From: Greg Kroah-Hartman Date: Thu, 29 Mar 2012 16:03:25 +0000 (-0700) Subject: 3.2-stable patches X-Git-Tag: v3.0.27~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=36049eb95c81cf8780799bb1b3621916153feac7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.2-stable patches added patches: backlight-fix-typo-in-tosa_lcd.c.patch bluetooth-btusb-fix-binterval-for-high-super-speed-isochronous-endpoints.patch module-remove-module-size-limit.patch nfsv4.1-fix-layoutcommit-error-handling.patch nfsv4-fix-two-infinite-loops-in-the-mount-code.patch slub-do-not-hold-slub_lock-when-calling-sysfs_slab_add.patch xfs-fix-oops-on-io-error-during-xlog_recover_process_iunlinks.patch --- diff --git a/queue-3.2/backlight-fix-typo-in-tosa_lcd.c.patch b/queue-3.2/backlight-fix-typo-in-tosa_lcd.c.patch new file mode 100644 index 00000000000..34df7847504 --- /dev/null +++ b/queue-3.2/backlight-fix-typo-in-tosa_lcd.c.patch @@ -0,0 +1,32 @@ +From 8da00edc1069f01c34510fa405dc15d96c090a3f Mon Sep 17 00:00:00 2001 +From: Masanari Iida +Date: Wed, 28 Mar 2012 14:42:56 -0700 +Subject: backlight: fix typo in tosa_lcd.c + +From: Masanari Iida + +commit 8da00edc1069f01c34510fa405dc15d96c090a3f upstream. + +Fix typo in drivers/video/backlight/tosa_lcd.c +"tosa_lcd_reume" should be "tosa_lcd_resume". + +Signed-off-by: Masanari Iida +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/backlight/tosa_lcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/backlight/tosa_lcd.c ++++ b/drivers/video/backlight/tosa_lcd.c +@@ -271,7 +271,7 @@ static int tosa_lcd_resume(struct spi_de + } + #else + #define tosa_lcd_suspend NULL +-#define tosa_lcd_reume NULL ++#define tosa_lcd_resume NULL + #endif + + static struct spi_driver tosa_lcd_driver = { diff --git a/queue-3.2/bluetooth-btusb-fix-binterval-for-high-super-speed-isochronous-endpoints.patch b/queue-3.2/bluetooth-btusb-fix-binterval-for-high-super-speed-isochronous-endpoints.patch new file mode 100644 index 00000000000..a6d9bdbab72 --- /dev/null +++ b/queue-3.2/bluetooth-btusb-fix-binterval-for-high-super-speed-isochronous-endpoints.patch @@ -0,0 +1,44 @@ +From fa0fb93f2ac308a76fa64eb57c18511dadf97089 Mon Sep 17 00:00:00 2001 +From: Bing Zhao +Date: Tue, 20 Dec 2011 18:19:00 -0800 +Subject: Bluetooth: btusb: fix bInterval for high/super speed isochronous endpoints + +From: Bing Zhao + +commit fa0fb93f2ac308a76fa64eb57c18511dadf97089 upstream. + +For high-speed/super-speed isochronous endpoints, the bInterval +value is used as exponent, 2^(bInterval-1). Luckily we have +usb_fill_int_urb() function that handles it correctly. So we just +call this function to fill in the RX URB. + +Cc: Marcel Holtmann +Signed-off-by: Bing Zhao +Acked-by: Marcel Holtmann +Signed-off-by: Gustavo F. Padovan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -507,15 +507,10 @@ static int btusb_submit_isoc_urb(struct + + pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); + +- urb->dev = data->udev; +- urb->pipe = pipe; +- urb->context = hdev; +- urb->complete = btusb_isoc_complete; +- urb->interval = data->isoc_rx_ep->bInterval; ++ usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, ++ hdev, data->isoc_rx_ep->bInterval); + + urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; +- urb->transfer_buffer = buf; +- urb->transfer_buffer_length = size; + + __fill_isoc_descriptor(urb, size, + le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); diff --git a/queue-3.2/module-remove-module-size-limit.patch b/queue-3.2/module-remove-module-size-limit.patch new file mode 100644 index 00000000000..d583a416ecd --- /dev/null +++ b/queue-3.2/module-remove-module-size-limit.patch @@ -0,0 +1,36 @@ +From f946eeb9313ff1470758e171a60fe7438a2ded3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2012 23:07:22 -0500 +Subject: module: Remove module size limit + +From: Sasha Levin + +commit f946eeb9313ff1470758e171a60fe7438a2ded3f upstream. + +Module size was limited to 64MB, this was legacy limitation due to vmalloc() +which was removed a while ago. + +Limiting module size to 64MB is both pointless and affects real world use +cases. + +Cc: Tim Abbott +Signed-off-by: Sasha Levin +Signed-off-by: Rusty Russell +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/module.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -2341,8 +2341,7 @@ static int copy_and_check(struct load_in + return -ENOEXEC; + + /* Suck in entire file: we'll want most of it. */ +- /* vmalloc barfs on "unusual" numbers. Check here */ +- if (len > 64 * 1024 * 1024 || (hdr = vmalloc(len)) == NULL) ++ if ((hdr = vmalloc(len)) == NULL) + return -ENOMEM; + + if (copy_from_user(hdr, umod, len) != 0) { diff --git a/queue-3.2/nfsv4-fix-two-infinite-loops-in-the-mount-code.patch b/queue-3.2/nfsv4-fix-two-infinite-loops-in-the-mount-code.patch new file mode 100644 index 00000000000..7e975f25202 --- /dev/null +++ b/queue-3.2/nfsv4-fix-two-infinite-loops-in-the-mount-code.patch @@ -0,0 +1,52 @@ +From 05e9cfb408b24debb3a85fd98edbfd09dd148881 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 27 Mar 2012 18:13:02 -0400 +Subject: NFSv4: Fix two infinite loops in the mount code + +From: Trond Myklebust + +commit 05e9cfb408b24debb3a85fd98edbfd09dd148881 upstream. + +We can currently loop forever in nfs4_lookup_root() and in +nfs41_proc_secinfo_no_name(), if the first iteration returns a +NFS4ERR_DELAY or something else that causes exception.retry to get +set. + +Reported-by: Weston Andros Adamson +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2242,11 +2242,12 @@ static int nfs4_lookup_root(struct nfs_s + switch (err) { + case 0: + case -NFS4ERR_WRONGSEC: +- break; ++ goto out; + default: + err = nfs4_handle_exception(server, err, &exception); + } + } while (exception.retry); ++out: + return err; + } + +@@ -6099,11 +6100,12 @@ nfs41_proc_secinfo_no_name(struct nfs_se + case 0: + case -NFS4ERR_WRONGSEC: + case -NFS4ERR_NOTSUPP: +- break; ++ goto out; + default: + err = nfs4_handle_exception(server, err, &exception); + } + } while (exception.retry); ++out: + return err; + } + diff --git a/queue-3.2/nfsv4.1-fix-layoutcommit-error-handling.patch b/queue-3.2/nfsv4.1-fix-layoutcommit-error-handling.patch new file mode 100644 index 00000000000..547a1e790aa --- /dev/null +++ b/queue-3.2/nfsv4.1-fix-layoutcommit-error-handling.patch @@ -0,0 +1,59 @@ +From e59d27e05a6435f8c04d5ad843f37fa795f2eaaa Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 27 Mar 2012 18:22:19 -0400 +Subject: NFSv4.1: Fix layoutcommit error handling + +From: Trond Myklebust + +commit e59d27e05a6435f8c04d5ad843f37fa795f2eaaa upstream. + +Firstly, task->tk_status will always return negative error values, +so the current tests for 'NFS4ERR_DELEG_REVOKED' etc. are all being +ignored. +Secondly, clean up the code so that we only need to test +task->tk_status once! + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5983,21 +5983,22 @@ nfs4_layoutcommit_done(struct rpc_task * + return; + + switch (task->tk_status) { /* Just ignore these failures */ +- case NFS4ERR_DELEG_REVOKED: /* layout was recalled */ +- case NFS4ERR_BADIOMODE: /* no IOMODE_RW layout for range */ +- case NFS4ERR_BADLAYOUT: /* no layout */ +- case NFS4ERR_GRACE: /* loca_recalim always false */ ++ case -NFS4ERR_DELEG_REVOKED: /* layout was recalled */ ++ case -NFS4ERR_BADIOMODE: /* no IOMODE_RW layout for range */ ++ case -NFS4ERR_BADLAYOUT: /* no layout */ ++ case -NFS4ERR_GRACE: /* loca_recalim always false */ + task->tk_status = 0; +- } +- +- if (nfs4_async_handle_error(task, server, NULL) == -EAGAIN) { +- rpc_restart_call_prepare(task); +- return; +- } +- +- if (task->tk_status == 0) ++ break; ++ case 0: + nfs_post_op_update_inode_force_wcc(data->args.inode, + data->res.fattr); ++ break; ++ default: ++ if (nfs4_async_handle_error(task, server, NULL) == -EAGAIN) { ++ rpc_restart_call_prepare(task); ++ return; ++ } ++ } + } + + static void nfs4_layoutcommit_release(void *calldata) diff --git a/queue-3.2/series b/queue-3.2/series index a59dfaebcc6..66bebc52e9c 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -124,3 +124,10 @@ dm-crypt-add-missing-error-handling.patch dm-exception-store-fix-init-error-path.patch dm-persistent-data-fix-btree-rebalancing-after-remove.patch dm-thin-fix-stacked-bi_next-usage.patch +backlight-fix-typo-in-tosa_lcd.c.patch +xfs-fix-oops-on-io-error-during-xlog_recover_process_iunlinks.patch +slub-do-not-hold-slub_lock-when-calling-sysfs_slab_add.patch +nfsv4-fix-two-infinite-loops-in-the-mount-code.patch +nfsv4.1-fix-layoutcommit-error-handling.patch +module-remove-module-size-limit.patch +bluetooth-btusb-fix-binterval-for-high-super-speed-isochronous-endpoints.patch diff --git a/queue-3.2/slub-do-not-hold-slub_lock-when-calling-sysfs_slab_add.patch b/queue-3.2/slub-do-not-hold-slub_lock-when-calling-sysfs_slab_add.patch new file mode 100644 index 00000000000..4d0c4819ba9 --- /dev/null +++ b/queue-3.2/slub-do-not-hold-slub_lock-when-calling-sysfs_slab_add.patch @@ -0,0 +1,48 @@ +From 66c4c35c6bc5a1a452b024cf0364635b28fd94e4 Mon Sep 17 00:00:00 2001 +From: Christoph Lameter +Date: Tue, 17 Jan 2012 09:27:31 -0600 +Subject: slub: Do not hold slub_lock when calling sysfs_slab_add() + +From: Christoph Lameter + +commit 66c4c35c6bc5a1a452b024cf0364635b28fd94e4 upstream. + +sysfs_slab_add() calls various sysfs functions that actually may +end up in userspace doing all sorts of things. + +Release the slub_lock after adding the kmem_cache structure to the list. +At that point the address of the kmem_cache is not known so we are +guaranteed exlusive access to the following modifications to the +kmem_cache structure. + +If the sysfs_slab_add fails then reacquire the slub_lock to +remove the kmem_cache structure from the list. + +Reported-by: Sasha Levin +Acked-by: Eric Dumazet +Signed-off-by: Christoph Lameter +Signed-off-by: Pekka Enberg +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slub.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -3911,13 +3911,14 @@ struct kmem_cache *kmem_cache_create(con + if (kmem_cache_open(s, n, + size, align, flags, ctor)) { + list_add(&s->list, &slab_caches); ++ up_write(&slub_lock); + if (sysfs_slab_add(s)) { ++ down_write(&slub_lock); + list_del(&s->list); + kfree(n); + kfree(s); + goto err; + } +- up_write(&slub_lock); + return s; + } + kfree(n); diff --git a/queue-3.2/xfs-fix-oops-on-io-error-during-xlog_recover_process_iunlinks.patch b/queue-3.2/xfs-fix-oops-on-io-error-during-xlog_recover_process_iunlinks.patch new file mode 100644 index 00000000000..10fc0840584 --- /dev/null +++ b/queue-3.2/xfs-fix-oops-on-io-error-during-xlog_recover_process_iunlinks.patch @@ -0,0 +1,81 @@ +From d97d32edcd732110758799ae60af725e5110b3dc Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 15 Mar 2012 09:34:02 +0000 +Subject: xfs: Fix oops on IO error during xlog_recover_process_iunlinks() + +From: Jan Kara + +commit d97d32edcd732110758799ae60af725e5110b3dc upstream. + +When an IO error happens during inode deletion run from +xlog_recover_process_iunlinks() filesystem gets shutdown. Thus any subsequent +attempt to read buffers fails. Code in xlog_recover_process_iunlinks() does not +count with the fact that read of a buffer which was read a while ago can +really fail which results in the oops on + agi = XFS_BUF_TO_AGI(agibp); + +Fix the problem by cleaning up the buffer handling in +xlog_recover_process_iunlinks() as suggested by Dave Chinner. We release buffer +lock but keep buffer reference to AG buffer. That is enough for buffer to stay +pinned in memory and we don't have to call xfs_read_agi() all the time. + +Signed-off-by: Jan Kara +Reviewed-by: Dave Chinner +Signed-off-by: Ben Myers +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_log_recover.c | 33 +++++++++++---------------------- + 1 file changed, 11 insertions(+), 22 deletions(-) + +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -3161,37 +3161,26 @@ xlog_recover_process_iunlinks( + */ + continue; + } ++ /* ++ * Unlock the buffer so that it can be acquired in the normal ++ * course of the transaction to truncate and free each inode. ++ * Because we are not racing with anyone else here for the AGI ++ * buffer, we don't even need to hold it locked to read the ++ * initial unlinked bucket entries out of the buffer. We keep ++ * buffer reference though, so that it stays pinned in memory ++ * while we need the buffer. ++ */ + agi = XFS_BUF_TO_AGI(agibp); ++ xfs_buf_unlock(agibp); + + for (bucket = 0; bucket < XFS_AGI_UNLINKED_BUCKETS; bucket++) { + agino = be32_to_cpu(agi->agi_unlinked[bucket]); + while (agino != NULLAGINO) { +- /* +- * Release the agi buffer so that it can +- * be acquired in the normal course of the +- * transaction to truncate and free the inode. +- */ +- xfs_buf_relse(agibp); +- + agino = xlog_recover_process_one_iunlink(mp, + agno, agino, bucket); +- +- /* +- * Reacquire the agibuffer and continue around +- * the loop. This should never fail as we know +- * the buffer was good earlier on. +- */ +- error = xfs_read_agi(mp, NULL, agno, &agibp); +- ASSERT(error == 0); +- agi = XFS_BUF_TO_AGI(agibp); + } + } +- +- /* +- * Release the buffer for the current agi so we can +- * go on to the next one. +- */ +- xfs_buf_relse(agibp); ++ xfs_buf_rele(agibp); + } + + mp->m_dmevmask = mp_dmevmask;