--- /dev/null
+From dfe5b9ad83a63180f358b27d1018649a27b394a9 Mon Sep 17 00:00:00 2001
+From: Steven Whitehouse <swhiteho@redhat.com>
+Date: Fri, 6 Dec 2013 11:52:34 +0000
+Subject: GFS2: don't hold s_umount over blkdev_put
+
+From: Steven Whitehouse <swhiteho@redhat.com>
+
+commit dfe5b9ad83a63180f358b27d1018649a27b394a9 upstream.
+
+This is a GFS2 version of Tejun's patch:
+4f331f01b9c43bf001d3ffee578a97a1e0633eac
+vfs: don't hold s_umount over close_bdev_exclusive() call
+
+In this case its blkdev_put itself that is the issue and this
+patch uses the same solution of dropping and retaking s_umount.
+
+Reported-by: Tejun Heo <tj@kernel.org>
+Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/ops_fstype.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1317,8 +1317,18 @@ static struct dentry *gfs2_mount(struct
+ if (IS_ERR(s))
+ goto error_bdev;
+
+- if (s->s_root)
++ if (s->s_root) {
++ /*
++ * s_umount nests inside bd_mutex during
++ * __invalidate_device(). blkdev_put() acquires
++ * bd_mutex and can't be called under s_umount. Drop
++ * s_umount temporarily. This is safe as we're
++ * holding an active reference.
++ */
++ up_write(&s->s_umount);
+ blkdev_put(bdev, mode);
++ down_write(&s->s_umount);
++ }
+
+ memset(&args, 0, sizeof(args));
+ args.ar_quota = GFS2_QUOTA_DEFAULT;
--- /dev/null
+From dfd11184d894cd0a92397b25cac18831a1a6a5bc Mon Sep 17 00:00:00 2001
+From: Steven Whitehouse <swhiteho@redhat.com>
+Date: Wed, 18 Dec 2013 14:14:52 +0000
+Subject: GFS2: Fix incorrect invalidation for DIO/buffered I/O
+
+From: Steven Whitehouse <swhiteho@redhat.com>
+
+commit dfd11184d894cd0a92397b25cac18831a1a6a5bc upstream.
+
+In patch 209806aba9d540dde3db0a5ce72307f85f33468f we allowed
+local deferred locks to be granted against a cached exclusive
+lock. That opened up a corner case which this patch now
+fixes.
+
+The solution to the problem is to check whether we have cached
+pages each time we do direct I/O and if so to unmap, flush
+and invalidate those pages. Since the glock state machine
+normally does that for us, mostly the code will be a no-op.
+
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/aops.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/fs/gfs2/aops.c
++++ b/fs/gfs2/aops.c
+@@ -999,6 +999,7 @@ static ssize_t gfs2_direct_IO(int rw, st
+ {
+ struct file *file = iocb->ki_filp;
+ struct inode *inode = file->f_mapping->host;
++ struct address_space *mapping = inode->i_mapping;
+ struct gfs2_inode *ip = GFS2_I(inode);
+ struct gfs2_holder gh;
+ int rv;
+@@ -1019,6 +1020,35 @@ static ssize_t gfs2_direct_IO(int rw, st
+ if (rv != 1)
+ goto out; /* dio not valid, fall back to buffered i/o */
+
++ /*
++ * Now since we are holding a deferred (CW) lock at this point, you
++ * might be wondering why this is ever needed. There is a case however
++ * where we've granted a deferred local lock against a cached exclusive
++ * glock. That is ok provided all granted local locks are deferred, but
++ * it also means that it is possible to encounter pages which are
++ * cached and possibly also mapped. So here we check for that and sort
++ * them out ahead of the dio. The glock state machine will take care of
++ * everything else.
++ *
++ * If in fact the cached glock state (gl->gl_state) is deferred (CW) in
++ * the first place, mapping->nr_pages will always be zero.
++ */
++ if (mapping->nrpages) {
++ loff_t lstart = offset & (PAGE_CACHE_SIZE - 1);
++ loff_t len = iov_length(iov, nr_segs);
++ loff_t end = PAGE_ALIGN(offset + len) - 1;
++
++ rv = 0;
++ if (len == 0)
++ goto out;
++ if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
++ unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len);
++ rv = filemap_write_and_wait_range(mapping, lstart, end);
++ if (rv)
++ return rv;
++ truncate_inode_pages_range(mapping, lstart, end);
++ }
++
+ rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
+ offset, nr_segs, gfs2_get_block_direct,
+ NULL, NULL, 0);
--- /dev/null
+From 4cc629b7a20945ce35628179180329b6bc9e552b Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Tue, 10 Dec 2013 15:19:03 -0800
+Subject: gpio: msm: Fix irq mask/unmask by writing bits instead of numbers
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit 4cc629b7a20945ce35628179180329b6bc9e552b upstream.
+
+We should be writing bits here but instead we're writing the
+numbers that correspond to the bits we want to write. Fix it by
+wrapping the numbers in the BIT() macro. This fixes gpios acting
+as interrupts.
+
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-msm-v2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-msm-v2.c
++++ b/drivers/gpio/gpio-msm-v2.c
+@@ -248,7 +248,7 @@ static void msm_gpio_irq_mask(struct irq
+
+ spin_lock_irqsave(&tlmm_lock, irq_flags);
+ writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
+- clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
++ clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
+ __clear_bit(gpio, msm_gpio.enabled_irqs);
+ spin_unlock_irqrestore(&tlmm_lock, irq_flags);
+ }
+@@ -260,7 +260,7 @@ static void msm_gpio_irq_unmask(struct i
+
+ spin_lock_irqsave(&tlmm_lock, irq_flags);
+ __set_bit(gpio, msm_gpio.enabled_irqs);
+- set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
++ set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
+ writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
+ spin_unlock_irqrestore(&tlmm_lock, irq_flags);
+ }
--- /dev/null
+From f5837ec11f8cfa6d53ebc5806582771b2c9988c6 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Thu, 5 Dec 2013 11:23:35 +0200
+Subject: gpio: twl4030: Fix regression for twl gpio LED output
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit f5837ec11f8cfa6d53ebc5806582771b2c9988c6 upstream.
+
+Commit 0b2aa8be introduced a regression that causes failure
+in setting LED GPO direction to OUT.
+
+This causes USB host probe failures for Beagleboard C4.
+
+platform usb_phy_gen_xceiv.2: Driver usb_phy_gen_xceiv requests probe deferral
+hsusb2_vcc: Failed to request enable GPIO510: -22
+reg-fixed-voltage reg-fixed-voltage.0.auto: Failed to register regulator: -22
+reg-fixed-voltage: probe of reg-fixed-voltage.0.auto failed with error -22
+
+direction_out/direction_in must return 0 if the operation succeeded.
+
+Also, don't update direction flag and output data if twl4030_set_gpio_direction()
+failed inside twl_direction_out();
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-twl4030.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpio/gpio-twl4030.c
++++ b/drivers/gpio/gpio-twl4030.c
+@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_
+ if (offset < TWL4030_GPIO_MAX)
+ ret = twl4030_set_gpio_direction(offset, 1);
+ else
+- ret = -EINVAL;
++ ret = -EINVAL; /* LED outputs can't be set as input */
+
+ if (!ret)
+ priv->direction &= ~BIT(offset);
+@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *ch
+ static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
+ {
+ struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
+- int ret = -EINVAL;
++ int ret = 0;
+
+ mutex_lock(&priv->mutex);
+- if (offset < TWL4030_GPIO_MAX)
++ if (offset < TWL4030_GPIO_MAX) {
+ ret = twl4030_set_gpio_direction(offset, 0);
++ if (ret) {
++ mutex_unlock(&priv->mutex);
++ return ret;
++ }
++ }
++
++ /*
++ * LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output
++ */
+
+ priv->direction |= BIT(offset);
+ mutex_unlock(&priv->mutex);
--- /dev/null
+From 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 26 Dec 2013 17:44:29 -0800
+Subject: Input: allocate absinfo data when setting ABS capability
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca upstream.
+
+We need to make sure we allocate absinfo data when we are setting one of
+EV_ABS/ABS_XXX capabilities, otherwise we may bomb when we try to emit this
+event.
+
+Rested-by: Paul Cercueil <pcercuei@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/input.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -1866,6 +1866,10 @@ void input_set_capability(struct input_d
+ break;
+
+ case EV_ABS:
++ input_alloc_absinfo(dev);
++ if (!dev->absinfo)
++ return;
++
+ __set_bit(code, dev->absbit);
+ break;
+
--- /dev/null
+From f6c07cad081ba222d63623d913aafba5586c1d2c Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 8 Dec 2013 21:12:59 -0500
+Subject: jbd2: don't BUG but return ENOSPC if a handle runs out of space
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit f6c07cad081ba222d63623d913aafba5586c1d2c upstream.
+
+If a handle runs out of space, we currently stop the kernel with a BUG
+in jbd2_journal_dirty_metadata(). This makes it hard to figure out
+what might be going on. So return an error of ENOSPC, so we can let
+the file system layer figure out what is going on, to make it more
+likely we can get useful debugging information). This should make it
+easier to debug problems such as the one which was reported by:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=44731
+
+The only two callers of this function are ext4_handle_dirty_metadata()
+and ocfs2_journal_dirty(). The ocfs2 function will trigger a
+BUG_ON(), which means there will be no change in behavior. The ext4
+function will call ext4_error_inode() which will print the useful
+debugging information and then handle the situation using ext4's error
+handling mechanisms (i.e., which might mean halting the kernel or
+remounting the file system read-only).
+
+Also, since both file systems already call WARN_ON(), drop the WARN_ON
+from jbd2_journal_dirty_metadata() to avoid two stack traces from
+being displayed.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Cc: ocfs2-devel@oss.oracle.com
+Acked-by: Joel Becker <jlbec@evilplan.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1151,7 +1151,10 @@ int jbd2_journal_dirty_metadata(handle_t
+ * once a transaction -bzzz
+ */
+ jh->b_modified = 1;
+- J_ASSERT_JH(jh, handle->h_buffer_credits > 0);
++ if (handle->h_buffer_credits <= 0) {
++ ret = -ENOSPC;
++ goto out_unlock_bh;
++ }
+ handle->h_buffer_credits--;
+ }
+
+@@ -1234,7 +1237,6 @@ out_unlock_bh:
+ jbd2_journal_put_journal_head(jh);
+ out:
+ JBUFFER_TRACE(jh, "exit");
+- WARN_ON(ret); /* All errors are bugs, so dump the stack */
+ return ret;
+ }
+
--- /dev/null
+From 695c60830764945cf61a2cc623eb1392d137223e Mon Sep 17 00:00:00 2001
+From: Vladimir Davydov <vdavydov@parallels.com>
+Date: Thu, 2 Jan 2014 12:58:47 -0800
+Subject: memcg: fix memcg_size() calculation
+
+From: Vladimir Davydov <vdavydov@parallels.com>
+
+commit 695c60830764945cf61a2cc623eb1392d137223e upstream.
+
+The mem_cgroup structure contains nr_node_ids pointers to
+mem_cgroup_per_node objects, not the objects themselves.
+
+Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
+Acked-by: Michal Hocko <mhocko@suse.cz>
+Cc: Glauber Costa <glommer@openvz.org>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -379,7 +379,7 @@ struct mem_cgroup {
+ static size_t memcg_size(void)
+ {
+ return sizeof(struct mem_cgroup) +
+- nr_node_ids * sizeof(struct mem_cgroup_per_node);
++ nr_node_ids * sizeof(struct mem_cgroup_per_node *);
+ }
+
+ /* internal only representation about the status of kmem accounting. */
--- /dev/null
+From 36d9f4d3b68c7035ead3850dc85f310a579ed0eb Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Wed, 18 Dec 2013 14:36:18 +0100
+Subject: s390/3270: fix allocation of tty3270_screen structure
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 36d9f4d3b68c7035ead3850dc85f310a579ed0eb upstream.
+
+The tty3270_alloc_screen function is called from tty3270_install with
+swapped arguments, the number of columns instead of rows and vice versa.
+The number of rows is typically smaller than the number of columns which
+makes the screen array too big but the individual cell arrays for the
+lines too small. Creating lines longer than the number of rows will
+clobber the memory after the end of the cell array.
+The fix is simple, call tty3270_alloc_screen with the correct argument
+order.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/char/tty3270.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/char/tty3270.c
++++ b/drivers/s390/char/tty3270.c
+@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_dr
+ return rc;
+ }
+
+- tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows);
++ tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols);
+ if (IS_ERR(tp->screen)) {
+ rc = PTR_ERR(tp->screen);
+ raw3270_put_view(&tp->view);
mm-hugetlb-check-for-pte-null-pointer-in-__page_check_address.patch
mm-fix-use-after-free-in-sys_remap_file_pages.patch
mm-memory-failure.c-transfer-page-count-from-head-page-to-tail-page-after-split-thp.patch
+input-allocate-absinfo-data-when-setting-abs-capability.patch
+gfs2-don-t-hold-s_umount-over-blkdev_put.patch
+gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch
+memcg-fix-memcg_size-calculation.patch
+s390-3270-fix-allocation-of-tty3270_screen-structure.patch
+jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch
+gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch
+gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch
+sh-always-link-in-helper-functions-extracted-from-libgcc.patch
--- /dev/null
+From 84ed8a99058e61567f495cc43118344261641c5f Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Wed, 18 Dec 2013 17:08:48 -0800
+Subject: sh: always link in helper functions extracted from libgcc
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 84ed8a99058e61567f495cc43118344261641c5f upstream.
+
+E.g. landisk_defconfig, which has CONFIG_NTFS_FS=m:
+
+ ERROR: "__ashrdi3" [fs/ntfs/ntfs.ko] undefined!
+
+For "lib-y", if no symbols in a compilation unit are referenced by other
+units, the compilation unit will not be included in vmlinux. This
+breaks modules that do reference those symbols.
+
+Use "obj-y" instead to fix this.
+
+http://kisskb.ellerman.id.au/kisskb/buildresult/8838077/
+
+This doesn't fix all cases. There are others, e.g. udivsi3.
+This is also not limited to sh, many architectures handle this in the
+same way.
+
+A simple solution is to unconditionally include all helper functions.
+A more complex solution is to make the choice of "lib-y" or "obj-y" depend
+on CONFIG_MODULES:
+
+ obj-$(CONFIG_MODULES) += ...
+ lib-y($CONFIG_MODULES) += ...
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Paul Mundt <lethal@linux-sh.org>
+Tested-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+Reviewed-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sh/lib/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sh/lib/Makefile
++++ b/arch/sh/lib/Makefile
+@@ -6,7 +6,7 @@ lib-y = delay.o memmove.o memchr.o \
+ checksum.o strlen.o div64.o div64-generic.o
+
+ # Extracted from libgcc
+-lib-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
++obj-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
+ ashlsi3.o ashrsi3.o ashiftrt.o lshrsi3.o \
+ udiv_qrnnd.o
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
