+++ /dev/null
-From 747df19747bc9752cd40b9cce761e17a033aa5c2 Mon Sep 17 00:00:00 2001
-From: Daniel Mack <daniel@zonque.org>
-Date: Thu, 11 Oct 2018 20:32:05 +0200
-Subject: ASoC: sta32x: set ->component pointer in private struct
-
-From: Daniel Mack <daniel@zonque.org>
-
-commit 747df19747bc9752cd40b9cce761e17a033aa5c2 upstream.
-
-The ESD watchdog code in sta32x_watchdog() dereferences the pointer
-which is never assigned.
-
-This is a regression from a1be4cead9b950 ("ASoC: sta32x: Convert to direct
-regmap API usage.") which went unnoticed since nobody seems to use that ESD
-workaround.
-
-Fixes: a1be4cead9b950 ("ASoC: sta32x: Convert to direct regmap API usage.")
-Signed-off-by: Daniel Mack <daniel@zonque.org>
-Signed-off-by: Mark Brown <broonie@kernel.org>
-Cc: stable@vger.kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- sound/soc/codecs/sta32x.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/sound/soc/codecs/sta32x.c
-+++ b/sound/soc/codecs/sta32x.c
-@@ -879,6 +879,9 @@ static int sta32x_probe(struct snd_soc_c
- struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec);
- struct sta32x_platform_data *pdata = sta32x->pdata;
- int i, ret = 0, thermal = 0;
-+
-+ sta32x->component = component;
-+
- ret = regulator_bulk_enable(ARRAY_SIZE(sta32x->supplies),
- sta32x->supplies);
- if (ret != 0) {
+++ /dev/null
-From 721fb6fbfd2132164c2e8777cc837f9b2c1794dc Mon Sep 17 00:00:00 2001
-From: Jan Kara <jack@suse.cz>
-Date: Wed, 17 Oct 2018 13:07:05 +0200
-Subject: fsnotify: Fix busy inodes during unmount
-
-From: Jan Kara <jack@suse.cz>
-
-commit 721fb6fbfd2132164c2e8777cc837f9b2c1794dc upstream.
-
-Detaching of mark connector from fsnotify_put_mark() can race with
-unmounting of the filesystem like:
-
- CPU1 CPU2
-fsnotify_put_mark()
- spin_lock(&conn->lock);
- ...
- inode = fsnotify_detach_connector_from_object(conn)
- spin_unlock(&conn->lock);
- generic_shutdown_super()
- fsnotify_unmount_inodes()
- sees connector detached for inode
- -> nothing to do
- evict_inode()
- barfs on pending inode reference
- iput(inode);
-
-Resulting in "Busy inodes after unmount" message and possible kernel
-oops. Make fsnotify_unmount_inodes() properly wait for outstanding inode
-references from detached connectors.
-
-Note that the accounting of outstanding inode references in the
-superblock can cause some cacheline contention on the counter. OTOH it
-happens only during deletion of the last notification mark from an inode
-(or during unlinking of watched inode) and that is not too bad. I have
-measured time to create & delete inotify watch 100000 times from 64
-processes in parallel (each process having its own inotify group and its
-own file on a shared superblock) on a 64 CPU machine. Average and
-standard deviation of 15 runs look like:
-
- Avg Stddev
-Vanilla 9.817400 0.276165
-Fixed 9.710467 0.228294
-
-So there's no statistically significant difference.
-
-Fixes: 6b3f05d24d35 ("fsnotify: Detach mark from object list when last reference is dropped")
-CC: stable@vger.kernel.org
-Signed-off-by: Jan Kara <jack@suse.cz>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/notify/fsnotify.c | 3 +++
- fs/notify/mark.c | 39 +++++++++++++++++++++++++++++++--------
- include/linux/fs.h | 3 +++
- 3 files changed, 37 insertions(+), 8 deletions(-)
-
---- a/fs/notify/fsnotify.c
-+++ b/fs/notify/fsnotify.c
-@@ -96,6 +96,9 @@ void fsnotify_unmount_inodes(struct supe
-
- if (iput_inode)
- iput(iput_inode);
-+ /* Wait for outstanding inode references from connectors */
-+ wait_var_event(&sb->s_fsnotify_inode_refs,
-+ !atomic_long_read(&sb->s_fsnotify_inode_refs));
- }
-
- /*
---- a/fs/notify/mark.c
-+++ b/fs/notify/mark.c
-@@ -161,15 +161,18 @@ static void fsnotify_connector_destroy_w
- }
- }
-
--static struct inode *fsnotify_detach_connector_from_object(
-- struct fsnotify_mark_connector *conn)
-+static void *fsnotify_detach_connector_from_object(
-+ struct fsnotify_mark_connector *conn,
-+ unsigned int *type)
- {
- struct inode *inode = NULL;
-
-+ *type = conn->type;
- if (conn->flags & FSNOTIFY_OBJ_TYPE_INODE) {
- inode = conn->inode;
- rcu_assign_pointer(inode->i_fsnotify_marks, NULL);
- inode->i_fsnotify_mask = 0;
-+ atomic_long_inc(&inode->i_sb->s_fsnotify_inode_refs);
- conn->inode = NULL;
- conn->flags &= ~FSNOTIFY_OBJ_TYPE_INODE;
- } else if (conn->flags & FSNOTIFY_OBJ_TYPE_VFSMOUNT) {
-@@ -193,10 +196,29 @@ static void fsnotify_final_mark_destroy(
- fsnotify_put_group(group);
- }
-
-+/* Drop object reference originally held by a connector */
-+static void fsnotify_drop_object(unsigned int type, void *objp)
-+{
-+ struct inode *inode;
-+ struct super_block *sb;
-+
-+ if (!objp)
-+ return;
-+ /* Currently only inode references are passed to be dropped */
-+ if (WARN_ON_ONCE(type != FSNOTIFY_OBJ_TYPE_INODE))
-+ return;
-+ inode = objp;
-+ sb = inode->i_sb;
-+ iput(inode);
-+ if (atomic_long_dec_and_test(&sb->s_fsnotify_inode_refs))
-+ wake_up_var(&sb->s_fsnotify_inode_refs);
-+}
-+
- void fsnotify_put_mark(struct fsnotify_mark *mark)
- {
- struct fsnotify_mark_connector *conn;
-- struct inode *inode = NULL;
-+ void *objp = NULL;
-+ unsigned int type = FSNOTIFY_OBJ_TYPE_DETACHED;
- bool free_conn = false;
-
- /* Catch marks that were actually never attached to object */
-@@ -216,7 +238,7 @@ void fsnotify_put_mark(struct fsnotify_m
- conn = mark->connector;
- hlist_del_init_rcu(&mark->obj_list);
- if (hlist_empty(&conn->list)) {
-- inode = fsnotify_detach_connector_from_object(conn);
-+ objp = fsnotify_detach_connector_from_object(conn, &type);
- free_conn = true;
- } else {
- __fsnotify_recalc_mask(conn);
-@@ -224,7 +246,7 @@ void fsnotify_put_mark(struct fsnotify_m
- mark->connector = NULL;
- spin_unlock(&conn->lock);
-
-- iput(inode);
-+ fsnotify_drop_object(type, objp);
-
- if (free_conn) {
- spin_lock(&destroy_lock);
-@@ -694,7 +716,8 @@ void fsnotify_destroy_marks(struct fsnot
- {
- struct fsnotify_mark_connector *conn;
- struct fsnotify_mark *mark, *old_mark = NULL;
-- struct inode *inode;
-+ void *objp;
-+ unsigned int type;
-
- conn = fsnotify_grab_connector(connp);
- if (!conn)
-@@ -720,11 +743,11 @@ void fsnotify_destroy_marks(struct fsnot
- * mark references get dropped. It would lead to strange results such
- * as delaying inode deletion or blocking unmount.
- */
-- inode = fsnotify_detach_connector_from_object(conn);
-+ objp = fsnotify_detach_connector_from_object(conn, &type);
- spin_unlock(&conn->lock);
- if (old_mark)
- fsnotify_put_mark(old_mark);
-- iput(inode);
-+ fsnotify_drop_object(type, objp);
- }
-
- /*
---- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -1406,6 +1406,9 @@ struct super_block {
- /* Number of inodes with nlink == 0 but still referenced */
- atomic_long_t s_remove_count;
-
-+ /* Pending fsnotify inode refs */
-+ atomic_long_t s_fsnotify_inode_refs;
-+
- /* Being remounted read-only */
- int s_readonly_remount;
-
+++ /dev/null
-From ef739b2175dde9c05594f768cb78149f1ce2ac36 Mon Sep 17 00:00:00 2001
-From: Chuck Lever <chuck.lever@oracle.com>
-Date: Mon, 1 Oct 2018 14:25:14 -0400
-Subject: xprtrdma: Reset credit grant properly after a disconnect
-
-From: Chuck Lever <chuck.lever@oracle.com>
-
-commit ef739b2175dde9c05594f768cb78149f1ce2ac36 upstream.
-
-On a fresh connection, an RPC/RDMA client is supposed to send only
-one RPC Call until it gets a credit grant in the first RPC Reply
-from the server [RFC 8166, Section 3.3.3].
-
-There is a bug in the Linux client's credit accounting mechanism
-introduced by commit e7ce710a8802 ("xprtrdma: Avoid deadlock when
-credit window is reset"). On connect, it simply dumps all pending
-RPC Calls onto the new connection.
-
-Servers have been tolerant of this bad behavior. Currently no server
-implementation ever changes its credit grant over reconnects, and
-servers always repost enough Receives before connections are fully
-established.
-
-To correct this issue, ensure that the client resets both the credit
-grant _and_ the congestion window when handling a reconnect.
-
-Fixes: e7ce710a8802 ("xprtrdma: Avoid deadlock when credit ... ")
-Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
-Cc: stable@kernel.org
-Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 1 +
- net/sunrpc/xprtrdma/transport.c | 6 ++++++
- 2 files changed, 7 insertions(+)
-
---- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
-+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
-@@ -263,6 +263,7 @@ static void
- xprt_rdma_bc_close(struct rpc_xprt *xprt)
- {
- dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
-+ xprt->cwnd = RPC_CWNDSHIFT;
- }
-
- static void
---- a/net/sunrpc/xprtrdma/transport.c
-+++ b/net/sunrpc/xprtrdma/transport.c
-@@ -484,6 +484,12 @@ xprt_rdma_close(struct rpc_xprt *xprt)
- xprt->reestablish_timeout = 0;
- xprt_disconnect_done(xprt);
- rpcrdma_ep_disconnect(ep, ia);
-+
-+ /* Prepare @xprt for the next connection by reinitializing
-+ * its credit grant to one (see RFC 8166, Section 3.3.3).
-+ */
-+ r_xprt->rx_buf.rb_credits = 1;
-+ xprt->cwnd = RPC_CWNDSHIFT;
- }
-
- static void
projects / thirdparty / kernel / stable-queue.git / commitdiff
