--- /dev/null
+From 08d4f7722268755ee34ed1c9e8afee7dfff022bb Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 5 Sep 2014 12:16:01 -0400
+Subject: dcache: fix kmemcheck warning in switch_names
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 08d4f7722268755ee34ed1c9e8afee7dfff022bb upstream.
+
+This patch fixes kmemcheck warning in switch_names. The function
+switch_names swaps inline names of two dentries. It swaps full arrays
+d_iname, no matter how many bytes are really used by the strings. Reading
+data beyond string ends results in kmemcheck warning.
+
+We fix the bug by marking both arrays as fully initialized.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2393,6 +2393,8 @@ static void swap_names(struct dentry *de
+ */
+ unsigned int i;
+ BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long)));
++ kmemcheck_mark_initialized(dentry->d_iname, DNAME_INLINE_LEN);
++ kmemcheck_mark_initialized(target->d_iname, DNAME_INLINE_LEN);
+ for (i = 0; i < DNAME_INLINE_LEN / sizeof(long); i++) {
+ swap(((long *) &dentry->d_iname)[i],
+ ((long *) &target->d_iname)[i]);
--- /dev/null
+From 445559cdcb98a141f5de415b94fd6eaccab87e6d Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Tue, 25 Nov 2014 17:45:15 -0800
+Subject: dm bufio: fix memleak when using a dm_buffer's inline bio
+
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+
+commit 445559cdcb98a141f5de415b94fd6eaccab87e6d upstream.
+
+When dm-bufio sets out to use the bio built into a struct dm_buffer to
+issue an IO, it needs to call bio_reset after it's done with the bio
+so that we can free things attached to the bio such as the integrity
+payload. Therefore, inject our own endio callback to take care of
+the bio_reset after calling submit_io's end_io callback.
+
+Test case:
+1. modprobe scsi_debug delay=0 dif=1 dix=199 ato=1 dev_size_mb=300
+2. Set up a dm-bufio client, e.g. dm-verity, on the scsi_debug device
+3. Repeatedly read metadata and watch kmalloc-192 leak!
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-bufio.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -532,6 +532,19 @@ static void use_dmio(struct dm_buffer *b
+ end_io(&b->bio, r);
+ }
+
++static void inline_endio(struct bio *bio, int error)
++{
++ bio_end_io_t *end_fn = bio->bi_private;
++
++ /*
++ * Reset the bio to free any attached resources
++ * (e.g. bio integrity profiles).
++ */
++ bio_reset(bio);
++
++ end_fn(bio, error);
++}
++
+ static void use_inline_bio(struct dm_buffer *b, int rw, sector_t block,
+ bio_end_io_t *end_io)
+ {
+@@ -543,7 +556,12 @@ static void use_inline_bio(struct dm_buf
+ b->bio.bi_max_vecs = DM_BUFIO_INLINE_VECS;
+ b->bio.bi_iter.bi_sector = block << b->c->sectors_per_block_bits;
+ b->bio.bi_bdev = b->c->bdev;
+- b->bio.bi_end_io = end_io;
++ b->bio.bi_end_io = inline_endio;
++ /*
++ * Use of .bi_private isn't a problem here because
++ * the dm_buffer's inline bio is local to bufio.
++ */
++ b->bio.bi_private = end_io;
+
+ /*
+ * We assume that if len >= PAGE_SIZE ptr is page-aligned.
--- /dev/null
+From 1e32134a5a404e80bfb47fad8a94e9bbfcbdacc5 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Thu, 27 Nov 2014 12:26:46 +0000
+Subject: dm cache: dirty flag was mistakenly being cleared when promoting via overwrite
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 1e32134a5a404e80bfb47fad8a94e9bbfcbdacc5 upstream.
+
+If the incoming bio is a WRITE and completely covers a block then we
+don't bother to do any copying for a promotion operation. Once this is
+done the cache block and origin block will be different, so we need to
+set it to 'dirty'.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-cache-target.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -951,10 +951,14 @@ static void migration_success_post_commi
+ }
+
+ } else {
+- clear_dirty(cache, mg->new_oblock, mg->cblock);
+- if (mg->requeue_holder)
++ if (mg->requeue_holder) {
++ clear_dirty(cache, mg->new_oblock, mg->cblock);
+ cell_defer(cache, mg->new_ocell, true);
+- else {
++ } else {
++ /*
++ * The block was promoted via an overwrite, so it's dirty.
++ */
++ set_dirty(cache, mg->new_oblock, mg->cblock);
+ bio_endio(mg->new_ocell->holder, 0);
+ cell_defer(cache, mg->new_ocell, false);
+ }
--- /dev/null
+From f824a2af3dfbbb766c02e19df21f985bceadf0ee Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Fri, 28 Nov 2014 09:48:25 +0000
+Subject: dm cache: fix spurious cell_defer when dealing with partial block at end of device
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit f824a2af3dfbbb766c02e19df21f985bceadf0ee upstream.
+
+We never bother caching a partial block that is at the back end of the
+origin device. No cell ever gets locked, but the calling code was
+assuming it was and trying to release it.
+
+Now the code only releases if the cell has been set to a non NULL
+value.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-cache-target.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -2554,11 +2554,11 @@ static int __cache_map(struct cache *cac
+ static int cache_map(struct dm_target *ti, struct bio *bio)
+ {
+ int r;
+- struct dm_bio_prison_cell *cell;
++ struct dm_bio_prison_cell *cell = NULL;
+ struct cache *cache = ti->private;
+
+ r = __cache_map(cache, bio, &cell);
+- if (r == DM_MAPIO_REMAPPED) {
++ if (r == DM_MAPIO_REMAPPED && cell) {
+ inc_ds(cache, bio, cell);
+ cell_defer(cache, cell, false);
+ }
--- /dev/null
+From f29a3147e251d7ae20d3194ff67f109d71e501b4 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Thu, 27 Nov 2014 12:21:08 +0000
+Subject: dm cache: only use overwrite optimisation for promotion when in writeback mode
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit f29a3147e251d7ae20d3194ff67f109d71e501b4 upstream.
+
+Overwrite causes the cache block and origin blocks to diverge, which
+is only allowed in writeback mode.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-cache-target.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-cache-target.c
++++ b/drivers/md/dm-cache-target.c
+@@ -1070,7 +1070,8 @@ static void issue_copy(struct dm_cache_m
+
+ avoid = is_discarded_oblock(cache, mg->new_oblock);
+
+- if (!avoid && bio_writes_complete_block(cache, bio)) {
++ if (writeback_mode(&cache->features) &&
++ !avoid && bio_writes_complete_block(cache, bio)) {
+ issue_overwrite(mg, bio);
+ return;
+ }
--- /dev/null
+From 1a71d6ffe18c0d0f03fc8531949cc8ed41d702ee Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Sat, 22 Nov 2014 09:36:04 +0100
+Subject: dm crypt: use memzero_explicit for on-stack buffer
+
+From: Milan Broz <gmazyland@gmail.com>
+
+commit 1a71d6ffe18c0d0f03fc8531949cc8ed41d702ee upstream.
+
+Use memzero_explicit to cleanup sensitive data allocated on stack
+to prevent the compiler from optimizing and removing memset() calls.
+
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -705,7 +705,7 @@ static int crypt_iv_tcw_whitening(struct
+ for (i = 0; i < ((1 << SECTOR_SHIFT) / 8); i++)
+ crypto_xor(data + i * 8, buf, 8);
+ out:
+- memset(buf, 0, sizeof(buf));
++ memzero_explicit(buf, sizeof(buf));
+ return r;
+ }
+
--- /dev/null
+From c1c6156fe4d4577444b769d7edd5dd503e57bbc9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 29 Nov 2014 15:50:21 +0300
+Subject: dm space map metadata: fix sm_bootstrap_get_nr_blocks()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit c1c6156fe4d4577444b769d7edd5dd503e57bbc9 upstream.
+
+This function isn't right and it causes a static checker warning:
+
+ drivers/md/dm-thin.c:3016 maybe_resize_data_dev()
+ error: potentially using uninitialized 'sb_data_size'.
+
+It should set "*count" and return zero on success the same as the
+sm_metadata_get_nr_blocks() function does earlier.
+
+Fixes: 3241b1d3e0aa ('dm: add persistent data library')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -564,7 +564,9 @@ static int sm_bootstrap_get_nr_blocks(st
+ {
+ struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+
+- return smm->ll.nr_blocks;
++ *count = smm->ll.nr_blocks;
++
++ return 0;
+ }
+
+ static int sm_bootstrap_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
--- /dev/null
+From 17181fb7a0c3a279196c0eeb2caba65a1519614b Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 5 Nov 2014 17:00:13 -0500
+Subject: dm thin: fix a race in thin_dtr
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 17181fb7a0c3a279196c0eeb2caba65a1519614b upstream.
+
+As long as struct thin_c is in the list, anyone can grab a reference of
+it. Consequently, we must wait for the reference count to drop to zero
+*after* we remove the structure from the list, not before.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -3266,14 +3266,14 @@ static void thin_dtr(struct dm_target *t
+ struct thin_c *tc = ti->private;
+ unsigned long flags;
+
+- thin_put(tc);
+- wait_for_completion(&tc->can_destroy);
+-
+ spin_lock_irqsave(&tc->pool->lock, flags);
+ list_del_rcu(&tc->list);
+ spin_unlock_irqrestore(&tc->pool->lock, flags);
+ synchronize_rcu();
+
++ thin_put(tc);
++ wait_for_completion(&tc->can_destroy);
++
+ mutex_lock(&dm_thin_pool_table.mutex);
+
+ __pool_dec(tc->pool);
--- /dev/null
+From 45ec9bd0fd7abf8705e7cf12205ff69fe9d51181 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 10 Dec 2014 17:06:57 +0000
+Subject: dm thin: fix inability to discard blocks when in out-of-data-space mode
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 45ec9bd0fd7abf8705e7cf12205ff69fe9d51181 upstream.
+
+When the pool was in PM_OUT_OF_SPACE mode its process_prepared_discard
+function pointer was incorrectly being set to
+process_prepared_discard_passdown rather than process_prepared_discard.
+
+This incorrect function pointer meant the discard was being passed down,
+but not effecting the mapping. As such any discard that was issued, in
+an attempt to reclaim blocks, would not successfully free data space.
+
+Reported-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -1824,7 +1824,7 @@ static void set_pool_mode(struct pool *p
+ pool->process_bio = process_bio_read_only;
+ pool->process_discard = process_discard;
+ pool->process_prepared_mapping = process_prepared_mapping;
+- pool->process_prepared_discard = process_prepared_discard_passdown;
++ pool->process_prepared_discard = process_prepared_discard;
+
+ if (!pool->pf.error_if_no_space && no_space_timeout)
+ queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout);
--- /dev/null
+From 2c43fd26e46734430122b8d2ad3024bb532df3ef Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Thu, 11 Dec 2014 11:12:19 +0000
+Subject: dm thin: fix missing out-of-data-space to write mode transition if blocks are released
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 2c43fd26e46734430122b8d2ad3024bb532df3ef upstream.
+
+Discard bios and thin device deletion have the potential to release data
+blocks. If the thin-pool is in out-of-data-space mode, and blocks were
+released, transition the thin-pool back to full write mode.
+
+The correct time to do this is just after the thin-pool metadata commit.
+It cannot be done before the commit because the space maps will not
+allow immediate reuse of the data blocks in case there's a rollback
+following power failure.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -990,6 +990,24 @@ static void schedule_external_copy(struc
+ schedule_zero(tc, virt_block, data_dest, cell, bio);
+ }
+
++static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
++
++static void check_for_space(struct pool *pool)
++{
++ int r;
++ dm_block_t nr_free;
++
++ if (get_pool_mode(pool) != PM_OUT_OF_DATA_SPACE)
++ return;
++
++ r = dm_pool_get_free_block_count(pool->pmd, &nr_free);
++ if (r)
++ return;
++
++ if (nr_free)
++ set_pool_mode(pool, PM_WRITE);
++}
++
+ /*
+ * A non-zero return indicates read_only or fail_io mode.
+ * Many callers don't care about the return value.
+@@ -1004,6 +1022,8 @@ static int commit(struct pool *pool)
+ r = dm_pool_commit_metadata(pool->pmd);
+ if (r)
+ metadata_operation_failed(pool, "dm_pool_commit_metadata", r);
++ else
++ check_for_space(pool);
+
+ return r;
+ }
+@@ -1022,8 +1042,6 @@ static void check_low_water_mark(struct
+ }
+ }
+
+-static void set_pool_mode(struct pool *pool, enum pool_mode new_mode);
+-
+ static int alloc_data_block(struct thin_c *tc, dm_block_t *result)
+ {
+ int r;
--- /dev/null
+From 9bd27ae4aafc9bfee6c8791f7d801ea16cc5622b Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 21 Oct 2014 14:07:33 +0200
+Subject: f2fs: avoid returning uninitialized value to userspace from f2fs_trim_fs()
+
+From: Jan Kara <jack@suse.cz>
+
+commit 9bd27ae4aafc9bfee6c8791f7d801ea16cc5622b upstream.
+
+If user specifies too low end sector for trimming, f2fs_trim_fs() will
+use uninitialized value as a number of trimmed blocks and returns it to
+userspace. Initialize number of trimmed blocks early to avoid the
+problem.
+
+Coverity-id: 1248809
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/f2fs/segment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1004,6 +1004,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sb
+ range->len < sbi->blocksize)
+ return -EINVAL;
+
++ cpc.trimmed = 0;
+ if (end <= MAIN_BLKADDR(sbi))
+ goto out;
+
+@@ -1015,7 +1016,6 @@ int f2fs_trim_fs(struct f2fs_sb_info *sb
+ cpc.trim_start = start_segno;
+ cpc.trim_end = end_segno;
+ cpc.trim_minlen = range->minlen >> sbi->log_blocksize;
+- cpc.trimmed = 0;
+
+ /* do checkpoint to issue discard commands safely */
+ write_checkpoint(sbi, &cpc);
--- /dev/null
+From 9234f3190bf8b25b11b105191d408ac50a107948 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 22 Oct 2014 15:21:47 +0200
+Subject: f2fs: fix possible data corruption in f2fs_write_begin()
+
+From: Jan Kara <jack@suse.cz>
+
+commit 9234f3190bf8b25b11b105191d408ac50a107948 upstream.
+
+f2fs_write_begin() doesn't initialize the 'dn' variable if the inode has
+inline data. However it uses its contents to decide whether it should
+just zero out the page or load data to it. Thus if we are unlucky we can
+zero out page contents instead of loading inline data into a page.
+
+CC: Changman Lee <cm224.lee@samsung.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/f2fs/data.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1007,21 +1007,19 @@ inline_data:
+ goto out;
+ }
+
+- if (dn.data_blkaddr == NEW_ADDR) {
++ if (f2fs_has_inline_data(inode)) {
++ err = f2fs_read_inline_data(inode, page);
++ if (err) {
++ page_cache_release(page);
++ goto fail;
++ }
++ } else if (dn.data_blkaddr == NEW_ADDR) {
+ zero_user_segment(page, 0, PAGE_CACHE_SIZE);
+ } else {
+- if (f2fs_has_inline_data(inode)) {
+- err = f2fs_read_inline_data(inode, page);
+- if (err) {
+- page_cache_release(page);
+- goto fail;
+- }
+- } else {
+- err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr,
+- READ_SYNC);
+- if (err)
+- goto fail;
+- }
++ err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr,
++ READ_SYNC);
++ if (err)
++ goto fail;
+
+ lock_page(page);
+ if (unlikely(!PageUptodate(page))) {
--- /dev/null
+From 170c238701ec38b1829321b17c70671c101bac55 Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 17 Nov 2014 15:24:23 +0530
+Subject: megaraid_sas: corrected return of wait_event from abort frame path
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit 170c238701ec38b1829321b17c70671c101bac55 upstream.
+
+Corrected wait_event() call which was waiting for wrong completion
+status (0xFF).
+
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1008,7 +1008,7 @@ megasas_issue_blocked_abort_cmd(struct m
+ cpu_to_le32(upper_32_bits(cmd_to_abort->frame_phys_addr));
+
+ cmd->sync_cmd = 1;
+- cmd->cmd_status = 0xFF;
++ cmd->cmd_status = ENODATA;
+
+ instance->instancet->issue_dcmd(instance, cmd);
+
--- /dev/null
+From 6e755ddc2935d970574263db3eca547eb70e67d7 Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 17 Nov 2014 15:24:28 +0530
+Subject: megaraid_sas: dndinaness related bug fixes
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit 6e755ddc2935d970574263db3eca547eb70e67d7 upstream.
+
+This patch addresses few endianness related bug fixes.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_fp.c | 17 +++++++++--------
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 13 +++++++------
+ 2 files changed, 16 insertions(+), 14 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -183,14 +183,15 @@ void MR_PopulateDrvRaidMap(struct megasa
+ /* New Raid map will not set totalSize, so keep expected value
+ * for legacy code in ValidateMapInfo
+ */
+- pDrvRaidMap->totalSize = sizeof(struct MR_FW_RAID_MAP_EXT);
++ pDrvRaidMap->totalSize =
++ cpu_to_le32(sizeof(struct MR_FW_RAID_MAP_EXT));
+ } else {
+ fw_map_old = (struct MR_FW_RAID_MAP_ALL *)
+ fusion->ld_map[(instance->map_id & 1)];
+ pFwRaidMap = &fw_map_old->raidMap;
+
+ #if VD_EXT_DEBUG
+- for (i = 0; i < pFwRaidMap->ldCount; i++) {
++ for (i = 0; i < le16_to_cpu(pFwRaidMap->ldCount); i++) {
+ dev_dbg(&instance->pdev->dev, "(%d) :Index 0x%x "
+ "Target Id 0x%x Seq Num 0x%x Size 0/%llx\n",
+ instance->unique_id, i,
+@@ -202,12 +203,12 @@ void MR_PopulateDrvRaidMap(struct megasa
+
+ memset(drv_map, 0, fusion->drv_map_sz);
+ pDrvRaidMap->totalSize = pFwRaidMap->totalSize;
+- pDrvRaidMap->ldCount = pFwRaidMap->ldCount;
++ pDrvRaidMap->ldCount = (__le16)pFwRaidMap->ldCount;
+ pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec;
+ for (i = 0; i < MAX_RAIDMAP_LOGICAL_DRIVES + MAX_RAIDMAP_VIEWS; i++)
+ pDrvRaidMap->ldTgtIdToLd[i] =
+ (u8)pFwRaidMap->ldTgtIdToLd[i];
+- for (i = 0; i < pDrvRaidMap->ldCount; i++) {
++ for (i = 0; i < le16_to_cpu(pDrvRaidMap->ldCount); i++) {
+ pDrvRaidMap->ldSpanMap[i] = pFwRaidMap->ldSpanMap[i];
+ #if VD_EXT_DEBUG
+ dev_dbg(&instance->pdev->dev,
+@@ -268,7 +269,7 @@ u8 MR_ValidateMapInfo(struct megasas_ins
+ else
+ expected_size =
+ (sizeof(struct MR_FW_RAID_MAP) - sizeof(struct MR_LD_SPAN_MAP) +
+- (sizeof(struct MR_LD_SPAN_MAP) * le32_to_cpu(pDrvRaidMap->ldCount)));
++ (sizeof(struct MR_LD_SPAN_MAP) * le16_to_cpu(pDrvRaidMap->ldCount)));
+
+ if (le32_to_cpu(pDrvRaidMap->totalSize) != expected_size) {
+ dev_err(&instance->pdev->dev, "map info structure size 0x%x is not matching with ld count\n",
+@@ -284,7 +285,7 @@ u8 MR_ValidateMapInfo(struct megasas_ins
+
+ mr_update_load_balance_params(drv_map, lbInfo);
+
+- num_lds = le32_to_cpu(drv_map->raidMap.ldCount);
++ num_lds = le16_to_cpu(drv_map->raidMap.ldCount);
+
+ /*Convert Raid capability values to CPU arch */
+ for (ldCount = 0; ldCount < num_lds; ldCount++) {
+@@ -457,7 +458,7 @@ u32 mr_spanset_get_span_block(struct meg
+ quad = &map->raidMap.ldSpanMap[ld].
+ spanBlock[span].
+ block_span_info.quad[info];
+- if (le32_to_cpu(quad->diff == 0))
++ if (le32_to_cpu(quad->diff) == 0)
+ return SPAN_INVALID;
+ if (le64_to_cpu(quad->logStart) <= row &&
+ row <= le64_to_cpu(quad->logEnd) &&
+@@ -520,7 +521,7 @@ static u64 get_row_from_strip(struct me
+ span_set->span_row_data_width) * span_set->diff;
+ for (span = 0, span_offset = 0; span < raid->spanDepth; span++)
+ if (le32_to_cpu(map->raidMap.ldSpanMap[ld].spanBlock[span].
+- block_span_info.noElements >= info+1)) {
++ block_span_info.noElements) >= info+1) {
+ if (strip_offset >=
+ span_set->strip_offset[span])
+ span_offset++;
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -880,7 +880,7 @@ megasas_sync_map_info(struct megasas_ins
+
+ map = fusion->ld_drv_map[instance->map_id & 1];
+
+- num_lds = le32_to_cpu(map->raidMap.ldCount);
++ num_lds = le16_to_cpu(map->raidMap.ldCount);
+
+ dcmd = &cmd->frame->dcmd;
+
+@@ -1173,9 +1173,10 @@ megasas_fire_cmd_fusion(struct megasas_i
+ struct megasas_register_set __iomem *regs)
+ {
+ #if defined(writeq) && defined(CONFIG_64BIT)
+- u64 req_data = (((u64)req_desc_hi << 32) | (u32)req_desc_lo);
++ u64 req_data = (((u64)le32_to_cpu(req_desc_hi) << 32) |
++ le32_to_cpu(req_desc_lo));
+
+- writeq(le64_to_cpu(req_data), &(regs)->inbound_low_queue_port);
++ writeq(req_data, &(regs)->inbound_low_queue_port);
+ #else
+ unsigned long flags;
+
+@@ -1373,7 +1374,7 @@ megasas_set_pd_lba(struct MPI2_RAID_SCSI
+ /* Logical block reference tag */
+ io_request->CDB.EEDP32.PrimaryReferenceTag =
+ cpu_to_be32(ref_tag);
+- io_request->CDB.EEDP32.PrimaryApplicationTagMask = 0xffff;
++ io_request->CDB.EEDP32.PrimaryApplicationTagMask = cpu_to_be16(0xffff);
+ io_request->IoFlags = cpu_to_le16(32); /* Specify 32-byte cdb */
+
+ /* Transfer length */
+@@ -1769,7 +1770,7 @@ megasas_build_dcdb_fusion(struct megasas
+
+ /* set RAID context values */
+ pRAID_Context->regLockFlags = REGION_TYPE_SHARED_READ;
+- pRAID_Context->timeoutValue = raid->fpIoTimeoutForLd;
++ pRAID_Context->timeoutValue = cpu_to_le16(raid->fpIoTimeoutForLd);
+ pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
+ pRAID_Context->regLockRowLBA = 0;
+ pRAID_Context->regLockLength = 0;
+@@ -2254,7 +2255,7 @@ build_mpt_mfi_pass_thru(struct megasas_i
+ * megasas_complete_cmd
+ */
+
+- if (frame_hdr->flags & MFI_FRAME_DONT_POST_IN_REPLY_QUEUE)
++ if (frame_hdr->flags & cpu_to_le16(MFI_FRAME_DONT_POST_IN_REPLY_QUEUE))
+ cmd->flags = MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
+
+ fusion = instance->ctrl_context;
--- /dev/null
+From 4bd5a980de87d2b5af417485bde97b8eb3d6cf6a Mon Sep 17 00:00:00 2001
+From: Peng Tao <tao.peng@primarydata.com>
+Date: Mon, 17 Nov 2014 11:05:17 +0800
+Subject: nfs41: fix nfs4_proc_layoutget error handling
+
+From: Peng Tao <tao.peng@primarydata.com>
+
+commit 4bd5a980de87d2b5af417485bde97b8eb3d6cf6a upstream.
+
+nfs4_layoutget_release() drops layout hdr refcnt. Grab the refcnt
+early so that it is safe to call .release in case nfs4_alloc_pages
+fails.
+
+Signed-off-by: Peng Tao <tao.peng@primarydata.com>
+Fixes: a47970ff78147 ("NFSv4.1: Hold reference to layout hdr in layoutget")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7704,6 +7704,9 @@ nfs4_proc_layoutget(struct nfs4_layoutge
+
+ dprintk("--> %s\n", __func__);
+
++ /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
++ pnfs_get_layout_hdr(NFS_I(inode)->layout);
++
+ lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags);
+ if (!lgp->args.layout.pages) {
+ nfs4_layoutget_release(lgp);
+@@ -7716,9 +7719,6 @@ nfs4_proc_layoutget(struct nfs4_layoutge
+ lgp->res.seq_res.sr_slot = NULL;
+ nfs4_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
+
+- /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
+- pnfs_get_layout_hdr(NFS_I(inode)->layout);
+-
+ task = rpc_run_task(&task_setup_data);
+ if (IS_ERR(task))
+ return ERR_CAST(task);
--- /dev/null
+From fe08be3ec8672ed92b3ed1b85810df9fa0f98931 Mon Sep 17 00:00:00 2001
+From: Markus Pargmann <mpa@pengutronix.de>
+Date: Mon, 6 Oct 2014 21:33:36 +0200
+Subject: regulator: anatop: Set default voltage selector for vddpu
+
+From: Markus Pargmann <mpa@pengutronix.de>
+
+commit fe08be3ec8672ed92b3ed1b85810df9fa0f98931 upstream.
+
+The code reads the default voltage selector from its register. If the
+bootloader disables the regulator, the default voltage selector will be
+0 which results in faulty behaviour of this regulator driver.
+
+This patch sets a default voltage selector for vddpu if it is not set in
+the register.
+
+Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/anatop-regulator.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/regulator/anatop-regulator.c
++++ b/drivers/regulator/anatop-regulator.c
+@@ -283,6 +283,14 @@ static int anatop_regulator_probe(struct
+ sreg->sel = 0;
+ sreg->bypass = true;
+ }
++
++ /*
++ * In case vddpu was disabled by the bootloader, we need to set
++ * a sane default until imx6-cpufreq was probed and changes the
++ * voltage to the correct value. In this case we set 1.25V.
++ */
++ if (!sreg->sel && !strcmp(sreg->name, "vddpu"))
++ sreg->sel = 22;
+ } else {
+ rdesc->ops = &anatop_rops;
+ }
--- /dev/null
+From b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Thu, 30 Oct 2014 09:44:36 +0100
+Subject: scsi: correct return values for .eh_abort_handler implementations
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf upstream.
+
+The .eh_abort_handler needs to return SUCCESS, FAILED, or
+FAST_IO_FAIL. So fixup all callers to adhere to this requirement.
+
+Reviewed-by: Robert Elliott <elliott@hp.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/NCR5380.c | 12 ++++++------
+ drivers/scsi/aha1740.c | 2 +-
+ drivers/scsi/atari_NCR5380.c | 2 +-
+ drivers/scsi/esas2r/esas2r_main.c | 2 +-
+ drivers/scsi/megaraid.c | 8 ++++----
+ drivers/scsi/sun3_NCR5380.c | 10 +++++-----
+ 6 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2647,14 +2647,14 @@ static void NCR5380_dma_complete(NCR5380
+ *
+ * Purpose : abort a command
+ *
+- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
+- * host byte of the result field to, if zero DID_ABORTED is
++ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
++ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+- * XXX - there is no way to abort the command that is currently
+- * connected, you have to wait for it to complete. If this is
++ * XXX - there is no way to abort the command that is currently
++ * connected, you have to wait for it to complete. If this is
+ * a problem, we could implement longjmp() / setjmp(), setjmp()
+ * called where the loop started in NCR5380_main().
+ *
+@@ -2704,7 +2704,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd
+ * aborted flag and get back into our main loop.
+ */
+
+- return 0;
++ return SUCCESS;
+ }
+ #endif
+
+--- a/drivers/scsi/aha1740.c
++++ b/drivers/scsi/aha1740.c
+@@ -531,7 +531,7 @@ static int aha1740_eh_abort_handler (Scs
+ * quiet as possible...
+ */
+
+- return 0;
++ return SUCCESS;
+ }
+
+ static struct scsi_host_template aha1740_template = {
+--- a/drivers/scsi/atari_NCR5380.c
++++ b/drivers/scsi/atari_NCR5380.c
+@@ -2607,7 +2607,7 @@ static void NCR5380_reselect(struct Scsi
+ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+ * XXX - there is no way to abort the command that is currently
+ * connected, you have to wait for it to complete. If this is
+--- a/drivers/scsi/esas2r/esas2r_main.c
++++ b/drivers/scsi/esas2r/esas2r_main.c
+@@ -1057,7 +1057,7 @@ int esas2r_eh_abort(struct scsi_cmnd *cm
+
+ cmd->scsi_done(cmd);
+
+- return 0;
++ return SUCCESS;
+ }
+
+ spin_lock_irqsave(&a->queue_lock, flags);
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1945,7 +1945,7 @@ megaraid_abort_and_reset(adapter_t *adap
+ cmd->device->id, (u32)cmd->device->lun);
+
+ if(list_empty(&adapter->pending_list))
+- return FALSE;
++ return FAILED;
+
+ list_for_each_safe(pos, next, &adapter->pending_list) {
+
+@@ -1968,7 +1968,7 @@ megaraid_abort_and_reset(adapter_t *adap
+ (aor==SCB_ABORT) ? "ABORTING":"RESET",
+ scb->idx);
+
+- return FALSE;
++ return FAILED;
+ }
+ else {
+
+@@ -1993,12 +1993,12 @@ megaraid_abort_and_reset(adapter_t *adap
+ list_add_tail(SCSI_LIST(cmd),
+ &adapter->completed_list);
+
+- return TRUE;
++ return SUCCESS;
+ }
+ }
+ }
+
+- return FALSE;
++ return FAILED;
+ }
+
+ static inline int
+--- a/drivers/scsi/sun3_NCR5380.c
++++ b/drivers/scsi/sun3_NCR5380.c
+@@ -2590,15 +2590,15 @@ static void NCR5380_reselect (struct Scs
+ * Purpose : abort a command
+ *
+ * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the
+- * host byte of the result field to, if zero DID_ABORTED is
++ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+- * XXX - there is no way to abort the command that is currently
+- * connected, you have to wait for it to complete. If this is
++ * XXX - there is no way to abort the command that is currently
++ * connected, you have to wait for it to complete. If this is
+ * a problem, we could implement longjmp() / setjmp(), setjmp()
+- * called where the loop started in NCR5380_main().
++ * called where the loop started in NCR5380_main().
+ */
+
+ static int NCR5380_abort(struct scsi_cmnd *cmd)
mmc-omap_hsmmc-fix-uhs-card-with-ddr50-support.patch
mmc-block-add-newline-to-sysfs-display-of-force_ro.patch
mmc-sdhci-pci-o2micro-fix-dell-e5440-issue.patch
+megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch
+megaraid_sas-dndinaness-related-bug-fixes.patch
+regulator-anatop-set-default-voltage-selector-for-vddpu.patch
+scsi-correct-return-values-for-.eh_abort_handler-implementations.patch
+f2fs-avoid-returning-uninitialized-value-to-userspace-from-f2fs_trim_fs.patch
+f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch
+nfs41-fix-nfs4_proc_layoutget-error-handling.patch
+dcache-fix-kmemcheck-warning-in-switch_names.patch
+dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch
+dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch
+dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch
+dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch
+dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch
+dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch
+dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch
+dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch
+dm-thin-fix-a-race-in-thin_dtr.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
