and/or unexpected behavior from a slave
may put the whole I2C bus in unworkable state. Clear I2C
bus state using HW command instead of bit-banging to avoid
assumption about GPIO recovery config.

Change-Id: I8d1d0002392f9ec9bc0db146aa0ce3e138334644
Signed-off-by: Gilad Avidov <gavidov@codeaurora.org>
Signed-off-by: franciscofranco <franciscofranco.1990@gmail.com>
Signed-off-by: engstk <eng.stk@sapo.pt>