--- /dev/null
+From 4f81f986761a7663db7d24d24cd6ae68008f1fc2 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 20 Aug 2012 10:57:22 -0400
+Subject: ACPI: export symbol acpi_get_table_with_size
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 4f81f986761a7663db7d24d24cd6ae68008f1fc2 upstream.
+
+We need it in the radeon drm module to fetch
+and verify the vbios image on UEFI systems.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/tbxface.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/acpi/acpica/tbxface.c
++++ b/drivers/acpi/acpica/tbxface.c
+@@ -436,6 +436,7 @@ acpi_get_table_with_size(char *signature
+
+ return (AE_NOT_FOUND);
+ }
++ACPI_EXPORT_SYMBOL(acpi_get_table_with_size)
+
+ acpi_status
+ acpi_get_table(char *signature,
--- /dev/null
+From 5ee0844d6427e7338e0aba748f62b62d07ea2ed0 Mon Sep 17 00:00:00 2001
+From: Stefan Behrens <sbehrens@giantdisaster.de>
+Date: Mon, 27 Aug 2012 08:30:03 -0600
+Subject: Btrfs: revert checksum error statistic which can cause a BUG()
+
+From: Stefan Behrens <sbehrens@giantdisaster.de>
+
+commit 5ee0844d6427e7338e0aba748f62b62d07ea2ed0 upstream.
+
+Commit 442a4f6308e694e0fa6025708bd5e4e424bbf51c added btrfs device
+statistic counters for detected IO and checksum errors to Linux 3.5.
+The statistic part that counts checksum errors in
+end_bio_extent_readpage() can cause a BUG() in a subfunction:
+"kernel BUG at fs/btrfs/volumes.c:3762!"
+That part is reverted with the current patch.
+However, the counting of checksum errors in the scrub context remains
+active, and the counting of detected IO errors (read, write or flush
+errors) in all contexts remains active.
+
+Signed-off-by: Stefan Behrens <sbehrens@giantdisaster.de>
+Signed-off-by: Chris Mason <chris.mason@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent_io.c | 17 ++---------------
+ fs/btrfs/volumes.c | 22 ----------------------
+ fs/btrfs/volumes.h | 2 --
+ 3 files changed, 2 insertions(+), 39 deletions(-)
+
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2329,23 +2329,10 @@ static void end_bio_extent_readpage(stru
+ if (uptodate && tree->ops && tree->ops->readpage_end_io_hook) {
+ ret = tree->ops->readpage_end_io_hook(page, start, end,
+ state, mirror);
+- if (ret) {
+- /* no IO indicated but software detected errors
+- * in the block, either checksum errors or
+- * issues with the contents */
+- struct btrfs_root *root =
+- BTRFS_I(page->mapping->host)->root;
+- struct btrfs_device *device;
+-
++ if (ret)
+ uptodate = 0;
+- device = btrfs_find_device_for_logical(
+- root, start, mirror);
+- if (device)
+- btrfs_dev_stat_inc_and_print(device,
+- BTRFS_DEV_STAT_CORRUPTION_ERRS);
+- } else {
++ else
+ clean_io_failure(start, page);
+- }
+ }
+
+ if (!uptodate && tree->ops && tree->ops->readpage_io_failed_hook) {
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4602,28 +4602,6 @@ int btrfs_read_sys_array(struct btrfs_ro
+ return ret;
+ }
+
+-struct btrfs_device *btrfs_find_device_for_logical(struct btrfs_root *root,
+- u64 logical, int mirror_num)
+-{
+- struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
+- int ret;
+- u64 map_length = 0;
+- struct btrfs_bio *bbio = NULL;
+- struct btrfs_device *device;
+-
+- BUG_ON(mirror_num == 0);
+- ret = btrfs_map_block(map_tree, WRITE, logical, &map_length, &bbio,
+- mirror_num);
+- if (ret) {
+- BUG_ON(bbio != NULL);
+- return NULL;
+- }
+- BUG_ON(mirror_num != bbio->mirror_num);
+- device = bbio->stripes[mirror_num - 1].dev;
+- kfree(bbio);
+- return device;
+-}
+-
+ int btrfs_read_chunk_tree(struct btrfs_root *root)
+ {
+ struct btrfs_path *path;
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -288,8 +288,6 @@ int btrfs_cancel_balance(struct btrfs_fs
+ int btrfs_chunk_readonly(struct btrfs_root *root, u64 chunk_offset);
+ int find_free_dev_extent(struct btrfs_device *device, u64 num_bytes,
+ u64 *start, u64 *max_avail);
+-struct btrfs_device *btrfs_find_device_for_logical(struct btrfs_root *root,
+- u64 logical, int mirror_num);
+ void btrfs_dev_stat_print_on_error(struct btrfs_device *device);
+ void btrfs_dev_stat_inc_and_print(struct btrfs_device *dev, int index);
+ int btrfs_get_dev_stats(struct btrfs_root *root,
--- /dev/null
+From b0cf0b118c90477d1a6811f2cd2307f6a5578362 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Tue, 21 Aug 2012 16:15:49 -0700
+Subject: cciss: fix incorrect scsi status reporting
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit b0cf0b118c90477d1a6811f2cd2307f6a5578362 upstream.
+
+Delete code which sets SCSI status incorrectly as it's already been set
+correctly above this incorrect code. The bug was introduced in 2009 by
+commit b0e15f6db111 ("cciss: fix typo that causes scsi status to be
+lost.")
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Reported-by: Roel van Meer <roel.vanmeer@bokxing.nl>
+Tested-by: Roel van Meer <roel.vanmeer@bokxing.nl>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/cciss_scsi.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -763,16 +763,7 @@ static void complete_scsi_command(Comman
+ {
+ case CMD_TARGET_STATUS:
+ /* Pass it up to the upper layers... */
+- if( ei->ScsiStatus)
+- {
+-#if 0
+- printk(KERN_WARNING "cciss: cmd %p "
+- "has SCSI Status = %x\n",
+- c, ei->ScsiStatus);
+-#endif
+- cmd->result |= (ei->ScsiStatus << 1);
+- }
+- else { /* scsi status is zero??? How??? */
++ if (!ei->ScsiStatus) {
+
+ /* Ordinarily, this case should never happen, but there is a bug
+ in some released firmware revisions that allows it to happen
audit-fix-refcounting-in-audit-tree.patch
drm-stop-vmgfx-driver-explosion.patch
revert-drm-radeon-fix-bo-creation-retry-path.patch
+btrfs-revert-checksum-error-statistic-which-can-cause-a-bug.patch
+svcrpc-fix-bug-in-svc_tcp_clear_pages.patch
+svcrpc-fix-svc_xprt_enqueue-svc_recv-busy-looping.patch
+svcrpc-sends-on-closed-socket-should-stop-immediately.patch
+cciss-fix-incorrect-scsi-status-reporting.patch
+acpi-export-symbol-acpi_get_table_with_size.patch
--- /dev/null
+From be1e44441a560c43c136a562d49a1c9623c91197 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Thu, 9 Aug 2012 18:12:28 -0400
+Subject: svcrpc: fix BUG() in svc_tcp_clear_pages
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit be1e44441a560c43c136a562d49a1c9623c91197 upstream.
+
+Examination of svc_tcp_clear_pages shows that it assumes sk_tcplen is
+consistent with sk_pages[] (in particular, sk_pages[n] can't be NULL if
+sk_tcplen would lead us to expect n pages of data).
+
+svc_tcp_restore_pages zeroes out sk_pages[] while leaving sk_tcplen.
+This is OK, since both functions are serialized by XPT_BUSY. However,
+that means the inconsistency must be repaired before dropping XPT_BUSY.
+
+Therefore we should be ensuring that svc_tcp_save_pages repairs the
+problem before exiting svc_tcp_recv_record on error.
+
+Symptoms were a BUG() in svc_tcp_clear_pages.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/svcsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -1129,9 +1129,9 @@ static int svc_tcp_recvfrom(struct svc_r
+ if (len >= 0)
+ svsk->sk_tcplen += len;
+ if (len != want) {
++ svc_tcp_save_pages(svsk, rqstp);
+ if (len < 0 && len != -EAGAIN)
+ goto err_other;
+- svc_tcp_save_pages(svsk, rqstp);
+ dprintk("svc: incomplete TCP record (%d of %d)\n",
+ svsk->sk_tcplen, svsk->sk_reclen);
+ goto err_noclose;
--- /dev/null
+From d10f27a750312ed5638c876e4bd6aa83664cccd8 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Fri, 17 Aug 2012 17:31:53 -0400
+Subject: svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit d10f27a750312ed5638c876e4bd6aa83664cccd8 upstream.
+
+The rpc server tries to ensure that there will be room to send a reply
+before it receives a request.
+
+It does this by tracking, in xpt_reserved, an upper bound on the total
+size of the replies that is has already committed to for the socket.
+
+Currently it is adding in the estimate for a new reply *before* it
+checks whether there is space available. If it finds that there is not
+space, it then subtracts the estimate back out.
+
+This may lead the subsequent svc_xprt_enqueue to decide that there is
+space after all.
+
+The results is a svc_recv() that will repeatedly return -EAGAIN, causing
+server threads to loop without doing any actual work.
+
+Reported-by: Michael Tokarev <mjt@tls.msk.ru>
+Tested-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/svc_xprt.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -316,7 +316,6 @@ static bool svc_xprt_has_something_to_do
+ */
+ void svc_xprt_enqueue(struct svc_xprt *xprt)
+ {
+- struct svc_serv *serv = xprt->xpt_server;
+ struct svc_pool *pool;
+ struct svc_rqst *rqstp;
+ int cpu;
+@@ -362,8 +361,6 @@ void svc_xprt_enqueue(struct svc_xprt *x
+ rqstp, rqstp->rq_xprt);
+ rqstp->rq_xprt = xprt;
+ svc_xprt_get(xprt);
+- rqstp->rq_reserved = serv->sv_max_mesg;
+- atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+ pool->sp_stats.threads_woken++;
+ wake_up(&rqstp->rq_wait);
+ } else {
+@@ -640,8 +637,6 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ if (xprt) {
+ rqstp->rq_xprt = xprt;
+ svc_xprt_get(xprt);
+- rqstp->rq_reserved = serv->sv_max_mesg;
+- atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+
+ /* As there is a shortage of threads and this request
+ * had to be queued, don't allow the thread to wait so
+@@ -738,6 +733,8 @@ int svc_recv(struct svc_rqst *rqstp, lon
+ else
+ len = xprt->xpt_ops->xpo_recvfrom(rqstp);
+ dprintk("svc: got len=%d\n", len);
++ rqstp->rq_reserved = serv->sv_max_mesg;
++ atomic_add(rqstp->rq_reserved, &xprt->xpt_reserved);
+ }
+ svc_xprt_received(xprt);
+
--- /dev/null
+From f06f00a24d76e168ecb38d352126fd203937b601 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 20 Aug 2012 16:04:40 -0400
+Subject: svcrpc: sends on closed socket should stop immediately
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit f06f00a24d76e168ecb38d352126fd203937b601 upstream.
+
+svc_tcp_sendto sets XPT_CLOSE if we fail to transmit the entire reply.
+However, the XPT_CLOSE won't be acted on immediately. Meanwhile other
+threads could send further replies before the socket is really shut
+down. This can manifest as data corruption: for example, if a truncated
+read reply is followed by another rpc reply, that second reply will look
+to the client like further read data.
+
+Symptoms were data corruption preceded by svc_tcp_sendto logging
+something like
+
+ kernel: rpc-srv/tcp: nfsd: sent only 963696 when sending 1048708 bytes - shutting down socket
+
+Reported-by: Malahal Naineni <malahal@us.ibm.com>
+Tested-by: Malahal Naineni <malahal@us.ibm.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/svc_xprt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -791,7 +791,8 @@ int svc_send(struct svc_rqst *rqstp)
+
+ /* Grab mutex to serialize outgoing data. */
+ mutex_lock(&xprt->xpt_mutex);
+- if (test_bit(XPT_DEAD, &xprt->xpt_flags))
++ if (test_bit(XPT_DEAD, &xprt->xpt_flags)
++ || test_bit(XPT_CLOSE, &xprt->xpt_flags))
+ len = -ENOTCONN;
+ else
+ len = xprt->xpt_ops->xpo_sendto(rqstp);
projects / thirdparty / kernel / stable-queue.git / commitdiff
