--- /dev/null
+From df279ca8966c3de83105428e3391ab17690802a9 Mon Sep 17 00:00:00 2001
+From: Renaud Lottiaux <renaud.lottiaux@kerlabs.com>
+Date: Tue, 30 Jun 2009 11:41:34 -0700
+Subject: bsdacct: fix access to invalid filp in acct_on()
+
+From: Renaud Lottiaux <renaud.lottiaux@kerlabs.com>
+
+commit df279ca8966c3de83105428e3391ab17690802a9 upstream.
+
+The file opened in acct_on and freshly stored in the ns->bacct struct can
+be closed in acct_file_reopen by a concurrent call after we release
+acct_lock and before we call mntput(file->f_path.mnt).
+
+Record file->f_path.mnt in a local variable and use this variable only.
+
+Signed-off-by: Renaud Lottiaux <renaud.lottiaux@kerlabs.com>
+Signed-off-by: Louis Rilling <louis.rilling@kerlabs.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/acct.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -215,6 +215,7 @@ static void acct_file_reopen(struct bsd_
+ static int acct_on(char *name)
+ {
+ struct file *file;
++ struct vfsmount *mnt;
+ int error;
+ struct pid_namespace *ns;
+ struct bsd_acct_struct *acct = NULL;
+@@ -256,11 +257,12 @@ static int acct_on(char *name)
+ acct = NULL;
+ }
+
+- mnt_pin(file->f_path.mnt);
++ mnt = file->f_path.mnt;
++ mnt_pin(mnt);
+ acct_file_reopen(ns->bacct, file, ns);
+ spin_unlock(&acct_lock);
+
+- mntput(file->f_path.mnt); /* it's pinned, now give up active reference */
++ mntput(mnt); /* it's pinned, now give up active reference */
+ kfree(acct);
+
+ return 0;
--- /dev/null
+From 874d2f61d31e596c36af7732dc1b3aa2dc233824 Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Tue, 30 Jun 2009 15:18:14 +0100
+Subject: dm exception store: really fix type lookup
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 874d2f61d31e596c36af7732dc1b3aa2dc233824 upstream.
+
+Fix exception store name handling.
+
+We need to reference exception store by zero terminated string.
+
+Fixes regression introduced in commit f6bd4eb73cdf2a5bf954e497972842f39cabb7e3
+
+Cc: Yi Yang <yi.y.yang@intel.com>
+Cc: Jonathan Brassow <jbrassow@redhat.com>
+Cc: stable@kernel.org
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -195,7 +195,7 @@ int dm_exception_store_create(struct dm_
+ struct dm_exception_store **store)
+ {
+ int r = 0;
+- struct dm_exception_store_type *type;
++ struct dm_exception_store_type *type = NULL;
+ struct dm_exception_store *tmp_store;
+ char persistent;
+
+@@ -211,12 +211,15 @@ int dm_exception_store_create(struct dm_
+ }
+
+ persistent = toupper(*argv[1]);
+- if (persistent != 'P' && persistent != 'N') {
++ if (persistent == 'P')
++ type = get_type("P");
++ else if (persistent == 'N')
++ type = get_type("N");
++ else {
+ ti->error = "Persistent flag is not P or N";
+ return -EINVAL;
+ }
+
+- type = get_type(&persistent);
+ if (!type) {
+ ti->error = "Exception store type not recognised";
+ r = -EINVAL;
-From a0861c02a981c943573478ea13b29b1fb958ee5b Mon Sep 17 00:00:00 2001
-From: Andi Kleen <ak@linux.intel.com>
-Date: Mon, 8 Jun 2009 17:37:09 +0800
-Subject: KVM: Add VT-x machine check support
+From andi@firstfloor.org Wed Jul 1 07:18:54 2009
+From: Andi Kleen <andi@firstfloor.org>
+Date: Wed, 1 Jul 2009 16:18:45 +0200
+Subject: KVM: Add VT-x machine check support v4
+To: Avi Kivity <avi@redhat.com>
+Cc: Andi Kleen <andi@firstfloor.org>, Andi Kleen <ak@linux.intel.com>, Greg KH <gregkh@suse.de>, Stefan Lippers-Hollmann <s.L-H@gmx.de>, linux-kernel@vger.kernel.org, ying.huang@intel.com, stable@kernel.org
+Message-ID: <20090701141845.GW6760@one.firstfloor.org>
+Content-Disposition: inline
-From: Andi Kleen <ak@linux.intel.com>
-commit a0861c02a981c943573478ea13b29b1fb958ee5b upstream.
+Subject: KVM: Add VT-x machine check support v4
-VT-x needs an explicit MC vector intercept to handle machine checks in the
-hyper visor.
+(replaces commit a0861c02a981c943573478ea13b29b1fb958ee5b upstream in a
+cleaner way for the 2.6.30 kernel tree)
+
+VT-x needs an explicit MC vector intercept to handle machine checks in
+the hypervisor.
It also has a special option to catch machine checks that happen
during VT entry.
handler. Make it always look like user space is interrupted because
the machine check handler treats kernel/user space differently.
-Thanks to Jiang Yunhong for help and testing.
+Thanks to Huang Ying and Jiang Yunhong for help and testing.
+
+Cc: ying.huang@intel.com
+
+v2: Handle machine checks still in interrupt off context
+to avoid problems on preemptible kernels.
+v3: Handle old style 32bit and make fully standalone
Signed-off-by: Andi Kleen <ak@linux.intel.com>
-Signed-off-by: Huang Ying <ying.huang@intel.com>
-Signed-off-by: Avi Kivity <avi@redhat.com>
+Cc: Huang Ying <ying.huang@intel.com>
+Acked-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
---
+ arch/x86/include/asm/kvm_host.h | 2 +
+ arch/x86/include/asm/mce.h | 2 +
arch/x86/include/asm/vmx.h | 1
+ arch/x86/kernel/cpu/mcheck/mce_32.c | 1
arch/x86/kernel/cpu/mcheck/mce_64.c | 1
- arch/x86/kvm/vmx.c | 50 ++++++++++++++++++++++++++++++++++--
- 3 files changed, 50 insertions(+), 2 deletions(-)
+ arch/x86/kvm/vmx.c | 49 +++++++++++++++++++++++++++++++++---
+ 6 files changed, 53 insertions(+), 3 deletions(-)
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -371,6 +371,8 @@ struct kvm_vcpu_arch {
+ unsigned long dr6;
+ unsigned long dr7;
+ unsigned long eff_db[KVM_NR_DB_REGS];
++
++ u32 exit_reason;
+ };
+
+ struct kvm_mem_alias {
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -153,5 +153,7 @@ extern void mcheck_init(struct cpuinfo_x
+
+ extern void (*mce_threshold_vector)(void);
+
++extern void (*machine_check_vector)(struct pt_regs *, long error_code);
++
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_X86_MCE_H */
--- a/arch/x86/include/asm/vmx.h
+++ b/arch/x86/include/asm/vmx.h
@@ -247,6 +247,7 @@ enum vmcs_field {
#define EXIT_REASON_TPR_BELOW_THRESHOLD 43
#define EXIT_REASON_APIC_ACCESS 44
#define EXIT_REASON_EPT_VIOLATION 48
+--- a/arch/x86/kernel/cpu/mcheck/mce_32.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_32.c
+@@ -29,6 +29,7 @@ static void unexpected_machine_check(str
+
+ /* Call the installed machine check handler for this CPU setup. */
+ void (*machine_check_vector)(struct pt_regs *, long error_code) = unexpected_machine_check;
++EXPORT_SYMBOL_GPL(machine_check_vector);
+
+ /* This has to be run for each processor */
+ void mcheck_init(struct cpuinfo_x86 *c)
--- a/arch/x86/kernel/cpu/mcheck/mce_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_64.c
@@ -420,6 +420,7 @@ void do_machine_check(struct pt_regs * r
#define __ex(x) __kvm_handle_fault_on_reboot(x)
-@@ -97,6 +98,7 @@ struct vcpu_vmx {
+@@ -97,6 +98,8 @@ struct vcpu_vmx {
int soft_vnmi_blocked;
ktime_t entry_time;
s64 vnmi_blocked_time;
++
+ u32 exit_reason;
};
static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu)
-@@ -213,6 +215,13 @@ static inline int is_external_interrupt(
- == (INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK);
- }
-
-+static inline int is_machine_check(u32 intr_info)
-+{
-+ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK |
-+ INTR_INFO_VALID_MASK)) ==
-+ (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK);
-+}
-+
- static inline int cpu_has_vmx_msr_bitmap(void)
- {
- return (vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS);
-@@ -478,7 +487,7 @@ static void update_exception_bitmap(stru
+@@ -478,7 +481,7 @@ static void update_exception_bitmap(stru
{
u32 eb;
if (!vcpu->fpu_active)
eb |= 1u << NM_VECTOR;
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
-@@ -2585,6 +2594,31 @@ static int handle_rmode_exception(struct
+@@ -2585,6 +2588,35 @@ static int handle_rmode_exception(struct
return 0;
}
+ */
+static void kvm_machine_check(void)
+{
-+#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64)
++#ifdef CONFIG_X86_MCE
+ struct pt_regs regs = {
+ .cs = 3, /* Fake ring 3 no matter what the guest ran on */
+ .flags = X86_EFLAGS_IF,
+ };
+
++#ifdef CONFIG_X86_64
+ do_machine_check(®s, 0);
++#else
++ machine_check_vector(®s, 0);
++#endif
+#endif
+}
+
static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
{
struct vcpu_vmx *vmx = to_vmx(vcpu);
-@@ -2596,6 +2630,9 @@ static int handle_exception(struct kvm_v
+@@ -2596,6 +2628,10 @@ static int handle_exception(struct kvm_v
vect_info = vmx->idt_vectoring_info;
intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
-+ if (is_machine_check(intr_info))
++ ex_no = intr_info & INTR_INFO_VECTOR_MASK;
++ if (ex_no == MC_VECTOR)
+ return handle_machine_check(vcpu, kvm_run);
+
if ((vect_info & VECTORING_INFO_VALID_MASK) &&
!is_page_fault(intr_info))
printk(KERN_ERR "%s: unexpected, vectoring info 0x%x "
-@@ -3150,6 +3187,7 @@ static int (*kvm_vmx_exit_handlers[])(st
+@@ -2648,7 +2684,6 @@ static int handle_exception(struct kvm_v
+ return 1;
+ }
+
+- ex_no = intr_info & INTR_INFO_VECTOR_MASK;
+ switch (ex_no) {
+ case DB_VECTOR:
+ dr6 = vmcs_readl(EXIT_QUALIFICATION);
+@@ -3150,6 +3185,7 @@ static int (*kvm_vmx_exit_handlers[])(st
[EXIT_REASON_WBINVD] = handle_wbinvd,
[EXIT_REASON_TASK_SWITCH] = handle_task_switch,
[EXIT_REASON_EPT_VIOLATION] = handle_ept_violation,
};
static const int kvm_vmx_max_exit_handlers =
-@@ -3161,8 +3199,8 @@ static const int kvm_vmx_max_exit_handle
+@@ -3161,8 +3197,8 @@ static const int kvm_vmx_max_exit_handle
*/
static int kvm_handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
{
u32 vectoring_info = vmx->idt_vectoring_info;
KVMTRACE_3D(VMEXIT, vcpu, exit_reason, (u32)kvm_rip_read(vcpu),
-@@ -3257,6 +3295,14 @@ static void vmx_complete_interrupts(stru
+@@ -3512,6 +3548,13 @@ static void vmx_vcpu_run(struct kvm_vcpu
- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+ intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+ vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
+
+ /* Handle machine checks before interrupts are enabled */
-+ if ((vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
-+ || (vmx->exit_reason == EXIT_REASON_EXCEPTION_NMI
-+ && is_machine_check(exit_intr_info)))
++ if ((vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY) ||
++ (intr_info & INTR_INFO_VECTOR_MASK) == MC_VECTOR)
+ kvm_machine_check();
+
/* We need to handle NMIs before interrupts are enabled */
- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
- (exit_intr_info & INTR_INFO_VALID_MASK)) {
+ if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+ (intr_info & INTR_INFO_VALID_MASK)) {
+++ /dev/null
-From 20f65983e30f222e5383f77206e3f571d1d64610 Mon Sep 17 00:00:00 2001
-From: Gleb Natapov <gleb@redhat.com>
-Date: Mon, 11 May 2009 13:35:55 +0300
-Subject: KVM: Move "exit due to NMI" handling into vmx_complete_interrupts()
-
-From: Gleb Natapov <gleb@redhat.com>
-
-commit 20f65983e30f222e5383f77206e3f571d1d64610 upstream.
-
-To save us one reading of VM_EXIT_INTR_INFO.
-
-Signed-off-by: Gleb Natapov <gleb@redhat.com>
-Signed-off-by: Avi Kivity <avi@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- arch/x86/kvm/vmx.c | 21 ++++++++++-----------
- 1 file changed, 10 insertions(+), 11 deletions(-)
-
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -3255,8 +3255,17 @@ static void vmx_complete_interrupts(stru
- bool idtv_info_valid;
- u32 error;
-
-- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
-+
-+ /* We need to handle NMIs before interrupts are enabled */
-+ if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
-+ (exit_intr_info & INTR_INFO_VALID_MASK)) {
-+ KVMTRACE_0D(NMI, &vmx->vcpu, handler);
-+ asm("int $2");
-+ }
-+
-+ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
-+
- if (cpu_has_virtual_nmis()) {
- unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
- vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
-@@ -3386,7 +3395,6 @@ static void fixup_rmode_irq(struct vcpu_
- static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
- {
- struct vcpu_vmx *vmx = to_vmx(vcpu);
-- u32 intr_info;
-
- /* Record the guest's net vcpu time for enforced NMI injections. */
- if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked))
-@@ -3515,15 +3523,6 @@ static void vmx_vcpu_run(struct kvm_vcpu
- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
- vmx->launched = 1;
-
-- intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
--
-- /* We need to handle NMIs before interrupts are enabled */
-- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
-- (intr_info & INTR_INFO_VALID_MASK)) {
-- KVMTRACE_0D(NMI, vcpu, handler);
-- asm("int $2");
-- }
--
- vmx_complete_interrupts(vmx);
- }
-
+++ /dev/null
-From 7b4a25cb296e2a73d2e87a4af65361d45d450a27 Mon Sep 17 00:00:00 2001
-From: Gleb Natapov <gleb@redhat.com>
-Date: Mon, 30 Mar 2009 16:03:08 +0300
-Subject: KVM: VMX: Fix handling of a fault during NMI unblocked due to IRET
-
-From: Gleb Natapov <gleb@redhat.com>
-
-commit 7b4a25cb296e2a73d2e87a4af65361d45d450a27 upstream.
-
-Bit 12 is undefined in any of the following cases:
- If the VM exit sets the valid bit in the IDT-vectoring information field.
- If the VM exit is due to a double fault.
-
-Signed-off-by: Gleb Natapov <gleb@redhat.com>
-Signed-off-by: Avi Kivity <avi@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- arch/x86/kvm/vmx.c | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -3248,36 +3248,41 @@ static void update_tpr_threshold(struct
- static void vmx_complete_interrupts(struct vcpu_vmx *vmx)
- {
- u32 exit_intr_info;
-- u32 idt_vectoring_info;
-+ u32 idt_vectoring_info = vmx->idt_vectoring_info;
- bool unblock_nmi;
- u8 vector;
- int type;
- bool idtv_info_valid;
- u32 error;
-
-+ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
- if (cpu_has_virtual_nmis()) {
- unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0;
- vector = exit_intr_info & INTR_INFO_VECTOR_MASK;
- /*
-- * SDM 3: 25.7.1.2
-+ * SDM 3: 27.7.1.2 (September 2008)
- * Re-set bit "block by NMI" before VM entry if vmexit caused by
- * a guest IRET fault.
-+ * SDM 3: 23.2.2 (September 2008)
-+ * Bit 12 is undefined in any of the following cases:
-+ * If the VM exit sets the valid bit in the IDT-vectoring
-+ * information field.
-+ * If the VM exit is due to a double fault.
- */
-- if (unblock_nmi && vector != DF_VECTOR)
-+ if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi &&
-+ vector != DF_VECTOR && !idtv_info_valid)
- vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
- GUEST_INTR_STATE_NMI);
- } else if (unlikely(vmx->soft_vnmi_blocked))
- vmx->vnmi_blocked_time +=
- ktime_to_ns(ktime_sub(ktime_get(), vmx->entry_time));
-
-- idt_vectoring_info = vmx->idt_vectoring_info;
-- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK;
- vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK;
- type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK;
- if (vmx->vcpu.arch.nmi_injected) {
- /*
-- * SDM 3: 25.7.1.2
-+ * SDM 3: 27.7.1.2 (September 2008)
- * Clear bit "block by NMI" before VM entry if a NMI delivery
- * faulted.
- */
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
-@@ -3015,6 +3015,12 @@ static int handle_vmcall(struct kvm_vcpu
+@@ -3013,6 +3013,12 @@ static int handle_vmcall(struct kvm_vcpu
return 1;
}
static int handle_invlpg(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
{
u64 exit_qualification = vmcs_read64(EXIT_QUALIFICATION);
-@@ -3182,6 +3188,15 @@ static int (*kvm_vmx_exit_handlers[])(st
+@@ -3180,6 +3186,15 @@ static int (*kvm_vmx_exit_handlers[])(st
[EXIT_REASON_HLT] = handle_halt,
[EXIT_REASON_INVLPG] = handle_invlpg,
[EXIT_REASON_VMCALL] = handle_vmcall,
firmware_map-fix-hang-with-x86-32bit.patch
fs-remove-incorrect-i_new-warnings.patch
pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch
-kvm-vmx-fix-handling-of-a-fault-during-nmi-unblocked-due-to-iret.patch
-kvm-move-exit-due-to-nmi-handling-into-vmx_complete_interrupts.patch
-kvm-add-vt-x-machine-check-support.patch
+kvm-add-vt-x-machine-check-support-v4.patch
kvm-disable-large-pages-on-misaligned-memory-slots.patch
kvm-prevent-overflow-in-largepages-calculation.patch
kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch
dm-sysfs-skip-output-when-device-is-being-destroyed.patch
dm-mpath-flush-keventd-queue-in-destructor.patch
dm-exception-store-fix-exstore-lookup-to-be-case-insensitive.patch
+dm-exception-store-really-fix-type-lookup.patch
dm-use-i_size_read.patch
vmscan-properly-account-for-the-number-of-page-cache-pages-zone_reclaim-can-reclaim.patch
vmscan-count-the-number-of-times-zone_reclaim-scans-and-fails.patch
ide-cd-prevent-null-pointer-deref-via-cdrom_newpc_intr.patch
drm-i915-correct-suspend-resume-ordering.patch
kvm-x86-silence-preempt-warning-on-kvm_write_guest_time.patch
+xfs-fix-freeing-memory-in-xfs_getbmap.patch
+bsdacct-fix-access-to-invalid-filp-in-acct_on.patch
--- /dev/null
+From 7747a0b0af5976ba3828796b4f7a7adc3bb76dbd Mon Sep 17 00:00:00 2001
+From: Felix Blyakher <felixb@sgi.com>
+Date: Thu, 11 Jun 2009 17:07:28 -0500
+Subject: xfs: fix freeing memory in xfs_getbmap()
+
+From: Felix Blyakher <felixb@sgi.com>
+
+commit 7747a0b0af5976ba3828796b4f7a7adc3bb76dbd upstream.
+
+Regression from commit 28e211700a81b0a934b6c7a4b8e7dda843634d2f.
+Need to free temporary buffer allocated in xfs_getbmap().
+
+Signed-off-by: Felix Blyakher <felixb@sgi.com>
+Signed-off-by: Hedi Berriche <hedi@sgi.com>
+Reported-by: Justin Piszcz <jpiszcz@lucidpixels.com>
+Reviewed-by: Eric Sandeen <sandeen@sandeen.net>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/xfs/xfs_bmap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/xfs/xfs_bmap.c
++++ b/fs/xfs/xfs_bmap.c
+@@ -6085,6 +6085,7 @@ xfs_getbmap(
+ break;
+ }
+
++ kmem_free(out);
+ return error;
+ }
+