From f23459f0112e00e88fecaf6acf9fc6c5884beb00 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 5 Jan 2015 11:55:15 -0800 Subject: [PATCH] 3.17-stable patches added patches: dcache-fix-kmemcheck-warning-in-switch_names.patch dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch dm-thin-fix-a-race-in-thin_dtr.patch dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch nfs41-fix-nfs4_proc_layoutget-error-handling.patch regulator-anatop-set-default-voltage-selector-for-vddpu.patch scsi-correct-return-values-for-.eh_abort_handler-implementations.patch --- ...ix-kmemcheck-warning-in-switch_names.patch | 35 +++++ ...-when-using-a-dm_buffer-s-inline-bio.patch | 65 ++++++++ ...cleared-when-promoting-via-overwrite.patch | 42 +++++ ...-with-partial-block-at-end-of-device.patch | 40 +++++ ...for-promotion-when-in-writeback-mode.patch | 32 ++++ ...memzero_explicit-for-on-stack-buffer.patch | 31 ++++ ...adata-fix-sm_bootstrap_get_nr_blocks.patch | 40 +++++ .../dm-thin-fix-a-race-in-thin_dtr.patch | 41 +++++ ...locks-when-in-out-of-data-space-mode.patch | 37 +++++ ...de-transition-if-blocks-are-released.patch | 71 +++++++++ ...-data-corruption-in-f2fs_write_begin.patch | 58 +++++++ ...-of-wait_event-from-abort-frame-path.patch | 33 ++++ ...x-nfs4_proc_layoutget-error-handling.patch | 44 ++++++ ...t-default-voltage-selector-for-vddpu.patch | 41 +++++ ...or-.eh_abort_handler-implementations.patch | 148 ++++++++++++++++++ queue-3.17/series | 15 ++ 16 files changed, 773 insertions(+) create mode 100644 queue-3.17/dcache-fix-kmemcheck-warning-in-switch_names.patch create mode 100644 queue-3.17/dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch create mode 100644 queue-3.17/dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch create mode 100644 queue-3.17/dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch create mode 100644 queue-3.17/dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch create mode 100644 queue-3.17/dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch create mode 100644 queue-3.17/dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch create mode 100644 queue-3.17/dm-thin-fix-a-race-in-thin_dtr.patch create mode 100644 queue-3.17/dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch create mode 100644 queue-3.17/dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch create mode 100644 queue-3.17/f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch create mode 100644 queue-3.17/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch create mode 100644 queue-3.17/nfs41-fix-nfs4_proc_layoutget-error-handling.patch create mode 100644 queue-3.17/regulator-anatop-set-default-voltage-selector-for-vddpu.patch create mode 100644 queue-3.17/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch diff --git a/queue-3.17/dcache-fix-kmemcheck-warning-in-switch_names.patch b/queue-3.17/dcache-fix-kmemcheck-warning-in-switch_names.patch new file mode 100644 index 00000000000..20f3b7fcde6 --- /dev/null +++ b/queue-3.17/dcache-fix-kmemcheck-warning-in-switch_names.patch @@ -0,0 +1,35 @@ +From 08d4f7722268755ee34ed1c9e8afee7dfff022bb Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 5 Sep 2014 12:16:01 -0400 +Subject: dcache: fix kmemcheck warning in switch_names + +From: Mikulas Patocka + +commit 08d4f7722268755ee34ed1c9e8afee7dfff022bb upstream. + +This patch fixes kmemcheck warning in switch_names. The function +switch_names swaps inline names of two dentries. It swaps full arrays +d_iname, no matter how many bytes are really used by the strings. Reading +data beyond string ends results in kmemcheck warning. + +We fix the bug by marking both arrays as fully initialized. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/dcache.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -2407,6 +2407,8 @@ static void switch_names(struct dentry * + */ + unsigned int i; + BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long))); ++ kmemcheck_mark_initialized(dentry->d_iname, DNAME_INLINE_LEN); ++ kmemcheck_mark_initialized(target->d_iname, DNAME_INLINE_LEN); + if (!exchange) { + memcpy(dentry->d_iname, target->d_name.name, + target->d_name.len + 1); diff --git a/queue-3.17/dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch b/queue-3.17/dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch new file mode 100644 index 00000000000..5af9b54b783 --- /dev/null +++ b/queue-3.17/dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch @@ -0,0 +1,65 @@ +From 445559cdcb98a141f5de415b94fd6eaccab87e6d Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Tue, 25 Nov 2014 17:45:15 -0800 +Subject: dm bufio: fix memleak when using a dm_buffer's inline bio + +From: "Darrick J. Wong" + +commit 445559cdcb98a141f5de415b94fd6eaccab87e6d upstream. + +When dm-bufio sets out to use the bio built into a struct dm_buffer to +issue an IO, it needs to call bio_reset after it's done with the bio +so that we can free things attached to the bio such as the integrity +payload. Therefore, inject our own endio callback to take care of +the bio_reset after calling submit_io's end_io callback. + +Test case: +1. modprobe scsi_debug delay=0 dif=1 dix=199 ato=1 dev_size_mb=300 +2. Set up a dm-bufio client, e.g. dm-verity, on the scsi_debug device +3. Repeatedly read metadata and watch kmalloc-192 leak! + +Signed-off-by: Darrick J. Wong +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-bufio.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -532,6 +532,19 @@ static void use_dmio(struct dm_buffer *b + end_io(&b->bio, r); + } + ++static void inline_endio(struct bio *bio, int error) ++{ ++ bio_end_io_t *end_fn = bio->bi_private; ++ ++ /* ++ * Reset the bio to free any attached resources ++ * (e.g. bio integrity profiles). ++ */ ++ bio_reset(bio); ++ ++ end_fn(bio, error); ++} ++ + static void use_inline_bio(struct dm_buffer *b, int rw, sector_t block, + bio_end_io_t *end_io) + { +@@ -543,7 +556,12 @@ static void use_inline_bio(struct dm_buf + b->bio.bi_max_vecs = DM_BUFIO_INLINE_VECS; + b->bio.bi_iter.bi_sector = block << b->c->sectors_per_block_bits; + b->bio.bi_bdev = b->c->bdev; +- b->bio.bi_end_io = end_io; ++ b->bio.bi_end_io = inline_endio; ++ /* ++ * Use of .bi_private isn't a problem here because ++ * the dm_buffer's inline bio is local to bufio. ++ */ ++ b->bio.bi_private = end_io; + + /* + * We assume that if len >= PAGE_SIZE ptr is page-aligned. diff --git a/queue-3.17/dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch b/queue-3.17/dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch new file mode 100644 index 00000000000..7b092bc20f5 --- /dev/null +++ b/queue-3.17/dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch @@ -0,0 +1,42 @@ +From 1e32134a5a404e80bfb47fad8a94e9bbfcbdacc5 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Thu, 27 Nov 2014 12:26:46 +0000 +Subject: dm cache: dirty flag was mistakenly being cleared when promoting via overwrite + +From: Joe Thornber + +commit 1e32134a5a404e80bfb47fad8a94e9bbfcbdacc5 upstream. + +If the incoming bio is a WRITE and completely covers a block then we +don't bother to do any copying for a promotion operation. Once this is +done the cache block and origin block will be different, so we need to +set it to 'dirty'. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-target.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -951,10 +951,14 @@ static void migration_success_post_commi + } + + } else { +- clear_dirty(cache, mg->new_oblock, mg->cblock); +- if (mg->requeue_holder) ++ if (mg->requeue_holder) { ++ clear_dirty(cache, mg->new_oblock, mg->cblock); + cell_defer(cache, mg->new_ocell, true); +- else { ++ } else { ++ /* ++ * The block was promoted via an overwrite, so it's dirty. ++ */ ++ set_dirty(cache, mg->new_oblock, mg->cblock); + bio_endio(mg->new_ocell->holder, 0); + cell_defer(cache, mg->new_ocell, false); + } diff --git a/queue-3.17/dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch b/queue-3.17/dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch new file mode 100644 index 00000000000..f0bbb42c93a --- /dev/null +++ b/queue-3.17/dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch @@ -0,0 +1,40 @@ +From f824a2af3dfbbb766c02e19df21f985bceadf0ee Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Fri, 28 Nov 2014 09:48:25 +0000 +Subject: dm cache: fix spurious cell_defer when dealing with partial block at end of device + +From: Joe Thornber + +commit f824a2af3dfbbb766c02e19df21f985bceadf0ee upstream. + +We never bother caching a partial block that is at the back end of the +origin device. No cell ever gets locked, but the calling code was +assuming it was and trying to release it. + +Now the code only releases if the cell has been set to a non NULL +value. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-target.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -2554,11 +2554,11 @@ static int __cache_map(struct cache *cac + static int cache_map(struct dm_target *ti, struct bio *bio) + { + int r; +- struct dm_bio_prison_cell *cell; ++ struct dm_bio_prison_cell *cell = NULL; + struct cache *cache = ti->private; + + r = __cache_map(cache, bio, &cell); +- if (r == DM_MAPIO_REMAPPED) { ++ if (r == DM_MAPIO_REMAPPED && cell) { + inc_ds(cache, bio, cell); + cell_defer(cache, cell, false); + } diff --git a/queue-3.17/dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch b/queue-3.17/dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch new file mode 100644 index 00000000000..26e9229c1d8 --- /dev/null +++ b/queue-3.17/dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch @@ -0,0 +1,32 @@ +From f29a3147e251d7ae20d3194ff67f109d71e501b4 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Thu, 27 Nov 2014 12:21:08 +0000 +Subject: dm cache: only use overwrite optimisation for promotion when in writeback mode + +From: Joe Thornber + +commit f29a3147e251d7ae20d3194ff67f109d71e501b4 upstream. + +Overwrite causes the cache block and origin blocks to diverge, which +is only allowed in writeback mode. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-target.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -1070,7 +1070,8 @@ static void issue_copy(struct dm_cache_m + + avoid = is_discarded_oblock(cache, mg->new_oblock); + +- if (!avoid && bio_writes_complete_block(cache, bio)) { ++ if (writeback_mode(&cache->features) && ++ !avoid && bio_writes_complete_block(cache, bio)) { + issue_overwrite(mg, bio); + return; + } diff --git a/queue-3.17/dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch b/queue-3.17/dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch new file mode 100644 index 00000000000..707f3c272f2 --- /dev/null +++ b/queue-3.17/dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch @@ -0,0 +1,31 @@ +From 1a71d6ffe18c0d0f03fc8531949cc8ed41d702ee Mon Sep 17 00:00:00 2001 +From: Milan Broz +Date: Sat, 22 Nov 2014 09:36:04 +0100 +Subject: dm crypt: use memzero_explicit for on-stack buffer + +From: Milan Broz + +commit 1a71d6ffe18c0d0f03fc8531949cc8ed41d702ee upstream. + +Use memzero_explicit to cleanup sensitive data allocated on stack +to prevent the compiler from optimizing and removing memset() calls. + +Signed-off-by: Milan Broz +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -711,7 +711,7 @@ static int crypt_iv_tcw_whitening(struct + for (i = 0; i < ((1 << SECTOR_SHIFT) / 8); i++) + crypto_xor(data + i * 8, buf, 8); + out: +- memset(buf, 0, sizeof(buf)); ++ memzero_explicit(buf, sizeof(buf)); + return r; + } + diff --git a/queue-3.17/dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch b/queue-3.17/dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch new file mode 100644 index 00000000000..c6fe01080e4 --- /dev/null +++ b/queue-3.17/dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch @@ -0,0 +1,40 @@ +From c1c6156fe4d4577444b769d7edd5dd503e57bbc9 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 29 Nov 2014 15:50:21 +0300 +Subject: dm space map metadata: fix sm_bootstrap_get_nr_blocks() + +From: Dan Carpenter + +commit c1c6156fe4d4577444b769d7edd5dd503e57bbc9 upstream. + +This function isn't right and it causes a static checker warning: + + drivers/md/dm-thin.c:3016 maybe_resize_data_dev() + error: potentially using uninitialized 'sb_data_size'. + +It should set "*count" and return zero on success the same as the +sm_metadata_get_nr_blocks() function does earlier. + +Fixes: 3241b1d3e0aa ('dm: add persistent data library') +Signed-off-by: Dan Carpenter +Acked-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/persistent-data/dm-space-map-metadata.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/md/persistent-data/dm-space-map-metadata.c ++++ b/drivers/md/persistent-data/dm-space-map-metadata.c +@@ -564,7 +564,9 @@ static int sm_bootstrap_get_nr_blocks(st + { + struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm); + +- return smm->ll.nr_blocks; ++ *count = smm->ll.nr_blocks; ++ ++ return 0; + } + + static int sm_bootstrap_get_nr_free(struct dm_space_map *sm, dm_block_t *count) diff --git a/queue-3.17/dm-thin-fix-a-race-in-thin_dtr.patch b/queue-3.17/dm-thin-fix-a-race-in-thin_dtr.patch new file mode 100644 index 00000000000..8d76a1b9351 --- /dev/null +++ b/queue-3.17/dm-thin-fix-a-race-in-thin_dtr.patch @@ -0,0 +1,41 @@ +From 17181fb7a0c3a279196c0eeb2caba65a1519614b Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Wed, 5 Nov 2014 17:00:13 -0500 +Subject: dm thin: fix a race in thin_dtr + +From: Mikulas Patocka + +commit 17181fb7a0c3a279196c0eeb2caba65a1519614b upstream. + +As long as struct thin_c is in the list, anyone can grab a reference of +it. Consequently, we must wait for the reference count to drop to zero +*after* we remove the structure from the list, not before. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -3266,14 +3266,14 @@ static void thin_dtr(struct dm_target *t + struct thin_c *tc = ti->private; + unsigned long flags; + +- thin_put(tc); +- wait_for_completion(&tc->can_destroy); +- + spin_lock_irqsave(&tc->pool->lock, flags); + list_del_rcu(&tc->list); + spin_unlock_irqrestore(&tc->pool->lock, flags); + synchronize_rcu(); + ++ thin_put(tc); ++ wait_for_completion(&tc->can_destroy); ++ + mutex_lock(&dm_thin_pool_table.mutex); + + __pool_dec(tc->pool); diff --git a/queue-3.17/dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch b/queue-3.17/dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch new file mode 100644 index 00000000000..4d12eaed4bc --- /dev/null +++ b/queue-3.17/dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch @@ -0,0 +1,37 @@ +From 45ec9bd0fd7abf8705e7cf12205ff69fe9d51181 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Wed, 10 Dec 2014 17:06:57 +0000 +Subject: dm thin: fix inability to discard blocks when in out-of-data-space mode + +From: Joe Thornber + +commit 45ec9bd0fd7abf8705e7cf12205ff69fe9d51181 upstream. + +When the pool was in PM_OUT_OF_SPACE mode its process_prepared_discard +function pointer was incorrectly being set to +process_prepared_discard_passdown rather than process_prepared_discard. + +This incorrect function pointer meant the discard was being passed down, +but not effecting the mapping. As such any discard that was issued, in +an attempt to reclaim blocks, would not successfully free data space. + +Reported-by: Eric Sandeen +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -1824,7 +1824,7 @@ static void set_pool_mode(struct pool *p + pool->process_bio = process_bio_read_only; + pool->process_discard = process_discard; + pool->process_prepared_mapping = process_prepared_mapping; +- pool->process_prepared_discard = process_prepared_discard_passdown; ++ pool->process_prepared_discard = process_prepared_discard; + + if (!pool->pf.error_if_no_space && no_space_timeout) + queue_delayed_work(pool->wq, &pool->no_space_timeout, no_space_timeout); diff --git a/queue-3.17/dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch b/queue-3.17/dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch new file mode 100644 index 00000000000..db379f9b1e8 --- /dev/null +++ b/queue-3.17/dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch @@ -0,0 +1,71 @@ +From 2c43fd26e46734430122b8d2ad3024bb532df3ef Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Thu, 11 Dec 2014 11:12:19 +0000 +Subject: dm thin: fix missing out-of-data-space to write mode transition if blocks are released + +From: Joe Thornber + +commit 2c43fd26e46734430122b8d2ad3024bb532df3ef upstream. + +Discard bios and thin device deletion have the potential to release data +blocks. If the thin-pool is in out-of-data-space mode, and blocks were +released, transition the thin-pool back to full write mode. + +The correct time to do this is just after the thin-pool metadata commit. +It cannot be done before the commit because the space maps will not +allow immediate reuse of the data blocks in case there's a rollback +following power failure. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -990,6 +990,24 @@ static void schedule_external_copy(struc + schedule_zero(tc, virt_block, data_dest, cell, bio); + } + ++static void set_pool_mode(struct pool *pool, enum pool_mode new_mode); ++ ++static void check_for_space(struct pool *pool) ++{ ++ int r; ++ dm_block_t nr_free; ++ ++ if (get_pool_mode(pool) != PM_OUT_OF_DATA_SPACE) ++ return; ++ ++ r = dm_pool_get_free_block_count(pool->pmd, &nr_free); ++ if (r) ++ return; ++ ++ if (nr_free) ++ set_pool_mode(pool, PM_WRITE); ++} ++ + /* + * A non-zero return indicates read_only or fail_io mode. + * Many callers don't care about the return value. +@@ -1004,6 +1022,8 @@ static int commit(struct pool *pool) + r = dm_pool_commit_metadata(pool->pmd); + if (r) + metadata_operation_failed(pool, "dm_pool_commit_metadata", r); ++ else ++ check_for_space(pool); + + return r; + } +@@ -1022,8 +1042,6 @@ static void check_low_water_mark(struct + } + } + +-static void set_pool_mode(struct pool *pool, enum pool_mode new_mode); +- + static int alloc_data_block(struct thin_c *tc, dm_block_t *result) + { + int r; diff --git a/queue-3.17/f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch b/queue-3.17/f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch new file mode 100644 index 00000000000..a71b62d5e47 --- /dev/null +++ b/queue-3.17/f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch @@ -0,0 +1,58 @@ +From 9234f3190bf8b25b11b105191d408ac50a107948 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 22 Oct 2014 15:21:47 +0200 +Subject: f2fs: fix possible data corruption in f2fs_write_begin() + +From: Jan Kara + +commit 9234f3190bf8b25b11b105191d408ac50a107948 upstream. + +f2fs_write_begin() doesn't initialize the 'dn' variable if the inode has +inline data. However it uses its contents to decide whether it should +just zero out the page or load data to it. Thus if we are unlucky we can +zero out page contents instead of loading inline data into a page. + +CC: Changman Lee +Signed-off-by: Jan Kara +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman + +--- + fs/f2fs/data.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1002,21 +1002,19 @@ inline_data: + goto out; + } + +- if (dn.data_blkaddr == NEW_ADDR) { ++ if (f2fs_has_inline_data(inode)) { ++ err = f2fs_read_inline_data(inode, page); ++ if (err) { ++ page_cache_release(page); ++ goto fail; ++ } ++ } else if (dn.data_blkaddr == NEW_ADDR) { + zero_user_segment(page, 0, PAGE_CACHE_SIZE); + } else { +- if (f2fs_has_inline_data(inode)) { +- err = f2fs_read_inline_data(inode, page); +- if (err) { +- page_cache_release(page); +- goto fail; +- } +- } else { +- err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr, +- READ_SYNC); +- if (err) +- goto fail; +- } ++ err = f2fs_submit_page_bio(sbi, page, dn.data_blkaddr, ++ READ_SYNC); ++ if (err) ++ goto fail; + + lock_page(page); + if (unlikely(!PageUptodate(page))) { diff --git a/queue-3.17/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch b/queue-3.17/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch new file mode 100644 index 00000000000..994406f9fe0 --- /dev/null +++ b/queue-3.17/megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch @@ -0,0 +1,33 @@ +From 170c238701ec38b1829321b17c70671c101bac55 Mon Sep 17 00:00:00 2001 +From: "Sumit.Saxena@avagotech.com" +Date: Mon, 17 Nov 2014 15:24:23 +0530 +Subject: megaraid_sas: corrected return of wait_event from abort frame path + +From: "Sumit.Saxena@avagotech.com" + +commit 170c238701ec38b1829321b17c70671c101bac55 upstream. + +Corrected wait_event() call which was waiting for wrong completion +status (0xFF). + +Signed-off-by: Sumit Saxena +Signed-off-by: Kashyap Desai +Reviewed-by: Tomas Henzl +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -980,7 +980,7 @@ megasas_issue_blocked_abort_cmd(struct m + cpu_to_le32(upper_32_bits(cmd_to_abort->frame_phys_addr)); + + cmd->sync_cmd = 1; +- cmd->cmd_status = 0xFF; ++ cmd->cmd_status = ENODATA; + + instance->instancet->issue_dcmd(instance, cmd); + diff --git a/queue-3.17/nfs41-fix-nfs4_proc_layoutget-error-handling.patch b/queue-3.17/nfs41-fix-nfs4_proc_layoutget-error-handling.patch new file mode 100644 index 00000000000..ecd200fae70 --- /dev/null +++ b/queue-3.17/nfs41-fix-nfs4_proc_layoutget-error-handling.patch @@ -0,0 +1,44 @@ +From 4bd5a980de87d2b5af417485bde97b8eb3d6cf6a Mon Sep 17 00:00:00 2001 +From: Peng Tao +Date: Mon, 17 Nov 2014 11:05:17 +0800 +Subject: nfs41: fix nfs4_proc_layoutget error handling + +From: Peng Tao + +commit 4bd5a980de87d2b5af417485bde97b8eb3d6cf6a upstream. + +nfs4_layoutget_release() drops layout hdr refcnt. Grab the refcnt +early so that it is safe to call .release in case nfs4_alloc_pages +fails. + +Signed-off-by: Peng Tao +Fixes: a47970ff78147 ("NFSv4.1: Hold reference to layout hdr in layoutget") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4proc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7692,6 +7692,9 @@ nfs4_proc_layoutget(struct nfs4_layoutge + + dprintk("--> %s\n", __func__); + ++ /* nfs4_layoutget_release calls pnfs_put_layout_hdr */ ++ pnfs_get_layout_hdr(NFS_I(inode)->layout); ++ + lgp->args.layout.pages = nfs4_alloc_pages(max_pages, gfp_flags); + if (!lgp->args.layout.pages) { + nfs4_layoutget_release(lgp); +@@ -7704,9 +7707,6 @@ nfs4_proc_layoutget(struct nfs4_layoutge + lgp->res.seq_res.sr_slot = NULL; + nfs4_init_sequence(&lgp->args.seq_args, &lgp->res.seq_res, 0); + +- /* nfs4_layoutget_release calls pnfs_put_layout_hdr */ +- pnfs_get_layout_hdr(NFS_I(inode)->layout); +- + task = rpc_run_task(&task_setup_data); + if (IS_ERR(task)) + return ERR_CAST(task); diff --git a/queue-3.17/regulator-anatop-set-default-voltage-selector-for-vddpu.patch b/queue-3.17/regulator-anatop-set-default-voltage-selector-for-vddpu.patch new file mode 100644 index 00000000000..e1969deabb8 --- /dev/null +++ b/queue-3.17/regulator-anatop-set-default-voltage-selector-for-vddpu.patch @@ -0,0 +1,41 @@ +From fe08be3ec8672ed92b3ed1b85810df9fa0f98931 Mon Sep 17 00:00:00 2001 +From: Markus Pargmann +Date: Mon, 6 Oct 2014 21:33:36 +0200 +Subject: regulator: anatop: Set default voltage selector for vddpu + +From: Markus Pargmann + +commit fe08be3ec8672ed92b3ed1b85810df9fa0f98931 upstream. + +The code reads the default voltage selector from its register. If the +bootloader disables the regulator, the default voltage selector will be +0 which results in faulty behaviour of this regulator driver. + +This patch sets a default voltage selector for vddpu if it is not set in +the register. + +Signed-off-by: Markus Pargmann +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/anatop-regulator.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/regulator/anatop-regulator.c ++++ b/drivers/regulator/anatop-regulator.c +@@ -283,6 +283,14 @@ static int anatop_regulator_probe(struct + sreg->sel = 0; + sreg->bypass = true; + } ++ ++ /* ++ * In case vddpu was disabled by the bootloader, we need to set ++ * a sane default until imx6-cpufreq was probed and changes the ++ * voltage to the correct value. In this case we set 1.25V. ++ */ ++ if (!sreg->sel && !strcmp(sreg->name, "vddpu")) ++ sreg->sel = 22; + } else { + rdesc->ops = &anatop_rops; + } diff --git a/queue-3.17/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch b/queue-3.17/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch new file mode 100644 index 00000000000..126fbed3b7e --- /dev/null +++ b/queue-3.17/scsi-correct-return-values-for-.eh_abort_handler-implementations.patch @@ -0,0 +1,148 @@ +From b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Thu, 30 Oct 2014 09:44:36 +0100 +Subject: scsi: correct return values for .eh_abort_handler implementations + +From: Hannes Reinecke + +commit b6c92b7e0af575e2b8b05bdf33633cf9e1661cbf upstream. + +The .eh_abort_handler needs to return SUCCESS, FAILED, or +FAST_IO_FAIL. So fixup all callers to adhere to this requirement. + +Reviewed-by: Robert Elliott +Signed-off-by: Hannes Reinecke +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/NCR5380.c | 12 ++++++------ + drivers/scsi/aha1740.c | 2 +- + drivers/scsi/atari_NCR5380.c | 2 +- + drivers/scsi/esas2r/esas2r_main.c | 2 +- + drivers/scsi/megaraid.c | 8 ++++---- + drivers/scsi/sun3_NCR5380.c | 10 +++++----- + 6 files changed, 18 insertions(+), 18 deletions(-) + +--- a/drivers/scsi/NCR5380.c ++++ b/drivers/scsi/NCR5380.c +@@ -2647,14 +2647,14 @@ static void NCR5380_dma_complete(NCR5380 + * + * Purpose : abort a command + * +- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the +- * host byte of the result field to, if zero DID_ABORTED is ++ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the ++ * host byte of the result field to, if zero DID_ABORTED is + * used. + * +- * Returns : 0 - success, -1 on failure. ++ * Returns : SUCCESS - success, FAILED on failure. + * +- * XXX - there is no way to abort the command that is currently +- * connected, you have to wait for it to complete. If this is ++ * XXX - there is no way to abort the command that is currently ++ * connected, you have to wait for it to complete. If this is + * a problem, we could implement longjmp() / setjmp(), setjmp() + * called where the loop started in NCR5380_main(). + * +@@ -2704,7 +2704,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd + * aborted flag and get back into our main loop. + */ + +- return 0; ++ return SUCCESS; + } + #endif + +--- a/drivers/scsi/aha1740.c ++++ b/drivers/scsi/aha1740.c +@@ -531,7 +531,7 @@ static int aha1740_eh_abort_handler (Scs + * quiet as possible... + */ + +- return 0; ++ return SUCCESS; + } + + static struct scsi_host_template aha1740_template = { +--- a/drivers/scsi/atari_NCR5380.c ++++ b/drivers/scsi/atari_NCR5380.c +@@ -2607,7 +2607,7 @@ static void NCR5380_reselect(struct Scsi + * host byte of the result field to, if zero DID_ABORTED is + * used. + * +- * Returns : 0 - success, -1 on failure. ++ * Returns : SUCCESS - success, FAILED on failure. + * + * XXX - there is no way to abort the command that is currently + * connected, you have to wait for it to complete. If this is +--- a/drivers/scsi/esas2r/esas2r_main.c ++++ b/drivers/scsi/esas2r/esas2r_main.c +@@ -1057,7 +1057,7 @@ int esas2r_eh_abort(struct scsi_cmnd *cm + + cmd->scsi_done(cmd); + +- return 0; ++ return SUCCESS; + } + + spin_lock_irqsave(&a->queue_lock, flags); +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -1945,7 +1945,7 @@ megaraid_abort_and_reset(adapter_t *adap + cmd->device->id, (u32)cmd->device->lun); + + if(list_empty(&adapter->pending_list)) +- return FALSE; ++ return FAILED; + + list_for_each_safe(pos, next, &adapter->pending_list) { + +@@ -1968,7 +1968,7 @@ megaraid_abort_and_reset(adapter_t *adap + (aor==SCB_ABORT) ? "ABORTING":"RESET", + scb->idx); + +- return FALSE; ++ return FAILED; + } + else { + +@@ -1993,12 +1993,12 @@ megaraid_abort_and_reset(adapter_t *adap + list_add_tail(SCSI_LIST(cmd), + &adapter->completed_list); + +- return TRUE; ++ return SUCCESS; + } + } + } + +- return FALSE; ++ return FAILED; + } + + static inline int +--- a/drivers/scsi/sun3_NCR5380.c ++++ b/drivers/scsi/sun3_NCR5380.c +@@ -2590,15 +2590,15 @@ static void NCR5380_reselect (struct Scs + * Purpose : abort a command + * + * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the +- * host byte of the result field to, if zero DID_ABORTED is ++ * host byte of the result field to, if zero DID_ABORTED is + * used. + * +- * Returns : 0 - success, -1 on failure. ++ * Returns : SUCCESS - success, FAILED on failure. + * +- * XXX - there is no way to abort the command that is currently +- * connected, you have to wait for it to complete. If this is ++ * XXX - there is no way to abort the command that is currently ++ * connected, you have to wait for it to complete. If this is + * a problem, we could implement longjmp() / setjmp(), setjmp() +- * called where the loop started in NCR5380_main(). ++ * called where the loop started in NCR5380_main(). + */ + + static int NCR5380_abort(struct scsi_cmnd *cmd) diff --git a/queue-3.17/series b/queue-3.17/series index 13817c6a7d4..3e95b41d1b0 100644 --- a/queue-3.17/series +++ b/queue-3.17/series @@ -10,3 +10,18 @@ mmc-dw_mmc-avoid-write-to-cdthrctl-on-older-versions.patch mmc-omap_hsmmc-fix-uhs-card-with-ddr50-support.patch mmc-block-add-newline-to-sysfs-display-of-force_ro.patch mmc-sdhci-pci-o2micro-fix-dell-e5440-issue.patch +megaraid_sas-corrected-return-of-wait_event-from-abort-frame-path.patch +regulator-anatop-set-default-voltage-selector-for-vddpu.patch +scsi-correct-return-values-for-.eh_abort_handler-implementations.patch +f2fs-fix-possible-data-corruption-in-f2fs_write_begin.patch +nfs41-fix-nfs4_proc_layoutget-error-handling.patch +dcache-fix-kmemcheck-warning-in-switch_names.patch +dm-bufio-fix-memleak-when-using-a-dm_buffer-s-inline-bio.patch +dm-crypt-use-memzero_explicit-for-on-stack-buffer.patch +dm-cache-only-use-overwrite-optimisation-for-promotion-when-in-writeback-mode.patch +dm-cache-dirty-flag-was-mistakenly-being-cleared-when-promoting-via-overwrite.patch +dm-cache-fix-spurious-cell_defer-when-dealing-with-partial-block-at-end-of-device.patch +dm-space-map-metadata-fix-sm_bootstrap_get_nr_blocks.patch +dm-thin-fix-inability-to-discard-blocks-when-in-out-of-data-space-mode.patch +dm-thin-fix-missing-out-of-data-space-to-write-mode-transition-if-blocks-are-released.patch +dm-thin-fix-a-race-in-thin_dtr.patch -- 2.47.3