From: Greg Kroah-Hartman Date: Sat, 26 Sep 2015 03:48:27 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v4.1.9~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=02783f6cbea8d3e39f42ece9dcdada72277bd19e;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: btrfs-check-if-previous-transaction-aborted-to-avoid-fs-corruption.patch nfsv4-don-t-set-setattr-for-o_rdonly-o_excl.patch rc-core-fix-remove-uevent-generation.patch v4l-omap3isp-fix-sub-device-power-management-code.patch --- diff --git a/queue-3.14/btrfs-check-if-previous-transaction-aborted-to-avoid-fs-corruption.patch b/queue-3.14/btrfs-check-if-previous-transaction-aborted-to-avoid-fs-corruption.patch new file mode 100644 index 00000000000..c6a9e290b50 --- /dev/null +++ b/queue-3.14/btrfs-check-if-previous-transaction-aborted-to-avoid-fs-corruption.patch @@ -0,0 +1,108 @@ +From 1f9b8c8fbc9a4d029760b16f477b9d15500e3a34 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Wed, 12 Aug 2015 11:54:35 +0100 +Subject: Btrfs: check if previous transaction aborted to avoid fs corruption + +From: Filipe Manana + +commit 1f9b8c8fbc9a4d029760b16f477b9d15500e3a34 upstream. + +While we are committing a transaction, it's possible the previous one is +still finishing its commit and therefore we wait for it to finish first. +However we were not checking if that previous transaction ended up getting +aborted after we waited for it to commit, so we ended up committing the +current transaction which can lead to fs corruption because the new +superblock can point to trees that have had one or more nodes/leafs that +were never durably persisted. +The following sequence diagram exemplifies how this is possible: + + CPU 0 CPU 1 + + transaction N starts + + (...) + + btrfs_commit_transaction(N) + + cur_trans->state = TRANS_STATE_COMMIT_START; + (...) + cur_trans->state = TRANS_STATE_COMMIT_DOING; + (...) + + cur_trans->state = TRANS_STATE_UNBLOCKED; + root->fs_info->running_transaction = NULL; + + btrfs_start_transaction() + --> starts transaction N + 1 + + btrfs_write_and_wait_transaction(trans, root); + --> starts writing all new or COWed ebs created + at transaction N + + creates some new ebs, COWs some + existing ebs but doesn't COW or + deletes eb X + + btrfs_commit_transaction(N + 1) + (...) + cur_trans->state = TRANS_STATE_COMMIT_START; + (...) + wait_for_commit(root, prev_trans); + --> prev_trans == transaction N + + btrfs_write_and_wait_transaction() continues + writing ebs + --> fails writing eb X, we abort transaction N + and set bit BTRFS_FS_STATE_ERROR on + fs_info->fs_state, so no new transactions + can start after setting that bit + + cleanup_transaction() + btrfs_cleanup_one_transaction() + wakes up task at CPU 1 + + continues, doesn't abort because + cur_trans->aborted (transaction N + 1) + is zero, and no checks for bit + BTRFS_FS_STATE_ERROR in fs_info->fs_state + are made + + btrfs_write_and_wait_transaction(trans, root); + --> succeeds, no errors during writeback + + write_ctree_super(trans, root, 0); + --> succeeds + --> we have now a superblock that points us + to some root that uses eb X, which was + never written to disk + +In this scenario future attempts to read eb X from disk results in an +error message like "parent transid verify failed on X wanted Y found Z". + +So fix this by aborting the current transaction if after waiting for the +previous transaction we verify that it was aborted. + +Signed-off-by: Filipe Manana +Reviewed-by: Josef Bacik +Reviewed-by: Liu Bo +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/transaction.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1710,8 +1710,11 @@ int btrfs_commit_transaction(struct btrf + spin_unlock(&root->fs_info->trans_lock); + + wait_for_commit(root, prev_trans); ++ ret = prev_trans->aborted; + + btrfs_put_transaction(prev_trans); ++ if (ret) ++ goto cleanup_transaction; + } else { + spin_unlock(&root->fs_info->trans_lock); + } diff --git a/queue-3.14/nfsv4-don-t-set-setattr-for-o_rdonly-o_excl.patch b/queue-3.14/nfsv4-don-t-set-setattr-for-o_rdonly-o_excl.patch new file mode 100644 index 00000000000..51ca066fedb --- /dev/null +++ b/queue-3.14/nfsv4-don-t-set-setattr-for-o_rdonly-o_excl.patch @@ -0,0 +1,50 @@ +From efcbc04e16dfa95fef76309f89710dd1d99a5453 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 30 Jul 2015 13:00:56 +1000 +Subject: NFSv4: don't set SETATTR for O_RDONLY|O_EXCL + +From: NeilBrown + +commit efcbc04e16dfa95fef76309f89710dd1d99a5453 upstream. + +It is unusual to combine the open flags O_RDONLY and O_EXCL, but +it appears that libre-office does just that. + +[pid 3250] stat("/home/USER/.config", {st_mode=S_IFDIR|0700, st_size=8192, ...}) = 0 +[pid 3250] open("/home/USER/.config/libreoffice/4-suse/user/extensions/buildid", O_RDONLY|O_EXCL + +NFSv4 takes O_EXCL as a sign that a setattr command should be sent, +probably to reset the timestamps. + +When it was an O_RDONLY open, the SETATTR command does not +identify any actual attributes to change. +If no delegation was provided to the open, the SETATTR uses the +all-zeros stateid and the request is accepted (at least by the +Linux NFS server - no harm, no foul). + +If a read-delegation was provided, this is used in the SETATTR +request, and a Netapp filer will justifiably claim +NFS4ERR_BAD_STATEID, which the Linux client takes as a sign +to retry - indefinitely. + +So only treat O_EXCL specially if O_CREAT was also given. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2275,7 +2275,7 @@ static int _nfs4_do_open(struct inode *d + goto err_free_label; + state = ctx->state; + +- if ((opendata->o_arg.open_flags & O_EXCL) && ++ if ((opendata->o_arg.open_flags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL) && + (opendata->o_arg.createmode != NFS4_CREATE_GUARDED)) { + nfs4_exclusive_attrset(opendata, sattr); + diff --git a/queue-3.14/rc-core-fix-remove-uevent-generation.patch b/queue-3.14/rc-core-fix-remove-uevent-generation.patch new file mode 100644 index 00000000000..ecf2cd8b15c --- /dev/null +++ b/queue-3.14/rc-core-fix-remove-uevent-generation.patch @@ -0,0 +1,36 @@ +From a66b0c41ad277ae62a3ae6ac430a71882f899557 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?David=20H=C3=A4rdeman?= +Date: Tue, 19 May 2015 19:03:12 -0300 +Subject: [media] rc-core: fix remove uevent generation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?David=20H=C3=A4rdeman?= + +commit a66b0c41ad277ae62a3ae6ac430a71882f899557 upstream. + +The input_dev is already gone when the rc device is being unregistered +so checking for its presence only means that no remove uevent will be +generated. + +Signed-off-by: David Härdeman +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/rc/rc-main.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -982,9 +982,6 @@ static int rc_dev_uevent(struct device * + { + struct rc_dev *dev = to_rc_dev(device); + +- if (!dev || !dev->input_dev) +- return -ENODEV; +- + if (dev->rc_map.name) + ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name); + if (dev->driver_name) diff --git a/queue-3.14/series b/queue-3.14/series index a39110d6673..011487c2015 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -19,3 +19,7 @@ cifs-fix-type-confusion-in-copy-offload-ioctl.patch add-radeon-suspend-resume-quirk-for-hp-compaq-dc5750.patch mm-check-if-section-present-during-memory-block-registering.patch x86-mm-initialize-pmd_idx-in-page_table_range_init_count.patch +rc-core-fix-remove-uevent-generation.patch +v4l-omap3isp-fix-sub-device-power-management-code.patch +btrfs-check-if-previous-transaction-aborted-to-avoid-fs-corruption.patch +nfsv4-don-t-set-setattr-for-o_rdonly-o_excl.patch diff --git a/queue-3.14/v4l-omap3isp-fix-sub-device-power-management-code.patch b/queue-3.14/v4l-omap3isp-fix-sub-device-power-management-code.patch new file mode 100644 index 00000000000..4b0d1b913bc --- /dev/null +++ b/queue-3.14/v4l-omap3isp-fix-sub-device-power-management-code.patch @@ -0,0 +1,46 @@ +From 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Fri, 12 Jun 2015 20:06:23 -0300 +Subject: [media] v4l: omap3isp: Fix sub-device power management code + +From: Sakari Ailus + +commit 9d39f05490115bf145e5ea03c0b7ec9d3d015b01 upstream. + +Commit 813f5c0ac5cc ("media: Change media device link_notify behaviour") +modified the media controller link setup notification API and updated the +OMAP3 ISP driver accordingly. As a side effect it introduced a bug by +turning power on after setting the link instead of before. This results in +sub-devices not being powered down in some cases when they should be. Fix +it. + +Fixes: 813f5c0ac5cc [media] media: Change media device link_notify behaviour + +Signed-off-by: Sakari Ailus +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/omap3isp/isp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -824,14 +824,14 @@ static int isp_pipeline_link_notify(stru + int ret; + + if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH && +- !(link->flags & MEDIA_LNK_FL_ENABLED)) { ++ !(flags & MEDIA_LNK_FL_ENABLED)) { + /* Powering off entities is assumed to never fail. */ + isp_pipeline_pm_power(source, -sink_use); + isp_pipeline_pm_power(sink, -source_use); + return 0; + } + +- if (notification == MEDIA_DEV_NOTIFY_POST_LINK_CH && ++ if (notification == MEDIA_DEV_NOTIFY_PRE_LINK_CH && + (flags & MEDIA_LNK_FL_ENABLED)) { + + ret = isp_pipeline_pm_power(source, sink_use);