From: Greg Kroah-Hartman Date: Wed, 23 Jul 2014 00:20:32 +0000 (-0700) Subject: 3.15-stable patches X-Git-Tag: v3.4.100~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d596cfda298df4cf2f7a711b49e1e514127dc0c7;p=thirdparty%2Fkernel%2Fstable-queue.git 3.15-stable patches added patches: alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch alsa-hda-revert-stream-assignment-order-for-intel-controllers.patch bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch drivers-hv-hv_fcopy-fix-a-race-condition-for-smp-guest.patch drivers-hv-util-fix-a-bug-in-the-kvp-code.patch fuse-avoid-scheduling-while-atomic.patch fuse-handle-large-user-and-group-id.patch fuse-ignore-entry-timeout-on-lookup_reval.patch fuse-timeout-comparison-fix.patch revert-bluetooth-add-a-new-pid-vid-0cf3-e005-for-ar3012.patch --- diff --git a/queue-3.15/alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch b/queue-3.15/alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch new file mode 100644 index 00000000000..0a3f7ba8162 --- /dev/null +++ b/queue-3.15/alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch @@ -0,0 +1,75 @@ +From 4da63c6fc426023d1a20e45508c47d7d68c6a53d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Jul 2014 15:19:43 +0200 +Subject: ALSA: hda - Fix broken PM due to incomplete i915 initialization + +From: Takashi Iwai + +commit 4da63c6fc426023d1a20e45508c47d7d68c6a53d upstream. + +When the initialization of Intel HDMI controller fails due to missing +i915 kernel symbols (e.g. HD-audio is built in while i915 is module), +the driver discontinues the probe. However, since the probe was done +asynchronously, the driver object still remains, thus the relevant PM +ops are still called at suspend/resume. This results in the bad access +to the incomplete audio card object, eventually leads to Oops or stall +at PM. + +This patch adds the missing checks of chip->init_failed flag at each +PM callback in order to fix the problem above. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79561 +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -590,7 +590,7 @@ static int azx_suspend(struct device *de + struct azx *chip = card->private_data; + struct azx_pcm *p; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); +@@ -622,7 +622,7 @@ static int azx_resume(struct device *dev + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) { +@@ -659,7 +659,7 @@ static int azx_runtime_suspend(struct de + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME)) +@@ -686,7 +686,7 @@ static int azx_runtime_resume(struct dev + struct hda_codec *codec; + int status; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME)) +@@ -723,7 +723,7 @@ static int azx_runtime_idle(struct devic + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!power_save_controller || diff --git a/queue-3.15/alsa-hda-revert-stream-assignment-order-for-intel-controllers.patch b/queue-3.15/alsa-hda-revert-stream-assignment-order-for-intel-controllers.patch new file mode 100644 index 00000000000..f0cdcfece11 --- /dev/null +++ b/queue-3.15/alsa-hda-revert-stream-assignment-order-for-intel-controllers.patch @@ -0,0 +1,64 @@ +From cd50065b3be83a705635550c04e368f2a4cc44d0 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 14 Jul 2014 10:45:31 +0200 +Subject: ALSA: hda - Revert stream assignment order for Intel controllers + +From: Takashi Iwai + +commit cd50065b3be83a705635550c04e368f2a4cc44d0 upstream. + +We got a regression report for 3.15.x kernels, and this turned out to +be triggered by the fix for stream assignment order. On reporter's +machine with Intel controller (8086:1e20) + VIA VT1802 codec, the +first playback slot can't work with speaker outputs. + +But the original commit was actually a fix for AMD controllers where +no proper GCAP value is returned, we shouldn't revert the whole +commit. Instead, in this patch, a new flag is introduced to determine +the stream assignment order, and follow the old behavior for Intel +controllers. + +Fixes: dcb32ecd9a53 ('ALSA: hda - Do not assign streams in reverse order') +Reported-and-tested-by: Steven Newbury +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_controller.c | 3 ++- + sound/pci/hda/hda_intel.c | 2 +- + sound/pci/hda/hda_priv.h | 1 + + 3 files changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -193,7 +193,8 @@ azx_assign_device(struct azx *chip, stru + dsp_unlock(azx_dev); + return azx_dev; + } +- if (!res) ++ if (!res || ++ (chip->driver_caps & AZX_DCAPS_REVERSE_ASSIGN)) + res = azx_dev; + } + dsp_unlock(azx_dev); +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -227,7 +227,7 @@ enum { + /* quirks for Intel PCH */ + #define AZX_DCAPS_INTEL_PCH_NOPM \ + (AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_BUFSIZE | \ +- AZX_DCAPS_COUNT_LPIB_DELAY) ++ AZX_DCAPS_COUNT_LPIB_DELAY | AZX_DCAPS_REVERSE_ASSIGN) + + #define AZX_DCAPS_INTEL_PCH \ + (AZX_DCAPS_INTEL_PCH_NOPM | AZX_DCAPS_PM_RUNTIME) +--- a/sound/pci/hda/hda_priv.h ++++ b/sound/pci/hda/hda_priv.h +@@ -186,6 +186,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO + #define AZX_DCAPS_BUFSIZE (1 << 21) /* no buffer size alignment */ + #define AZX_DCAPS_ALIGN_BUFSIZE (1 << 22) /* buffer size alignment */ + #define AZX_DCAPS_4K_BDLE_BOUNDARY (1 << 23) /* BDLE in 4k boundary */ ++#define AZX_DCAPS_REVERSE_ASSIGN (1 << 24) /* Assign devices in reverse order */ + #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25) /* Take LPIB as delay */ + #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */ + #define AZX_DCAPS_I915_POWERWELL (1 << 27) /* HSW i915 powerwell support */ diff --git a/queue-3.15/bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch b/queue-3.15/bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch new file mode 100644 index 00000000000..8b038982bd4 --- /dev/null +++ b/queue-3.15/bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch @@ -0,0 +1,31 @@ +From 48439d501e3d9e8634bdc0c418e066870039599d Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Mon, 23 Jun 2014 17:42:44 +0200 +Subject: Bluetooth: Ignore H5 non-link packets in non-active state + +From: Loic Poulain + +commit 48439d501e3d9e8634bdc0c418e066870039599d upstream. + +When detecting a non-link packet, h5_reset_rx() frees the Rx skb. +Not returning after that will cause the upcoming h5_rx_payload() +call to dereference a now NULL Rx skb and trigger a kernel oops. + +Signed-off-by: Loic Poulain +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/hci_h5.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -406,6 +406,7 @@ static int h5_rx_3wire_hdr(struct hci_ua + H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) { + BT_ERR("Non-link packet received in non-active state"); + h5_reset_rx(h5); ++ return 0; + } + + h5->rx_func = h5_rx_payload; diff --git a/queue-3.15/drivers-hv-hv_fcopy-fix-a-race-condition-for-smp-guest.patch b/queue-3.15/drivers-hv-hv_fcopy-fix-a-race-condition-for-smp-guest.patch new file mode 100644 index 00000000000..de27a19217d --- /dev/null +++ b/queue-3.15/drivers-hv-hv_fcopy-fix-a-race-condition-for-smp-guest.patch @@ -0,0 +1,43 @@ +From 2ef82d24f445e82f80e235f44eb9d1bc933e3670 Mon Sep 17 00:00:00 2001 +From: Dexuan Cui +Date: Wed, 16 Jul 2014 00:00:45 -0700 +Subject: Drivers: hv: hv_fcopy: fix a race condition for SMP guest + +From: Dexuan Cui + +commit 2ef82d24f445e82f80e235f44eb9d1bc933e3670 upstream. + +We should schedule the 5s "timer work" before starting the data transfer, +otherwise, the data transfer code may finish so fast on another +virtual cpu that when the code(fcopy_write()) trying to cancel the 5s +"timer work" can occasionally fail because the "timer work" may haven't +been scheduled yet and as a result the fcopy process will be aborted +wrongly by fcopy_work_func() in 5s. + +Thank Liz Zhang for the initial investigation +on the bug. + +This addresses https://bugzilla.redhat.com/show_bug.cgi?id=1118123 + +Tested-by: Liz Zhang +Cc: Haiyang Zhang +Signed-off-by: Dexuan Cui +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_fcopy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hv/hv_fcopy.c ++++ b/drivers/hv/hv_fcopy.c +@@ -246,8 +246,8 @@ void hv_fcopy_onchannelcallback(void *co + /* + * Send the information to the user-level daemon. + */ +- fcopy_send_data(); + schedule_delayed_work(&fcopy_work, 5*HZ); ++ fcopy_send_data(); + return; + } + icmsghdr->icflags = ICMSGHDRFLAG_TRANSACTION | ICMSGHDRFLAG_RESPONSE; diff --git a/queue-3.15/drivers-hv-util-fix-a-bug-in-the-kvp-code.patch b/queue-3.15/drivers-hv-util-fix-a-bug-in-the-kvp-code.patch new file mode 100644 index 00000000000..54e8351816a --- /dev/null +++ b/queue-3.15/drivers-hv-util-fix-a-bug-in-the-kvp-code.patch @@ -0,0 +1,76 @@ +From 9bd2d0dfe4714dd5d7c09a93a5c9ea9e14ceb3fc Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Mon, 7 Jul 2014 16:34:25 -0700 +Subject: Drivers: hv: util: Fix a bug in the KVP code + +From: "K. Y. Srinivasan" + +commit 9bd2d0dfe4714dd5d7c09a93a5c9ea9e14ceb3fc upstream. + +Add code to poll the channel since we process only one message +at a time and the host may not interrupt us. Also increase the +receive buffer size since some KVP messages are close to 8K bytes in size. + +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_kvp.c | 14 ++++++++++++-- + drivers/hv/hv_util.c | 2 +- + 2 files changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -127,6 +127,15 @@ kvp_work_func(struct work_struct *dummy) + kvp_respond_to_host(NULL, HV_E_FAIL); + } + ++static void poll_channel(struct vmbus_channel *channel) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&channel->inbound_lock, flags); ++ hv_kvp_onchannelcallback(channel); ++ spin_unlock_irqrestore(&channel->inbound_lock, flags); ++} ++ + static int kvp_handle_handshake(struct hv_kvp_msg *msg) + { + int ret = 1; +@@ -155,7 +164,7 @@ static int kvp_handle_handshake(struct h + kvp_register(dm_reg_value); + kvp_transaction.active = false; + if (kvp_transaction.kvp_context) +- hv_kvp_onchannelcallback(kvp_transaction.kvp_context); ++ poll_channel(kvp_transaction.kvp_context); + } + return ret; + } +@@ -568,6 +577,7 @@ response_done: + + vmbus_sendpacket(channel, recv_buffer, buf_len, req_id, + VM_PKT_DATA_INBAND, 0); ++ poll_channel(channel); + + } + +@@ -603,7 +613,7 @@ void hv_kvp_onchannelcallback(void *cont + return; + } + +- vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 2, &recvlen, ++ vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen, + &requestid); + + if (recvlen > 0) { +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -319,7 +319,7 @@ static int util_probe(struct hv_device * + (struct hv_util_service *)dev_id->driver_data; + int ret; + +- srv->recv_buffer = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); ++ srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL); + if (!srv->recv_buffer) + return -ENOMEM; + if (srv->util_init) { diff --git a/queue-3.15/fuse-avoid-scheduling-while-atomic.patch b/queue-3.15/fuse-avoid-scheduling-while-atomic.patch new file mode 100644 index 00000000000..da99af0d47f --- /dev/null +++ b/queue-3.15/fuse-avoid-scheduling-while-atomic.patch @@ -0,0 +1,162 @@ +From c55a01d360afafcd52bc405c044a6ebf5de436d5 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 7 Jul 2014 15:28:51 +0200 +Subject: fuse: avoid scheduling while atomic + +From: Miklos Szeredi + +commit c55a01d360afafcd52bc405c044a6ebf5de436d5 upstream. + +As reported by Richard Sharpe, an attempt to use fuse_notify_inval_entry() +triggers complains about scheduling while atomic: + + BUG: scheduling while atomic: fuse.hf/13976/0x10000001 + +This happens because fuse_notify_inval_entry() attempts to allocate memory +with GFP_KERNEL, holding "struct fuse_copy_state" mapped by kmap_atomic(). + +Introduced by commit 58bda1da4b3c "fuse/dev: use atomic maps" + +Fix by moving the map/unmap to just cover the actual memcpy operation. + +Original patch from Maxim Patlasov + +Reported-by: Richard Sharpe +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dev.c | 51 +++++++++++++++++++++++---------------------------- + 1 file changed, 23 insertions(+), 28 deletions(-) + +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -643,9 +643,8 @@ struct fuse_copy_state { + unsigned long seglen; + unsigned long addr; + struct page *pg; +- void *mapaddr; +- void *buf; + unsigned len; ++ unsigned offset; + unsigned move_pages:1; + }; + +@@ -666,23 +665,17 @@ static void fuse_copy_finish(struct fuse + if (cs->currbuf) { + struct pipe_buffer *buf = cs->currbuf; + +- if (!cs->write) { +- kunmap_atomic(cs->mapaddr); +- } else { +- kunmap_atomic(cs->mapaddr); ++ if (cs->write) + buf->len = PAGE_SIZE - cs->len; +- } + cs->currbuf = NULL; +- cs->mapaddr = NULL; +- } else if (cs->mapaddr) { +- kunmap_atomic(cs->mapaddr); ++ } else if (cs->pg) { + if (cs->write) { + flush_dcache_page(cs->pg); + set_page_dirty_lock(cs->pg); + } + put_page(cs->pg); +- cs->mapaddr = NULL; + } ++ cs->pg = NULL; + } + + /* +@@ -691,7 +684,7 @@ static void fuse_copy_finish(struct fuse + */ + static int fuse_copy_fill(struct fuse_copy_state *cs) + { +- unsigned long offset; ++ struct page *page; + int err; + + unlock_request(cs->fc, cs->req); +@@ -706,14 +699,12 @@ static int fuse_copy_fill(struct fuse_co + + BUG_ON(!cs->nr_segs); + cs->currbuf = buf; +- cs->mapaddr = kmap_atomic(buf->page); ++ cs->pg = buf->page; ++ cs->offset = buf->offset; + cs->len = buf->len; +- cs->buf = cs->mapaddr + buf->offset; + cs->pipebufs++; + cs->nr_segs--; + } else { +- struct page *page; +- + if (cs->nr_segs == cs->pipe->buffers) + return -EIO; + +@@ -726,8 +717,8 @@ static int fuse_copy_fill(struct fuse_co + buf->len = 0; + + cs->currbuf = buf; +- cs->mapaddr = kmap_atomic(page); +- cs->buf = cs->mapaddr; ++ cs->pg = page; ++ cs->offset = 0; + cs->len = PAGE_SIZE; + cs->pipebufs++; + cs->nr_segs++; +@@ -740,14 +731,13 @@ static int fuse_copy_fill(struct fuse_co + cs->iov++; + cs->nr_segs--; + } +- err = get_user_pages_fast(cs->addr, 1, cs->write, &cs->pg); ++ err = get_user_pages_fast(cs->addr, 1, cs->write, &page); + if (err < 0) + return err; + BUG_ON(err != 1); +- offset = cs->addr % PAGE_SIZE; +- cs->mapaddr = kmap_atomic(cs->pg); +- cs->buf = cs->mapaddr + offset; +- cs->len = min(PAGE_SIZE - offset, cs->seglen); ++ cs->pg = page; ++ cs->offset = cs->addr % PAGE_SIZE; ++ cs->len = min(PAGE_SIZE - cs->offset, cs->seglen); + cs->seglen -= cs->len; + cs->addr += cs->len; + } +@@ -760,15 +750,20 @@ static int fuse_copy_do(struct fuse_copy + { + unsigned ncpy = min(*size, cs->len); + if (val) { ++ void *pgaddr = kmap_atomic(cs->pg); ++ void *buf = pgaddr + cs->offset; ++ + if (cs->write) +- memcpy(cs->buf, *val, ncpy); ++ memcpy(buf, *val, ncpy); + else +- memcpy(*val, cs->buf, ncpy); ++ memcpy(*val, buf, ncpy); ++ ++ kunmap_atomic(pgaddr); + *val += ncpy; + } + *size -= ncpy; + cs->len -= ncpy; +- cs->buf += ncpy; ++ cs->offset += ncpy; + return ncpy; + } + +@@ -874,8 +869,8 @@ static int fuse_try_move_page(struct fus + out_fallback_unlock: + unlock_page(newpage); + out_fallback: +- cs->mapaddr = kmap_atomic(buf->page); +- cs->buf = cs->mapaddr + buf->offset; ++ cs->pg = buf->page; ++ cs->offset = buf->offset; + + err = lock_request(cs->fc, cs->req); + if (err) diff --git a/queue-3.15/fuse-handle-large-user-and-group-id.patch b/queue-3.15/fuse-handle-large-user-and-group-id.patch new file mode 100644 index 00000000000..4ec90b6ad5c --- /dev/null +++ b/queue-3.15/fuse-handle-large-user-and-group-id.patch @@ -0,0 +1,72 @@ +From 233a01fa9c4c7c41238537e8db8434667ff28a2f Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 7 Jul 2014 15:28:51 +0200 +Subject: fuse: handle large user and group ID + +From: Miklos Szeredi + +commit 233a01fa9c4c7c41238537e8db8434667ff28a2f upstream. + +If the number in "user_id=N" or "group_id=N" mount options was larger than +INT_MAX then fuse returned EINVAL. + +Fix this to handle all valid uid/gid values. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/inode.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -478,6 +478,17 @@ static const match_table_t tokens = { + {OPT_ERR, NULL} + }; + ++static int fuse_match_uint(substring_t *s, unsigned int *res) ++{ ++ int err = -ENOMEM; ++ char *buf = match_strdup(s); ++ if (buf) { ++ err = kstrtouint(buf, 10, res); ++ kfree(buf); ++ } ++ return err; ++} ++ + static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) + { + char *p; +@@ -488,6 +499,7 @@ static int parse_fuse_opt(char *opt, str + while ((p = strsep(&opt, ",")) != NULL) { + int token; + int value; ++ unsigned uv; + substring_t args[MAX_OPT_ARGS]; + if (!*p) + continue; +@@ -511,18 +523,18 @@ static int parse_fuse_opt(char *opt, str + break; + + case OPT_USER_ID: +- if (match_int(&args[0], &value)) ++ if (fuse_match_uint(&args[0], &uv)) + return 0; +- d->user_id = make_kuid(current_user_ns(), value); ++ d->user_id = make_kuid(current_user_ns(), uv); + if (!uid_valid(d->user_id)) + return 0; + d->user_id_present = 1; + break; + + case OPT_GROUP_ID: +- if (match_int(&args[0], &value)) ++ if (fuse_match_uint(&args[0], &uv)) + return 0; +- d->group_id = make_kgid(current_user_ns(), value); ++ d->group_id = make_kgid(current_user_ns(), uv); + if (!gid_valid(d->group_id)) + return 0; + d->group_id_present = 1; diff --git a/queue-3.15/fuse-ignore-entry-timeout-on-lookup_reval.patch b/queue-3.15/fuse-ignore-entry-timeout-on-lookup_reval.patch new file mode 100644 index 00000000000..372f45351e3 --- /dev/null +++ b/queue-3.15/fuse-ignore-entry-timeout-on-lookup_reval.patch @@ -0,0 +1,54 @@ +From 154210ccb3a871e631bf39fdeb7a8731d98af87b Mon Sep 17 00:00:00 2001 +From: Anand Avati +Date: Thu, 26 Jun 2014 20:21:57 -0400 +Subject: fuse: ignore entry-timeout on LOOKUP_REVAL + +From: Anand Avati + +commit 154210ccb3a871e631bf39fdeb7a8731d98af87b upstream. + +The following test case demonstrates the bug: + + sh# mount -t glusterfs localhost:meta-test /mnt/one + + sh# mount -t glusterfs localhost:meta-test /mnt/two + + sh# echo stuff > /mnt/one/file; rm -f /mnt/two/file; echo stuff > /mnt/one/file + bash: /mnt/one/file: Stale file handle + + sh# echo stuff > /mnt/one/file; rm -f /mnt/two/file; sleep 1; echo stuff > /mnt/one/file + +On the second open() on /mnt/one, FUSE would have used the old +nodeid (file handle) trying to re-open it. Gluster is returning +-ESTALE. The ESTALE propagates back to namei.c:filename_lookup() +where lookup is re-attempted with LOOKUP_REVAL. The right +behavior now, would be for FUSE to ignore the entry-timeout and +and do the up-call revalidation. Instead FUSE is ignoring +LOOKUP_REVAL, succeeding the revalidation (because entry-timeout +has not passed), and open() is again retried on the old file +handle and finally the ESTALE is going back to the application. + +Fix: if revalidation is happening with LOOKUP_REVAL, then ignore +entry-timeout and always do the up-call. + +Signed-off-by: Anand Avati +Reviewed-by: Niels de Vos +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -198,7 +198,8 @@ static int fuse_dentry_revalidate(struct + inode = ACCESS_ONCE(entry->d_inode); + if (inode && is_bad_inode(inode)) + goto invalid; +- else if (time_before64(fuse_dentry_time(entry), get_jiffies_64())) { ++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || ++ (flags & LOOKUP_REVAL)) { + int err; + struct fuse_entry_out outarg; + struct fuse_req *req; diff --git a/queue-3.15/fuse-timeout-comparison-fix.patch b/queue-3.15/fuse-timeout-comparison-fix.patch new file mode 100644 index 00000000000..b253c288a9d --- /dev/null +++ b/queue-3.15/fuse-timeout-comparison-fix.patch @@ -0,0 +1,48 @@ +From 126b9d4365b110c157bc4cbc32540dfa66c9c85a Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 7 Jul 2014 15:28:50 +0200 +Subject: fuse: timeout comparison fix + +From: Miklos Szeredi + +commit 126b9d4365b110c157bc4cbc32540dfa66c9c85a upstream. + +As suggested by checkpatch.pl, use time_before64() instead of direct +comparison of jiffies64 values. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -198,7 +198,7 @@ static int fuse_dentry_revalidate(struct + inode = ACCESS_ONCE(entry->d_inode); + if (inode && is_bad_inode(inode)) + goto invalid; +- else if (fuse_dentry_time(entry) < get_jiffies_64()) { ++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64())) { + int err; + struct fuse_entry_out outarg; + struct fuse_req *req; +@@ -985,7 +985,7 @@ int fuse_update_attributes(struct inode + int err; + bool r; + +- if (fi->i_time < get_jiffies_64()) { ++ if (time_before64(fi->i_time, get_jiffies_64())) { + r = true; + err = fuse_do_getattr(inode, stat, file); + } else { +@@ -1171,7 +1171,7 @@ static int fuse_permission(struct inode + ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) { + struct fuse_inode *fi = get_fuse_inode(inode); + +- if (fi->i_time < get_jiffies_64()) { ++ if (time_before64(fi->i_time, get_jiffies_64())) { + refreshed = true; + + err = fuse_perm_getattr(inode, mask); diff --git a/queue-3.15/revert-bluetooth-add-a-new-pid-vid-0cf3-e005-for-ar3012.patch b/queue-3.15/revert-bluetooth-add-a-new-pid-vid-0cf3-e005-for-ar3012.patch new file mode 100644 index 00000000000..26a08e017e1 --- /dev/null +++ b/queue-3.15/revert-bluetooth-add-a-new-pid-vid-0cf3-e005-for-ar3012.patch @@ -0,0 +1,58 @@ +From a2b23bacb315d3873ed90029fd2b68c95de734c0 Mon Sep 17 00:00:00 2001 +From: Marcel Holtmann +Date: Fri, 20 Jun 2014 12:34:28 +0200 +Subject: Revert "Bluetooth: Add a new PID/VID 0cf3/e005 for AR3012." + +From: Marcel Holtmann + +commit a2b23bacb315d3873ed90029fd2b68c95de734c0 upstream. + +This reverts commit ca58e594da2486c1d28e7ad547d82266604ec4ce. + +For some unclear reason this patch tries to add suport for the +product ID 0xe005, but it ends up adding product ID 0x3005 to +all the tables. This is obviously wrong and causing multiple +issues. + +The original patch seemed to be fine, but what ended up in 3.15 +is not what the patch intended. The commit 0a3658cccdf53 is +already present and adds support for this hardware. This means +only revert of this broken commit is requird. + +Signed-off-by: Marcel Holtmann +Reported-by: Alexander Holler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/ath3k.c | 2 -- + drivers/bluetooth/btusb.c | 1 - + 2 files changed, 3 deletions(-) + +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -90,7 +90,6 @@ static const struct usb_device_id ath3k_ + { USB_DEVICE(0x0b05, 0x17d0) }, + { USB_DEVICE(0x0CF3, 0x0036) }, + { USB_DEVICE(0x0CF3, 0x3004) }, +- { USB_DEVICE(0x0CF3, 0x3005) }, + { USB_DEVICE(0x0CF3, 0x3008) }, + { USB_DEVICE(0x0CF3, 0x311D) }, + { USB_DEVICE(0x0CF3, 0x311E) }, +@@ -140,7 +139,6 @@ static const struct usb_device_id ath3k_ + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311E), .driver_info = BTUSB_ATH3012 }, +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -160,7 +160,6 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, diff --git a/queue-3.15/series b/queue-3.15/series index ab67dc8dfe9..d209423d990 100644 --- a/queue-3.15/series +++ b/queue-3.15/series @@ -1,3 +1,13 @@ usb-check-if-port-status-is-equal-to-rxdetect.patch usb-chipidea-udc-disable-auto-zlp-generation-on-ep0.patch media-gspca_pac7302-add-new-usb-id-for-genius-i-look-317.patch +alsa-hda-revert-stream-assignment-order-for-intel-controllers.patch +alsa-hda-fix-broken-pm-due-to-incomplete-i915-initialization.patch +drivers-hv-hv_fcopy-fix-a-race-condition-for-smp-guest.patch +drivers-hv-util-fix-a-bug-in-the-kvp-code.patch +revert-bluetooth-add-a-new-pid-vid-0cf3-e005-for-ar3012.patch +bluetooth-ignore-h5-non-link-packets-in-non-active-state.patch +fuse-timeout-comparison-fix.patch +fuse-avoid-scheduling-while-atomic.patch +fuse-handle-large-user-and-group-id.patch +fuse-ignore-entry-timeout-on-lookup_reval.patch