--- /dev/null
+From b94e22805a2224061bb263a82b72e09544a5fbb3 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Wed, 7 Oct 2015 13:10:54 +0200
+Subject: iio: mxs-lradc: Fix temperature offset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit b94e22805a2224061bb263a82b72e09544a5fbb3 upstream.
+
+0° Kelvin is actually −273.15°C, not -272.15°C. Fix the temperature offset.
+Also improve the comment explaining the calculation.
+
+Reported-by: Janusz Użycki <j.uzycki@elpromaelectronics.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Marek Vasut <marex@denx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/adc/mxs-lradc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/iio/adc/mxs-lradc.c
++++ b/drivers/staging/iio/adc/mxs-lradc.c
+@@ -920,11 +920,12 @@ static int mxs_lradc_read_raw(struct iio
+ case IIO_CHAN_INFO_OFFSET:
+ if (chan->type == IIO_TEMP) {
+ /* The calculated value from the ADC is in Kelvin, we
+- * want Celsius for hwmon so the offset is
+- * -272.15 * scale
++ * want Celsius for hwmon so the offset is -273.15
++ * The offset is applied before scaling so it is
++ * actually -213.15 * 4 / 1.012 = -1079.644268
+ */
+- *val = -1075;
+- *val2 = 691699;
++ *val = -1079;
++ *val2 = 644268;
+
+ return IIO_VAL_INT_PLUS_MICRO;
+ }
--- /dev/null
+From 1f2c6651f69c14d0d3a9cfbda44ea101b02160ba Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Sun, 11 Oct 2015 19:38:00 +0200
+Subject: rbd: don't leak parent_spec in rbd_dev_probe_parent()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 1f2c6651f69c14d0d3a9cfbda44ea101b02160ba upstream.
+
+Currently we leak parent_spec and trigger a "parent reference
+underflow" warning if rbd_dev_create() in rbd_dev_probe_parent() fails.
+The problem is we take the !parent out_err branch and that only drops
+refcounts; parent_spec that would've been freed had we called
+rbd_dev_unparent() remains and triggers rbd_warn() in
+rbd_dev_parent_put() - at that point we have parent_spec != NULL and
+parent_ref == 0, so counter ends up being -1 after the decrement.
+
+Redo rbd_dev_probe_parent() to fix this.
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+[idryomov@gmail.com: backport to < 4.2: rbd_dev->opts]
+Reviewed-by: Alex Elder <elder@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 35 +++++++++++++++--------------------
+ 1 file changed, 15 insertions(+), 20 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -4825,41 +4825,36 @@ out_err:
+ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
+ {
+ struct rbd_device *parent = NULL;
+- struct rbd_spec *parent_spec;
+- struct rbd_client *rbdc;
+ int ret;
+
+ if (!rbd_dev->parent_spec)
+ return 0;
+- /*
+- * We need to pass a reference to the client and the parent
+- * spec when creating the parent rbd_dev. Images related by
+- * parent/child relationships always share both.
+- */
+- parent_spec = rbd_spec_get(rbd_dev->parent_spec);
+- rbdc = __rbd_get_client(rbd_dev->rbd_client);
+
+- ret = -ENOMEM;
+- parent = rbd_dev_create(rbdc, parent_spec);
+- if (!parent)
++ parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
++ if (!parent) {
++ ret = -ENOMEM;
+ goto out_err;
++ }
++
++ /*
++ * Images related by parent/child relationships always share
++ * rbd_client and spec/parent_spec, so bump their refcounts.
++ */
++ __rbd_get_client(rbd_dev->rbd_client);
++ rbd_spec_get(rbd_dev->parent_spec);
+
+ ret = rbd_dev_image_probe(parent, false);
+ if (ret < 0)
+ goto out_err;
++
+ rbd_dev->parent = parent;
+ atomic_set(&rbd_dev->parent_ref, 1);
+-
+ return 0;
++
+ out_err:
+- if (parent) {
+- rbd_dev_unparent(rbd_dev);
++ rbd_dev_unparent(rbd_dev);
++ if (parent)
+ rbd_dev_destroy(parent);
+- } else {
+- rbd_put_client(rbdc);
+- rbd_spec_put(parent_spec);
+- }
+-
+ return ret;
+ }
+
--- /dev/null
+From 6d69bb536bac0d403d83db1ca841444981b280cd Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Sun, 11 Oct 2015 19:38:00 +0200
+Subject: rbd: prevent kernel stack blow up on rbd map
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 6d69bb536bac0d403d83db1ca841444981b280cd upstream.
+
+Mapping an image with a long parent chain (e.g. image foo, whose parent
+is bar, whose parent is baz, etc) currently leads to a kernel stack
+overflow, due to the following recursion in the reply path:
+
+ rbd_osd_req_callback()
+ rbd_obj_request_complete()
+ rbd_img_obj_callback()
+ rbd_img_parent_read_callback()
+ rbd_obj_request_complete()
+ ...
+
+Limit the parent chain to 16 images, which is ~5K worth of stack. When
+the above recursion is eliminated, this limit can be lifted.
+
+Fixes: http://tracker.ceph.com/issues/12538
+
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Josh Durgin <jdurgin@redhat.com>
+[idryomov@gmail.com: backport to 3.14: rbd_dev->opts, context]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -94,6 +94,8 @@ static int atomic_dec_return_safe(atomic
+ #define RBD_MINORS_PER_MAJOR 256
+ #define RBD_SINGLE_MAJOR_PART_SHIFT 4
+
++#define RBD_MAX_PARENT_CHAIN_LEN 16
++
+ #define RBD_SNAP_DEV_NAME_PREFIX "snap_"
+ #define RBD_MAX_SNAP_NAME_LEN \
+ (NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))
+@@ -411,7 +413,7 @@ static ssize_t rbd_add_single_major(stru
+ size_t count);
+ static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf,
+ size_t count);
+-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping);
++static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth);
+ static void rbd_spec_put(struct rbd_spec *spec);
+
+ static int rbd_dev_id_to_minor(int dev_id)
+@@ -4822,7 +4824,12 @@ out_err:
+ return ret;
+ }
+
+-static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
++/*
++ * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() ->
++ * rbd_dev_image_probe() recursion depth, which means it's also the
++ * length of the already discovered part of the parent chain.
++ */
++static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
+ {
+ struct rbd_device *parent = NULL;
+ int ret;
+@@ -4830,6 +4837,12 @@ static int rbd_dev_probe_parent(struct r
+ if (!rbd_dev->parent_spec)
+ return 0;
+
++ if (++depth > RBD_MAX_PARENT_CHAIN_LEN) {
++ pr_info("parent chain is too long (%d)\n", depth);
++ ret = -EINVAL;
++ goto out_err;
++ }
++
+ parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec);
+ if (!parent) {
+ ret = -ENOMEM;
+@@ -4843,7 +4856,7 @@ static int rbd_dev_probe_parent(struct r
+ __rbd_get_client(rbd_dev->rbd_client);
+ rbd_spec_get(rbd_dev->parent_spec);
+
+- ret = rbd_dev_image_probe(parent, false);
++ ret = rbd_dev_image_probe(parent, depth);
+ if (ret < 0)
+ goto out_err;
+
+@@ -4970,7 +4983,7 @@ static void rbd_dev_image_release(struct
+ * parent), initiate a watch on its header object before using that
+ * object to get detailed information about the rbd image.
+ */
+-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
++static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
+ {
+ int ret;
+
+@@ -4990,7 +5003,7 @@ static int rbd_dev_image_probe(struct rb
+ if (ret)
+ goto err_out_format;
+
+- if (mapping) {
++ if (!depth) {
+ ret = rbd_dev_header_watch_sync(rbd_dev);
+ if (ret)
+ goto out_header_name;
+@@ -5007,7 +5020,7 @@ static int rbd_dev_image_probe(struct rb
+ if (ret)
+ goto err_out_probe;
+
+- ret = rbd_dev_probe_parent(rbd_dev);
++ ret = rbd_dev_probe_parent(rbd_dev, depth);
+ if (ret)
+ goto err_out_probe;
+
+@@ -5018,7 +5031,7 @@ static int rbd_dev_image_probe(struct rb
+ err_out_probe:
+ rbd_dev_unprobe(rbd_dev);
+ err_out_watch:
+- if (mapping)
++ if (!depth)
+ rbd_dev_header_unwatch_sync(rbd_dev);
+ out_header_name:
+ kfree(rbd_dev->header_name);
+@@ -5085,7 +5098,7 @@ static ssize_t do_rbd_add(struct bus_typ
+ rbdc = NULL; /* rbd_dev now owns this */
+ spec = NULL; /* rbd_dev now owns this */
+
+- rc = rbd_dev_image_probe(rbd_dev, true);
++ rc = rbd_dev_image_probe(rbd_dev, 0);
+ if (rc < 0)
+ goto err_out_rbd_dev;
+
--- /dev/null
+From bae818ee1577c27356093901a0ea48f672eda514 Mon Sep 17 00:00:00 2001
+From: Ronny Hegewald <ronny.hegewald@online.de>
+Date: Thu, 15 Oct 2015 18:50:46 +0000
+Subject: rbd: require stable pages if message data CRCs are enabled
+
+From: Ronny Hegewald <ronny.hegewald@online.de>
+
+commit bae818ee1577c27356093901a0ea48f672eda514 upstream.
+
+rbd requires stable pages, as it performs a crc of the page data before
+they are send to the OSDs.
+
+But since kernel 3.9 (patch 1d1d1a767206fbe5d4c69493b7e6d2a8d08cc0a0
+"mm: only enforce stable page writes if the backing device requires
+it") it is not assumed anymore that block devices require stable pages.
+
+This patch sets the necessary flag to get stable pages back for rbd.
+
+In a ceph installation that provides multiple ext4 formatted rbd
+devices "bad crc" messages appeared regularly (ca 1 message every 1-2
+minutes on every OSD that provided the data for the rbd) in the
+OSD-logs before this patch. After this patch this messages are pretty
+much gone (only ca 1-2 / month / OSD).
+
+Signed-off-by: Ronny Hegewald <Ronny.Hegewald@online.de>
+[idryomov@gmail.com: require stable pages only in crc case, changelog]
+[idryomov@gmail.com: backport to 3.9-3.17: context]
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -3443,6 +3443,9 @@ static int rbd_init_disk(struct rbd_devi
+ blk_queue_io_opt(q, segment_size);
+
+ blk_queue_merge_bvec(q, rbd_merge_bvec);
++ if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
++ q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES;
++
+ disk->queue = q;
+
+ q->queuedata = rbd_dev;
drm-nouveau-gem-return-only-valid-domain-when-there-s-only-one.patch
drm-i915-restore-lost-dpll-register-write-on-gen2-4.patch
drm-radeon-don-t-try-to-recreate-sysfs-entries-on-resume.patch
+iio-mxs-lradc-fix-temperature-offset.patch
+rbd-require-stable-pages-if-message-data-crcs-are-enabled.patch
+rbd-don-t-leak-parent_spec-in-rbd_dev_probe_parent.patch
+rbd-prevent-kernel-stack-blow-up-on-rbd-map.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
