--- /dev/null
+From 445559cdcb98a141f5de415b94fd6eaccab87e6d Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Tue, 25 Nov 2014 17:45:15 -0800
+Subject: dm bufio: fix memleak when using a dm_buffer's inline bio
+
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+
+commit 445559cdcb98a141f5de415b94fd6eaccab87e6d upstream.
+
+When dm-bufio sets out to use the bio built into a struct dm_buffer to
+issue an IO, it needs to call bio_reset after it's done with the bio
+so that we can free things attached to the bio such as the integrity
+payload. Therefore, inject our own endio callback to take care of
+the bio_reset after calling submit_io's end_io callback.
+
+Test case:
+1. modprobe scsi_debug delay=0 dif=1 dix=199 ato=1 dev_size_mb=300
+2. Set up a dm-bufio client, e.g. dm-verity, on the scsi_debug device
+3. Repeatedly read metadata and watch kmalloc-192 leak!
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-bufio.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -529,6 +529,19 @@ static void use_dmio(struct dm_buffer *b
+ end_io(&b->bio, r);
+ }
+
++static void inline_endio(struct bio *bio, int error)
++{
++ bio_end_io_t *end_fn = bio->bi_private;
++
++ /*
++ * Reset the bio to free any attached resources
++ * (e.g. bio integrity profiles).
++ */
++ bio_reset(bio);
++
++ end_fn(bio, error);
++}
++
+ static void use_inline_bio(struct dm_buffer *b, int rw, sector_t block,
+ bio_end_io_t *end_io)
+ {
+@@ -540,7 +553,12 @@ static void use_inline_bio(struct dm_buf
+ b->bio.bi_max_vecs = DM_BUFIO_INLINE_VECS;
+ b->bio.bi_sector = block << b->c->sectors_per_block_bits;
+ b->bio.bi_bdev = b->c->bdev;
+- b->bio.bi_end_io = end_io;
++ b->bio.bi_end_io = inline_endio;
++ /*
++ * Use of .bi_private isn't a problem here because
++ * the dm_buffer's inline bio is local to bufio.
++ */
++ b->bio.bi_private = end_io;
+
+ /*
+ * We assume that if len >= PAGE_SIZE ptr is page-aligned.
--- /dev/null
+From c1c6156fe4d4577444b769d7edd5dd503e57bbc9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 29 Nov 2014 15:50:21 +0300
+Subject: dm space map metadata: fix sm_bootstrap_get_nr_blocks()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit c1c6156fe4d4577444b769d7edd5dd503e57bbc9 upstream.
+
+This function isn't right and it causes a static checker warning:
+
+ drivers/md/dm-thin.c:3016 maybe_resize_data_dev()
+ error: potentially using uninitialized 'sb_data_size'.
+
+It should set "*count" and return zero on success the same as the
+sm_metadata_get_nr_blocks() function does earlier.
+
+Fixes: 3241b1d3e0aa ('dm: add persistent data library')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/persistent-data/dm-space-map-metadata.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/persistent-data/dm-space-map-metadata.c
++++ b/drivers/md/persistent-data/dm-space-map-metadata.c
+@@ -493,7 +493,9 @@ static int sm_bootstrap_get_nr_blocks(st
+ {
+ struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
+
+- return smm->ll.nr_blocks;
++ *count = smm->ll.nr_blocks;
++
++ return 0;
+ }
+
+ static int sm_bootstrap_get_nr_free(struct dm_space_map *sm, dm_block_t *count)
--- /dev/null
+From 170c238701ec38b1829321b17c70671c101bac55 Mon Sep 17 00:00:00 2001
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+Date: Mon, 17 Nov 2014 15:24:23 +0530
+Subject: megaraid_sas: corrected return of wait_event from abort frame path
+
+From: "Sumit.Saxena@avagotech.com" <Sumit.Saxena@avagotech.com>
+
+commit 170c238701ec38b1829321b17c70671c101bac55 upstream.
+
+Corrected wait_event() call which was waiting for wrong completion
+status (0xFF).
+
+Signed-off-by: Sumit Saxena <sumit.saxena@avagotech.com>
+Signed-off-by: Kashyap Desai <kashyap.desai@avagotech.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -933,7 +933,7 @@ megasas_issue_blocked_abort_cmd(struct m
+ abort_fr->abort_mfi_phys_addr_hi = 0;
+
+ cmd->sync_cmd = 1;
+- cmd->cmd_status = 0xFF;
++ cmd->cmd_status = ENODATA;
+
+ instance->instancet->issue_dcmd(instance, cmd);
+
--- /dev/null
+From 4bd5a980de87d2b5af417485bde97b8eb3d6cf6a Mon Sep 17 00:00:00 2001
+From: Peng Tao <tao.peng@primarydata.com>
+Date: Mon, 17 Nov 2014 11:05:17 +0800
+Subject: nfs41: fix nfs4_proc_layoutget error handling
+
+From: Peng Tao <tao.peng@primarydata.com>
+
+commit 4bd5a980de87d2b5af417485bde97b8eb3d6cf6a upstream.
+
+nfs4_layoutget_release() drops layout hdr refcnt. Grab the refcnt
+early so that it is safe to call .release in case nfs4_alloc_pages
+fails.
+
+Signed-off-by: Peng Tao <tao.peng@primarydata.com>
+Fixes: a47970ff78147 ("NFSv4.1: Hold reference to layout hdr in layoutget")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6418,6 +6418,9 @@ nfs4_proc_layoutget(struct nfs4_layoutge
+
+ dprintk("--> %s\n", __func__);
+
++ /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
++ pnfs_get_layout_hdr(NFS_I(inode)->layout);
++
+ lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags);
+ if (!lgp->args.layout.pages) {
+ nfs4_layoutget_release(lgp);
+@@ -6430,9 +6433,6 @@ nfs4_proc_layoutget(struct nfs4_layoutge
+ lgp->res.seq_res.sr_slot = NULL;
+ nfs41_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0);
+
+- /* nfs4_layoutget_release calls pnfs_put_layout_hdr */
+- pnfs_get_layout_hdr(NFS_I(inode)->layout);
+-
+ task = rpc_run_task(&task_setup_data);
+ if (IS_ERR(task))
+ return ERR_CAST(task);
md-bitmap-always-wait-for-writes-on-unplug.patch
mfd-tc6393xb-fail-ohci-suspend-if-full-state-restore-is-required.patch
mmc-block-add-newline-to-sysfs-display-of-force_ro.patch
+megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch
+nfs41-fix-nfs4_proc_layoutget-error-handling.patch
+dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch
+dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
