--- /dev/null
+From 475d0db742e3755c6b267f48577ff7cbb7dfda0d Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sat, 17 May 2014 20:56:38 +0900
+Subject: fs: Fix theoretical division by 0 in super_cache_scan().
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 475d0db742e3755c6b267f48577ff7cbb7dfda0d upstream.
+
+total_objects could be 0 and is used as a denom.
+
+While total_objects is a "long", total_objects == 0 unlikely happens for
+3.12 and later kernels because 32-bit architectures would not be able to
+hold (1 << 32) objects. However, total_objects == 0 may happen for kernels
+between 3.1 and 3.11 because total_objects in prune_super() was an "int"
+and (e.g.) x86_64 architecture might be able to hold (1 << 32) objects.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -76,6 +76,8 @@ static int prune_super(struct shrinker *
+
+ total_objects = sb->s_nr_dentry_unused +
+ sb->s_nr_inodes_unused + fs_objects + 1;
++ if (!total_objects)
++ total_objects = 1;
+
+ if (sc->nr_to_scan) {
+ int dentries;
--- /dev/null
+From c2ca0fcd202863b14bd041a7fece2e789926c225 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Sun, 27 Jul 2014 13:00:41 -0400
+Subject: fs: make cont_expand_zero interruptible
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit c2ca0fcd202863b14bd041a7fece2e789926c225 upstream.
+
+This patch makes it possible to kill a process looping in
+cont_expand_zero. A process may spend a lot of time in this function, so
+it is desirable to be able to kill it.
+
+It happened to me that I wanted to copy a piece data from the disk to a
+file. By mistake, I used the "seek" parameter to dd instead of "skip". Due
+to the "seek" parameter, dd attempted to extend the file and became stuck
+doing so - the only possibility was to reset the machine or wait many
+hours until the filesystem runs out of space and cont_expand_zero fails.
+We need this patch to be able to terminate the process.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/buffer.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2254,6 +2254,11 @@ static int cont_expand_zero(struct file
+ err = 0;
+
+ balance_dirty_pages_ratelimited(mapping);
++
++ if (unlikely(fatal_signal_pending(current))) {
++ err = -EINTR;
++ goto out;
++ }
+ }
+
+ /* page covers the boundary, find the boundary offset */
--- /dev/null
+From 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 Mon Sep 17 00:00:00 2001
+From: Ondrej Zary <linux@rainbow-software.org>
+Date: Sat, 27 Sep 2014 00:04:46 +0200
+Subject: libata-sff: Fix controllers with no ctl port
+
+From: Ondrej Zary <linux@rainbow-software.org>
+
+commit 6d8ca28fa688a9354bc9fbc935bdaeb3651b6677 upstream.
+
+Currently, ata_sff_softreset is skipped for controllers with no ctl port.
+But that also skips ata_sff_dev_classify required for device detection.
+This means that libata is currently broken on controllers with no ctl port.
+
+No device connected:
+[ 1.872480] pata_isapnp 01:01.02: activated
+[ 1.889823] scsi2 : pata_isapnp
+[ 1.890109] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 6.888110] ata3.01: qc timeout (cmd 0xec)
+[ 6.888179] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 16.888085] ata3.01: qc timeout (cmd 0xec)
+[ 16.888147] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 46.888086] ata3.01: qc timeout (cmd 0xec)
+[ 46.888148] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 51.888100] ata3.00: qc timeout (cmd 0xec)
+[ 51.888160] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 61.888079] ata3.00: qc timeout (cmd 0xec)
+[ 61.888141] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 91.888089] ata3.00: qc timeout (cmd 0xec)
+[ 91.888152] ata3.00: failed to IDENTIFY (I/O error, err_mask=0x5)
+
+ATAPI device connected:
+[ 1.882061] pata_isapnp 01:01.02: activated
+[ 1.893430] scsi2 : pata_isapnp
+[ 1.893719] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 6.892107] ata3.01: qc timeout (cmd 0xec)
+[ 6.892171] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 16.892079] ata3.01: qc timeout (cmd 0xec)
+[ 16.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 46.892079] ata3.01: qc timeout (cmd 0xec)
+[ 46.892138] ata3.01: failed to IDENTIFY (I/O error, err_mask=0x5)
+[ 46.908586] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr
+[ 46.924570] ata3.00: configured for PIO0 (device error ignored)
+[ 46.926295] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5
+[ 46.984519] sr0: scsi3-mmc drive: 6x/6x xa/form2 tray
+[ 46.984592] cdrom: Uniform CD-ROM driver Revision: 3.20
+
+So don't skip ata_sff_softreset, just skip the reset part of ata_bus_softreset
+if the ctl port is not available.
+
+This makes IDE port on ES968 behave correctly:
+
+No device connected:
+[ 4.670888] pata_isapnp 01:01.02: activated
+[ 4.673207] scsi host2: pata_isapnp
+[ 4.673675] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 7.081840] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k
+
+ATAPI device connected:
+[ 4.704362] pata_isapnp 01:01.02: activated
+[ 4.706620] scsi host2: pata_isapnp
+[ 4.706877] ata3: PATA max PIO0 cmd 0x1e8 ctl 0x0 irq 11
+[ 4.872782] ata3.00: ATAPI: ACER CD-767E/O, V1.5X, max PIO2, CDB intr
+[ 4.888673] ata3.00: configured for PIO0 (device error ignored)
+[ 4.893984] scsi 2:0:0:0: CD-ROM ACER CD-767E/O 1.5X PQ: 0 ANSI: 5
+[ 7.015578] Adding 2541652k swap on /dev/sda2. Priority:-1 extents:1 across:2541652k
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-sff.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_
+
+ DPRINTK("ata%u: bus reset via SRST\n", ap->print_id);
+
+- /* software reset. causes dev0 to be selected */
+- iowrite8(ap->ctl, ioaddr->ctl_addr);
+- udelay(20); /* FIXME: flush */
+- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr);
+- udelay(20); /* FIXME: flush */
+- iowrite8(ap->ctl, ioaddr->ctl_addr);
+- ap->last_ctl = ap->ctl;
++ if (ap->ioaddr.ctl_addr) {
++ /* software reset. causes dev0 to be selected */
++ iowrite8(ap->ctl, ioaddr->ctl_addr);
++ udelay(20); /* FIXME: flush */
++ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr);
++ udelay(20); /* FIXME: flush */
++ iowrite8(ap->ctl, ioaddr->ctl_addr);
++ ap->last_ctl = ap->ctl;
++ }
+
+ /* wait the port to become ready */
+ return ata_sff_wait_after_reset(&ap->link, devmask, deadline);
+@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_po
+
+ spin_unlock_irqrestore(ap->lock, flags);
+
+- /* ignore ata_sff_softreset if ctl isn't accessible */
+- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr)
+- softreset = NULL;
+-
+ /* ignore built-in hardresets if SCR access is not available */
+ if ((hardreset == sata_std_hardreset ||
+ hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link))
--- /dev/null
+From 173b3afceebe76fa2205b2c8808682d5b541fe3c Mon Sep 17 00:00:00 2001
+From: Benjamin Coddington <bcodding@redhat.com>
+Date: Tue, 23 Sep 2014 12:26:20 -0400
+Subject: lockd: Try to reconnect if statd has moved
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+commit 173b3afceebe76fa2205b2c8808682d5b541fe3c upstream.
+
+If rpc.statd is restarted, upcalls to monitor hosts can fail with
+ECONNREFUSED. In that case force a lookup of statd's new port and retry the
+upcall.
+
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/lockd/mon.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -159,6 +159,12 @@ static int nsm_mon_unmon(struct nsm_hand
+
+ msg.rpc_proc = &clnt->cl_procinfo[proc];
+ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN);
++ if (status == -ECONNREFUSED) {
++ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n",
++ status);
++ rpc_force_rebind(clnt);
++ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN);
++ }
+ if (status < 0)
+ dprintk("lockd: NSM upcall RPC failed, status=%d\n",
+ status);
--- /dev/null
+From d1419d50c1bf711e9fd27b516a739c86b23f7cf9 Mon Sep 17 00:00:00 2001
+From: Roger Tseng <rogerable@realtek.com>
+Date: Fri, 15 Aug 2014 14:06:00 +0800
+Subject: mmc: rtsx_pci_sdmmc: fix incorrect last byte in R2 response
+
+From: Roger Tseng <rogerable@realtek.com>
+
+commit d1419d50c1bf711e9fd27b516a739c86b23f7cf9 upstream.
+
+Current code erroneously fill the last byte of R2 response with an undefined
+value. In addition, the controller actually 'offloads' the last byte
+(CRC7, end bit) while receiving R2 response and thus it's impossible to get the
+actual value. This could cause mmc stack to obtain inconsistent CID from the
+same card after resume and misidentify it as a different card.
+
+Fix by assigning dummy CRC and end bit: {7'b0, 1} = 0x1 to the last byte of R2.
+
+Fixes: ff984e57d36e ("mmc: Add realtek pcie sdmmc host driver")
+Signed-off-by: Roger Tseng <rogerable@realtek.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -341,6 +341,13 @@ static void sd_send_cmd_get_rsp(struct r
+ }
+
+ if (rsp_type == SD_RSP_TYPE_R2) {
++ /*
++ * The controller offloads the last byte {CRC-7, end bit 1'b1}
++ * of response type R2. Assign dummy CRC, 0, and end bit to the
++ * byte(ptr[16], goes into the LSB of resp[3] later).
++ */
++ ptr[16] = 1;
++
+ for (i = 0; i < 4; i++) {
+ cmd->resp[i] = get_unaligned_be32(ptr + 1 + i * 4);
+ dev_dbg(sdmmc_dev(host), "cmd->resp[%d] = 0x%08x\n",
--- /dev/null
+From 37017ac6849e772e67dd187ba2fbd056c4afa533 Mon Sep 17 00:00:00 2001
+From: Scott Carter <ccscott@funsoft.com>
+Date: Wed, 24 Sep 2014 18:13:09 -0700
+Subject: pata_serverworks: disable 64-KB DMA transfers on Broadcom OSB4 IDE Controller
+
+From: Scott Carter <ccscott@funsoft.com>
+
+commit 37017ac6849e772e67dd187ba2fbd056c4afa533 upstream.
+
+The Broadcom OSB4 IDE Controller (vendor and device IDs: 1166:0211)
+does not support 64-KB DMA transfers.
+Whenever a 64-KB DMA transfer is attempted,
+the transfer fails and messages similar to the following
+are written to the console log:
+
+ [ 2431.851125] sr 0:0:0:0: [sr0] Unhandled sense code
+ [ 2431.851139] sr 0:0:0:0: [sr0] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
+ [ 2431.851152] sr 0:0:0:0: [sr0] Sense Key : Hardware Error [current]
+ [ 2431.851166] sr 0:0:0:0: [sr0] Add. Sense: Logical unit communication time-out
+ [ 2431.851182] sr 0:0:0:0: [sr0] CDB: Read(10): 28 00 00 00 76 f4 00 00 40 00
+ [ 2431.851210] end_request: I/O error, dev sr0, sector 121808
+
+When the libata and pata_serverworks modules
+are recompiled with ATA_DEBUG and ATA_VERBOSE_DEBUG defined in libata.h,
+the 64-KB transfer size in the scatter-gather list can be seen
+in the console log:
+
+ [ 2664.897267] sr 9:0:0:0: [sr0] Send:
+ [ 2664.897274] 0xf63d85e0
+ [ 2664.897283] sr 9:0:0:0: [sr0] CDB:
+ [ 2664.897288] Read(10): 28 00 00 00 7f b4 00 00 40 00
+ [ 2664.897319] buffer = 0xf6d6fbc0, bufflen = 131072, queuecommand 0xf81b7700
+ [ 2664.897331] ata_scsi_dump_cdb: CDB (1:0,0,0) 28 00 00 00 7f b4 00 00 40
+ [ 2664.897338] ata_scsi_translate: ENTER
+ [ 2664.897345] ata_sg_setup: ENTER, ata1
+ [ 2664.897356] ata_sg_setup: 3 sg elements mapped
+ [ 2664.897364] ata_bmdma_fill_sg: PRD[0] = (0x66FD2000, 0xE000)
+ [ 2664.897371] ata_bmdma_fill_sg: PRD[1] = (0x65000000, 0x10000)
+ ------------------------------------------------------> =======
+ [ 2664.897378] ata_bmdma_fill_sg: PRD[2] = (0x66A10000, 0x2000)
+ [ 2664.897386] ata1: ata_dev_select: ENTER, device 0, wait 1
+ [ 2664.897422] ata_sff_tf_load: feat 0x1 nsect 0x0 lba 0x0 0x0 0xFC
+ [ 2664.897428] ata_sff_tf_load: device 0xA0
+ [ 2664.897448] ata_sff_exec_command: ata1: cmd 0xA0
+ [ 2664.897457] ata_scsi_translate: EXIT
+ [ 2664.897462] leaving scsi_dispatch_cmnd()
+ [ 2664.897497] Doing sr request, dev = sr0, block = 0
+ [ 2664.897507] sr0 : reading 64/256 512 byte blocks.
+ [ 2664.897553] ata_sff_hsm_move: ata1: protocol 7 task_state 1 (dev_stat 0x58)
+ [ 2664.897560] atapi_send_cdb: send cdb
+ [ 2666.910058] ata_bmdma_port_intr: ata1: host_stat 0x64
+ [ 2666.910079] __ata_sff_port_intr: ata1: protocol 7 task_state 3
+ [ 2666.910093] ata_sff_hsm_move: ata1: protocol 7 task_state 3 (dev_stat 0x51)
+ [ 2666.910101] ata_sff_hsm_move: ata1: protocol 7 task_state 4 (dev_stat 0x51)
+ [ 2666.910129] sr 9:0:0:0: [sr0] Done:
+ [ 2666.910136] 0xf63d85e0 TIMEOUT
+
+lspci shows that the driver used for the Broadcom OSB4 IDE Controller is
+pata_serverworks:
+
+ 00:0f.1 IDE interface: Broadcom OSB4 IDE Controller (prog-if 8e [Master SecP SecO PriP])
+ Flags: bus master, medium devsel, latency 64
+ [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8]
+ [virtual] Memory at 000003f0 (type 3, non-prefetchable) [size=1]
+ I/O ports at 0170 [size=8]
+ I/O ports at 0374 [size=4]
+ I/O ports at 1440 [size=16]
+ Kernel driver in use: pata_serverworks
+
+The pata_serverworks driver supports five distinct device IDs,
+one being the OSB4 and the other four belonging to the CSB series.
+The CSB series appears to support 64-KB DMA transfers,
+as tests on a machine with an SAI2 motherboard
+containing a Broadcom CSB5 IDE Controller (vendor and device IDs: 1166:0212)
+showed no problems with 64-KB DMA transfers.
+
+This problem was first discovered when attempting to install openSUSE
+from a DVD on a machine with an STL2 motherboard.
+Using the pata_serverworks module,
+older releases of openSUSE will not install at all due to the timeouts.
+Releases of openSUSE prior to 11.3 can be installed by disabling
+the pata_serverworks module using the brokenmodules boot parameter,
+which causes the serverworks module to be used instead.
+Recent releases of openSUSE (12.2 and later) include better error recovery and
+will install, though very slowly.
+On all openSUSE releases, the problem can be recreated
+on a machine containing a Broadcom OSB4 IDE Controller
+by mounting an install DVD and running a command similar to the following:
+
+ find /mnt -type f -print | xargs cat > /dev/null
+
+The patch below corrects the problem.
+Similar to the other ATA drivers that do not support 64-KB DMA transfers,
+the patch changes the ata_port_operations qc_prep vector to point to a routine
+that breaks any 64-KB segment into two 32-KB segments and
+changes the scsi_host_template sg_tablesize element to reduce by half
+the number of scatter/gather elements allowed.
+These two changes affect only the OSB4.
+
+Signed-off-by: Scott Carter <ccscott@funsoft.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/pata_serverworks.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/pata_serverworks.c
++++ b/drivers/ata/pata_serverworks.c
+@@ -252,12 +252,18 @@ static void serverworks_set_dmamode(stru
+ pci_write_config_byte(pdev, 0x54, ultra_cfg);
+ }
+
+-static struct scsi_host_template serverworks_sht = {
++static struct scsi_host_template serverworks_osb4_sht = {
++ ATA_BMDMA_SHT(DRV_NAME),
++ .sg_tablesize = LIBATA_DUMB_MAX_PRD,
++};
++
++static struct scsi_host_template serverworks_csb_sht = {
+ ATA_BMDMA_SHT(DRV_NAME),
+ };
+
+ static struct ata_port_operations serverworks_osb4_port_ops = {
+ .inherits = &ata_bmdma_port_ops,
++ .qc_prep = ata_bmdma_dumb_qc_prep,
+ .cable_detect = serverworks_cable_detect,
+ .mode_filter = serverworks_osb4_filter,
+ .set_piomode = serverworks_set_piomode,
+@@ -266,6 +272,7 @@ static struct ata_port_operations server
+
+ static struct ata_port_operations serverworks_csb_port_ops = {
+ .inherits = &serverworks_osb4_port_ops,
++ .qc_prep = ata_bmdma_qc_prep,
+ .mode_filter = serverworks_csb_filter,
+ };
+
+@@ -405,6 +412,7 @@ static int serverworks_init_one(struct p
+ }
+ };
+ const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL };
++ struct scsi_host_template *sht = &serverworks_csb_sht;
+ int rc;
+
+ rc = pcim_enable_device(pdev);
+@@ -418,6 +426,7 @@ static int serverworks_init_one(struct p
+ /* Select non UDMA capable OSB4 if we can't do fixups */
+ if (rc < 0)
+ ppi[0] = &info[1];
++ sht = &serverworks_osb4_sht;
+ }
+ /* setup CSB5/CSB6 : South Bridge and IDE option RAID */
+ else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) ||
+@@ -434,7 +443,7 @@ static int serverworks_init_one(struct p
+ ppi[1] = &ata_dummy_port_info;
+ }
+
+- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0);
++ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0);
+ }
+
+ #ifdef CONFIG_PM
--- /dev/null
+From bb2e226b3bef596dd56be97df655d857b4603923 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 21 Sep 2014 15:04:53 -0700
+Subject: Revert "percpu: free percpu allocation info for uniprocessor system"
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit bb2e226b3bef596dd56be97df655d857b4603923 upstream.
+
+This reverts commit 3189eddbcafc ("percpu: free percpu allocation info for
+uniprocessor system").
+
+The commit causes a hang with a crisv32 image. This may be an architecture
+problem, but at least for now the revert is necessary to be able to boot a
+crisv32 image.
+
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Honggang Li <enjoymindful@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Fixes: 3189eddbcafc ("percpu: free percpu allocation info for uniprocessor system")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1910,8 +1910,6 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
+-
+- pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
ax88179_178a-fix-bonding-failure.patch
ipv4-dst_entry-leak-in-ip_send_unicast_reply.patch
drivers-net-macvtap-and-tun-depend-on-inet.patch
+lockd-try-to-reconnect-if-statd-has-moved.patch
+revert-percpu-free-percpu-allocation-info-for-uniprocessor-system.patch
+pata_serverworks-disable-64-kb-dma-transfers-on-broadcom-osb4-ide-controller.patch
+libata-sff-fix-controllers-with-no-ctl-port.patch
+mmc-rtsx_pci_sdmmc-fix-incorrect-last-byte-in-r2-response.patch
+fs-make-cont_expand_zero-interruptible.patch
+fs-fix-theoretical-division-by-0-in-super_cache_scan.patch
+ubifs-remove-mst_mutex.patch
+ubifs-fix-a-race-condition.patch
+ubifs-fix-free-log-space-calculation.patch
--- /dev/null
+From 052c28073ff26f771d44ef33952a41d18dadd255 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Sun, 29 Jun 2014 17:00:45 +0300
+Subject: UBIFS: fix a race condition
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit 052c28073ff26f771d44ef33952a41d18dadd255 upstream.
+
+Hu (hujianyang@huawei.com) discovered a race condition which may lead to a
+situation when UBIFS is unable to mount the file-system after an unclean
+reboot. The problem is theoretical, though.
+
+In UBIFS, we have the log, which basically a set of LEBs in a certain area. The
+log has the tail and the head.
+
+Every time user writes data to the file-system, the UBIFS journal grows, and
+the log grows as well, because we append new reference nodes to the head of the
+log. So the head moves forward all the time, while the log tail stays at the
+same position.
+
+At any time, the UBIFS master node points to the tail of the log. When we mount
+the file-system, we scan the log, and we always start from its tail, because
+this is where the master node points to. The only occasion when the tail of the
+log changes is the commit operation.
+
+The commit operation has 2 phases - "commit start" and "commit end". The former
+is relatively short, and does not involve much I/O. During this phase we mostly
+just build various in-memory lists of the things which have to be written to
+the flash media during "commit end" phase.
+
+During the commit start phase, what we do is we "clean" the log. Indeed, the
+commit operation will index all the data in the journal, so the entire journal
+"disappears", and therefore the data in the log become unneeded. So we just
+move the head of the log to the next LEB, and write the CS node there. This LEB
+will be the tail of the new log when the commit operation finishes.
+
+When the "commit start" phase finishes, users may write more data to the
+file-system, in parallel with the ongoing "commit end" operation. At this point
+the log tail was not changed yet, it is the same as it had been before we
+started the commit. The log head keeps moving forward, though.
+
+The commit operation now needs to write the new master node, and the new master
+node should point to the new log tail. After this the LEBs between the old log
+tail and the new log tail can be unmapped and re-used again.
+
+And here is the possible problem. We do 2 operations: (a) We first update the
+log tail position in memory (see 'ubifs_log_end_commit()'). (b) And then we
+write the master node (see the big lock of code in 'do_commit()').
+
+But nothing prevents the log head from moving forward between (a) and (b), and
+the log head may "wrap" now to the old log tail. And when the "wrap" happens,
+the contends of the log tail gets erased. Now a power cut happens and we are in
+trouble. We end up with the old master node pointing to the old tail, which was
+erased. And replay fails because it expects the master node to point to the
+correct log tail at all times.
+
+This patch merges the abovementioned (a) and (b) operations by moving the master
+node change code to the 'ubifs_log_end_commit()' function, so that it runs with
+the log mutex locked, which will prevent the log from being changed benween
+operations (a) and (b).
+
+Reported-by: hujianyang <hujianyang@huawei.com>
+Tested-by: hujianyang <hujianyang@huawei.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/commit.c | 8 +++-----
+ fs/ubifs/log.c | 11 ++++++++---
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -166,10 +166,6 @@ static int do_commit(struct ubifs_info *
+ err = ubifs_orphan_end_commit(c);
+ if (err)
+ goto out;
+- old_ltail_lnum = c->ltail_lnum;
+- err = ubifs_log_end_commit(c, new_ltail_lnum);
+- if (err)
+- goto out;
+ err = dbg_check_old_index(c, &zroot);
+ if (err)
+ goto out;
+@@ -202,7 +198,9 @@ static int do_commit(struct ubifs_info *
+ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
+ else
+ c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS);
+- err = ubifs_write_master(c);
++
++ old_ltail_lnum = c->ltail_lnum;
++ err = ubifs_log_end_commit(c, new_ltail_lnum);
+ if (err)
+ goto out;
+
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -447,9 +447,9 @@ out:
+ * @ltail_lnum: new log tail LEB number
+ *
+ * This function is called on when the commit operation was finished. It
+- * moves log tail to new position and unmaps LEBs which contain obsolete data.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
++ * moves log tail to new position and updates the master node so that it stores
++ * the new log tail LEB number. Returns zero in case of success and a negative
++ * error code in case of failure.
+ */
+ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum)
+ {
+@@ -477,7 +477,12 @@ int ubifs_log_end_commit(struct ubifs_in
+ spin_unlock(&c->buds_lock);
+
+ err = dbg_check_bud_bytes(c);
++ if (err)
++ goto out;
+
++ err = ubifs_write_master(c);
++
++out:
+ mutex_unlock(&c->log_mutex);
+ return err;
+ }
--- /dev/null
+From ba29e721eb2df6df8f33c1f248388bb037a47914 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Wed, 16 Jul 2014 15:22:29 +0300
+Subject: UBIFS: fix free log space calculation
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit ba29e721eb2df6df8f33c1f248388bb037a47914 upstream.
+
+Hu (hujianyang <hujianyang@huawei.com>) discovered an issue in the
+'empty_log_bytes()' function, which calculates how many bytes are left in the
+log:
+
+"
+If 'c->lhead_lnum + 1 == c->ltail_lnum' and 'c->lhead_offs == c->leb_size', 'h'
+would equalent to 't' and 'empty_log_bytes()' would return 'c->log_bytes'
+instead of 0.
+"
+
+At this point it is not clear what would be the consequences of this, and
+whether this may lead to any problems, but this patch addresses the issue just
+in case.
+
+Tested-by: hujianyang <hujianyang@huawei.com>
+Reported-by: hujianyang <hujianyang@huawei.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/log.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -106,10 +106,14 @@ static inline long long empty_log_bytes(
+ h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs;
+ t = (long long)c->ltail_lnum * c->leb_size;
+
+- if (h >= t)
++ if (h > t)
+ return c->log_bytes - h + t;
+- else
++ else if (h != t)
+ return t - h;
++ else if (c->lhead_lnum != c->ltail_lnum)
++ return 0;
++ else
++ return c->log_bytes;
+ }
+
+ /**
--- /dev/null
+From 07e19dff63e3d5d6500d831e36554ac9b1b0560e Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Sun, 29 Jun 2014 16:55:02 +0300
+Subject: UBIFS: remove mst_mutex
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit 07e19dff63e3d5d6500d831e36554ac9b1b0560e upstream.
+
+The 'mst_mutex' is not needed since because 'ubifs_write_master()' is only
+called on the mount path and commit path. The mount path is sequential and
+there is no parallelism, and the commit path is also serialized - there is only
+one commit going on at a time.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/commit.c | 2 --
+ fs/ubifs/master.c | 7 +++----
+ fs/ubifs/super.c | 1 -
+ fs/ubifs/ubifs.h | 2 --
+ 4 files changed, 3 insertions(+), 9 deletions(-)
+
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -174,7 +174,6 @@ static int do_commit(struct ubifs_info *
+ if (err)
+ goto out;
+
+- mutex_lock(&c->mst_mutex);
+ c->mst_node->cmt_no = cpu_to_le64(c->cmt_no);
+ c->mst_node->log_lnum = cpu_to_le32(new_ltail_lnum);
+ c->mst_node->root_lnum = cpu_to_le32(zroot.lnum);
+@@ -204,7 +203,6 @@ static int do_commit(struct ubifs_info *
+ else
+ c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS);
+ err = ubifs_write_master(c);
+- mutex_unlock(&c->mst_mutex);
+ if (err)
+ goto out;
+
+--- a/fs/ubifs/master.c
++++ b/fs/ubifs/master.c
+@@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info
+ * ubifs_write_master - write master node.
+ * @c: UBIFS file-system description object
+ *
+- * This function writes the master node. The caller has to take the
+- * @c->mst_mutex lock before calling this function. Returns zero in case of
+- * success and a negative error code in case of failure. The master node is
+- * written twice to enable recovery.
++ * This function writes the master node. Returns zero in case of success and a
++ * negative error code in case of failure. The master node is written twice to
++ * enable recovery.
+ */
+ int ubifs_write_master(struct ubifs_info *c)
+ {
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1970,7 +1970,6 @@ static struct ubifs_info *alloc_ubifs_in
+ mutex_init(&c->lp_mutex);
+ mutex_init(&c->tnc_mutex);
+ mutex_init(&c->log_mutex);
+- mutex_init(&c->mst_mutex);
+ mutex_init(&c->umount_mutex);
+ mutex_init(&c->bu_mutex);
+ mutex_init(&c->write_reserve_mutex);
+--- a/fs/ubifs/ubifs.h
++++ b/fs/ubifs/ubifs.h
+@@ -1042,7 +1042,6 @@ struct ubifs_debug_info;
+ *
+ * @mst_node: master node
+ * @mst_offs: offset of valid master node
+- * @mst_mutex: protects the master node area, @mst_node, and @mst_offs
+ *
+ * @max_bu_buf_len: maximum bulk-read buffer length
+ * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu
+@@ -1282,7 +1281,6 @@ struct ubifs_info {
+
+ struct ubifs_mst_node *mst_node;
+ int mst_offs;
+- struct mutex mst_mutex;
+
+ int max_bu_buf_len;
+ struct mutex bu_mutex;
projects / thirdparty / kernel / stable-queue.git / commitdiff
