--- /dev/null
+From stable-bounces@linux.kernel.org Fri Jul 20 00:33:13 2007
+From: akpm@linux-foundation.org
+Date: Fri, 20 Jul 2007 00:31:47 -0700
+Subject: cr_backlight_probe() allocates too little storage for struct cr_panel
+To: torvalds@linux-foundation.org
+Cc: thomas@tungstengraphics.com, akpm@linux-foundation.org, jesper.juhl@gmail.com, alanh@tungstengraphics.com, stable@kernel.org
+Message-ID: <200707200731.l6K7VlJj013766@imap1.linux-foundation.org>
+
+
+From: Jesper Juhl <jesper.juhl@gmail.com>
+
+The Coverity checker noticed that we allocate too little storage for
+"struct cr_panel *crp" in cr_backlight_probe().
+
+Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
+Cc: Thomas Hellstrom <thomas@tungstengraphics.com>
+Cc: Alan Hourihane <alanh@tungstengraphics.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/backlight/cr_bllcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/backlight/cr_bllcd.c
++++ b/drivers/video/backlight/cr_bllcd.c
+@@ -174,7 +174,7 @@ static int cr_backlight_probe(struct pla
+ struct cr_panel *crp;
+ u8 dev_en;
+
+- crp = kzalloc(sizeof(crp), GFP_KERNEL);
++ crp = kzalloc(sizeof(*crp), GFP_KERNEL);
+ if (crp == NULL)
+ return -ENOMEM;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 12 09:28:41 2007
+From: Stefan Bader <shbader@de.ibm.com>
+Date: Thu, 12 Jul 2007 17:28:33 +0100
+Subject: dm: disable barriers
+To: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable@kernel.org, Stefan Bader <shbader@de.ibm.com>
+Message-ID: <20070712162833.GT24114@agk.fab.redhat.com>
+Content-Disposition: inline
+
+
+From: Stefan Bader <shbader@de.ibm.com>
+
+This patch causes device-mapper to reject any barrier requests. This is done
+since most of the targets won't handle this correctly anyway. So until the
+situation improves it is better to reject these requests at the first place.
+Since barrier requests won't get to the targets, the checks there can be
+removed.
+
+Signed-off-by: Stefan Bader <shbader@de.ibm.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 3 ---
+ drivers/md/dm-mpath.c | 3 ---
+ drivers/md/dm-snap.c | 6 ------
+ drivers/md/dm.c | 9 +++++++++
+ 4 files changed, 9 insertions(+), 12 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -943,9 +943,6 @@ static int crypt_map(struct dm_target *t
+ struct crypt_config *cc = ti->private;
+ struct crypt_io *io;
+
+- if (bio_barrier(bio))
+- return -EOPNOTSUPP;
+-
+ io = mempool_alloc(cc->io_pool, GFP_NOIO);
+ io->target = ti;
+ io->base_bio = bio;
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -798,9 +798,6 @@ static int multipath_map(struct dm_targe
+ struct mpath_io *mpio;
+ struct multipath *m = (struct multipath *) ti->private;
+
+- if (bio_barrier(bio))
+- return -EOPNOTSUPP;
+-
+ mpio = mempool_alloc(m->mpio_pool, GFP_NOIO);
+ dm_bio_record(&mpio->details, bio);
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -887,9 +887,6 @@ static int snapshot_map(struct dm_target
+ if (!s->valid)
+ return -EIO;
+
+- if (unlikely(bio_barrier(bio)))
+- return -EOPNOTSUPP;
+-
+ /* FIXME: should only take write lock if we need
+ * to copy an exception */
+ down_write(&s->lock);
+@@ -1160,9 +1157,6 @@ static int origin_map(struct dm_target *
+ struct dm_dev *dev = (struct dm_dev *) ti->private;
+ bio->bi_bdev = dev->bdev;
+
+- if (unlikely(bio_barrier(bio)))
+- return -EOPNOTSUPP;
+-
+ /* Only tell snapshots if this is a write */
+ return (bio_rw(bio) == WRITE) ? do_origin(dev, bio) : DM_MAPIO_REMAPPED;
+ }
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -802,6 +802,15 @@ static int dm_request(request_queue_t *q
+ int rw = bio_data_dir(bio);
+ struct mapped_device *md = q->queuedata;
+
++ /*
++ * There is no use in forwarding any barrier request since we can't
++ * guarantee it is (or can be) handled by the targets correctly.
++ */
++ if (unlikely(bio_barrier(bio))) {
++ bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
++ return 0;
++ }
++
+ down_read(&md->io_lock);
+
+ disk_stat_inc(dm_disk(md), ios[rw]);
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 12 09:28:00 2007
+From: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>
+Date: Thu, 12 Jul 2007 17:27:45 +0100
+Subject: dm io: fix panic on large request
+To: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>, stable@kernel.org
+Message-ID: <20070712162745.GP24114@agk.fab.redhat.com>
+Content-Disposition: inline
+
+
+From: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>
+
+bio_alloc_bioset() will return NULL if 'num_vecs' is too large.
+Use bio_get_nr_vecs() to get estimation of maximum number.
+
+Signed-off-by: Junichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-io.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -293,7 +293,10 @@ static void do_region(int rw, unsigned i
+ * bvec for bio_get/set_region() and decrement bi_max_vecs
+ * to hide it from bio_add_page().
+ */
+- num_bvecs = (remaining / (PAGE_SIZE >> SECTOR_SHIFT)) + 2;
++ num_bvecs = dm_sector_div_up(remaining,
++ (PAGE_SIZE >> SECTOR_SHIFT));
++ num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
++ num_bvecs);
+ bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
+ bio->bi_sector = where->sector + (where->count - remaining);
+ bio->bi_bdev = where->bdev;
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 12 09:27:34 2007
+From: Milan Broz <mbroz@redhat.com>
+Date: Thu, 12 Jul 2007 17:27:24 +0100
+Subject: dm raid1: fix status
+To: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable@kernel.org, Milan Broz <mbroz@redhat.com>
+Message-ID: <20070712162724.GO24114@agk.fab.redhat.com>
+Content-Disposition: inline
+
+
+From: Milan Broz <mbroz@redhat.com>
+
+Fix mirror status line broken in dm-log-report-fault-status.patch:
+ - space missing between two words
+ - placeholder ("0") required for compatibility with a subsequent patch
+ - incorrect offset parameter
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-raid1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -1288,12 +1288,12 @@ static int mirror_status(struct dm_targe
+ for (m = 0; m < ms->nr_mirrors; m++)
+ DMEMIT("%s ", ms->mirror[m].dev->name);
+
+- DMEMIT("%llu/%llu",
++ DMEMIT("%llu/%llu 0 ",
+ (unsigned long long)ms->rh.log->type->
+ get_sync_count(ms->rh.log),
+ (unsigned long long)ms->nr_regions);
+
+- sz = ms->rh.log->type->status(ms->rh.log, type, result, maxlen);
++ sz += ms->rh.log->type->status(ms->rh.log, type, result+sz, maxlen-sz);
+
+ break;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Jul 12 09:28:21 2007
+From: Milan Broz <mbroz@redhat.com>
+Date: Thu, 12 Jul 2007 17:28:13 +0100
+Subject: dm snapshot: permit invalid activation
+To: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable@kernel.org, Milan Broz <mbroz@redhat.com>
+Message-ID: <20070712162813.GR24114@agk.fab.redhat.com>
+Content-Disposition: inline
+
+
+From: Milan Broz <mbroz@redhat.com>
+
+Allow invalid snapshots to be activated instead of failing.
+
+This allows userspace to reinstate any given snapshot state - for
+example after an unscheduled reboot - and clean up the invalid snapshot
+at its leisure.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/md/dm-exception-store.c | 11 ++++++-----
+ drivers/md/dm-snap.c | 5 ++++-
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -457,11 +457,6 @@ static int persistent_read_metadata(stru
+ /*
+ * Sanity checks.
+ */
+- if (!ps->valid) {
+- DMWARN("snapshot is marked invalid");
+- return -EINVAL;
+- }
+-
+ if (ps->version != SNAPSHOT_DISK_VERSION) {
+ DMWARN("unable to handle snapshot disk version %d",
+ ps->version);
+@@ -469,6 +464,12 @@ static int persistent_read_metadata(stru
+ }
+
+ /*
++ * Metadata are valid, but snapshot is invalidated
++ */
++ if (!ps->valid)
++ return 1;
++
++ /*
+ * Read the metadata.
+ */
+ r = read_exceptions(ps);
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -522,9 +522,12 @@ static int snapshot_ctr(struct dm_target
+
+ /* Metadata must only be loaded into one table at once */
+ r = s->store.read_metadata(&s->store);
+- if (r) {
++ if (r < 0) {
+ ti->error = "Failed to read snapshot metadata";
+ goto bad6;
++ } else if (r > 0) {
++ s->valid = 0;
++ DMWARN("Snapshot is marked invalid.");
+ }
+
+ bio_list_init(&s->queued_bios);
libata-add-fujitsu-mhv2080bh-to-ncq-blacklist.patch
ieee1394-revert-sbp2-enforce-32bit-dma-mapping.patch
nfsd-fix-possible-oops-on-re-insertion-of-rpcsec_gss-modules.patch
+dm-raid1-fix-status.patch
+dm-io-fix-panic-on-large-request-2.patch
+dm-snapshot-permit-invalid-activation.patch
+dm-disable-barriers.patch
+cr_backlight_probe-allocates-too-little-storage-for-struct-cr_panel.patch