--- /dev/null
+From e43f998e47bae27e37e159915625e8d4b130153b Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.cz>
+Date: Fri, 6 Dec 2013 17:51:32 +0100
+Subject: btrfs: call mnt_drop_write after interrupted subvol deletion
+
+From: David Sterba <dsterba@suse.cz>
+
+commit e43f998e47bae27e37e159915625e8d4b130153b upstream.
+
+If btrfs_ioctl_snap_destroy blocks on the mutex and the process is
+killed, mnt_write count is unbalanced and leads to unmountable
+filesystem.
+
+Signed-off-by: David Sterba <dsterba@suse.cz>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2093,7 +2093,7 @@ static noinline int btrfs_ioctl_snap_des
+
+ err = mutex_lock_killable_nested(&dir->i_mutex, I_MUTEX_PARENT);
+ if (err == -EINTR)
+- goto out;
++ goto out_drop_write;
+ dentry = lookup_one_len(vol_args->name, parent, namelen);
+ if (IS_ERR(dentry)) {
+ err = PTR_ERR(dentry);
+@@ -2235,6 +2235,7 @@ out_dput:
+ dput(dentry);
+ out_unlock_dir:
+ mutex_unlock(&dir->i_mutex);
++out_drop_write:
+ mnt_drop_write_file(file);
+ out:
+ kfree(vol_args);
--- /dev/null
+From 700ff4f095d78af0998953e922e041d75254518b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 10 Jan 2013 03:57:25 -0500
+Subject: Btrfs: fix access_ok() check in btrfs_ioctl_send()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 700ff4f095d78af0998953e922e041d75254518b upstream.
+
+The closing parenthesis is in the wrong place. We want to check
+"sizeof(*arg->clone_sources) * arg->clone_sources_count" instead of
+"sizeof(*arg->clone_sources * arg->clone_sources_count)".
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Jie Liu <jeff.liu@oracle.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/send.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -4623,8 +4623,8 @@ long btrfs_ioctl_send(struct file *mnt_f
+ }
+
+ if (!access_ok(VERIFY_READ, arg->clone_sources,
+- sizeof(*arg->clone_sources *
+- arg->clone_sources_count))) {
++ sizeof(*arg->clone_sources) *
++ arg->clone_sources_count)) {
+ ret = -EFAULT;
+ goto out;
+ }
--- /dev/null
+From ed9571f0cf1fe09d3506302610f3ccdfa1d22c4a Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Fri, 13 Dec 2013 14:55:55 +0000
+Subject: dm array: fix a reference counting bug in shadow_ablock
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit ed9571f0cf1fe09d3506302610f3ccdfa1d22c4a upstream.
+
+An old array block could have its reference count decremented below
+zero when it is being replaced in the btree by a new array block.
+
+The fix is to increment the old ablock's reference count just before
+inserting a new ablock into the btree.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-array.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/persistent-data/dm-array.c
++++ b/drivers/md/persistent-data/dm-array.c
+@@ -317,8 +317,16 @@ static int shadow_ablock(struct dm_array
+ * The shadow op will often be a noop. Only insert if it really
+ * copied data.
+ */
+- if (dm_block_location(*block) != b)
++ if (dm_block_location(*block) != b) {
++ /*
++ * dm_tm_shadow_block will have already decremented the old
++ * block, but it is still referenced by the btree. We
++ * increment to stop the insert decrementing it below zero
++ * when overwriting the old value.
++ */
++ dm_tm_inc(info->btree_info.tm, b);
+ r = insert_ablock(info, index, *block, root);
++ }
+
+ return r;
+ }
--- /dev/null
+From 4cb57ab4a2e61978f3a9b7d4f53988f30d61c27f Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 5 Dec 2013 17:33:29 -0500
+Subject: dm bufio: initialize read-only module parameters
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 4cb57ab4a2e61978f3a9b7d4f53988f30d61c27f upstream.
+
+Some module parameters in dm-bufio are read-only. These parameters
+inform the user about memory consumption. They are not supposed to be
+changed by the user.
+
+However, despite being read-only, these parameters can be set on
+modprobe or insmod command line, for example:
+modprobe dm-bufio current_allocated_bytes=12345
+
+The kernel doesn't expect that these variables can be non-zero at module
+initialization and if the user sets them, it results in BUG.
+
+This patch initializes the variables in the module init routine, so that
+user-supplied values are ignored.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-bufio.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1660,6 +1660,11 @@ static int __init dm_bufio_init(void)
+ {
+ __u64 mem;
+
++ dm_bufio_allocated_kmem_cache = 0;
++ dm_bufio_allocated_get_free_pages = 0;
++ dm_bufio_allocated_vmalloc = 0;
++ dm_bufio_current_allocated = 0;
++
+ memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches);
+ memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names);
+
--- /dev/null
+From 718822c1c112dc99e0c72c8968ee1db9d9d910f0 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 15 Nov 2013 16:12:20 -0500
+Subject: dm delay: fix a possible deadlock due to shared workqueue
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 718822c1c112dc99e0c72c8968ee1db9d9d910f0 upstream.
+
+The dm-delay target uses a shared workqueue for multiple instances. This
+can cause deadlock if two or more dm-delay targets are stacked on the top
+of each other.
+
+This patch changes dm-delay to use a per-instance workqueue.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-delay.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -20,6 +20,7 @@
+ struct delay_c {
+ struct timer_list delay_timer;
+ struct mutex timer_lock;
++ struct workqueue_struct *kdelayd_wq;
+ struct work_struct flush_expired_bios;
+ struct list_head delayed_bios;
+ atomic_t may_delay;
+@@ -45,14 +46,13 @@ struct dm_delay_info {
+
+ static DEFINE_MUTEX(delayed_bios_lock);
+
+-static struct workqueue_struct *kdelayd_wq;
+ static struct kmem_cache *delayed_cache;
+
+ static void handle_delayed_timer(unsigned long data)
+ {
+ struct delay_c *dc = (struct delay_c *)data;
+
+- queue_work(kdelayd_wq, &dc->flush_expired_bios);
++ queue_work(dc->kdelayd_wq, &dc->flush_expired_bios);
+ }
+
+ static void queue_timeout(struct delay_c *dc, unsigned long expires)
+@@ -191,6 +191,12 @@ out:
+ goto bad_dev_write;
+ }
+
++ dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
++ if (!dc->kdelayd_wq) {
++ DMERR("Couldn't start kdelayd");
++ goto bad_queue;
++ }
++
+ setup_timer(&dc->delay_timer, handle_delayed_timer, (unsigned long)dc);
+
+ INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
+@@ -203,6 +209,8 @@ out:
+ ti->private = dc;
+ return 0;
+
++bad_queue:
++ mempool_destroy(dc->delayed_pool);
+ bad_dev_write:
+ if (dc->dev_write)
+ dm_put_device(ti, dc->dev_write);
+@@ -217,7 +225,7 @@ static void delay_dtr(struct dm_target *
+ {
+ struct delay_c *dc = ti->private;
+
+- flush_workqueue(kdelayd_wq);
++ destroy_workqueue(dc->kdelayd_wq);
+
+ dm_put_device(ti, dc->dev_read);
+
+@@ -350,12 +358,6 @@ static int __init dm_delay_init(void)
+ {
+ int r = -ENOMEM;
+
+- kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
+- if (!kdelayd_wq) {
+- DMERR("Couldn't start kdelayd");
+- goto bad_queue;
+- }
+-
+ delayed_cache = KMEM_CACHE(dm_delay_info, 0);
+ if (!delayed_cache) {
+ DMERR("Couldn't create delayed bio cache.");
+@@ -373,8 +375,6 @@ static int __init dm_delay_init(void)
+ bad_register:
+ kmem_cache_destroy(delayed_cache);
+ bad_memcache:
+- destroy_workqueue(kdelayd_wq);
+-bad_queue:
+ return r;
+ }
+
+@@ -382,7 +382,6 @@ static void __exit dm_delay_exit(void)
+ {
+ dm_unregister_target(&delay_target);
+ kmem_cache_destroy(delayed_cache);
+- destroy_workqueue(kdelayd_wq);
+ }
+
+ /* Module hooks */
--- /dev/null
+From 230c83afdd9cd384348475bea1e14b80b3b6b1b8 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 29 Nov 2013 18:13:37 -0500
+Subject: dm snapshot: avoid snapshot space leak on crash
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 230c83afdd9cd384348475bea1e14b80b3b6b1b8 upstream.
+
+There is a possible leak of snapshot space in case of crash.
+
+The reason for space leaking is that chunks in the snapshot device are
+allocated sequentially, but they are finished (and stored in the metadata)
+out of order, depending on the order in which copying finished.
+
+For example, supposed that the metadata contains the following records
+SUPERBLOCK
+METADATA (blocks 0 ... 250)
+DATA 0
+DATA 1
+DATA 2
+...
+DATA 250
+
+Now suppose that you allocate 10 new data blocks 251-260. Suppose that
+copying of these blocks finish out of order (block 260 finished first
+and the block 251 finished last). Now, the snapshot device looks like
+this:
+SUPERBLOCK
+METADATA (blocks 0 ... 250, 260, 259, 258, 257, 256)
+DATA 0
+DATA 1
+DATA 2
+...
+DATA 250
+DATA 251
+DATA 252
+DATA 253
+DATA 254
+DATA 255
+METADATA (blocks 255, 254, 253, 252, 251)
+DATA 256
+DATA 257
+DATA 258
+DATA 259
+DATA 260
+
+Now, if the machine crashes after writing the first metadata block but
+before writing the second metadata block, the space for areas DATA 250-255
+is leaked, it contains no valid data and it will never be used in the
+future.
+
+This patch makes dm-snapshot complete exceptions in the same order they
+were allocated, thus fixing this bug.
+
+Note: when backporting this patch to the stable kernel, change the version
+field in the following way:
+* if version in the stable kernel is {1, 11, 1}, change it to {1, 12, 0}
+* if version in the stable kernel is {1, 10, 0} or {1, 10, 1}, change it
+ to {1, 10, 2}
+Userspace reads the version to determine if the bug was fixed, so the
+version change is needed.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-snap.c | 71 +++++++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 64 insertions(+), 7 deletions(-)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -66,6 +66,18 @@ struct dm_snapshot {
+
+ atomic_t pending_exceptions_count;
+
++ /* Protected by "lock" */
++ sector_t exception_start_sequence;
++
++ /* Protected by kcopyd single-threaded callback */
++ sector_t exception_complete_sequence;
++
++ /*
++ * A list of pending exceptions that completed out of order.
++ * Protected by kcopyd single-threaded callback.
++ */
++ struct list_head out_of_order_list;
++
+ mempool_t *pending_pool;
+
+ struct dm_exception_table pending;
+@@ -173,6 +185,14 @@ struct dm_snap_pending_exception {
+ */
+ int started;
+
++ /* There was copying error. */
++ int copy_error;
++
++ /* A sequence number, it is used for in-order completion. */
++ sector_t exception_sequence;
++
++ struct list_head out_of_order_entry;
++
+ /*
+ * For writing a complete chunk, bypassing the copy.
+ */
+@@ -1094,6 +1114,9 @@ static int snapshot_ctr(struct dm_target
+ s->valid = 1;
+ s->active = 0;
+ atomic_set(&s->pending_exceptions_count, 0);
++ s->exception_start_sequence = 0;
++ s->exception_complete_sequence = 0;
++ INIT_LIST_HEAD(&s->out_of_order_list);
+ init_rwsem(&s->lock);
+ INIT_LIST_HEAD(&s->list);
+ spin_lock_init(&s->pe_lock);
+@@ -1443,6 +1466,19 @@ static void commit_callback(void *contex
+ pending_complete(pe, success);
+ }
+
++static void complete_exception(struct dm_snap_pending_exception *pe)
++{
++ struct dm_snapshot *s = pe->snap;
++
++ if (unlikely(pe->copy_error))
++ pending_complete(pe, 0);
++
++ else
++ /* Update the metadata if we are persistent */
++ s->store->type->commit_exception(s->store, &pe->e,
++ commit_callback, pe);
++}
++
+ /*
+ * Called when the copy I/O has finished. kcopyd actually runs
+ * this code so don't block.
+@@ -1452,13 +1488,32 @@ static void copy_callback(int read_err,
+ struct dm_snap_pending_exception *pe = context;
+ struct dm_snapshot *s = pe->snap;
+
+- if (read_err || write_err)
+- pending_complete(pe, 0);
++ pe->copy_error = read_err || write_err;
+
+- else
+- /* Update the metadata if we are persistent */
+- s->store->type->commit_exception(s->store, &pe->e,
+- commit_callback, pe);
++ if (pe->exception_sequence == s->exception_complete_sequence) {
++ s->exception_complete_sequence++;
++ complete_exception(pe);
++
++ while (!list_empty(&s->out_of_order_list)) {
++ pe = list_entry(s->out_of_order_list.next,
++ struct dm_snap_pending_exception, out_of_order_entry);
++ if (pe->exception_sequence != s->exception_complete_sequence)
++ break;
++ s->exception_complete_sequence++;
++ list_del(&pe->out_of_order_entry);
++ complete_exception(pe);
++ }
++ } else {
++ struct list_head *lh;
++ struct dm_snap_pending_exception *pe2;
++
++ list_for_each_prev(lh, &s->out_of_order_list) {
++ pe2 = list_entry(lh, struct dm_snap_pending_exception, out_of_order_entry);
++ if (pe2->exception_sequence < pe->exception_sequence)
++ break;
++ }
++ list_add(&pe->out_of_order_entry, lh);
++ }
+ }
+
+ /*
+@@ -1553,6 +1608,8 @@ __find_pending_exception(struct dm_snaps
+ return NULL;
+ }
+
++ pe->exception_sequence = s->exception_start_sequence++;
++
+ dm_insert_exception(&s->pending, &pe->e);
+
+ return pe;
+@@ -2192,7 +2249,7 @@ static struct target_type origin_target
+
+ static struct target_type snapshot_target = {
+ .name = "snapshot",
+- .version = {1, 11, 1},
++ .version = {1, 12, 0},
+ .module = THIS_MODULE,
+ .ctr = snapshot_ctr,
+ .dtr = snapshot_dtr,
--- /dev/null
+From f62b6b8f498658a9d537c7d380e9966f15e1b2a1 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Mon, 2 Dec 2013 16:47:01 -0500
+Subject: dm space map metadata: return on failure in sm_metadata_new_block
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit f62b6b8f498658a9d537c7d380e9966f15e1b2a1 upstream.
+
+Commit 2fc48021f4afdd109b9e52b6eef5db89ca80bac7 ("dm persistent
+metadata: add space map threshold callback") introduced a regression
+to the metadata block allocation path that resulted in errors being
+ignored. This regression was uncovered by running the following
+device-mapper-test-suite test:
+dmtest run --suite thin-provisioning -n /exhausting_metadata_space_causes_fail_mode/
+
+The ignored error codes in sm_metadata_new_block() could crash the
+kernel through use of either the dm-thin or dm-cache targets, e.g.:
+
+device-mapper: thin: 253:4: reached low water mark for metadata device: sending event.
+device-mapper: space map metadata: unable to allocate new metadata block
+general protection fault: 0000 [#1] SMP
+...
+Workqueue: dm-thin do_worker [dm_thin_pool]
+task: ffff880035ce2ab0 ti: ffff88021a054000 task.ti: ffff88021a054000
+RIP: 0010:[<ffffffffa0331385>] [<ffffffffa0331385>] metadata_ll_load_ie+0x15/0x30 [dm_persistent_data]
+RSP: 0018:ffff88021a055a68 EFLAGS: 00010202
+RAX: 003fc8243d212ba0 RBX: ffff88021a780070 RCX: ffff88021a055a78
+RDX: ffff88021a055a78 RSI: 0040402222a92a80 RDI: ffff88021a780070
+RBP: ffff88021a055a68 R08: ffff88021a055ba4 R09: 0000000000000010
+R10: 0000000000000000 R11: 00000002a02e1000 R12: ffff88021a055ad4
+R13: 0000000000000598 R14: ffffffffa0338470 R15: ffff88021a055ba4
+FS: 0000000000000000(0000) GS:ffff88033fca0000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 00007f467c0291b8 CR3: 0000000001a0b000 CR4: 00000000000007e0
+Stack:
+ ffff88021a055ab8 ffffffffa0332020 ffff88021a055b30 0000000000000001
+ ffff88021a055b30 0000000000000000 ffff88021a055b18 0000000000000000
+ ffff88021a055ba4 ffff88021a055b98 ffff88021a055ae8 ffffffffa033304c
+Call Trace:
+ [<ffffffffa0332020>] sm_ll_lookup_bitmap+0x40/0xa0 [dm_persistent_data]
+ [<ffffffffa033304c>] sm_metadata_count_is_more_than_one+0x8c/0xc0 [dm_persistent_data]
+ [<ffffffffa0333825>] dm_tm_shadow_block+0x65/0x110 [dm_persistent_data]
+ [<ffffffffa0331b00>] sm_ll_mutate+0x80/0x300 [dm_persistent_data]
+ [<ffffffffa0330e60>] ? set_ref_count+0x10/0x10 [dm_persistent_data]
+ [<ffffffffa0331dba>] sm_ll_inc+0x1a/0x20 [dm_persistent_data]
+ [<ffffffffa0332270>] sm_disk_new_block+0x60/0x80 [dm_persistent_data]
+ [<ffffffff81520036>] ? down_write+0x16/0x40
+ [<ffffffffa001e5c4>] dm_pool_alloc_data_block+0x54/0x80 [dm_thin_pool]
+ [<ffffffffa001b23c>] alloc_data_block+0x9c/0x130 [dm_thin_pool]
+ [<ffffffffa001c27e>] provision_block+0x4e/0x180 [dm_thin_pool]
+ [<ffffffffa001fe9a>] ? dm_thin_find_block+0x6a/0x110 [dm_thin_pool]
+ [<ffffffffa001c57a>] process_bio+0x1ca/0x1f0 [dm_thin_pool]
+ [<ffffffff8111e2ed>] ? mempool_free+0x8d/0xa0
+ [<ffffffffa001d755>] process_deferred_bios+0xc5/0x230 [dm_thin_pool]
+ [<ffffffffa001d911>] do_worker+0x51/0x60 [dm_thin_pool]
+ [<ffffffff81067872>] process_one_work+0x182/0x3b0
+ [<ffffffff81068c90>] worker_thread+0x120/0x3a0
+ [<ffffffff81068b70>] ? manage_workers+0x160/0x160
+ [<ffffffff8106eb2e>] kthread+0xce/0xe0
+ [<ffffffff8106ea60>] ? kthread_freezable_should_stop+0x70/0x70
+ [<ffffffff8152af6c>] ret_from_fork+0x7c/0xb0
+ [<ffffffff8106ea60>] ? kthread_freezable_should_stop+0x70/0x70
+ [<ffffffff8152af6c>] ret_from_fork+0x7c/0xb0
+ [<ffffffff8106ea60>] ? kthread_freezable_should_stop+0x70/0x70
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Acked-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -384,12 +384,16 @@ static int sm_metadata_new_block(struct
+ struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+
+ int r = sm_metadata_new_block_(sm, b);
+- if (r)
++ if (r) {
+ DMERR("unable to allocate new metadata block");
++ return r;
++ }
+
+ r = sm_metadata_get_nr_free(sm, &count);
+- if (r)
++ if (r) {
+ DMERR("couldn't get free block count");
++ return r;
++ }
+
+ check_threshold(&smm->threshold, count);
+
--- /dev/null
+From 5b2d06576c5410c10d95adfd5c4d8b24de861d87 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 22 Nov 2013 19:52:06 -0500
+Subject: dm table: fail dm_table_create on dm_round_up overflow
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 5b2d06576c5410c10d95adfd5c4d8b24de861d87 upstream.
+
+The dm_round_up function may overflow to zero. In this case,
+dm_table_create() must fail rather than go on to allocate an empty array
+with alloc_targets().
+
+This fixes a possible memory corruption that could be caused by passing
+too large a number in "param->target_count".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-table.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -215,6 +215,11 @@ int dm_table_create(struct dm_table **re
+
+ num_targets = dm_round_up(num_targets, KEYS_PER_NODE);
+
++ if (!num_targets) {
++ kfree(t);
++ return -ENOMEM;
++ }
++
+ if (alloc_targets(t, num_targets)) {
+ kfree(t);
+ return -ENOMEM;
--- /dev/null
+From fafc7a815e40255d24e80a1cb7365892362fa398 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Mon, 2 Dec 2013 17:57:42 -0500
+Subject: dm thin: switch to read only mode if a mapping insert fails
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit fafc7a815e40255d24e80a1cb7365892362fa398 upstream.
+
+Switch the thin pool to read-only mode when dm_thin_insert_block() fails
+since there is little reason to expect the cause of the failure to be
+resolved without further action by user space.
+
+This issue was noticed with the device-mapper-test-suite using:
+dmtest run --suite thin-provisioning -n /exhausting_metadata_space_causes_fail_mode/
+
+The quantity of errors logged in this case must be reduced.
+
+before patch:
+
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: dm_thin_insert_block() failed
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: space map metadata: unable to allocate new metadata block
+<snip ... these repeat for a long while ... >
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: space map common: dm_tm_shadow_block() failed
+device-mapper: thin: 253:4: no free metadata space available.
+device-mapper: thin: 253:4: switching pool to read-only mode
+
+after patch:
+
+device-mapper: space map metadata: unable to allocate new metadata block
+device-mapper: thin: 253:4: dm_thin_insert_block() failed: error = -28
+device-mapper: thin: 253:4: switching pool to read-only mode
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -640,7 +640,9 @@ static void process_prepared_mapping(str
+ */
+ r = dm_thin_insert_block(tc->td, m->virt_block, m->data_block);
+ if (r) {
+- DMERR_LIMIT("dm_thin_insert_block() failed");
++ DMERR_LIMIT("%s: dm_thin_insert_block() failed: error = %d",
++ dm_device_name(pool->pool_md), r);
++ set_pool_mode(pool, PM_READ_ONLY);
+ cell_error(pool, m->cell);
+ goto out;
+ }
--- /dev/null
+From d18a88b1f535d627412b2a265d71b2f7d464860e Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Wed, 27 Nov 2013 17:17:43 -0300
+Subject: media: af9033: fix broken I2C
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit d18a88b1f535d627412b2a265d71b2f7d464860e upstream.
+
+Driver did not work anymore since I2C has gone broken due
+to recent commit:
+commit 37ebaf6891ee81687bb558e8375c0712d8264ed8
+[media] dvb-frontends: Don't use dynamic static allocation
+
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/af9033.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/dvb-frontends/af9033.c
++++ b/drivers/media/dvb-frontends/af9033.c
+@@ -170,18 +170,18 @@ static int af9033_rd_reg_mask(struct af9
+ static int af9033_wr_reg_val_tab(struct af9033_state *state,
+ const struct reg_val *tab, int tab_len)
+ {
++#define MAX_TAB_LEN 212
+ int ret, i, j;
+- u8 buf[MAX_XFER_SIZE];
++ u8 buf[1 + MAX_TAB_LEN];
++
++ dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
+
+ if (tab_len > sizeof(buf)) {
+- dev_warn(&state->i2c->dev,
+- "%s: i2c wr len=%d is too big!\n",
+- KBUILD_MODNAME, tab_len);
++ dev_warn(&state->i2c->dev, "%s: tab len %d is too big\n",
++ KBUILD_MODNAME, tab_len);
+ return -EINVAL;
+ }
+
+- dev_dbg(&state->i2c->dev, "%s: tab_len=%d\n", __func__, tab_len);
+-
+ for (i = 0, j = 0; i < tab_len; i++) {
+ buf[j] = tab[i].val;
+
--- /dev/null
+From 0c413d10515feae02cee967b31bb8afea8aa0d29 Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Thu, 8 Aug 2013 19:41:06 -0300
+Subject: media: af9035: add [0413:6a05] Leadtek WinFast DTV Dongle Dual
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit 0c413d10515feae02cee967b31bb8afea8aa0d29 upstream.
+
+It is IT9135 dual design.
+Thanks to Michael Piko for reporting that!
+
+Reported-by: Michael Piko <michael@piko.com.au>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/af9035.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -1512,6 +1512,8 @@ static const struct usb_device_id af9035
+ /* XXX: that same ID [0ccd:0099] is used by af9015 driver too */
+ { DVB_USB_DEVICE(USB_VID_TERRATEC, 0x0099,
+ &af9035_props, "TerraTec Cinergy T Stick Dual RC (rev. 2)", NULL) },
++ { DVB_USB_DEVICE(USB_VID_LEADTEK, 0x6a05,
++ &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(usb, af9035_id_table);
--- /dev/null
+From 3189ef0290dcc9f44782672fade35847cb30da00 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Nov 2013 04:50:46 -0300
+Subject: media: af9035: unlock on error in af9035_i2c_master_xfer()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3189ef0290dcc9f44782672fade35847cb30da00 upstream.
+
+We introduced a couple new error paths which are missing unlocks.
+Fixes: 7760e148350b ('[media] af9035: Don't use dynamic static allocation')
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb-v2/af9035.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -244,7 +244,8 @@ static int af9035_i2c_master_xfer(struct
+ dev_warn(&d->udev->dev,
+ "%s: i2c xfer: len=%d is too big!\n",
+ KBUILD_MODNAME, msg[0].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ req.mbox |= ((msg[0].addr & 0x80) >> 3);
+ buf[0] = msg[1].len;
+@@ -280,7 +281,8 @@ static int af9035_i2c_master_xfer(struct
+ dev_warn(&d->udev->dev,
+ "%s: i2c xfer: len=%d is too big!\n",
+ KBUILD_MODNAME, msg[0].len);
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto unlock;
+ }
+ req.mbox |= ((msg[0].addr & 0x80) >> 3);
+ buf[0] = msg[0].len;
+@@ -300,6 +302,7 @@ static int af9035_i2c_master_xfer(struct
+ ret = -EOPNOTSUPP;
+ }
+
++unlock:
+ mutex_unlock(&d->i2c_mutex);
+
+ if (ret < 0)
--- /dev/null
+From f8e1b699a5504a2da05834c7cfdddb125a8ce088 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Mon, 11 Nov 2013 08:16:03 -0300
+Subject: media: bttv: don't setup the controls if there are no video devices
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit f8e1b699a5504a2da05834c7cfdddb125a8ce088 upstream.
+
+The no_video flag was checked in all other cases except one. Calling
+v4l2_ctrl_handler_setup() if no_video is 1 will crash.
+This wasn't noticed before since there are only two card types that
+set no_video to 1, so this type of hardware is quite rare.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Lorenz Röhrl <sheepshit@gmx.de>
+Tested-by: Lorenz Röhrl <sheepshit@gmx.de>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -4226,7 +4226,8 @@ static int bttv_probe(struct pci_dev *de
+ }
+ btv->std = V4L2_STD_PAL;
+ init_irqreg(btv);
+- v4l2_ctrl_handler_setup(hdl);
++ if (!bttv_tvcards[btv->c.type].no_video)
++ v4l2_ctrl_handler_setup(hdl);
+ if (hdl->error) {
+ result = hdl->error;
+ goto fail2;
--- /dev/null
+From 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Fri, 25 Oct 2013 06:34:03 -0300
+Subject: media: saa7164: fix return value check in saa7164_initdev()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 upstream.
+
+In case of error, the function kthread_run() returns ERR_PTR()
+and never returns NULL. The NULL test in the return value check
+should be replaced with IS_ERR().
+
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/saa7164/saa7164-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/pci/saa7164/saa7164-core.c
++++ b/drivers/media/pci/saa7164/saa7164-core.c
+@@ -1348,9 +1348,11 @@ static int saa7164_initdev(struct pci_de
+ if (fw_debug) {
+ dev->kthread = kthread_run(saa7164_thread_function, dev,
+ "saa7164 debug");
+- if (!dev->kthread)
++ if (IS_ERR(dev->kthread)) {
++ dev->kthread = NULL;
+ printk(KERN_ERR "%s() Failed to create "
+ "debug kernel thread\n", __func__);
++ }
+ }
+
+ } /* != BOARD_UNKNOWN */
--- /dev/null
+From 3af41a337a5b270de3e65466a07f106ad97ad0c6 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Mon, 11 Nov 2013 11:02:52 -0300
+Subject: media: wm8775: fix broken audio routing
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit 3af41a337a5b270de3e65466a07f106ad97ad0c6 upstream.
+
+Commit 5aa9ae5ed5d449a85fbf7aac3d1fdc241c542a79 inverted the mute control
+state test in s_routing which caused the audio routing to fail. This broke
+ivtv support for the Hauppauge video/audio input bracket (which adds additional
+video and audio inputs) all the way back in kernel 2.6.36.
+This fix fixes the condition and it also removes a nonsense check on the
+balance control.
+Bisected-by: Rajil Saraswat <rajil.s@gmail.com>
+
+Signed-off-by: Andy Walls <awalls@md.metrocast.net>
+Reported-by: Rajil Saraswat <rajil.s@gmail.com>
+Tested-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/wm8775.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/wm8775.c
++++ b/drivers/media/i2c/wm8775.c
+@@ -131,12 +131,10 @@ static int wm8775_s_routing(struct v4l2_
+ return -EINVAL;
+ }
+ state->input = input;
+- if (!v4l2_ctrl_g_ctrl(state->mute))
++ if (v4l2_ctrl_g_ctrl(state->mute))
+ return 0;
+ if (!v4l2_ctrl_g_ctrl(state->vol))
+ return 0;
+- if (!v4l2_ctrl_g_ctrl(state->bal))
+- return 0;
+ wm8775_set_audio(sd, 1);
+ return 0;
+ }
x86-efi-don-t-use-u-efi-time-services-on-32-bit.patch
x86-build-pass-in-additional-mno-mmx-mno-sse-options.patch
x86-build-icc-remove-uninitialized_var-from-compiler-intel.h.patch
+media-saa7164-fix-return-value-check-in-saa7164_initdev.patch
+media-bttv-don-t-setup-the-controls-if-there-are-no-video-devices.patch
+media-af9033-fix-broken-i2c.patch
+media-wm8775-fix-broken-audio-routing.patch
+media-af9035-add-leadtek-winfast-dtv-dongle-dual.patch
+media-af9035-unlock-on-error-in-af9035_i2c_master_xfer.patch
+btrfs-fix-access_ok-check-in-btrfs_ioctl_send.patch
+btrfs-call-mnt_drop_write-after-interrupted-subvol-deletion.patch
+dm-bufio-initialize-read-only-module-parameters.patch
+dm-snapshot-avoid-snapshot-space-leak-on-crash.patch
+dm-array-fix-a-reference-counting-bug-in-shadow_ablock.patch
+dm-delay-fix-a-possible-deadlock-due-to-shared-workqueue.patch
+dm-space-map-metadata-return-on-failure-in-sm_metadata_new_block.patch
+dm-table-fail-dm_table_create-on-dm_round_up-overflow.patch
+dm-thin-switch-to-read-only-mode-if-a-mapping-insert-fails.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
