--- /dev/null
+From ece8f914845577a9e87c37e702a3ac952bb24ea1 Mon Sep 17 00:00:00 2001
+From: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
+Date: Tue, 20 Nov 2018 11:25:10 +0800
+Subject: btrfs: fix pinned underflow after transaction aborted
+
+commit fcd5e74288f7d36991b1f0fb96b8c57079645e38 upstream.
+
+When running generic/475, we may get the following warning in dmesg:
+
+[ 6902.102154] WARNING: CPU: 3 PID: 18013 at fs/btrfs/extent-tree.c:9776 btrfs_free_block_groups+0x2af/0x3b0 [btrfs]
+[ 6902.109160] CPU: 3 PID: 18013 Comm: umount Tainted: G W O 4.19.0-rc8+ #8
+[ 6902.110971] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+[ 6902.112857] RIP: 0010:btrfs_free_block_groups+0x2af/0x3b0 [btrfs]
+[ 6902.118921] RSP: 0018:ffffc9000459bdb0 EFLAGS: 00010286
+[ 6902.120315] RAX: ffff880175050bb0 RBX: ffff8801124a8000 RCX: 0000000000170007
+[ 6902.121969] RDX: 0000000000000002 RSI: 0000000000170007 RDI: ffffffff8125fb74
+[ 6902.123716] RBP: ffff880175055d10 R08: 0000000000000000 R09: 0000000000000000
+[ 6902.125417] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880175055d88
+[ 6902.127129] R13: ffff880175050bb0 R14: 0000000000000000 R15: dead000000000100
+[ 6902.129060] FS: 00007f4507223780(0000) GS:ffff88017ba00000(0000) knlGS:0000000000000000
+[ 6902.130996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 6902.132558] CR2: 00005623599cac78 CR3: 000000014b700001 CR4: 00000000003606e0
+[ 6902.134270] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 6902.135981] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 6902.137836] Call Trace:
+[ 6902.138939] close_ctree+0x171/0x330 [btrfs]
+[ 6902.140181] ? kthread_stop+0x146/0x1f0
+[ 6902.141277] generic_shutdown_super+0x6c/0x100
+[ 6902.142517] kill_anon_super+0x14/0x30
+[ 6902.143554] btrfs_kill_super+0x13/0x100 [btrfs]
+[ 6902.144790] deactivate_locked_super+0x2f/0x70
+[ 6902.146014] cleanup_mnt+0x3b/0x70
+[ 6902.147020] task_work_run+0x9e/0xd0
+[ 6902.148036] do_syscall_64+0x470/0x600
+[ 6902.149142] ? trace_hardirqs_off_thunk+0x1a/0x1c
+[ 6902.150375] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 6902.151640] RIP: 0033:0x7f45077a6a7b
+[ 6902.157324] RSP: 002b:00007ffd589f3e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+[ 6902.159187] RAX: 0000000000000000 RBX: 000055e8eec732b0 RCX: 00007f45077a6a7b
+[ 6902.160834] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055e8eec73490
+[ 6902.162526] RBP: 0000000000000000 R08: 000055e8eec734b0 R09: 00007ffd589f26c0
+[ 6902.164141] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e8eec73490
+[ 6902.165815] R13: 00007f4507ac61a4 R14: 0000000000000000 R15: 00007ffd589f40d8
+[ 6902.167553] irq event stamp: 0
+[ 6902.168998] hardirqs last enabled at (0): [<0000000000000000>] (null)
+[ 6902.170731] hardirqs last disabled at (0): [<ffffffff810cd810>] copy_process.part.55+0x3b0/0x1f00
+[ 6902.172773] softirqs last enabled at (0): [<ffffffff810cd810>] copy_process.part.55+0x3b0/0x1f00
+[ 6902.174671] softirqs last disabled at (0): [<0000000000000000>] (null)
+[ 6902.176407] ---[ end trace 463138c2986b275c ]---
+[ 6902.177636] BTRFS info (device dm-3): space_info 4 has 273465344 free, is not full
+[ 6902.179453] BTRFS info (device dm-3): space_info total=276824064, used=4685824, pinned=18446744073708158976, reserved=0, may_use=0, readonly=65536
+
+In the above line there's "pinned=18446744073708158976" which is an
+unsigned u64 value of -1392640, an obvious underflow.
+
+When transaction_kthread is running cleanup_transaction(), another
+fsstress is running btrfs_commit_transaction(). The
+btrfs_finish_extent_commit() may get the same range as
+btrfs_destroy_pinned_extent() got, which causes the pinned underflow.
+
+Fixes: d4b450cd4b33 ("Btrfs: fix race between transaction commit and empty block group removal")
+CC: stable@vger.kernel.org # 4.4+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/disk-io.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 8dbb00fbb00b..b0875ef48522 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4333,6 +4333,7 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root,
+ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
+ struct extent_io_tree *pinned_extents)
+ {
++ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct extent_io_tree *unpin;
+ u64 start;
+ u64 end;
+@@ -4342,21 +4343,31 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
+ unpin = pinned_extents;
+ again:
+ while (1) {
++ /*
++ * The btrfs_finish_extent_commit() may get the same range as
++ * ours between find_first_extent_bit and clear_extent_dirty.
++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin
++ * the same extent range.
++ */
++ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+ EXTENT_DIRTY, NULL);
+- if (ret)
++ if (ret) {
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
++ }
+
+ clear_extent_dirty(unpin, start, end, GFP_NOFS);
+ btrfs_error_unpin_extent_range(root, start, end);
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ cond_resched();
+ }
+
+ if (loop) {
+- if (unpin == &root->fs_info->freed_extents[0])
+- unpin = &root->fs_info->freed_extents[1];
++ if (unpin == &fs_info->freed_extents[0])
++ unpin = &fs_info->freed_extents[1];
+ else
+- unpin = &root->fs_info->freed_extents[0];
++ unpin = &fs_info->freed_extents[0];
+ loop = false;
+ goto again;
+ }
+--
+2.17.1
+
--- /dev/null
+From ff10a42ac83b16222947069e544992c351a6fa1b Mon Sep 17 00:00:00 2001
+From: Andreas Gruenbacher <agruenba@redhat.com>
+Date: Mon, 19 Nov 2018 17:24:36 +0100
+Subject: gfs2: Put bitmap buffers in put_super
+
+commit 10283ea525d30f2e99828978fd04d8427876a7ad upstream.
+
+gfs2_put_super calls gfs2_clear_rgrpd to destroy the gfs2_rgrpd objects
+attached to the resource group glocks. That function should release the
+buffers attached to the gfs2_bitmap objects (bi_bh), but the call to
+gfs2_rgrp_brelse for doing that is missing.
+
+When gfs2_releasepage later runs across these buffers which are still
+referenced, it refuses to free them. This causes the pages the buffers
+are attached to to remain referenced as well. With enough mount/unmount
+cycles, the system will eventually run out of memory.
+
+Fix this by adding the missing call to gfs2_rgrp_brelse in
+gfs2_clear_rgrpd.
+
+(Also fix a gfs2_rgrp_relse -> gfs2_rgrp_brelse typo in a comment.)
+
+Fixes: 39b0f1e92908 ("GFS2: Don't brelse rgrp buffer_heads every allocation")
+Cc: stable@vger.kernel.org # v4.4
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index c134c0462cee..ef24894edecc 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -732,6 +732,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
+ spin_lock(&gl->gl_lockref.lock);
+ gl->gl_object = NULL;
+ spin_unlock(&gl->gl_lockref.lock);
++ gfs2_rgrp_brelse(rgd);
+ gfs2_glock_add_to_lru(gl);
+ gfs2_glock_put(gl);
+ }
+@@ -1139,7 +1140,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd)
+ * @rgd: the struct gfs2_rgrpd describing the RG to read in
+ *
+ * Read in all of a Resource Group's header and bitmap blocks.
+- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps.
++ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps.
+ *
+ * Returns: errno
+ */
+--
+2.17.1
+
--- /dev/null
+From 52ef83fc505994d891f23654fb230cdad271df0a Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Thu, 22 Nov 2018 12:43:54 +0100
+Subject: Revert "media: videobuf2-core: don't call memop 'finish' when
+ queueing"
+
+This reverts commit 46431d9c28f6859f8e568ac7db92137f1da31100.
+
+This commit fixes a bug in upstream commit a136f59c0a1f ("vb2: Move
+buffer cache synchronisation to prepare from queue") which isn't
+present in 4.4.
+
+So as a result you get an UNBALANCED message in the kernel log if
+this patch is applied:
+
+vb2: counters for queue ffffffc0f3687478, buffer 3: UNBALANCED!
+vb2: buf_init: 1 buf_cleanup: 1 buf_prepare: 805 buf_finish: 805
+vb2: buf_queue: 806 buf_done: 806
+vb2: alloc: 0 put: 0 prepare: 806 finish: 805 mmap: 0
+vb2: get_userptr: 0 put_userptr: 0
+vb2: attach_dmabuf: 1 detach_dmabuf: 1 map_dmabuf: 805 unmap_dmabuf: 805
+vb2: get_dmabuf: 0 num_users: 1609 vaddr: 0 cookie: 805
+
+Reverting this patch solves this regression.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index 1c37d5a78822..8ce9c63dfc59 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -870,12 +870,9 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state)
+ dprintk(4, "done processing on buffer %d, state: %d\n",
+ vb->index, state);
+
+- if (state != VB2_BUF_STATE_QUEUED &&
+- state != VB2_BUF_STATE_REQUEUEING) {
+- /* sync buffers */
+- for (plane = 0; plane < vb->num_planes; ++plane)
+- call_void_memop(vb, finish, vb->planes[plane].mem_priv);
+- }
++ /* sync buffers */
++ for (plane = 0; plane < vb->num_planes; ++plane)
++ call_void_memop(vb, finish, vb->planes[plane].mem_priv);
+
+ spin_lock_irqsave(&q->done_lock, flags);
+ if (state == VB2_BUF_STATE_QUEUED ||
+--
+2.17.1
+
hwmon-ibmpowernv-remove-bogus-__init-annotations.patch
lib-raid6-fix-arm64-test-build.patch
i2c-omap-enable-for-arch_k3.patch
+zram-close-udev-startup-race-condition-as-default-gr.patch
+sunrpc-drop-pointless-static-qualifier-in-xdr_get_ne.patch
+gfs2-put-bitmap-buffers-in-put_super.patch
+btrfs-fix-pinned-underflow-after-transaction-aborted.patch
+revert-media-videobuf2-core-don-t-call-memop-finish-.patch
--- /dev/null
+From d444f7fa58a87b243b9224362de541eed6288095 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 8 Nov 2018 02:04:57 +0000
+Subject: SUNRPC: drop pointless static qualifier in
+ xdr_get_next_encode_buffer()
+
+[ Upstream commit 025911a5f4e36955498ed50806ad1b02f0f76288 ]
+
+There is no need to have the '__be32 *p' variable static since new value
+always be assigned before use it.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xdr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 9b8d855e4a87..ed9bbd383f7d 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -512,7 +512,7 @@ EXPORT_SYMBOL_GPL(xdr_commit_encode);
+ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
+ size_t nbytes)
+ {
+- static __be32 *p;
++ __be32 *p;
+ int space_left;
+ int frag1bytes, frag2bytes;
+
+--
+2.17.1
+
--- /dev/null
+From b1ea8a876a0f98cb12ae0a7357a39324b9c5b7dc Mon Sep 17 00:00:00 2001
+From: Minchan Kim <minchan@kernel.org>
+Date: Fri, 23 Nov 2018 15:30:06 +0900
+Subject: zram: close udev startup race condition as default groups
+
+commit fef912bf860e upstream.
+commit 98af4d4df889 upstream.
+
+I got a report from Howard Chen that he saw zram and sysfs race(ie,
+zram block device file is created but sysfs for it isn't yet)
+when he tried to create new zram devices via hotadd knob.
+
+v4.20 kernel fixes it by [1, 2] but it's too large size to merge
+into -stable so this patch fixes the problem by registering defualt
+group by Greg KH's approach[3].
+
+This patch should be applied to every stable tree [3.16+] currently
+existing from kernel.org because the problem was introduced at 2.6.37
+by [4].
+
+[1] fef912bf860e, block: genhd: add 'groups' argument to device_add_disk
+[2] 98af4d4df889, zram: register default groups with device_add_disk()
+[3] http://kroah.com/log/blog/2013/06/26/how-to-create-a-sysfs-file-correctly/
+[4] 33863c21e69e9, Staging: zram: Replace ioctls with sysfs interface
+
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Tested-by: Howard Chen <howardsoc@google.com>
+Signed-off-by: Minchan Kim <minchan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 26 ++++++--------------------
+ 1 file changed, 6 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 502406c9e6e1..616ee4f9c233 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1184,6 +1184,11 @@ static struct attribute_group zram_disk_attr_group = {
+ .attrs = zram_disk_attrs,
+ };
+
++static const struct attribute_group *zram_disk_attr_groups[] = {
++ &zram_disk_attr_group,
++ NULL,
++};
++
+ /*
+ * Allocate and initialize new zram device. the function returns
+ * '>= 0' device_id upon success, and negative value otherwise.
+@@ -1264,15 +1269,9 @@ static int zram_add(void)
+ zram->disk->queue->limits.discard_zeroes_data = 0;
+ queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, zram->disk->queue);
+
++ disk_to_dev(zram->disk)->groups = zram_disk_attr_groups;
+ add_disk(zram->disk);
+
+- ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj,
+- &zram_disk_attr_group);
+- if (ret < 0) {
+- pr_err("Error creating sysfs group for device %d\n",
+- device_id);
+- goto out_free_disk;
+- }
+ strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor));
+ zram->meta = NULL;
+ zram->max_comp_streams = 1;
+@@ -1280,9 +1279,6 @@ static int zram_add(void)
+ pr_info("Added device: %s\n", zram->disk->disk_name);
+ return device_id;
+
+-out_free_disk:
+- del_gendisk(zram->disk);
+- put_disk(zram->disk);
+ out_free_queue:
+ blk_cleanup_queue(queue);
+ out_free_idr:
+@@ -1310,16 +1306,6 @@ static int zram_remove(struct zram *zram)
+ zram->claim = true;
+ mutex_unlock(&bdev->bd_mutex);
+
+- /*
+- * Remove sysfs first, so no one will perform a disksize
+- * store while we destroy the devices. This also helps during
+- * hot_remove -- zram_reset_device() is the last holder of
+- * ->init_lock, no later/concurrent disksize_store() or any
+- * other sysfs handlers are possible.
+- */
+- sysfs_remove_group(&disk_to_dev(zram->disk)->kobj,
+- &zram_disk_attr_group);
+-
+ /* Make sure all the pending I/O are finished */
+ fsync_bdev(bdev);
+ zram_reset_device(zram);
+--
+2.17.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
