From d6525407395068b0ae4b034cc294be9f16225935 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 20 Jan 2010 20:02:03 -0800 Subject: [PATCH] start .27 queue --- ...dac-critical-fix-panic-out-of-bounds.patch | 46 +++++++++++ ..._mode_io-world-writeable-permissions.patch | 35 +++++++++ ...-truncate-blocks-not-used-by-a-write.patch | 78 +++++++++++++++++++ queue-2.6.27/series | 3 + 4 files changed, 162 insertions(+) create mode 100644 queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch create mode 100644 queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch create mode 100644 queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch create mode 100644 queue-2.6.27/series diff --git a/queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch b/queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch new file mode 100644 index 00000000000..c9eca1d453c --- /dev/null +++ b/queue-2.6.27/edac-i5000_edac-critical-fix-panic-out-of-bounds.patch @@ -0,0 +1,46 @@ +From 118f3e1afd5534c15f9701f33514186cfc841a27 Mon Sep 17 00:00:00 2001 +From: Tamas Vincze +Date: Fri, 15 Jan 2010 17:01:10 -0800 +Subject: edac: i5000_edac critical fix panic out of bounds + +From: Tamas Vincze + +commit 118f3e1afd5534c15f9701f33514186cfc841a27 upstream. + +EDAC MC0: INTERNAL ERROR: channel-b out of range (4 >= 4) +Kernel panic - not syncing: EDAC MC0: Uncorrected Error (XEN) Domain 0 crashed: 'noreboot' set - not rebooting. + +This happens because FERR_NF_FBD bit 28 is not updated on i5000. Due to +that, both bits 28 and 29 may be equal to one, returning channel = 3. As +this value is invalid, EDAC core generates the panic. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14568 + +Signed-off-by: Tamas Vincze +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Doug Thompson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/i5000_edac.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/edac/i5000_edac.c ++++ b/drivers/edac/i5000_edac.c +@@ -566,7 +566,13 @@ static void i5000_process_nonfatal_error + debugf0("\tUncorrected bits= 0x%x\n", ue_errors); + + branch = EXTRACT_FBDCHAN_INDX(info->ferr_nf_fbd); +- channel = branch; ++ ++ /* ++ * According with i5000 datasheet, bit 28 has no significance ++ * for errors M4Err-M12Err and M17Err-M21Err, on FERR_NF_FBD ++ */ ++ channel = branch & 2; ++ + bank = NREC_BANK(info->nrecmema); + rank = NREC_RANK(info->nrecmema); + rdwr = NREC_RDWR(info->nrecmema); diff --git a/queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch b/queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch new file mode 100644 index 00000000000..25ccd610fb9 --- /dev/null +++ b/queue-2.6.27/megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch @@ -0,0 +1,35 @@ +From bb7d3f24c71e528989501617651b669fbed798cb Mon Sep 17 00:00:00 2001 +From: Bryn M. Reeves +Date: Thu, 12 Nov 2009 18:31:54 +0000 +Subject: [SCSI] megaraid_sas: remove sysfs poll_mode_io world writeable permissions + +From: Bryn M. Reeves + +commit bb7d3f24c71e528989501617651b669fbed798cb upstream. + +/sys/bus/pci/drivers/megaraid_sas/poll_mode_io defaults to being +world-writable, which seems bad (letting any user affect kernel driver +behavior). + +This turns off group and user write permissions, so that on typical +production systems only root can write to it. + +Signed-off-by: Bryn M. Reeves +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/megaraid/megaraid_sas.c ++++ b/drivers/scsi/megaraid/megaraid_sas.c +@@ -3462,7 +3462,7 @@ out: + return retval; + } + +-static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUGO, ++static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUSR, + megasas_sysfs_show_poll_mode_io, + megasas_sysfs_set_poll_mode_io); + diff --git a/queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch b/queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch new file mode 100644 index 00000000000..0cfb6f272c7 --- /dev/null +++ b/queue-2.6.27/reiserfs-truncate-blocks-not-used-by-a-write.patch @@ -0,0 +1,78 @@ +From ec8e2f7466ca370f5e09000ca40a71759afc9ac8 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 17 Dec 2009 15:27:06 -0800 +Subject: reiserfs: truncate blocks not used by a write + +From: Jan Kara + +commit ec8e2f7466ca370f5e09000ca40a71759afc9ac8 upstream. + +It can happen that write does not use all the blocks allocated in +write_begin either because of some filesystem error (like ENOSPC) or +because page with data to write has been removed from memory. We truncate +these blocks so that we don't have dangling blocks beyond i_size. + +Cc: Jeff Mahoney +Signed-off-by: Jan Kara +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/reiserfs/inode.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -2545,6 +2545,12 @@ static int reiserfs_writepage(struct pag + return reiserfs_write_full_page(page, wbc); + } + ++static void reiserfs_truncate_failed_write(struct inode *inode) ++{ ++ truncate_inode_pages(inode->i_mapping, inode->i_size); ++ reiserfs_truncate_file(inode, 0); ++} ++ + static int reiserfs_write_begin(struct file *file, + struct address_space *mapping, + loff_t pos, unsigned len, unsigned flags, +@@ -2611,6 +2617,8 @@ static int reiserfs_write_begin(struct f + if (ret) { + unlock_page(page); + page_cache_release(page); ++ /* Truncate allocated blocks */ ++ reiserfs_truncate_failed_write(inode); + } + return ret; + } +@@ -2703,8 +2711,7 @@ static int reiserfs_write_end(struct fil + ** transaction tracking stuff when the size changes. So, we have + ** to do the i_size updates here. + */ +- pos += copied; +- if (pos > inode->i_size) { ++ if (pos + copied > inode->i_size) { + struct reiserfs_transaction_handle myth; + reiserfs_write_lock(inode->i_sb); + /* If the file have grown beyond the border where it +@@ -2722,7 +2729,7 @@ static int reiserfs_write_end(struct fil + goto journal_error; + } + reiserfs_update_inode_transaction(inode); +- inode->i_size = pos; ++ inode->i_size = pos + copied; + /* + * this will just nest into our transaction. It's important + * to use mark_inode_dirty so the inode gets pushed around on the +@@ -2749,6 +2756,10 @@ static int reiserfs_write_end(struct fil + out: + unlock_page(page); + page_cache_release(page); ++ ++ if (pos + len > inode->i_size) ++ reiserfs_truncate_failed_write(inode); ++ + return ret == 0 ? copied : ret; + + journal_error: diff --git a/queue-2.6.27/series b/queue-2.6.27/series new file mode 100644 index 00000000000..465ee51e6e1 --- /dev/null +++ b/queue-2.6.27/series @@ -0,0 +1,3 @@ +edac-i5000_edac-critical-fix-panic-out-of-bounds.patch +megaraid_sas-remove-sysfs-poll_mode_io-world-writeable-permissions.patch +reiserfs-truncate-blocks-not-used-by-a-write.patch -- 2.47.3