--- /dev/null
+From 5ab3633d6907018b0b830a720e877c3884d679c3 Mon Sep 17 00:00:00 2001
+From: Hunt Xu <mhuntxu@gmail.com>
+Date: Sun, 1 Jul 2012 03:45:07 +0000
+Subject: drm/i915: make rc6 in sysfs functions conditional
+
+From: Hunt Xu <mhuntxu@gmail.com>
+
+commit 5ab3633d6907018b0b830a720e877c3884d679c3 upstream.
+
+Commit 0136db586c028f71e7cc21cc183064ff0d5919c8 merges rc6 information
+into the power group. However, when compiled with CONFIG_PM not set,
+modprobing i915 would taint since power_group_name is defined as NULL.
+
+This patch makes these rc6 in sysfs functions conditional upon the
+definition of the CONFIG_PM macro to avoid the above-mentioned problem.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=45181
+Tested-by: Kris Karas <bugs-a12@moonlit-rail.com>
+Signed-off-by: Hunt Xu <mhuntxu@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_sysfs.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_sysfs.c
++++ b/drivers/gpu/drm/i915/i915_sysfs.c
+@@ -31,6 +31,7 @@
+ #include <linux/sysfs.h>
+ #include "i915_drv.h"
+
++#ifdef CONFIG_PM
+ static u32 calc_residency(struct drm_device *dev, const u32 reg)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -109,3 +110,14 @@ void i915_teardown_sysfs(struct drm_devi
+ {
+ sysfs_unmerge_group(&dev->primary->kdev.kobj, &rc6_attr_group);
+ }
++#else
++void i915_setup_sysfs(struct drm_device *dev)
++{
++ return;
++}
++
++void i915_teardown_sysfs(struct drm_device *dev)
++{
++ return;
++}
++#endif /* CONFIG_PM */
--- /dev/null
+From 2f292004dd1fb005788dc0a9cdd5559812ed866e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 6 Aug 2012 10:03:59 -0400
+Subject: drm/radeon: add some new SI pci ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 2f292004dd1fb005788dc0a9cdd5559812ed866e upstream.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_pciids.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -213,9 +213,12 @@
+ {0x1002, 0x6800, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6801, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6802, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6806, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6810, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6816, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x6817, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6818, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6819, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6820, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
--- /dev/null
+From 5b23c9045a8b61352986270b2d109edf5085e113 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 31 Jul 2012 11:05:11 -0400
+Subject: drm/radeon: fix bank tiling parameters on cayman
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5b23c9045a8b61352986270b2d109edf5085e113 upstream.
+
+Handle the 16 bank case.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -574,10 +574,18 @@ static void cayman_gpu_init(struct radeo
+ if (rdev->flags & RADEON_IS_IGP)
+ rdev->config.cayman.tile_config |= 1 << 4;
+ else {
+- if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+- rdev->config.cayman.tile_config |= 1 << 4;
+- else
++ switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
++ case 0: /* four banks */
+ rdev->config.cayman.tile_config |= 0 << 4;
++ break;
++ case 1: /* eight banks */
++ rdev->config.cayman.tile_config |= 1 << 4;
++ break;
++ case 2: /* sixteen banks */
++ default:
++ rdev->config.cayman.tile_config |= 2 << 4;
++ break;
++ }
+ }
+ rdev->config.cayman.tile_config |=
+ ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
--- /dev/null
+From c8d15edc17d836686d1f071e564800e1a2724fa6 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 31 Jul 2012 11:01:10 -0400
+Subject: drm/radeon: fix bank tiling parameters on evergreen
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit c8d15edc17d836686d1f071e564800e1a2724fa6 upstream.
+
+Handle the 16 bank case.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1801,10 +1801,18 @@ static void evergreen_gpu_init(struct ra
+ if (rdev->flags & RADEON_IS_IGP)
+ rdev->config.evergreen.tile_config |= 1 << 4;
+ else {
+- if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+- rdev->config.evergreen.tile_config |= 1 << 4;
+- else
++ switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
++ case 0: /* four banks */
+ rdev->config.evergreen.tile_config |= 0 << 4;
++ break;
++ case 1: /* eight banks */
++ rdev->config.evergreen.tile_config |= 1 << 4;
++ break;
++ case 2: /* sixteen banks */
++ default:
++ rdev->config.evergreen.tile_config |= 2 << 4;
++ break;
++ }
+ }
+ rdev->config.evergreen.tile_config |= 0 << 8;
+ rdev->config.evergreen.tile_config |=
--- /dev/null
+From dca571a6a4edda1f61ba7ecb47431a22245490a3 Mon Sep 17 00:00:00 2001
+From: Christian König <deathsimple@vodafone.de>
+Date: Tue, 31 Jul 2012 13:48:51 +0200
+Subject: drm/radeon: fix bank tiling parameters on SI
+
+From: Christian König <deathsimple@vodafone.de>
+
+commit dca571a6a4edda1f61ba7ecb47431a22245490a3 upstream.
+
+The sixteen bank case wasn't handled here, leading to GPU
+crashes because of userspace miscalculation.
+
+Signed-off-by: Christian König <deathsimple@vodafone.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -1639,11 +1639,19 @@ static void si_gpu_init(struct radeon_de
+ /* XXX what about 12? */
+ rdev->config.si.tile_config |= (3 << 0);
+ break;
+- }
+- if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+- rdev->config.si.tile_config |= 1 << 4;
+- else
++ }
++ switch ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) {
++ case 0: /* four banks */
+ rdev->config.si.tile_config |= 0 << 4;
++ break;
++ case 1: /* eight banks */
++ rdev->config.si.tile_config |= 1 << 4;
++ break;
++ case 2: /* sixteen banks */
++ default:
++ rdev->config.si.tile_config |= 2 << 4;
++ break;
++ }
+ rdev->config.si.tile_config |=
+ ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
+ rdev->config.si.tile_config |=
--- /dev/null
+From 0f457e488c79922dfd646f94ed058764f7ba758c Mon Sep 17 00:00:00 2001
+From: Marek Olšák <maraeo@gmail.com>
+Date: Sun, 29 Jul 2012 16:24:57 +0200
+Subject: drm/radeon/kms: allow "invalid" DB formats as a means to disable DB
+
+From: Marek Olšák <maraeo@gmail.com>
+
+commit 0f457e488c79922dfd646f94ed058764f7ba758c upstream.
+
+Signed-off-by: Marek Olšák <maraeo@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen_cs.c | 6 ++++--
+ drivers/gpu/drm/radeon/evergreend.h | 2 ++
+ drivers/gpu/drm/radeon/r600_cs.c | 6 ++++--
+ drivers/gpu/drm/radeon/radeon_drv.c | 3 ++-
+ 4 files changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen_cs.c
++++ b/drivers/gpu/drm/radeon/evergreen_cs.c
+@@ -961,13 +961,15 @@ static int evergreen_cs_track_check(stru
+
+ if (track->db_dirty) {
+ /* Check stencil buffer */
+- if (G_028800_STENCIL_ENABLE(track->db_depth_control)) {
++ if (G_028044_FORMAT(track->db_s_info) != V_028044_STENCIL_INVALID &&
++ G_028800_STENCIL_ENABLE(track->db_depth_control)) {
+ r = evergreen_cs_track_validate_stencil(p);
+ if (r)
+ return r;
+ }
+ /* Check depth buffer */
+- if (G_028800_Z_ENABLE(track->db_depth_control)) {
++ if (G_028040_FORMAT(track->db_z_info) != V_028040_Z_INVALID &&
++ G_028800_Z_ENABLE(track->db_depth_control)) {
+ r = evergreen_cs_track_validate_depth(p);
+ if (r)
+ return r;
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -1273,6 +1273,8 @@
+ #define S_028044_FORMAT(x) (((x) & 0x1) << 0)
+ #define G_028044_FORMAT(x) (((x) >> 0) & 0x1)
+ #define C_028044_FORMAT 0xFFFFFFFE
++#define V_028044_STENCIL_INVALID 0
++#define V_028044_STENCIL_8 1
+ #define G_028044_TILE_SPLIT(x) (((x) >> 8) & 0x7)
+ #define DB_Z_READ_BASE 0x28048
+ #define DB_STENCIL_READ_BASE 0x2804c
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -764,8 +764,10 @@ static int r600_cs_track_check(struct ra
+ }
+
+ /* Check depth buffer */
+- if (track->db_dirty && (G_028800_STENCIL_ENABLE(track->db_depth_control) ||
+- G_028800_Z_ENABLE(track->db_depth_control))) {
++ if (track->db_dirty &&
++ G_028010_FORMAT(track->db_depth_info) != V_028010_DEPTH_INVALID &&
++ (G_028800_STENCIL_ENABLE(track->db_depth_control) ||
++ G_028800_Z_ENABLE(track->db_depth_control))) {
+ r = r600_cs_track_validate_db(p);
+ if (r)
+ return r;
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -59,9 +59,10 @@
+ * 2.15.0 - add max_pipes query
+ * 2.16.0 - fix evergreen 2D tiled surface calculation
+ * 2.17.0 - add STRMOUT_BASE_UPDATE for r7xx
++ * 2.18.0 - r600-eg: allow "invalid" DB formats
+ */
+ #define KMS_DRIVER_MAJOR 2
+-#define KMS_DRIVER_MINOR 17
++#define KMS_DRIVER_MINOR 18
+ #define KMS_DRIVER_PATCHLEVEL 0
+ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
+ int radeon_driver_unload_kms(struct drm_device *dev);
--- /dev/null
+From 7e731bc9a12339f344cddf82166b82633d99dd86 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 5 Aug 2012 23:28:16 -0400
+Subject: ext4: avoid kmemcheck complaint from reading uninitialized memory
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 7e731bc9a12339f344cddf82166b82633d99dd86 upstream.
+
+Commit 03179fe923 introduced a kmemcheck complaint in
+ext4_da_get_block_prep() because we save and restore
+ei->i_da_metadata_calc_last_lblock even though it is left
+uninitialized in the case where i_da_metadata_calc_len is zero.
+
+This doesn't hurt anything, but silencing the kmemcheck complaint
+makes it easier for people to find real bugs.
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45631
+(which is marked as a regression).
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -976,6 +976,7 @@ static struct inode *ext4_alloc_inode(st
+ ei->i_reserved_meta_blocks = 0;
+ ei->i_allocated_meta_blocks = 0;
+ ei->i_da_metadata_calc_len = 0;
++ ei->i_da_metadata_calc_last_lblock = 0;
+ spin_lock_init(&(ei->i_block_reservation_lock));
+ #ifdef CONFIG_QUOTA
+ ei->i_reserved_quota = 0;
--- /dev/null
+From 7a4c5de27efa4c2ecca87af0a3deea63446367e2 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 10 Aug 2012 13:57:52 -0400
+Subject: ext4: don't call ext4_error while block group is locked
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 7a4c5de27efa4c2ecca87af0a3deea63446367e2 upstream.
+
+While in ext4_validate_block_bitmap(), if an block allocation bitmap
+is found to be invalid, we call ext4_error() while the block group is
+still locked. This causes ext4_commit_super() to call a function
+which might sleep while in an atomic context.
+
+There's no need to keep the block group locked at this point, so hoist
+the ext4_error() call up to ext4_validate_block_bitmap() and release
+the block group spinlock before calling ext4_error().
+
+The reported stack trace can be found at:
+
+ http://article.gmane.org/gmane.comp.file-systems.ext4/33731
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/balloc.c | 62 ++++++++++++++++++++++++++++++++-----------------------
+ fs/ext4/bitmap.c | 1
+ 2 files changed, 37 insertions(+), 26 deletions(-)
+
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -280,14 +280,18 @@ struct ext4_group_desc * ext4_get_group_
+ return desc;
+ }
+
+-static int ext4_valid_block_bitmap(struct super_block *sb,
+- struct ext4_group_desc *desc,
+- unsigned int block_group,
+- struct buffer_head *bh)
++/*
++ * Return the block number which was discovered to be invalid, or 0 if
++ * the block bitmap is valid.
++ */
++static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
++ struct ext4_group_desc *desc,
++ unsigned int block_group,
++ struct buffer_head *bh)
+ {
+ ext4_grpblk_t offset;
+ ext4_grpblk_t next_zero_bit;
+- ext4_fsblk_t bitmap_blk;
++ ext4_fsblk_t blk;
+ ext4_fsblk_t group_first_block;
+
+ if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FLEX_BG)) {
+@@ -297,37 +301,33 @@ static int ext4_valid_block_bitmap(struc
+ * or it has to also read the block group where the bitmaps
+ * are located to verify they are set.
+ */
+- return 1;
++ return 0;
+ }
+ group_first_block = ext4_group_first_block_no(sb, block_group);
+
+ /* check whether block bitmap block number is set */
+- bitmap_blk = ext4_block_bitmap(sb, desc);
+- offset = bitmap_blk - group_first_block;
++ blk = ext4_block_bitmap(sb, desc);
++ offset = blk - group_first_block;
+ if (!ext4_test_bit(offset, bh->b_data))
+ /* bad block bitmap */
+- goto err_out;
++ return blk;
+
+ /* check whether the inode bitmap block number is set */
+- bitmap_blk = ext4_inode_bitmap(sb, desc);
+- offset = bitmap_blk - group_first_block;
++ blk = ext4_inode_bitmap(sb, desc);
++ offset = blk - group_first_block;
+ if (!ext4_test_bit(offset, bh->b_data))
+ /* bad block bitmap */
+- goto err_out;
++ return blk;
+
+ /* check whether the inode table block number is set */
+- bitmap_blk = ext4_inode_table(sb, desc);
+- offset = bitmap_blk - group_first_block;
++ blk = ext4_inode_table(sb, desc);
++ offset = blk - group_first_block;
+ next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
+ offset + EXT4_SB(sb)->s_itb_per_group,
+ offset);
+- if (next_zero_bit >= offset + EXT4_SB(sb)->s_itb_per_group)
+- /* good bitmap for inode tables */
+- return 1;
+-
+-err_out:
+- ext4_error(sb, "Invalid block bitmap - block_group = %d, block = %llu",
+- block_group, bitmap_blk);
++ if (next_zero_bit < offset + EXT4_SB(sb)->s_itb_per_group)
++ /* bad bitmap for inode tables */
++ return blk;
+ return 0;
+ }
+
+@@ -336,14 +336,26 @@ void ext4_validate_block_bitmap(struct s
+ unsigned int block_group,
+ struct buffer_head *bh)
+ {
++ ext4_fsblk_t blk;
++
+ if (buffer_verified(bh))
+ return;
+
+ ext4_lock_group(sb, block_group);
+- if (ext4_valid_block_bitmap(sb, desc, block_group, bh) &&
+- ext4_block_bitmap_csum_verify(sb, block_group, desc, bh,
+- EXT4_BLOCKS_PER_GROUP(sb) / 8))
+- set_buffer_verified(bh);
++ blk = ext4_valid_block_bitmap(sb, desc, block_group, bh);
++ if (unlikely(blk != 0)) {
++ ext4_unlock_group(sb, block_group);
++ ext4_error(sb, "bg %u: block %llu: invalid block bitmap",
++ block_group, blk);
++ return;
++ }
++ if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group,
++ desc, bh, EXT4_BLOCKS_PER_GROUP(sb) / 8))) {
++ ext4_unlock_group(sb, block_group);
++ ext4_error(sb, "bg %u: bad block bitmap checksum", block_group);
++ return;
++ }
++ set_buffer_verified(bh);
+ ext4_unlock_group(sb, block_group);
+ }
+
+--- a/fs/ext4/bitmap.c
++++ b/fs/ext4/bitmap.c
+@@ -86,7 +86,6 @@ int ext4_block_bitmap_csum_verify(struct
+ if (provided == calculated)
+ return 1;
+
+- ext4_error(sb, "Bad block bitmap checksum: block_group = %u", group);
+ return 0;
+ }
+
--- /dev/null
+From 89a4e48f8479f8145eca9698f39fe188c982212f Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 17 Aug 2012 08:54:52 -0400
+Subject: ext4: fix kernel BUG on large-scale rm -rf commands
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 89a4e48f8479f8145eca9698f39fe188c982212f upstream.
+
+Commit 968dee7722: "ext4: fix hole punch failure when depth is greater
+than 0" introduced a regression in v3.5.1/v3.6-rc1 which caused kernel
+crashes when users ran run "rm -rf" on large directory hierarchy on
+ext4 filesystems on RAID devices:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
+
+ Process rm (pid: 18229, threadinfo ffff8801276bc000, task ffff880123631710)
+ Call Trace:
+ [<ffffffff81236483>] ? __ext4_handle_dirty_metadata+0x83/0x110
+ [<ffffffff812353d3>] ext4_ext_truncate+0x193/0x1d0
+ [<ffffffff8120a8cf>] ? ext4_mark_inode_dirty+0x7f/0x1f0
+ [<ffffffff81207e05>] ext4_truncate+0xf5/0x100
+ [<ffffffff8120cd51>] ext4_evict_inode+0x461/0x490
+ [<ffffffff811a1312>] evict+0xa2/0x1a0
+ [<ffffffff811a1513>] iput+0x103/0x1f0
+ [<ffffffff81196d84>] do_unlinkat+0x154/0x1c0
+ [<ffffffff8118cc3a>] ? sys_newfstatat+0x2a/0x40
+ [<ffffffff81197b0b>] sys_unlinkat+0x1b/0x50
+ [<ffffffff816135e9>] system_call_fastpath+0x16/0x1b
+ Code: 8b 4d 20 0f b7 41 02 48 8d 04 40 48 8d 04 81 49 89 45 18 0f b7 49 02 48 83 c1 01 49 89 4d 00 e9 ae f8 ff ff 0f 1f 00 49 8b 45 28 <48> 8b 40 28 49 89 45 20 e9 85 f8 ff ff 0f 1f 80 00 00 00
+
+ RIP [<ffffffff81233164>] ext4_ext_remove_space+0xa34/0xdf0
+
+This could be reproduced as follows:
+
+The problem in commit 968dee7722 was that caused the variable 'i' to
+be left uninitialized if the truncate required more space than was
+available in the journal. This resulted in the function
+ext4_ext_truncate_extend_restart() returning -EAGAIN, which caused
+ext4_ext_remove_space() to restart the truncate operation after
+starting a new jbd2 handle.
+
+Reported-by: Maciej Żenczykowski <maze@google.com>
+Reported-by: Marti Raudsepp <marti@juffo.org>
+Tested-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -2663,6 +2663,7 @@ cont:
+ }
+ path[0].p_depth = depth;
+ path[0].p_hdr = ext_inode_hdr(inode);
++ i = 0;
+
+ if (ext4_ext_check(inode, path[0].p_hdr, depth)) {
+ err = -EIO;
--- /dev/null
+From 0548bbb85337e532ca2ed697c3e9b227ff2ed4b4 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Thu, 16 Aug 2012 11:59:04 -0400
+Subject: ext4: fix long mount times on very big file systems
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 0548bbb85337e532ca2ed697c3e9b227ff2ed4b4 upstream.
+
+Commit 8aeb00ff85a: "ext4: fix overhead calculation used by
+ext4_statfs()" introduced a O(n**2) calculation which makes very large
+file systems take forever to mount. Fix this with an optimization for
+non-bigalloc file systems. (For bigalloc file systems the overhead
+needs to be set in the the superblock.)
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3110,6 +3110,10 @@ static int count_overhead(struct super_b
+ ext4_group_t i, ngroups = ext4_get_groups_count(sb);
+ int s, j, count = 0;
+
++ if (!EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_BIGALLOC))
++ return (ext4_bg_has_super(sb, grp) + ext4_bg_num_gdb(sb, grp) +
++ sbi->s_itb_per_group + 2);
++
+ first_block = le32_to_cpu(sbi->s_es->s_first_data_block) +
+ (grp * EXT4_BLOCKS_PER_GROUP(sb));
+ last_block = first_block + EXT4_BLOCKS_PER_GROUP(sb) - 1;
--- /dev/null
+From d796c52ef0b71a988364f6109aeb63d79c5b116b Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 5 Aug 2012 19:04:57 -0400
+Subject: ext4: make sure the journal sb is written in ext4_clear_journal_err()
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit d796c52ef0b71a988364f6109aeb63d79c5b116b upstream.
+
+After we transfer set the EXT4_ERROR_FS bit in the file system
+superblock, it's not enough to call jbd2_journal_clear_err() to clear
+the error indication from journal superblock --- we need to call
+jbd2_journal_update_sb_errno() as well. Otherwise, when the root file
+system is mounted read-only, the journal is replayed, and the error
+indicator is transferred to the superblock --- but the s_errno field
+in the jbd2 superblock is left set (since although we cleared it in
+memory, we never flushed it out to disk).
+
+This can end up confusing e2fsck. We should make e2fsck more robust
+in this case, but the kernel shouldn't be leaving things in this
+confused state, either.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/super.c | 1 +
+ fs/jbd2/journal.c | 3 ++-
+ include/linux/jbd2.h | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4406,6 +4406,7 @@ static void ext4_clear_journal_err(struc
+ ext4_commit_super(sb, 1);
+
+ jbd2_journal_clear_err(journal);
++ jbd2_journal_update_sb_errno(journal);
+ }
+ }
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1377,7 +1377,7 @@ static void jbd2_mark_journal_empty(jour
+ * Update a journal's errno. Write updated superblock to disk waiting for IO
+ * to complete.
+ */
+-static void jbd2_journal_update_sb_errno(journal_t *journal)
++void jbd2_journal_update_sb_errno(journal_t *journal)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
+
+@@ -1390,6 +1390,7 @@ static void jbd2_journal_update_sb_errno
+
+ jbd2_write_superblock(journal, WRITE_SYNC);
+ }
++EXPORT_SYMBOL(jbd2_journal_update_sb_errno);
+
+ /*
+ * Read the superblock for a given journal, performing initial
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1125,6 +1125,7 @@ extern int jbd2_journal_destroy (j
+ extern int jbd2_journal_recover (journal_t *journal);
+ extern int jbd2_journal_wipe (journal_t *, int);
+ extern int jbd2_journal_skip_recovery (journal_t *);
++extern void jbd2_journal_update_sb_errno(journal_t *);
+ extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+ unsigned long, int);
+ extern void __jbd2_journal_abort_hard (journal_t *);
drm-i915-reorder-edp-disabling-to-fix-ivb-macbook-air.patch
drm-radeon-properly-handle-crtc-powergating.patch
drm-radeon-do-not-reenable-crtc-after-moving-vram-start-address.patch
+drm-i915-make-rc6-in-sysfs-functions-conditional.patch
+drm-radeon-add-some-new-si-pci-ids.patch
+drm-radeon-fix-bank-tiling-parameters-on-cayman.patch
+drm-radeon-fix-bank-tiling-parameters-on-si.patch
+drm-radeon-fix-bank-tiling-parameters-on-evergreen.patch
+drm-radeon-kms-allow-invalid-db-formats-as-a-means-to-disable-db.patch
+yama-access-task_struct-comm-directly.patch
+ext4-make-sure-the-journal-sb-is-written-in-ext4_clear_journal_err.patch
+ext4-avoid-kmemcheck-complaint-from-reading-uninitialized-memory.patch
+ext4-don-t-call-ext4_error-while-block-group-is-locked.patch
+ext4-fix-long-mount-times-on-very-big-file-systems.patch
+ext4-fix-kernel-bug-on-large-scale-rm-rf-commands.patch
--- /dev/null
+From 7612bfeecc197bbb6629842b5c6ff1967f0a9b70 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 15 Aug 2012 11:41:55 -0700
+Subject: Yama: access task_struct->comm directly
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 7612bfeecc197bbb6629842b5c6ff1967f0a9b70 upstream.
+
+The core ptrace access checking routine holds a task lock, and when
+reporting a failure, Yama takes a separate task lock. To avoid a
+potential deadlock with two ptracers taking the opposite locks, do not
+use get_task_comm() and just use ->comm directly since accuracy is not
+important for the report.
+
+Reported-by: Fengguang Wu <fengguang.wu@intel.com>
+Suggested-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/yama/yama_lsm.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/security/yama/yama_lsm.c
++++ b/security/yama/yama_lsm.c
+@@ -279,12 +279,9 @@ static int yama_ptrace_access_check(stru
+ }
+
+ if (rc) {
+- char name[sizeof(current->comm)];
+ printk_ratelimited(KERN_NOTICE
+ "ptrace of pid %d was attempted by: %s (pid %d)\n",
+- child->pid,
+- get_task_comm(name, current),
+- current->pid);
++ child->pid, current->comm, current->pid);
+ }
+
+ return rc;
+@@ -319,12 +316,9 @@ static int yama_ptrace_traceme(struct ta
+ }
+
+ if (rc) {
+- char name[sizeof(current->comm)];
+ printk_ratelimited(KERN_NOTICE
+ "ptraceme of pid %d was attempted by: %s (pid %d)\n",
+- current->pid,
+- get_task_comm(name, parent),
+- parent->pid);
++ current->pid, parent->comm, parent->pid);
+ }
+
+ return rc;
projects / thirdparty / kernel / stable-queue.git / commitdiff
