--- /dev/null
+From 1f9b8c8fbc9a4d029760b16f477b9d15500e3a34 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Wed, 12 Aug 2015 11:54:35 +0100
+Subject: Btrfs: check if previous transaction aborted to avoid fs corruption
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 1f9b8c8fbc9a4d029760b16f477b9d15500e3a34 upstream.
+
+While we are committing a transaction, it's possible the previous one is
+still finishing its commit and therefore we wait for it to finish first.
+However we were not checking if that previous transaction ended up getting
+aborted after we waited for it to commit, so we ended up committing the
+current transaction which can lead to fs corruption because the new
+superblock can point to trees that have had one or more nodes/leafs that
+were never durably persisted.
+The following sequence diagram exemplifies how this is possible:
+
+ CPU 0 CPU 1
+
+ transaction N starts
+
+ (...)
+
+ btrfs_commit_transaction(N)
+
+ cur_trans->state = TRANS_STATE_COMMIT_START;
+ (...)
+ cur_trans->state = TRANS_STATE_COMMIT_DOING;
+ (...)
+
+ cur_trans->state = TRANS_STATE_UNBLOCKED;
+ root->fs_info->running_transaction = NULL;
+
+ btrfs_start_transaction()
+ --> starts transaction N + 1
+
+ btrfs_write_and_wait_transaction(trans, root);
+ --> starts writing all new or COWed ebs created
+ at transaction N
+
+ creates some new ebs, COWs some
+ existing ebs but doesn't COW or
+ deletes eb X
+
+ btrfs_commit_transaction(N + 1)
+ (...)
+ cur_trans->state = TRANS_STATE_COMMIT_START;
+ (...)
+ wait_for_commit(root, prev_trans);
+ --> prev_trans == transaction N
+
+ btrfs_write_and_wait_transaction() continues
+ writing ebs
+ --> fails writing eb X, we abort transaction N
+ and set bit BTRFS_FS_STATE_ERROR on
+ fs_info->fs_state, so no new transactions
+ can start after setting that bit
+
+ cleanup_transaction()
+ btrfs_cleanup_one_transaction()
+ wakes up task at CPU 1
+
+ continues, doesn't abort because
+ cur_trans->aborted (transaction N + 1)
+ is zero, and no checks for bit
+ BTRFS_FS_STATE_ERROR in fs_info->fs_state
+ are made
+
+ btrfs_write_and_wait_transaction(trans, root);
+ --> succeeds, no errors during writeback
+
+ write_ctree_super(trans, root, 0);
+ --> succeeds
+ --> we have now a superblock that points us
+ to some root that uses eb X, which was
+ never written to disk
+
+In this scenario future attempts to read eb X from disk results in an
+error message like "parent transid verify failed on X wanted Y found Z".
+
+So fix this by aborting the current transaction if after waiting for the
+previous transaction we verify that it was aborted.
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/transaction.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1710,8 +1710,11 @@ int btrfs_commit_transaction(struct btrf
+ spin_unlock(&root->fs_info->trans_lock);
+
+ wait_for_commit(root, prev_trans);
++ ret = prev_trans->aborted;
+
+ btrfs_put_transaction(prev_trans);
++ if (ret)
++ goto cleanup_transaction;
+ } else {
+ spin_unlock(&root->fs_info->trans_lock);
+ }
--- /dev/null
+From efcbc04e16dfa95fef76309f89710dd1d99a5453 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Thu, 30 Jul 2015 13:00:56 +1000
+Subject: NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
+
+From: NeilBrown <neilb@suse.com>
+
+commit efcbc04e16dfa95fef76309f89710dd1d99a5453 upstream.
+
+It is unusual to combine the open flags O_RDONLY and O_EXCL, but
+it appears that libre-office does just that.
+
+[pid 3250] stat("/home/USER/.config", {st_mode=S_IFDIR|0700, st_size=8192, ...}) = 0
+[pid 3250] open("/home/USER/.config/libreoffice/4-suse/user/extensions/buildid", O_RDONLY|O_EXCL <unfinished ...>
+
+NFSv4 takes O_EXCL as a sign that a setattr command should be sent,
+probably to reset the timestamps.
+
+When it was an O_RDONLY open, the SETATTR command does not
+identify any actual attributes to change.
+If no delegation was provided to the open, the SETATTR uses the
+all-zeros stateid and the request is accepted (at least by the
+Linux NFS server - no harm, no foul).
+
+If a read-delegation was provided, this is used in the SETATTR
+request, and a Netapp filer will justifiably claim
+NFS4ERR_BAD_STATEID, which the Linux client takes as a sign
+to retry - indefinitely.
+
+So only treat O_EXCL specially if O_CREAT was also given.
+
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2275,7 +2275,7 @@ static int _nfs4_do_open(struct inode *d
+ goto err_free_label;
+ state = ctx->state;
+
+- if ((opendata->o_arg.open_flags & O_EXCL) &&
++ if ((opendata->o_arg.open_flags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL) &&
+ (opendata->o_arg.createmode != NFS4_CREATE_GUARDED)) {
+ nfs4_exclusive_attrset(opendata, sattr);
+
--- /dev/null
+From a66b0c41ad277ae62a3ae6ac430a71882f899557 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+Date: Tue, 19 May 2015 19:03:12 -0300
+Subject: [media] rc-core: fix remove uevent generation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+
+commit a66b0c41ad277ae62a3ae6ac430a71882f899557 upstream.
+
+The input_dev is already gone when the rc device is being unregistered
+so checking for its presence only means that no remove uevent will be
+generated.
+
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/rc-main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -982,9 +982,6 @@ static int rc_dev_uevent(struct device *
+ {
+ struct rc_dev *dev = to_rc_dev(device);
+
+- if (!dev || !dev->input_dev)
+- return -ENODEV;
+-
+ if (dev->rc_map.name)
+ ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name);
+ if (dev->driver_name)
add-radeon-suspend-resume-quirk-for-hp-compaq-dc5750.patch
mm-check-if-section-present-during-memory-block-registering.patch
x86-mm-initialize-pmd_idx-in-page_table_range_init_count.patch
+rc-core-fix-remove-uevent-generation.patch
+v4l-omap3isp-fix-sub-device-power-management-code.patch
+btrfs-check-if-previous-transaction-aborted-to-avoid-fs-corruption.patch
+nfsv4-don-t-set-setattr-for-o_rdonly-o_excl.patch
--- /dev/null
+From 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@iki.fi>
+Date: Fri, 12 Jun 2015 20:06:23 -0300
+Subject: [media] v4l: omap3isp: Fix sub-device power management code
+
+From: Sakari Ailus <sakari.ailus@iki.fi>
+
+commit 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 upstream.
+
+Commit 813f5c0ac5cc ("media: Change media device link_notify behaviour")
+modified the media controller link setup notification API and updated the
+OMAP3 ISP driver accordingly. As a side effect it introduced a bug by
+turning power on after setting the link instead of before. This results in
+sub-devices not being powered down in some cases when they should be. Fix
+it.
+
+Fixes: 813f5c0ac5cc [media] media: Change media device link_notify behaviour
+
+Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/omap3isp/isp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -824,14 +824,14 @@ static int isp_pipeline_link_notify(stru
+ int ret;
+
+ if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
+- !(link->flags & MEDIA_LNK_FL_ENABLED)) {
++ !(flags & MEDIA_LNK_FL_ENABLED)) {
+ /* Powering off entities is assumed to never fail. */
+ isp_pipeline_pm_power(source, -sink_use);
+ isp_pipeline_pm_power(sink, -source_use);
+ return 0;
+ }
+
+- if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH &&
++ if (notification == MEDIA_DEV_NOTIFY_PRE_LINK_CH &&
+ (flags & MEDIA_LNK_FL_ENABLED)) {
+
+ ret = isp_pipeline_pm_power(source, sink_use);
projects / thirdparty / kernel / stable-queue.git / commitdiff
