]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.8-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 26 Mar 2013 18:07:07 +0000 (11:07 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 26 Mar 2013 18:07:07 +0000 (11:07 -0700)
added patches:
cifs-delay-super-block-destruction-until-all-cifsfileinfo-objects-are-gone.patch
cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch
dm-thin-fix-discard-corruption.patch
dm-verity-avoid-deadlock.patch
drm-mgag200-bug-fix-modified-pll-algorithm-for-eh-project.patch
drm-radeon-add-richland-pci-ids.patch
drm-radeon-add-support-for-richland-apus.patch
drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch
drm-radeon-fix-backend-map-setup-on-1-rb-trinity-boards.patch
drm-radeon-fix-s-r-on-vm-systems-cayman-tn-si.patch
ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch
jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch

13 files changed:
queue-3.8/cifs-delay-super-block-destruction-until-all-cifsfileinfo-objects-are-gone.patch [new file with mode: 0644]
queue-3.8/cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch [new file with mode: 0644]
queue-3.8/dm-thin-fix-discard-corruption.patch [new file with mode: 0644]
queue-3.8/dm-verity-avoid-deadlock.patch [new file with mode: 0644]
queue-3.8/drm-mgag200-bug-fix-modified-pll-algorithm-for-eh-project.patch [new file with mode: 0644]
queue-3.8/drm-radeon-add-richland-pci-ids.patch [new file with mode: 0644]
queue-3.8/drm-radeon-add-support-for-richland-apus.patch [new file with mode: 0644]
queue-3.8/drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch [new file with mode: 0644]
queue-3.8/drm-radeon-fix-backend-map-setup-on-1-rb-trinity-boards.patch [new file with mode: 0644]
queue-3.8/drm-radeon-fix-s-r-on-vm-systems-cayman-tn-si.patch [new file with mode: 0644]
queue-3.8/ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch [new file with mode: 0644]
queue-3.8/jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch [new file with mode: 0644]
queue-3.8/series

diff --git a/queue-3.8/cifs-delay-super-block-destruction-until-all-cifsfileinfo-objects-are-gone.patch b/queue-3.8/cifs-delay-super-block-destruction-until-all-cifsfileinfo-objects-are-gone.patch
new file mode 100644 (file)
index 0000000..bbeda76
--- /dev/null
@@ -0,0 +1,121 @@
+From 24261fc23db950951760d00c188ba63cc756b932 Mon Sep 17 00:00:00 2001
+From: Mateusz Guzik <mguzik@redhat.com>
+Date: Fri, 8 Mar 2013 16:30:03 +0100
+Subject: cifs: delay super block destruction until all cifsFileInfo objects are gone
+
+From: Mateusz Guzik <mguzik@redhat.com>
+
+commit 24261fc23db950951760d00c188ba63cc756b932 upstream.
+
+cifsFileInfo objects hold references to dentries and it is possible that
+these will still be around in workqueues when VFS decides to kill super
+block during unmount.
+
+This results in panics like this one:
+BUG: Dentry ffff88001f5e76c0{i=66b4a,n=1M-2} still in use (1) [unmount of cifs cifs]
+------------[ cut here ]------------
+kernel BUG at fs/dcache.c:943!
+[..]
+Process umount (pid: 1781, threadinfo ffff88003d6e8000, task ffff880035eeaec0)
+[..]
+Call Trace:
+ [<ffffffff811b44f3>] shrink_dcache_for_umount+0x33/0x60
+ [<ffffffff8119f7fc>] generic_shutdown_super+0x2c/0xe0
+ [<ffffffff8119f946>] kill_anon_super+0x16/0x30
+ [<ffffffffa036623a>] cifs_kill_sb+0x1a/0x30 [cifs]
+ [<ffffffff8119fcc7>] deactivate_locked_super+0x57/0x80
+ [<ffffffff811a085e>] deactivate_super+0x4e/0x70
+ [<ffffffff811bb417>] mntput_no_expire+0xd7/0x130
+ [<ffffffff811bc30c>] sys_umount+0x9c/0x3c0
+ [<ffffffff81657c19>] system_call_fastpath+0x16/0x1b
+
+Fix this by making each cifsFileInfo object hold a reference to cifs
+super block, which implicitly keeps VFS super block around as well.
+
+Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Reported-and-Tested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifsfs.c |   24 ++++++++++++++++++++++++
+ fs/cifs/cifsfs.h |    4 ++++
+ fs/cifs/file.c   |    6 +++++-
+ 3 files changed, 33 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -91,6 +91,30 @@ struct workqueue_struct     *cifsiod_wq;
+ __u8 cifs_client_guid[SMB2_CLIENT_GUID_SIZE];
+ #endif
++/*
++ * Bumps refcount for cifs super block.
++ * Note that it should be only called if a referece to VFS super block is
++ * already held, e.g. in open-type syscalls context. Otherwise it can race with
++ * atomic_dec_and_test in deactivate_locked_super.
++ */
++void
++cifs_sb_active(struct super_block *sb)
++{
++      struct cifs_sb_info *server = CIFS_SB(sb);
++
++      if (atomic_inc_return(&server->active) == 1)
++              atomic_inc(&sb->s_active);
++}
++
++void
++cifs_sb_deactive(struct super_block *sb)
++{
++      struct cifs_sb_info *server = CIFS_SB(sb);
++
++      if (atomic_dec_and_test(&server->active))
++              deactivate_super(sb);
++}
++
+ static int
+ cifs_read_super(struct super_block *sb)
+ {
+--- a/fs/cifs/cifsfs.h
++++ b/fs/cifs/cifsfs.h
+@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_t
+ extern const struct address_space_operations cifs_addr_ops;
+ extern const struct address_space_operations cifs_addr_ops_smallbuf;
++/* Functions related to super block operations */
++extern void cifs_sb_active(struct super_block *sb);
++extern void cifs_sb_deactive(struct super_block *sb);
++
+ /* Functions related to inodes */
+ extern const struct inode_operations cifs_dir_inode_ops;
+ extern struct inode *cifs_root_iget(struct super_block *);
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -294,6 +294,8 @@ cifs_new_fileinfo(struct cifs_fid *fid,
+       INIT_WORK(&cfile->oplock_break, cifs_oplock_break);
+       mutex_init(&cfile->fh_mutex);
++      cifs_sb_active(inode->i_sb);
++
+       /*
+        * If the server returned a read oplock and we have mandatory brlocks,
+        * set oplock level to None.
+@@ -343,7 +345,8 @@ void cifsFileInfo_put(struct cifsFileInf
+       struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+       struct TCP_Server_Info *server = tcon->ses->server;
+       struct cifsInodeInfo *cifsi = CIFS_I(inode);
+-      struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
++      struct super_block *sb = inode->i_sb;
++      struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+       struct cifsLockInfo *li, *tmp;
+       struct cifs_fid fid;
+       struct cifs_pending_open open;
+@@ -408,6 +411,7 @@ void cifsFileInfo_put(struct cifsFileInf
+       cifs_put_tlink(cifs_file->tlink);
+       dput(cifs_file->dentry);
++      cifs_sb_deactive(sb);
+       kfree(cifs_file);
+ }
diff --git a/queue-3.8/cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch b/queue-3.8/cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch
new file mode 100644 (file)
index 0000000..850099d
--- /dev/null
@@ -0,0 +1,97 @@
+From f853c616883a8de966873a1dab283f1369e275a1 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 11 Mar 2013 09:52:19 -0400
+Subject: cifs: ignore everything in SPNEGO blob after mechTypes
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit f853c616883a8de966873a1dab283f1369e275a1 upstream.
+
+We've had several reports of people attempting to mount Windows 8 shares
+and getting failures with a return code of -EINVAL. The default sec=
+mode changed recently to sec=ntlmssp. With that, we expect and parse a
+SPNEGO blob from the server in the NEGOTIATE reply.
+
+The current decode_negTokenInit function first parses all of the
+mechTypes and then tries to parse the rest of the negTokenInit reply.
+The parser however currently expects a mechListMIC or nothing to follow the
+mechTypes, but Windows 8 puts a mechToken field there instead to carry
+some info for the new NegoEx stuff.
+
+In practice, we don't do anything with the fields after the mechTypes
+anyway so I don't see any real benefit in continuing to parse them.
+This patch just has the kernel ignore the fields after the mechTypes.
+We'll probably need to reinstate some of this if we ever want to support
+NegoEx.
+
+Reported-by: Jason Burgess <jason@jacknife2.dns2go.com>
+Reported-by: Yan Li <elliot.li.tech@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/asn1.c |   53 +++++------------------------------------------------
+ 1 file changed, 5 insertions(+), 48 deletions(-)
+
+--- a/fs/cifs/asn1.c
++++ b/fs/cifs/asn1.c
+@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *secur
+               }
+       }
+-      /* mechlistMIC */
+-      if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-              /* Check if we have reached the end of the blob, but with
+-                 no mechListMic (e.g. NTLMSSP instead of KRB5) */
+-              if (ctx.error == ASN1_ERR_DEC_EMPTY)
+-                      goto decode_negtoken_exit;
+-              cFYI(1, "Error decoding last part negTokenInit exit3");
+-              return 0;
+-      } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-              /* tag = 3 indicating mechListMIC */
+-              cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
+-                      cls, con, tag, end, *end);
+-              return 0;
+-      }
+-
+-      /* sequence */
+-      if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-              cFYI(1, "Error decoding last part negTokenInit exit5");
+-              return 0;
+-      } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
+-                 || (tag != ASN1_SEQ)) {
+-              cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
+-                      cls, con, tag, end, *end);
+-      }
+-
+-      /* sequence of */
+-      if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-              cFYI(1, "Error decoding last part negTokenInit exit 7");
+-              return 0;
+-      } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
+-              cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
+-                      cls, con, tag, end, *end);
+-              return 0;
+-      }
+-
+-      /* general string */
+-      if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
+-              cFYI(1, "Error decoding last part negTokenInit exit9");
+-              return 0;
+-      } else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
+-                 || (tag != ASN1_GENSTR)) {
+-              cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
+-                      cls, con, tag, end, *end);
+-              return 0;
+-      }
+-      cFYI(1, "Need to call asn1_octets_decode() function for %s",
+-              ctx.pointer);   /* is this UTF-8 or ASCII? */
+-decode_negtoken_exit:
++      /*
++       * We currently ignore anything at the end of the SPNEGO blob after
++       * the mechTypes have been parsed, since none of that info is
++       * used at the moment.
++       */
+       return 1;
+ }
diff --git a/queue-3.8/dm-thin-fix-discard-corruption.patch b/queue-3.8/dm-thin-fix-discard-corruption.patch
new file mode 100644 (file)
index 0000000..dbc41ed
--- /dev/null
@@ -0,0 +1,192 @@
+From f046f89a99ccfd9408b94c653374ff3065c7edb3 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 20 Mar 2013 17:21:24 +0000
+Subject: dm thin: fix discard corruption
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit f046f89a99ccfd9408b94c653374ff3065c7edb3 upstream.
+
+Fix a bug in dm_btree_remove that could leave leaf values with incorrect
+reference counts.  The effect of this was that removal of a shared block
+could result in the space maps thinking the block was no longer used.
+More concretely, if you have a thin device and a snapshot of it, sending
+a discard to a shared region of the thin could corrupt the snapshot.
+
+Thinp uses a 2-level nested btree to store it's mappings.  This first
+level is indexed by thin device, and the second level by logical
+block.
+
+Often when we're removing an entry in this mapping tree we need to
+rebalance nodes, which can involve shadowing them, possibly creating a
+copy if the block is shared.  If we do create a copy then children of
+that node need to have their reference counts incremented.  In this
+way reference counts percolate down the tree as shared trees diverge.
+
+The rebalance functions were incrementing the children at the
+appropriate time, but they were always assuming the children were
+internal nodes.  This meant the leaf values (in our case packed
+block/flags entries) were not being incremented.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c                         |    4 +-
+ drivers/md/persistent-data/dm-btree-remove.c |   46 ++++++++++++++-------------
+ 2 files changed, 26 insertions(+), 24 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2479,7 +2479,7 @@ static struct target_type pool_target =
+       .name = "thin-pool",
+       .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
+                   DM_TARGET_IMMUTABLE,
+-      .version = {1, 6, 1},
++      .version = {1, 7, 0},
+       .module = THIS_MODULE,
+       .ctr = pool_ctr,
+       .dtr = pool_dtr,
+@@ -2766,7 +2766,7 @@ static int thin_iterate_devices(struct d
+ static struct target_type thin_target = {
+       .name = "thin",
+-      .version = {1, 7, 1},
++      .version = {1, 8, 0},
+       .module = THIS_MODULE,
+       .ctr = thin_ctr,
+       .dtr = thin_dtr,
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -139,15 +139,8 @@ struct child {
+       struct btree_node *n;
+ };
+-static struct dm_btree_value_type le64_type = {
+-      .context = NULL,
+-      .size = sizeof(__le64),
+-      .inc = NULL,
+-      .dec = NULL,
+-      .equal = NULL
+-};
+-
+-static int init_child(struct dm_btree_info *info, struct btree_node *parent,
++static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
++                    struct btree_node *parent,
+                     unsigned index, struct child *result)
+ {
+       int r, inc;
+@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_in
+       result->n = dm_block_data(result->block);
+       if (inc)
+-              inc_children(info->tm, result->n, &le64_type);
++              inc_children(info->tm, result->n, vt);
+       *((__le64 *) value_ptr(parent, index)) =
+               cpu_to_le64(dm_block_location(result->block));
+@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree
+ }
+ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
+-                    unsigned left_index)
++                    struct dm_btree_value_type *vt, unsigned left_index)
+ {
+       int r;
+       struct btree_node *parent;
+@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spin
+       parent = dm_block_data(shadow_current(s));
+-      r = init_child(info, parent, left_index, &left);
++      r = init_child(info, vt, parent, left_index, &left);
+       if (r)
+               return r;
+-      r = init_child(info, parent, left_index + 1, &right);
++      r = init_child(info, vt, parent, left_index + 1, &right);
+       if (r) {
+               exit_child(info, &left);
+               return r;
+@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree
+ }
+ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
+-                    unsigned left_index)
++                    struct dm_btree_value_type *vt, unsigned left_index)
+ {
+       int r;
+       struct btree_node *parent = dm_block_data(shadow_current(s));
+@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spin
+       /*
+        * FIXME: fill out an array?
+        */
+-      r = init_child(info, parent, left_index, &left);
++      r = init_child(info, vt, parent, left_index, &left);
+       if (r)
+               return r;
+-      r = init_child(info, parent, left_index + 1, &center);
++      r = init_child(info, vt, parent, left_index + 1, &center);
+       if (r) {
+               exit_child(info, &left);
+               return r;
+       }
+-      r = init_child(info, parent, left_index + 2, &right);
++      r = init_child(info, vt, parent, left_index + 2, &right);
+       if (r) {
+               exit_child(info, &left);
+               exit_child(info, &center);
+@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_tran
+ }
+ static int rebalance_children(struct shadow_spine *s,
+-                            struct dm_btree_info *info, uint64_t key)
++                            struct dm_btree_info *info,
++                            struct dm_btree_value_type *vt, uint64_t key)
+ {
+       int i, r, has_left_sibling, has_right_sibling;
+       uint32_t child_entries;
+@@ -472,13 +466,13 @@ static int rebalance_children(struct sha
+       has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
+       if (!has_left_sibling)
+-              r = rebalance2(s, info, i);
++              r = rebalance2(s, info, vt, i);
+       else if (!has_right_sibling)
+-              r = rebalance2(s, info, i - 1);
++              r = rebalance2(s, info, vt, i - 1);
+       else
+-              r = rebalance3(s, info, i - 1);
++              r = rebalance3(s, info, vt, i - 1);
+       return r;
+ }
+@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spin
+               if (le32_to_cpu(n->header.flags) & LEAF_NODE)
+                       return do_leaf(n, key, index);
+-              r = rebalance_children(s, info, key);
++              r = rebalance_children(s, info, vt, key);
+               if (r)
+                       break;
+@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spin
+       return r;
+ }
++static struct dm_btree_value_type le64_type = {
++      .context = NULL,
++      .size = sizeof(__le64),
++      .inc = NULL,
++      .dec = NULL,
++      .equal = NULL
++};
++
+ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+                   uint64_t *keys, dm_block_t *new_root)
+ {
diff --git a/queue-3.8/dm-verity-avoid-deadlock.patch b/queue-3.8/dm-verity-avoid-deadlock.patch
new file mode 100644 (file)
index 0000000..9e9bebe
--- /dev/null
@@ -0,0 +1,130 @@
+From 3b6b7813b198b578aa7e04e4047ddb8225c37b7f Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 20 Mar 2013 17:21:25 +0000
+Subject: dm verity: avoid deadlock
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 3b6b7813b198b578aa7e04e4047ddb8225c37b7f upstream.
+
+A deadlock was found in the prefetch code in the dm verity map
+function.  This patch fixes this by transferring the prefetch
+to a worker thread and skipping it completely if kmalloc fails.
+
+If generic_make_request is called recursively, it queues the I/O
+request on the current->bio_list without making the I/O request
+and returns. The routine making the recursive call cannot wait
+for the I/O to complete.
+
+The deadlock occurs when one thread grabs the bufio_client
+mutex and waits for an I/O to complete but the I/O is queued
+on another thread's current->bio_list and is waiting to get
+the mutex held by the first thread.
+
+The fix recognises that prefetching is not essential.  If memory
+can be allocated, it queues the prefetch request to the worker thread,
+but if not, it does nothing.
+
+Signed-off-by: Paul Taysom <taysom@chromium.org>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-bufio.c  |    2 ++
+ drivers/md/dm-verity.c |   39 ++++++++++++++++++++++++++++++++++-----
+ 2 files changed, 36 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1026,6 +1026,8 @@ void dm_bufio_prefetch(struct dm_bufio_c
+ {
+       struct blk_plug plug;
++      BUG_ON(dm_bufio_in_request());
++
+       blk_start_plug(&plug);
+       dm_bufio_lock(c);
+--- a/drivers/md/dm-verity.c
++++ b/drivers/md/dm-verity.c
+@@ -93,6 +93,13 @@ struct dm_verity_io {
+        */
+ };
++struct dm_verity_prefetch_work {
++      struct work_struct work;
++      struct dm_verity *v;
++      sector_t block;
++      unsigned n_blocks;
++};
++
+ static struct shash_desc *io_hash_desc(struct dm_verity *v, struct dm_verity_io *io)
+ {
+       return (struct shash_desc *)(io + 1);
+@@ -424,15 +431,18 @@ static void verity_end_io(struct bio *bi
+  * The root buffer is not prefetched, it is assumed that it will be cached
+  * all the time.
+  */
+-static void verity_prefetch_io(struct dm_verity *v, struct dm_verity_io *io)
++static void verity_prefetch_io(struct work_struct *work)
+ {
++      struct dm_verity_prefetch_work *pw =
++              container_of(work, struct dm_verity_prefetch_work, work);
++      struct dm_verity *v = pw->v;
+       int i;
+       for (i = v->levels - 2; i >= 0; i--) {
+               sector_t hash_block_start;
+               sector_t hash_block_end;
+-              verity_hash_at_level(v, io->block, i, &hash_block_start, NULL);
+-              verity_hash_at_level(v, io->block + io->n_blocks - 1, i, &hash_block_end, NULL);
++              verity_hash_at_level(v, pw->block, i, &hash_block_start, NULL);
++              verity_hash_at_level(v, pw->block + pw->n_blocks - 1, i, &hash_block_end, NULL);
+               if (!i) {
+                       unsigned cluster = ACCESS_ONCE(dm_verity_prefetch_cluster);
+@@ -452,6 +462,25 @@ no_prefetch_cluster:
+               dm_bufio_prefetch(v->bufio, hash_block_start,
+                                 hash_block_end - hash_block_start + 1);
+       }
++
++      kfree(pw);
++}
++
++static void verity_submit_prefetch(struct dm_verity *v, struct dm_verity_io *io)
++{
++      struct dm_verity_prefetch_work *pw;
++
++      pw = kmalloc(sizeof(struct dm_verity_prefetch_work),
++              GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
++
++      if (!pw)
++              return;
++
++      INIT_WORK(&pw->work, verity_prefetch_io);
++      pw->v = v;
++      pw->block = io->block;
++      pw->n_blocks = io->n_blocks;
++      queue_work(v->verify_wq, &pw->work);
+ }
+ /*
+@@ -498,7 +527,7 @@ static int verity_map(struct dm_target *
+       memcpy(io->io_vec, bio_iovec(bio),
+              io->io_vec_size * sizeof(struct bio_vec));
+-      verity_prefetch_io(v, io);
++      verity_submit_prefetch(v, io);
+       generic_make_request(bio);
+@@ -858,7 +887,7 @@ bad:
+ static struct target_type verity_target = {
+       .name           = "verity",
+-      .version        = {1, 1, 1},
++      .version        = {1, 2, 0},
+       .module         = THIS_MODULE,
+       .ctr            = verity_ctr,
+       .dtr            = verity_dtr,
diff --git a/queue-3.8/drm-mgag200-bug-fix-modified-pll-algorithm-for-eh-project.patch b/queue-3.8/drm-mgag200-bug-fix-modified-pll-algorithm-for-eh-project.patch
new file mode 100644 (file)
index 0000000..41fec4d
--- /dev/null
@@ -0,0 +1,68 @@
+From 260b3f1291a75a580d22ce8bfb1499c617272716 Mon Sep 17 00:00:00 2001
+From: Julia Lemire <jlemire@matrox.com>
+Date: Mon, 18 Mar 2013 10:17:47 -0400
+Subject: drm/mgag200: Bug fix: Modified pll algorithm for EH project
+
+From: Julia Lemire <jlemire@matrox.com>
+
+commit 260b3f1291a75a580d22ce8bfb1499c617272716 upstream.
+
+While testing the mgag200 kms driver on the HP ProLiant Gen8, a
+bug was seen.  Once the bootloader would load the selected kernel,
+the screen would go black.  At first it was assumed that the
+mgag200 kms driver was hanging.  But after setting up the grub
+serial output, it was seen that the driver was being loaded
+properly.  After trying serval monitors, one finaly displayed
+the message "Frequency Out of Range".  By comparing the kms pll
+algorithm with the previous mgag200 xorg driver pll algorithm,
+discrepencies were found.  Once the kms pll algorithm was
+modified, the expected pll values were produced.  This fix was
+tested on several monitors of varying native resolutions.
+
+Signed-off-by: Julia Lemire <jlemire@matrox.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mgag200/mgag200_mode.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
+@@ -382,19 +382,19 @@ static int mga_g200eh_set_plls(struct mg
+       m = n = p = 0;
+       vcomax = 800000;
+       vcomin = 400000;
+-      pllreffreq = 3333;
++      pllreffreq = 33333;
+       delta = 0xffffffff;
+       permitteddelta = clock * 5 / 1000;
+-      for (testp = 16; testp > 0; testp--) {
++      for (testp = 16; testp > 0; testp >>= 1) {
+               if (clock * testp > vcomax)
+                       continue;
+               if (clock * testp < vcomin)
+                       continue;
+               for (testm = 1; testm < 33; testm++) {
+-                      for (testn = 1; testn < 257; testn++) {
++                      for (testn = 17; testn < 257; testn++) {
+                               computed = (pllreffreq * testn) /
+                                       (testm * testp);
+                               if (computed > clock)
+@@ -404,11 +404,11 @@ static int mga_g200eh_set_plls(struct mg
+                               if (tmpdelta < delta) {
+                                       delta = tmpdelta;
+                                       n = testn - 1;
+-                                      m = (testm - 1) | ((n >> 1) & 0x80);
++                                      m = (testm - 1);
+                                       p = testp - 1;
+                               }
+                               if ((clock * testp) >= 600000)
+-                                      p |= 80;
++                                      p |= 0x80;
+                       }
+               }
+       }
diff --git a/queue-3.8/drm-radeon-add-richland-pci-ids.patch b/queue-3.8/drm-radeon-add-richland-pci-ids.patch
new file mode 100644 (file)
index 0000000..b376f59
--- /dev/null
@@ -0,0 +1,46 @@
+From b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 8 Mar 2013 13:36:54 -0500
+Subject: drm/radeon: add Richland pci ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b75bbaa038ffc426e88ea3df6c4ae11834fc3e4f upstream.
+
+Reviewed-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_pciids.h |   13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -568,7 +568,11 @@
+       {0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+-      {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+@@ -579,6 +583,13 @@
+       {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++      {0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+       {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
diff --git a/queue-3.8/drm-radeon-add-support-for-richland-apus.patch b/queue-3.8/drm-radeon-add-support-for-richland-apus.patch
new file mode 100644 (file)
index 0000000..1cfb2b8
--- /dev/null
@@ -0,0 +1,53 @@
+From e4d170633fde379f39a90f8a5e7eb619b5d1144d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 8 Mar 2013 13:44:15 -0500
+Subject: drm/radeon: add support for Richland APUs
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e4d170633fde379f39a90f8a5e7eb619b5d1144d upstream.
+
+Richland APUs are a new version of the Trinity APUs
+with performance and power management improvements.
+
+Reviewed-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c |   11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -466,13 +466,19 @@ static void cayman_gpu_init(struct radeo
+                   (rdev->pdev->device == 0x9907) ||
+                   (rdev->pdev->device == 0x9908) ||
+                   (rdev->pdev->device == 0x9909) ||
++                  (rdev->pdev->device == 0x990B) ||
++                  (rdev->pdev->device == 0x990C) ||
++                  (rdev->pdev->device == 0x990F) ||
+                   (rdev->pdev->device == 0x9910) ||
+-                  (rdev->pdev->device == 0x9917)) {
++                  (rdev->pdev->device == 0x9917) ||
++                  (rdev->pdev->device == 0x9999)) {
+                       rdev->config.cayman.max_simds_per_se = 6;
+                       rdev->config.cayman.max_backends_per_se = 2;
+               } else if ((rdev->pdev->device == 0x9903) ||
+                          (rdev->pdev->device == 0x9904) ||
+                          (rdev->pdev->device == 0x990A) ||
++                         (rdev->pdev->device == 0x990D) ||
++                         (rdev->pdev->device == 0x990E) ||
+                          (rdev->pdev->device == 0x9913) ||
+                          (rdev->pdev->device == 0x9918)) {
+                       rdev->config.cayman.max_simds_per_se = 4;
+@@ -481,6 +487,9 @@ static void cayman_gpu_init(struct radeo
+                          (rdev->pdev->device == 0x9990) ||
+                          (rdev->pdev->device == 0x9991) ||
+                          (rdev->pdev->device == 0x9994) ||
++                         (rdev->pdev->device == 0x9995) ||
++                         (rdev->pdev->device == 0x9996) ||
++                         (rdev->pdev->device == 0x999A) ||
+                          (rdev->pdev->device == 0x99A0)) {
+                       rdev->config.cayman.max_simds_per_se = 3;
+                       rdev->config.cayman.max_backends_per_se = 1;
diff --git a/queue-3.8/drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch b/queue-3.8/drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch
new file mode 100644 (file)
index 0000000..ab7a664
--- /dev/null
@@ -0,0 +1,47 @@
+From fa8d387dc3f62062a6b4afbbb2a3438094fd8584 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 12 Mar 2013 12:53:13 -0400
+Subject: drm/radeon/benchmark: make sure bo blit copy exists before using it
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fa8d387dc3f62062a6b4afbbb2a3438094fd8584 upstream.
+
+Fixes a segfault on asics without a blit callback.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=62239
+
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_benchmark.c |   16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
++++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
+@@ -135,13 +135,15 @@ static void radeon_benchmark_move(struct
+                                                    sdomain, ddomain, "dma");
+       }
+-      time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
+-                                      RADEON_BENCHMARK_COPY_BLIT, n);
+-      if (time < 0)
+-              goto out_cleanup;
+-      if (time > 0)
+-              radeon_benchmark_log_results(n, size, time,
+-                                           sdomain, ddomain, "blit");
++      if (rdev->asic->copy.blit) {
++              time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
++                                              RADEON_BENCHMARK_COPY_BLIT, n);
++              if (time < 0)
++                      goto out_cleanup;
++              if (time > 0)
++                      radeon_benchmark_log_results(n, size, time,
++                                                   sdomain, ddomain, "blit");
++      }
+ out_cleanup:
+       if (sobj) {
diff --git a/queue-3.8/drm-radeon-fix-backend-map-setup-on-1-rb-trinity-boards.patch b/queue-3.8/drm-radeon-fix-backend-map-setup-on-1-rb-trinity-boards.patch
new file mode 100644 (file)
index 0000000..b3ec1ce
--- /dev/null
@@ -0,0 +1,53 @@
+From 8f612b23a17dce86fef75407e698de6243cc99a1 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 11 Mar 2013 19:28:39 -0400
+Subject: drm/radeon: fix backend map setup on 1 RB trinity boards
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 8f612b23a17dce86fef75407e698de6243cc99a1 upstream.
+
+Need to adjust the backend map depending on which RB is
+enabled.  This is the trinity equivalent of:
+f7eb97300832f4fe5fe916c5d84cd2e25169330e
+
+May fix:
+https://bugs.freedesktop.org/show_bug.cgi?id=57919
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c |   21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -623,11 +623,22 @@ static void cayman_gpu_init(struct radeo
+       WREG32(DMA_TILING_CONFIG + DMA0_REGISTER_OFFSET, gb_addr_config);
+       WREG32(DMA_TILING_CONFIG + DMA1_REGISTER_OFFSET, gb_addr_config);
+-      tmp = gb_addr_config & NUM_PIPES_MASK;
+-      tmp = r6xx_remap_render_backend(rdev, tmp,
+-                                      rdev->config.cayman.max_backends_per_se *
+-                                      rdev->config.cayman.max_shader_engines,
+-                                      CAYMAN_MAX_BACKENDS, disabled_rb_mask);
++      if ((rdev->config.cayman.max_backends_per_se == 1) &&
++          (rdev->flags & RADEON_IS_IGP)) {
++              if ((disabled_rb_mask & 3) == 1) {
++                      /* RB0 disabled, RB1 enabled */
++                      tmp = 0x11111111;
++              } else {
++                      /* RB1 disabled, RB0 enabled */
++                      tmp = 0x00000000;
++              }
++      } else {
++              tmp = gb_addr_config & NUM_PIPES_MASK;
++              tmp = r6xx_remap_render_backend(rdev, tmp,
++                                              rdev->config.cayman.max_backends_per_se *
++                                              rdev->config.cayman.max_shader_engines,
++                                              CAYMAN_MAX_BACKENDS, disabled_rb_mask);
++      }
+       WREG32(GB_BACKEND_MAP, tmp);
+       cgts_tcc_disable = 0xffff0000;
diff --git a/queue-3.8/drm-radeon-fix-s-r-on-vm-systems-cayman-tn-si.patch b/queue-3.8/drm-radeon-fix-s-r-on-vm-systems-cayman-tn-si.patch
new file mode 100644 (file)
index 0000000..9be8c9d
--- /dev/null
@@ -0,0 +1,45 @@
+From fa3daf9aa74a3ac1c87d8188a43d283d06720032 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 11 Mar 2013 15:32:26 -0400
+Subject: drm/radeon: fix S/R on VM systems (cayman/TN/SI)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fa3daf9aa74a3ac1c87d8188a43d283d06720032 upstream.
+
+We weren't properly tearing down the VM sub-alloctor
+on suspend leading to bogus VM PTs on resume.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=60439
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Tested-by: Dmitry Cherkasov <Dmitrii.Cherkasov@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c |    1 +
+ drivers/gpu/drm/radeon/si.c |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1671,6 +1671,7 @@ int cayman_resume(struct radeon_device *
+ int cayman_suspend(struct radeon_device *rdev)
+ {
+       r600_audio_fini(rdev);
++      radeon_vm_manager_fini(rdev);
+       cayman_cp_enable(rdev, false);
+       cayman_dma_stop(rdev);
+       evergreen_irq_suspend(rdev);
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4232,6 +4232,7 @@ int si_resume(struct radeon_device *rdev
+ int si_suspend(struct radeon_device *rdev)
+ {
++      radeon_vm_manager_fini(rdev);
+       si_cp_enable(rdev, false);
+       cayman_dma_stop(rdev);
+       si_irq_suspend(rdev);
diff --git a/queue-3.8/ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch b/queue-3.8/ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch
new file mode 100644 (file)
index 0000000..a1e6bd9
--- /dev/null
@@ -0,0 +1,74 @@
+From 3a2256702e47f68f921dfad41b1764d05c572329 Mon Sep 17 00:00:00 2001
+From: Zheng Liu <wenqing.lz@taobao.com>
+Date: Sun, 10 Mar 2013 21:20:23 -0400
+Subject: ext4: fix the wrong number of the allocated blocks in ext4_split_extent()
+
+From: Zheng Liu <wenqing.lz@taobao.com>
+
+commit 3a2256702e47f68f921dfad41b1764d05c572329 upstream.
+
+This commit fixes a wrong return value of the number of the allocated
+blocks in ext4_split_extent.  When the length of blocks we want to
+allocate is greater than the length of the current extent, we return a
+wrong number.  Let's see what happens in the following case when we
+call ext4_split_extent().
+
+  map: [48, 72]
+  ex:  [32, 64, u]
+
+'ex' will be split into two parts:
+  ex1: [32, 47, u]
+  ex2: [48, 64, w]
+
+'map->m_len' is returned from this function, and the value is 24.  But
+the real length is 16.  So it should be fixed.
+
+Meanwhile in this commit we use right length of the allocated blocks
+when get_reserved_cluster_alloc in ext4_ext_handle_uninitialized_extents
+is called.
+
+Signed-off-by: Zheng Liu <wenqing.lz@taobao.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Cc: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -3089,6 +3089,7 @@ static int ext4_split_extent(handle_t *h
+       int err = 0;
+       int uninitialized;
+       int split_flag1, flags1;
++      int allocated = map->m_len;
+       depth = ext_depth(inode);
+       ex = path[depth].p_ext;
+@@ -3108,6 +3109,8 @@ static int ext4_split_extent(handle_t *h
+                               map->m_lblk + map->m_len, split_flag1, flags1);
+               if (err)
+                       goto out;
++      } else {
++              allocated = ee_len - (map->m_lblk - ee_block);
+       }
+       ext4_ext_drop_refs(path);
+@@ -3130,7 +3133,7 @@ static int ext4_split_extent(handle_t *h
+       ext4_ext_show_leaf(inode, path);
+ out:
+-      return err ? err : map->m_len;
++      return err ? err : allocated;
+ }
+ /*
+@@ -3720,6 +3723,7 @@ out:
+                                       allocated - map->m_len);
+               allocated = map->m_len;
+       }
++      map->m_len = allocated;
+       /*
+        * If we have done fallocate with the offset that is already
diff --git a/queue-3.8/jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch b/queue-3.8/jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch
new file mode 100644 (file)
index 0000000..8d371a2
--- /dev/null
@@ -0,0 +1,76 @@
+From ad56edad089b56300fd13bb9eeb7d0424d978239 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 11 Mar 2013 13:24:56 -0400
+Subject: jbd2: fix use after free in jbd2_journal_dirty_metadata()
+
+From: Jan Kara <jack@suse.cz>
+
+commit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream.
+
+jbd2_journal_dirty_metadata() didn't get a reference to journal_head it
+was working with. This is OK in most of the cases since the journal head
+should be attached to a transaction but in rare occasions when we are
+journalling data, __ext4_journalled_writepage() can race with
+jbd2_journal_invalidatepage() stripping buffers from a page and thus
+journal head can be freed under hands of jbd2_journal_dirty_metadata().
+
+Fix the problem by getting own journal head reference in
+jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()
+which can possibly have the same issue).
+
+Reported-by: Zheng Liu <gnehzuil.liu@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c |   15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1047,9 +1047,12 @@ out:
+ void jbd2_journal_set_triggers(struct buffer_head *bh,
+                              struct jbd2_buffer_trigger_type *type)
+ {
+-      struct journal_head *jh = bh2jh(bh);
++      struct journal_head *jh = jbd2_journal_grab_journal_head(bh);
++      if (WARN_ON(!jh))
++              return;
+       jh->b_triggers = type;
++      jbd2_journal_put_journal_head(jh);
+ }
+ void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
+@@ -1101,17 +1104,18 @@ int jbd2_journal_dirty_metadata(handle_t
+ {
+       transaction_t *transaction = handle->h_transaction;
+       journal_t *journal = transaction->t_journal;
+-      struct journal_head *jh = bh2jh(bh);
++      struct journal_head *jh;
+       int ret = 0;
+-      jbd_debug(5, "journal_head %p\n", jh);
+-      JBUFFER_TRACE(jh, "entry");
+       if (is_handle_aborted(handle))
+               goto out;
+-      if (!buffer_jbd(bh)) {
++      jh = jbd2_journal_grab_journal_head(bh);
++      if (!jh) {
+               ret = -EUCLEAN;
+               goto out;
+       }
++      jbd_debug(5, "journal_head %p\n", jh);
++      JBUFFER_TRACE(jh, "entry");
+       jbd_lock_bh_state(bh);
+@@ -1202,6 +1206,7 @@ int jbd2_journal_dirty_metadata(handle_t
+       spin_unlock(&journal->j_list_lock);
+ out_unlock_bh:
+       jbd_unlock_bh_state(bh);
++      jbd2_journal_put_journal_head(jh);
+ out:
+       JBUFFER_TRACE(jh, "exit");
+       WARN_ON(ret);   /* All errors are bugs, so dump the stack */
index 4d9c91a5a7bd2338d963377396207458e0436d7c..4a703cceeb8f6b5e82e9c29743a5ae5a638f719d 100644 (file)
@@ -54,3 +54,15 @@ mqueue-sys_mq_open-do-not-call-mnt_drop_write-if-read-only.patch
 target-iscsi-fix-mutual-chap-auth-on-big-endian-arches.patch
 target-file-bump-fd_max_sectors-to-2048-to-handle-1m-sized-i-os.patch
 arm-tegra-fix-register-address-of-slink-controller.patch
+dm-thin-fix-discard-corruption.patch
+dm-verity-avoid-deadlock.patch
+drm-mgag200-bug-fix-modified-pll-algorithm-for-eh-project.patch
+drm-radeon-add-richland-pci-ids.patch
+drm-radeon-add-support-for-richland-apus.patch
+drm-radeon-fix-s-r-on-vm-systems-cayman-tn-si.patch
+drm-radeon-fix-backend-map-setup-on-1-rb-trinity-boards.patch
+drm-radeon-benchmark-make-sure-bo-blit-copy-exists-before-using-it.patch
+cifs-delay-super-block-destruction-until-all-cifsfileinfo-objects-are-gone.patch
+cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch
+jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch
+ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch