--- /dev/null
+From 385277bfb57faac44e92497104ba542cdd82d5fe Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 8 Jan 2016 19:07:55 -0500
+Subject: dm snapshot: fix hung bios when copy error occurs
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 385277bfb57faac44e92497104ba542cdd82d5fe upstream.
+
+When there is an error copying a chunk dm-snapshot can incorrectly hold
+associated bios indefinitely, resulting in hung IO.
+
+The function copy_callback sets pe->error if there was error copying the
+chunk, and then calls complete_exception. complete_exception calls
+pending_complete on error, otherwise it calls commit_exception with
+commit_callback (and commit_callback calls complete_exception).
+
+The persistent exception store (dm-snap-persistent.c) assumes that calls
+to prepare_exception and commit_exception are paired.
+persistent_prepare_exception increases ps->pending_count and
+persistent_commit_exception decreases it.
+
+If there is a copy error, persistent_prepare_exception is called but
+persistent_commit_exception is not. This results in the variable
+ps->pending_count never returning to zero and that causes some pending
+exceptions (and their associated bios) to be held forever.
+
+Fix this by unconditionally calling commit_exception regardless of
+whether the copy was successful. A new "valid" parameter is added to
+commit_exception -- when the copy fails this parameter is set to zero so
+that the chunk that failed to copy (and all following chunks) is not
+recorded in the snapshot store. Also, remove commit_callback now that
+it is merely a wrapper around pending_complete.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-exception-store.h | 2 +-
+ drivers/md/dm-snap-persistent.c | 5 ++++-
+ drivers/md/dm-snap-transient.c | 4 ++--
+ drivers/md/dm-snap.c | 20 +++++---------------
+ 4 files changed, 12 insertions(+), 19 deletions(-)
+
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -70,7 +70,7 @@ struct dm_exception_store_type {
+ * Update the metadata with this exception.
+ */
+ void (*commit_exception) (struct dm_exception_store *store,
+- struct dm_exception *e,
++ struct dm_exception *e, int valid,
+ void (*callback) (void *, int success),
+ void *callback_context);
+
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -700,7 +700,7 @@ static int persistent_prepare_exception(
+ }
+
+ static void persistent_commit_exception(struct dm_exception_store *store,
+- struct dm_exception *e,
++ struct dm_exception *e, int valid,
+ void (*callback) (void *, int success),
+ void *callback_context)
+ {
+@@ -709,6 +709,9 @@ static void persistent_commit_exception(
+ struct core_exception ce;
+ struct commit_callback *cb;
+
++ if (!valid)
++ ps->valid = 0;
++
+ ce.old_chunk = e->old_chunk;
+ ce.new_chunk = e->new_chunk;
+ write_exception(ps, ps->current_committed++, &ce);
+--- a/drivers/md/dm-snap-transient.c
++++ b/drivers/md/dm-snap-transient.c
+@@ -52,12 +52,12 @@ static int transient_prepare_exception(s
+ }
+
+ static void transient_commit_exception(struct dm_exception_store *store,
+- struct dm_exception *e,
++ struct dm_exception *e, int valid,
+ void (*callback) (void *, int success),
+ void *callback_context)
+ {
+ /* Just succeed */
+- callback(callback_context, 1);
++ callback(callback_context, valid);
+ }
+
+ static void transient_usage(struct dm_exception_store *store,
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1388,8 +1388,9 @@ static void __invalidate_snapshot(struct
+ dm_table_event(s->ti->table);
+ }
+
+-static void pending_complete(struct dm_snap_pending_exception *pe, int success)
++static void pending_complete(void *context, int success)
+ {
++ struct dm_snap_pending_exception *pe = context;
+ struct dm_exception *e;
+ struct dm_snapshot *s = pe->snap;
+ struct bio *origin_bios = NULL;
+@@ -1460,24 +1461,13 @@ out:
+ free_pending_exception(pe);
+ }
+
+-static void commit_callback(void *context, int success)
+-{
+- struct dm_snap_pending_exception *pe = context;
+-
+- pending_complete(pe, success);
+-}
+-
+ static void complete_exception(struct dm_snap_pending_exception *pe)
+ {
+ struct dm_snapshot *s = pe->snap;
+
+- if (unlikely(pe->copy_error))
+- pending_complete(pe, 0);
+-
+- else
+- /* Update the metadata if we are persistent */
+- s->store->type->commit_exception(s->store, &pe->e,
+- commit_callback, pe);
++ /* Update the metadata if we are persistent */
++ s->store->type->commit_exception(s->store, &pe->e, !pe->copy_error,
++ pending_complete, pe);
+ }
+
+ /*
--- /dev/null
+From 512167788a6fe9481a33a3cce5f80b684631a1bb Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Mon, 14 Dec 2015 09:26:01 -0500
+Subject: dm space map metadata: remove unused variable in brb_pop()
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 512167788a6fe9481a33a3cce5f80b684631a1bb upstream.
+
+Remove the unused struct block_op pointer that was inadvertantly
+introduced, via cut-and-paste of previous brb_op() code, as part of
+commit 50dd842ad.
+
+(Cc'ing stable@ because commit 50dd842ad did)
+
+Fixes: 50dd842ad ("dm space map metadata: fix ref counting bug when bootstrapping a new space map")
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -152,12 +152,9 @@ static int brb_peek(struct bop_ring_buff
+
+ static int brb_pop(struct bop_ring_buffer *brb)
+ {
+- struct block_op *bop;
+-
+ if (brb_empty(brb))
+ return -ENODATA;
+
+- bop = brb->bops + brb->begin;
+ brb->begin = brb_next(brb, brb->begin);
+
+ return 0;
--- /dev/null
+From dcc7fdbec53a960588f2c40232db2c6466c09917 Mon Sep 17 00:00:00 2001
+From: Antonio Ospite <ao2@ao2.it>
+Date: Fri, 2 Oct 2015 17:33:13 -0300
+Subject: [media] gspca: ov534/topro: prevent a division by 0
+
+From: Antonio Ospite <ao2@ao2.it>
+
+commit dcc7fdbec53a960588f2c40232db2c6466c09917 upstream.
+
+v4l2-compliance sends a zeroed struct v4l2_streamparm in
+v4l2-test-formats.cpp::testParmType(), and this results in a division by
+0 in some gspca subdrivers:
+
+ divide error: 0000 [#1] SMP
+ Modules linked in: gspca_ov534 gspca_main ...
+ CPU: 0 PID: 17201 Comm: v4l2-compliance Not tainted 4.3.0-rc2-ao2 #1
+ Hardware name: System manufacturer System Product Name/M2N-E SLI, BIOS
+ ASUS M2N-E SLI ACPI BIOS Revision 1301 09/16/2010
+ task: ffff8800818306c0 ti: ffff880095c4c000 task.ti: ffff880095c4c000
+ RIP: 0010:[<ffffffffa079bd62>] [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
+ RSP: 0018:ffff880095c4fce8 EFLAGS: 00010296
+ RAX: 0000000000000000 RBX: ffff8800c9522000 RCX: ffffffffa077a140
+ RDX: 0000000000000000 RSI: ffff880095e0c100 RDI: ffff8800c9522000
+ RBP: ffff880095e0c100 R08: ffffffffa077a100 R09: 00000000000000cc
+ R10: ffff880067ec7740 R11: 0000000000000016 R12: ffffffffa07bb400
+ R13: 0000000000000000 R14: ffff880081b6a800 R15: 0000000000000000
+ FS: 00007fda0de78740(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000014630f8 CR3: 00000000cf349000 CR4: 00000000000006f0
+ Stack:
+ ffffffffa07a6431 ffff8800c9522000 ffffffffa077656e 00000000c0cc5616
+ ffff8800c9522000 ffffffffa07a5e20 ffff880095e0c100 0000000000000000
+ ffff880067ec7740 ffffffffa077a140 ffff880067ec7740 0000000000000016
+ Call Trace:
+ [<ffffffffa07a6431>] ? v4l_s_parm+0x21/0x50 [videodev]
+ [<ffffffffa077656e>] ? vidioc_s_parm+0x4e/0x60 [gspca_main]
+ [<ffffffffa07a5e20>] ? __video_do_ioctl+0x280/0x2f0 [videodev]
+ [<ffffffffa07a5ba0>] ? video_ioctl2+0x20/0x20 [videodev]
+ [<ffffffffa07a59b9>] ? video_usercopy+0x319/0x4e0 [videodev]
+ [<ffffffff81182dc1>] ? page_add_new_anon_rmap+0x71/0xa0
+ [<ffffffff811afb92>] ? mem_cgroup_commit_charge+0x52/0x90
+ [<ffffffff81179b18>] ? handle_mm_fault+0xc18/0x1680
+ [<ffffffffa07a15cc>] ? v4l2_ioctl+0xac/0xd0 [videodev]
+ [<ffffffff811c846f>] ? do_vfs_ioctl+0x28f/0x480
+ [<ffffffff811c86d4>] ? SyS_ioctl+0x74/0x80
+ [<ffffffff8154a8b6>] ? entry_SYSCALL_64_fastpath+0x16/0x75
+ Code: c7 93 d9 79 a0 5b 5d e9 f1 f3 9a e0 0f 1f 00 66 2e 0f 1f 84 00
+ 00 00 00 00 66 66 66 66 90 53 31 d2 48 89 fb 48 83 ec 08 8b 46 10 <f7>
+ 76 0c 80 bf ac 0c 00 00 00 88 87 4e 0e 00 00 74 09 80 bf 4f
+ RIP [<ffffffffa079bd62>] sd_set_streamparm+0x12/0x60 [gspca_ov534]
+ RSP <ffff880095c4fce8>
+ ---[ end trace 279710c2c6c72080 ]---
+
+Following what the doc says about a zeroed timeperframe (see
+http://www.linuxtv.org/downloads/v4l-dvb-apis/vidioc-g-parm.html):
+
+ ...
+ To reset manually applications can just set this field to zero.
+
+fix the issue by resetting the frame rate to a default value in case of
+an unusable timeperframe.
+
+The fix is done in the subdrivers instead of gspca.c because only the
+subdrivers have notion of a default frame rate to reset the camera to.
+
+Signed-off-by: Antonio Ospite <ao2@ao2.it>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/gspca/ov534.c | 9 +++++++--
+ drivers/media/usb/gspca/topro.c | 6 +++++-
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/gspca/ov534.c
++++ b/drivers/media/usb/gspca/ov534.c
+@@ -1490,8 +1490,13 @@ static void sd_set_streamparm(struct gsp
+ struct v4l2_fract *tpf = &cp->timeperframe;
+ struct sd *sd = (struct sd *) gspca_dev;
+
+- /* Set requested framerate */
+- sd->frame_rate = tpf->denominator / tpf->numerator;
++ if (tpf->numerator == 0 || tpf->denominator == 0)
++ /* Set default framerate */
++ sd->frame_rate = 30;
++ else
++ /* Set requested framerate */
++ sd->frame_rate = tpf->denominator / tpf->numerator;
++
+ if (gspca_dev->streaming)
+ set_frame_rate(gspca_dev);
+
+--- a/drivers/media/usb/gspca/topro.c
++++ b/drivers/media/usb/gspca/topro.c
+@@ -4792,7 +4792,11 @@ static void sd_set_streamparm(struct gsp
+ struct v4l2_fract *tpf = &cp->timeperframe;
+ int fr, i;
+
+- sd->framerate = tpf->denominator / tpf->numerator;
++ if (tpf->numerator == 0 || tpf->denominator == 0)
++ sd->framerate = 30;
++ else
++ sd->framerate = tpf->denominator / tpf->numerator;
++
+ if (gspca_dev->streaming)
+ setframerate(gspca_dev, v4l2_ctrl_g_ctrl(gspca_dev->exposure));
+
--- /dev/null
+From c9d57de6103e343f2d4e04ea8d9e417e10a24da7 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Mon, 31 Aug 2015 06:13:45 -0300
+Subject: [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit c9d57de6103e343f2d4e04ea8d9e417e10a24da7 upstream.
+
+When in FE_TUNE_MODE_ONESHOT the frontend must report
+the actual capabilities so user can take appropriate
+action.
+
+With frontends that can't do auto inversion this is done
+by dvb-core automatically so CAN_INVERSION_AUTO is valid.
+
+However, when in FE_TUNE_MODE_ONESHOT this is not true.
+
+So only set FE_CAN_INVERSION_AUTO in modes other than
+FE_TUNE_MODE_ONESHOT
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-core/dvb_frontend.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb-core/dvb_frontend.c
+@@ -2195,9 +2195,9 @@ static int dvb_frontend_ioctl_legacy(str
+ dev_dbg(fe->dvb->device, "%s: current delivery system on cache: %d, V3 type: %d\n",
+ __func__, c->delivery_system, fe->ops.info.type);
+
+- /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't
+- * do it, it is done for it. */
+- info->caps |= FE_CAN_INVERSION_AUTO;
++ /* Set CAN_INVERSION_AUTO bit on in other than oneshot mode */
++ if (!(fepriv->tune_mode_flags & FE_TUNE_MODE_ONESHOT))
++ info->caps |= FE_CAN_INVERSION_AUTO;
+ err = 0;
+ break;
+ }
s390-dasd-fix-refcount-for-pav-reassignment.patch
uml-flush-stdout-before-forking.patch
uml-fix-hostfs-mknod.patch
+media-dvb-core-don-t-force-can_inversion_auto-in-oneshot-mode.patch
+gspca-ov534-topro-prevent-a-division-by-0.patch
+tda1004x-only-update-the-frontend-properties-if-locked.patch
+dm-space-map-metadata-remove-unused-variable-in-brb_pop.patch
+dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch
--- /dev/null
+From e8beb02343e7582980c6705816cd957cf4f74c7a Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Wed, 3 Feb 2016 17:33:48 -0200
+Subject: [media] tda1004x: only update the frontend properties if locked
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit e8beb02343e7582980c6705816cd957cf4f74c7a upstream.
+
+The tda1004x was updating the properties cache before locking.
+If the device is not locked, the data at the registers are just
+random values with no real meaning.
+
+This caused the driver to fail with libdvbv5, as such library
+calls GET_PROPERTY from time to time, in order to return the
+DVB stats.
+
+Tested with a saa7134 card 78:
+ ASUSTeK P7131 Dual, vendor PCI ID: 1043:4862
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/tda1004x.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/dvb-frontends/tda1004x.c
++++ b/drivers/media/dvb-frontends/tda1004x.c
+@@ -903,9 +903,18 @@ static int tda1004x_get_fe(struct dvb_fr
+ {
+ struct dtv_frontend_properties *fe_params = &fe->dtv_property_cache;
+ struct tda1004x_state* state = fe->demodulator_priv;
++ int status;
+
+ dprintk("%s\n", __func__);
+
++ status = tda1004x_read_byte(state, TDA1004X_STATUS_CD);
++ if (status == -1)
++ return -EIO;
++
++ /* Only update the properties cache if device is locked */
++ if (!(status & 8))
++ return 0;
++
+ // inversion status
+ fe_params->inversion = INVERSION_OFF;
+ if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20)
projects / thirdparty / kernel / stable-queue.git / commitdiff
