commit f23dc93c0e6772577309e150daf1906dbfd9d43b Author: Greg Kroah-Hartman Date: Mon Aug 2 10:24:59 2010 -0700 Linux 2.6.32.17 commit 8da946481f9b8b857216eafcc4a1ab48fdbe3bd7 Author: Daniel Ritz Date: Sat Dec 12 14:57:17 2009 -0300 V4L/DVB (13830): uvcvideo: add another YUYV format GUID for iSight cameras commit 68f194e027ecfbbc8d5515bc40787e542eed59e9 upstream. For some unknown reason, on a MacBookPro5,3 the iSight sometimes report a different video format GUID. This patch add the other (wrong) GUID to the format table, making the iSight work always w/o other problems. What it should report: 32595559-0000-0010-8000-00aa00389b71 What it often reports: 32595559-0000-0010-8000-000000389b71 Signed-off-by: Daniel Ritz Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Cc: Leann Ogasawara Signed-off-by: Greg Kroah-Hartman commit 16a7cf55c838e4a80ab4776d3ff0ffe48ef0724b Author: Dmitry Torokhov Date: Mon Jul 26 01:12:37 2010 -0700 Input: RX51 keymap - fix recent compile breakage commit 2e65a2075cc740b485ab203430bdf3459d5551b6 upstream. Commit 3fea60261e73 ("Input: twl40300-keypad - fix handling of "all ground" rows") broke compilation as I managed to use non-existent keycodes. Reported-by: Arjan van de Ven Signed-off-by: Dmitry Torokhov Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2e3d07384961134749541e3d2b39cac3241ead70 Author: Bob Copeland Date: Fri Jun 18 13:15:23 2010 -0400 ath5k: initialize ah->ah_current_channel commit b6855772f4a22c4fbdd4fcaceff5c8a527035123 upstream. ath5k assumes ah_current_channel is always a valid pointer in several places, but a newly created interface may not have a channel. To avoid null pointer dereferences, set it up to point to the first available channel until later reconfigured. This fixes the following oops: $ rmmod ath5k $ insmod ath5k $ iw phy0 set distance 11000 BUG: unable to handle kernel NULL pointer dereference at 00000006 IP: [] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] *pde = 00000000 Oops: 0000 [#1] last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90 scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci 8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc Pid: 1597, comm: iw Not tainted (2.6.32.14 #8) EIP: 0060:[] EFLAGS: 00010296 CPU: 0 EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080 ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000) Stack: d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0 <0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7 <0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000 Call Trace: [] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k] [] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211] [] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211] [] ? nla_parse+0x59/0xc0 [] ? genl_rcv_msg+0x169/0x1a0 [] ? genl_rcv_msg+0x0/0x1a0 [] ? netlink_rcv_skb+0x38/0x90 [] ? genl_rcv+0x19/0x30 [] ? netlink_unicast+0x1b3/0x220 [] ? netlink_sendmsg+0x26e/0x290 [] ? sock_sendmsg+0xbe/0xf0 [] ? autoremove_wake_function+0x0/0x50 [] ? __alloc_pages_nodemask+0x106/0x530 [] ? do_lookup+0x53/0x1b0 [] ? __link_path_walk+0x9b9/0x9e0 [] ? verify_iovec+0x50/0x90 [] ? sys_sendmsg+0x1e1/0x270 [] ? find_get_page+0x10/0x50 [] ? filemap_fault+0x5f/0x370 [] ? __do_fault+0x319/0x370 [] ? sys_socketcall+0x244/0x290 [] ? do_page_fault+0x1ec/0x270 [] ? do_page_fault+0x0/0x270 [] ? syscall_call+0x7/0xb Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24 0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7 43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2 EIP: [] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP 0068:cfa09bf4 CR2: 0000000000000006 ---[ end trace 54f73d6b10ceb87b ]--- Reported-by: Steve Brown Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c7fe2f529c6c6f11d48eb71d850031dc63f1b0d2 Author: Andre Osterhues Date: Tue Jul 13 15:59:17 2010 -0500 ecryptfs: Bugfix for error related to ecryptfs_hash_buckets commit a6f80fb7b5986fda663d94079d3bba0937a6b6ff upstream. The function ecryptfs_uid_hash wrongly assumes that the second parameter to hash_long() is the number of hash buckets instead of the number of hash bits. This patch fixes that and renames the variable ecryptfs_hash_buckets to ecryptfs_hash_bits to make it clearer. Fixes: CVE-2010-2492 Signed-off-by: Andre Osterhues Signed-off-by: Tyler Hicks Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d1a6b6c9ed5d5965d4961e39d57bfae3f8ac94ed Author: Tony Luck Date: Wed Jun 30 10:46:16 2010 -0700 Fix spinaphore down_spin() commit b70f4e85bfc4d7000036355b714a92d5c574f1be upstream. Typo in down_spin() meant it only read the low 32 bits of the "serve" value, instead of the full 64 bits. This results in the system hanging when the values in ticket/serve get larger than 32-bits. A big enough system running the right test can hit this in a just a few hours. Broken since 883a3acf5b0d4782ac35981227a0d094e8b44850 [IA64] Re-implement spinaphores using ticket lock concepts Reported via IRC by Bjorn Helgaas Signed-off-by: Tony Luck Signed-off-by: Greg Kroah-Hartman commit fe17e2bb5f588ee25647a5087710bab3e70d4e86 Author: Alan Jenkins Date: Mon Feb 22 16:03:58 2010 +0000 eeepc-laptop: check wireless hotplug events commit bc9d24a3aeb1532fc3e234907a8b6d671f7ed68f upstream. Before we mark the wireless device as unplugged, check PCI config space to see whether the wireless device is really disabled (and vice versa). This works around newer models which don't want the hotplug code, where we end up disabling the wired network device. My old 701 still works correctly with this. I can also simulate an afflicted model by changing the hardcoded PCI bus/slot number in the driver, and it seems to work nicely (although it is a bit noisy). In future this type of hotplug support will be implemented by the PCI core. The existing blacklist and the new warning message will be removed at that point. Signed-off-by: Alan Jenkins Signed-off-by: Corentin Chary Cc: Tim Gardner Signed-off-by: Greg Kroah-Hartman commit bf1fe0bc49306efd7b822d1a90bfafbd4cb68694 Author: Krzysztof Halasa Date: Fri Jun 11 01:08:20 2010 +0200 kbuild: Fix modpost segfault commit 1c938663d58b5b2965976a6f54cc51b5d6f691aa upstream. Alan writes: > program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o > Module.symvers -S vmlinux.o > > Program received signal SIGSEGV, Segmentation fault. It just hit me. It's the offset calculation in reloc_location() which overflows: return (void *)elf->hdr + sechdrs[section].sh_offset + (r->r_offset - sechdrs[section].sh_addr); E.g. for the first rodata r entry: r->r_offset < sechdrs[section].sh_addr and the expression in the parenthesis produces 0xFFFFFFE0 or something equally wise. Reported-by: Alan Signed-off-by: Krzysztof Hałasa Tested-by: Alan Signed-off-by: Michal Marek Signed-off-by: Greg Kroah-Hartman commit ee567ad914fef697cfffffd2940c022b50f8bc5e Author: Shanyu Zhao Date: Tue Jun 1 17:13:58 2010 -0700 iwlagn: verify flow id in compressed BA packet commit b561e8274f75831ee87e4ea378cbb1f9f050a51a upstream. The flow id (scd_flow) in a compressed BA packet should match the txq_id of the queue from which the aggregated packets were sent. However, in some hardware like the 1000 series, sometimes the flow id is 0 for the txq_id (10 to 19). This can cause the annoying message: [ 2213.306191] iwlagn 0000:01:00.0: Received BA when not expected [ 2213.310178] iwlagn 0000:01:00.0: Read index for DMA queue txq id (0), index 5, is out of range [0-256] 7 7. And even worse, if agg->wait_for_ba is true when the bad BA is arriving, this can cause system hang due to NULL pointer dereference because the code is operating in a wrong tx queue! Signed-off-by: Shanyu Zhao Signed-off-by: Pradeep Kulkarni Signed-off-by: Reinette Chatre Signed-off-by: Greg Kroah-Hartman commit e3bc0200396a03fb55e187bba268d49749722238 Author: Laurent Pinchart Date: Mon Apr 12 10:41:22 2010 -0300 V4L/DVB: uvcvideo: Add support for V4L2_PIX_FMT_Y16 commit 61421206833a4085d9bdf35b2b84cd9a67dfdfac upstream. The Miricle 307K (17dc:0202) camera reports a 16-bit greyscale format, support it in the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit b3671c74c3ebdcccdf96e627319dec7744ab0def Author: Laurent Pinchart Date: Sat Mar 13 18:12:15 2010 -0300 V4L/DVB: uvcvideo: Add support for Packard Bell EasyNote MX52 integrated webcam commit f129b03ba272c86c42ad476684caa0d6109cb383 upstream. The camera requires the STREAM_NO_FID quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 3cff495e70a35dca84c749467cfd2973d079c00c Author: Laurent Pinchart Date: Thu Mar 4 07:51:25 2010 -0300 V4L/DVB: uvcvideo: Add support for unbranded Arkmicro 18ec:3290 webcams commit 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c upstream. The camera requires the PROBE_DEF quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit fe2dba54e065b31005fd28d8cddbc838e275eabc Author: Stanislaw Gruszka Date: Wed Apr 28 17:03:15 2010 +0200 mac80211: fix supported rates IE if AP doesn't give us it's rates commit 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 upstream. If AP do not provide us supported rates before assiociation, send all rates we are supporting instead of empty information element. v1 -> v2: Add comment. Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 4abe1cbd9c9a9b9ab5cc3986df22c6532de36860 Author: Hiroshi Shimamoto Date: Mon Apr 19 15:32:20 2010 +0000 cxgb3: fix linkup issue commit 9441cad99b4b09d6b627351c2d282833868c116c upstream. I encountered an issue that not to link up on cxgb3 fabric. I bisected and found that this regression was introduced by 0f07c4ee8c800923ae7918c231532a9256233eed. Correct to pass phy_addr to cphy_init() at t3_xaui_direct_phy_prep(). Signed-off-by: Hiroshi Shimamoto Acked-by: Divy Le Ray Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 15b956904a38753fbc9ef8dfa1cafbf5b78e7331 Author: Ben Hutchings Date: Sat May 15 13:45:37 2010 -0300 V4L/DVB: budget: Select correct frontends commit d46b36e7f927772bb72524dc9f1e384e3cb4a975 upstream. Update the Kconfig selections to match the code. Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit a6507d3cb85e02d965f0367c3ed0de5a9b25d8f8 Author: Shane McDonald Date: Thu May 6 23:26:57 2010 -0600 MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1 commit 95e8f634d7a3ea5af40ec3fa42c8a152fd3a0624 upstream. In the FPU emulator code of the MIPS, the Cause bits of the FCSR register are not currently writeable by the ctc1 instruction. In odd corner cases, this can cause problems. For example, a case existed where a divide-by-zero exception was generated by the FPU, and the signal handler attempted to restore the FPU registers to their state before the exception occurred. In this particular setup, writing the old value to the FCSR register would cause another divide-by-zero exception to occur immediately. The solution is to change the ctc1 instruction emulator code to allow the Cause bits of the FCSR register to be writeable. This is the behaviour of the hardware that the code is emulating. This problem was found by Shane McDonald, but the credit for the fix goes to Kevin Kissell. In Kevin's words: I submit that the bug is indeed in that ctc_op: case of the emulator. The Cause bits (17:12) are supposed to be writable by that instruction, but the CTC1 emulation won't let them be updated by the instruction. I think that actually if you just completely removed lines 387-388 [...] things would work a good deal better. At least, it would be a more accurate emulation of the architecturally defined FPU. If I wanted to be really, really pedantic (which I sometimes do), I'd also protect the reserved bits that aren't necessarily writable. Signed-off-by: Shane McDonald To: anemo@mba.ocn.ne.jp To: kevink@paralogos.com To: sshtylyov@mvista.com Patchwork: http://patchwork.linux-mips.org/patch/1205/ Signed-off-by: Ralf Baechle Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 025be5bec7dabcbc1e972a0a8a7f41c6701fb3a0 Author: Richard Airlie Date: Mon Apr 5 22:22:46 2010 +0100 staging: rtl8192su: add Support for Belkin F5D8053 v6 commit d615da093eb0f691a73a754589e2a4a24a6f1ca7 upstream. Please find attached a patch which adds the device ID for the Belkin F5D8053 v6 to the rtl8192su driver. I've tested this in 2.6.34-rc3 (Ubuntu 9.10 amd64) and the network adapter is working flawlessly. Signed-off-by: Richard Airlie Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit cd67c595a03ec6a41f14ae060bfbb1757b80aa5a Author: Ayaz Abdulla Date: Tue Apr 13 18:49:51 2010 -0700 forcedeth: fix tx limit2 flag check commit 5c659322a904a7cc0265e7b183372b9bdebec6db upstream. This is a fix for bug 572201 @ bugs.debian.org This patch fixes the TX_LIMIT feature flag. The previous logic check for TX_LIMIT2 also took into account a device that only had TX_LIMIT set. Reported-by: Stephen Mulcahu Reported-by: Ben Huchings Signed-off-by: Ayaz Abdulla Signed-off-by: David S. Miller Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit e9594751e4454139901cb1d68dd05ad7f48bdb59 Author: Jean Delvare Date: Wed May 26 10:05:11 2010 -0300 V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probing commit 806b07c29b711aaf90c81d2a19711607769f8246 upstream. IR support on FusionHDTV cards is broken since kernel 2.6.31. One side effect of the switch to the standard binding model for IR I2C devices was to let i2c-core do the probing instead of the ir-kbd-i2c driver. There is a slight difference between the two probe methods: i2c-core uses 0-byte writes, while the ir-kbd-i2c was using 0-byte reads. As some IR I2C devices only support reads, the new probe method fails to detect them. For now, revert to letting the driver do the probe, using 0-byte reads. In the future, i2c-core will be extended to let callers of i2c_new_probed_device() provide a custom probing function. Signed-off-by: Jean Delvare Tested-by: "Timothy D. Lenz" Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 65019a1c668d1dbcc4c6bdcdb7bb66d8ea714752 Author: Ang Way Chuang Date: Thu May 27 02:02:09 2010 -0300 V4L/DVB: dvb-core: Fix ULE decapsulation bug commit 5c331fc8c19e181bffab46e9d18e1637cdc47170 upstream. Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation code has a bug that incorrectly treats ULE SNDU packed into the remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer field on the subsequent MPEG2-TS frame. Signed-off-by: Ang Way Chuang Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit ac633f17d4a5030d5924c1a85bbcde1ad42c3998 Author: Giuliano Pochini Date: Wed Feb 17 00:57:44 2010 +0100 ALSA: Echoaudio, fix Guru Meditation #00000005.48454C50 commit b721e68bdc5b39c51bf6a1469f8d3663fbe03243 upstream. This patch fixes a division by zero error in the irq handler. There is a small window between the hw_params() callback and when runtime->frame_bits is set by ALSA middle layer. When another substream is already running, if an interrupt is delivered during that window the irq handler calls pcm_pointer() which does a division by zero. The patch below makes the irq handler skip substreams that are initialized but not started yet. Cc to Clemens Ladisch because he proposed an alternate fix. For more information, please read the original thread in the linux-kernel mailing list: http://lkml.org/lkml/2010/2/2/187 Signed-off-by: Giuliano Pochini Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ddcd49b943272f275e890e9c1c06cfdbc0a899e3 Author: Andrej Gelenberg Date: Fri May 14 15:15:58 2010 -0700 revert "[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)" commit accd846698439ba18250e8fd5681af280446b853 upstream. 395913d0b1db37092ea3d9d69b832183b1dd84c5 ("[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)") is not needed, because there is no rwsem lock in cpufreq_ondemand and cpufreq_conservative anymore. Lock should not be released until the work done. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=1594 Signed-off-by: Andrej Gelenberg Cc: Mathieu Desnoyers Cc: Venkatesh Pallipadi Signed-off-by: Andrew Morton Acked-by: Mathieu Desnoyers Signed-off-by: Dave Jones Signed-off-by: Greg Kroah-Hartman commit e48db6326ecea360d79f42ec7fdaad53a328e362 Author: David Woodhouse Date: Sun May 2 11:21:21 2010 +0300 firmware_class: fix memory leak - free allocated pages commit dd336c554d8926c3348a2d5f2a5ef5597f6d1a06 upstream. fix memory leak introduced by the patch 6e03a201bbe: firmware: speed up request_firmware() 1. vfree won't release pages there were allocated explicitly and mapped using vmap. The memory has to be vunmap-ed and the pages needs to be freed explicitly 2. page array is moved into the 'struct firmware' so that we can free it from release_firmware() and not only in fw_dev_release() The fix doesn't break the firmware load speed. Cc: Johannes Berg Cc: Ming Lei Cc: Catalin Marinas Singed-off-by: Kay Sievers Signed-off-by: David Woodhouse Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman commit 46287c9a808ec7eb9f635f279474bdb1df2a8898 Author: Baruch Siach Date: Mon May 17 17:45:48 2010 -0700 dm9000: fix "BUG: spinlock recursion" commit 380fefb2ddabd4cd5f14dbe090481f0544e65078 upstream. dm9000_set_rx_csum and dm9000_hash_table are called from atomic context (in dm9000_init_dm9000), and from non-atomic context (via ethtool_ops and net_device_ops respectively). This causes a spinlock recursion BUG. Fix this by renaming these functions to *_unlocked for the atomic context, and make the original functions locking wrappers for use in the non-atomic context. Signed-off-by: Baruch Siach Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f4b01c2be53befd8374d1569e1ae10bf9648025a Author: Daniel Mack Date: Tue Apr 6 10:52:44 2010 +0200 libertas/sdio: 8686: set ECSI bit for 1-bit transfers commit 8a64c0f6b7ec7f758c4ef445e49f479e27fa2236 upstream. When operating in 1-bit mode, SDAT1 is used as dedicated interrupt line. However, the 8686 will only drive this line when the ECSI bit is set in the CCCR_IF register. Thanks to Alagu Sankar for pointing me in the right direction. Signed-off-by: Daniel Mack Cc: Alagu Sankar Cc: Volker Ernst Cc: Dan Williams Cc: John W. Linville Cc: Holger Schurig Cc: Bing Zhao Cc: libertas-dev@lists.infradead.org Cc: linux-wireless@vger.kernel.org Cc: linux-mmc@vger.kernel.org Acked-by: Dan Williams Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1e2894c496bbb024c457d2240559631f12efd019 Author: Matthew Garrett Date: Tue May 11 13:49:25 2010 -0400 ACPI: Unconditionally set SCI_EN on resume commit b6dacf63e9fb2e7a1369843d6cef332f76fca6a3 upstream. The ACPI spec tells us that the firmware will reenable SCI_EN on resume. Reality disagrees in some cases. The ACPI spec tells us that the only way to set SCI_EN is via an SMM call. https://bugzilla.kernel.org/show_bug.cgi?id=13745 shows us that doing so may break machines. Tracing the ACPI calls made by Windows shows that it unconditionally sets SCI_EN on resume with a direct register write, and therefore the overwhelming probability is that everything is fine with this behaviour. Signed-off-by: Matthew Garrett Tested-by: Rafael J. Wysocki Signed-off-by: Len Brown Cc: Kamal Mostafa Signed-off-by: Greg Kroah-Hartman commit 447cc37695575ab9fa8b00427b00ca228832ec25 Author: Len Brown Date: Thu Jul 22 16:54:27 2010 -0400 ACPI: skip checking BM_STS if the BIOS doesn't ask for it commit 718be4aaf3613cf7c2d097f925abc3d3553c0605 upstream. It turns out that there is a bit in the _CST for Intel FFH C3 that tells the OS if we should be checking BM_STS or not. Linux has been unconditionally checking BM_STS. If the chip-set is configured to enable BM_STS, it can retard or completely prevent entry into deep C-states -- as illustrated by turbostat: http://userweb.kernel.org/~lenb/acpi/utils/pmtools/turbostat/ ref: Intel Processor Vendor-Specific ACPI Interface Specification table 4 "_CST FFH GAS Field Encoding" Bit 1: Set to 1 if OSPM should use Bus Master avoidance for this C-state https://bugzilla.kernel.org/show_bug.cgi?id=15886 Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 784724e6862571cde726a78287d16867fbbf2b28 Author: Ondrej Zary Date: Tue Jun 8 00:32:49 2010 +0200 PM / x86: Save/restore MISC_ENABLE register commit 85a0e7539781dad4bfcffd98e72fa9f130f4e40d upstream. Save/restore MISC_ENABLE register on suspend/resume. This fixes OOPS (invalid opcode) on resume from STR on Asus P4P800-VM, which wakes up with MWAIT disabled. Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15385 Signed-off-by: Ondrej Zary Tested-by: Alan Stern Acked-by: H. Peter Anvin Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 7ff3f29680547064a5733c18dbfdb20a957cdbb2 Author: Steven Whitehouse Date: Fri Oct 2 11:50:54 2009 +0100 GFS2: Fix up system xattrs commit 2646a1f61a3b5525914757f10fa12b5b94713648 upstream. This code has been shamelessly stolen from XFS at the suggestion of Christoph Hellwig. I've not added support for cached ACLs so far... watch for that in a later patch, although this is designed in such a way that they should be easy to add. Signed-off-by: Steven Whitehouse Cc: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit 29540fc633e3f0ce474cf8d46806c0f92d1dd6f7 Author: Michal Hocko Date: Wed Jun 30 09:51:19 2010 +0200 futex: futex_find_get_task remove credentails check commit 7a0ea09ad5352efce8fe79ed853150449903b9f5 upstream. futex_find_get_task is currently used (through lookup_pi_state) from two contexts, futex_requeue and futex_lock_pi_atomic. None of the paths looks it needs the credentials check, though. Different (e)uids shouldn't matter at all because the only thing that is important for shared futex is the accessibility of the shared memory. The credentail check results in glibc assert failure or process hang (if glibc is compiled without assert support) for shared robust pthread mutex with priority inheritance if a process tries to lock already held lock owned by a process with a different euid: pthread_mutex_lock.c:312: __pthread_mutex_lock_full: Assertion `(-(e)) != 3 || !robust' failed. The problem is that futex_lock_pi_atomic which is called when we try to lock already held lock checks the current holder (tid is stored in the futex value) to get the PI state. It uses lookup_pi_state which in turn gets task struct from futex_find_get_task. ESRCH is returned either when the task is not found or if credentials check fails. futex_lock_pi_atomic simply returns if it gets ESRCH. glibc code, however, doesn't expect that robust lock returns with ESRCH because it should get either success or owner died. Signed-off-by: Michal Hocko Acked-by: Darren Hart Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Nick Piggin Cc: Alexey Kuznetsov Cc: Peter Zijlstra Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 05ae56ca1cd57e3b6fb57173e8f9e23f289880e9 Author: Marcelo Tosatti Date: Fri May 28 09:44:59 2010 -0300 KVM: MMU: invalidate and flush on spte small->large page size change Always invalidate spte and flush TLBs when changing page size, to make sure different sized translations for the same address are never cached in a CPU's TLB. Currently the only case where this occurs is when a non-leaf spte pointer is overwritten by a leaf, large spte entry. This can happen after dirty logging is disabled on a memslot, for example. Noticed by Andrea. KVM-Stable-Tag Signed-off-by: Marcelo Tosatti Signed-off-by: Avi Kivity (cherry picked from commit 3be2264be3c00865116f997dc53ebcc90fe7fc4b) commit a71507e88e9f1ff0d958d77e9194827d7898c42b Author: Joerg Roedel Date: Mon May 17 14:43:35 2010 +0200 KVM: SVM: Implement workaround for Erratum 383 This patch implements a workaround for AMD erratum 383 into KVM. Without this erratum fix it is possible for a guest to kill the host machine. This patch implements the suggested workaround for hypervisors which will be published by the next revision guide update. [jan: fix overflow warning on i386] [xiao: fix unused variable warning] Cc: stable@kernel.org Signed-off-by: Joerg Roedel Signed-off-by: Jan Kiszka Signed-off-by: Xiao Guangrong Signed-off-by: Avi Kivity (cherry picked from commit 67ec66077799f2fef84b21a643912b179c422281) commit 4d2e11d122c66cd284881c3442efb4f41c1ffe5c Author: Joerg Roedel Date: Mon May 17 14:43:34 2010 +0200 KVM: SVM: Handle MCEs early in the vmexit process This patch moves handling of the MC vmexits to an earlier point in the vmexit. The handle_exit function is too late because the vcpu might alreadry have changed its physical cpu. Cc: stable@kernel.org Signed-off-by: Joerg Roedel Signed-off-by: Avi Kivity (cherry picked from commit fe5913e4e1700cbfc337f4b1da9ddb26f6a55586) commit 57b8799a75fca910443b5fcc645b091d30aac5db Author: Avi Kivity Date: Thu May 27 14:35:58 2010 +0300 KVM: MMU: Remove user access when allowing kernel access to gpte.w=0 page If cr0.wp=0, we have to allow the guest kernel access to a page with pte.w=0. We do that by setting spte.w=1, since the host cr0.wp must remain set so the host can write protect pages. Once we allow write access, we must remove user access otherwise we mistakenly allow the user to write the page. Reviewed-by: Xiao Guangrong Signed-off-by: Avi Kivity (cherry picked from commit 69325a122580d3a7b26589e8efdd6663001c3297) commit 282d0217435ad7747d615cc19331d72e76f3fa3e Author: Frank Mayhar Date: Sun May 30 22:50:06 2010 -0400 ext4: Make fsync sync new parent directories in no-journal mode commit 14ece1028b3ed53ffec1b1213ffc6acaf79ad77c upstream (as of v2.6.34-git13) Add a new ext4 state to tell us when a file has been newly created; use that state in ext4_sync_file in no-journal mode to tell us when we need to sync the parent directory as well as the inode and data itself. This fixes a problem in which a panic or power failure may lose the entire file even when using fsync, since the parent directory entry is lost. Addresses-Google-Bug: #2480057 Signed-off-by: Frank Mayhar Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 7b3bfead648da9a5457a639f08eefa96bf4c60d1 Author: Ben Hutchings Date: Sun May 30 22:50:05 2010 -0400 ext4: Fix compat EXT4_IOC_ADD_GROUP commit 4d92dc0f00a775dc2e1267b0e00befb783902fe7 upstream (as of v2.6.34-git13) struct ext4_new_group_input needs to be converted because u64 has only 32-bit alignment on some 32-bit architectures, notably i386. Signed-off-by: Ben Hutchings Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 489e65d8ef73c154e1c14eb935081fd7f30a71d9 Author: Ben Hutchings Date: Sun May 30 22:50:04 2010 -0400 ext4: Conditionally define compat ioctl numbers commit 899ad0cea6ad7ff4ba24b16318edbc3cbbe03fad upstream (as of v2.6.34-git13) It is unnecessary, and in general impossible, to define the compat ioctl numbers except when building the filesystem with CONFIG_COMPAT defined. Signed-off-by: Ben Hutchings Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit cfc3ed8bbe8eaa8b35326b10a8dc7aa6bb8da2a6 Author: Dmitry Monakhov Date: Sun May 30 22:50:03 2010 -0400 ext4: restart ext4_ext_remove_space() after transaction restart commit 0617b83fa239db9743a18ce6cc0e556f4d0fd567 upstream (as of v2.6.34-git13) If i_data_sem was internally dropped due to transaction restart, it is necessary to restart path look-up because extents tree was possibly modified by ext4_get_block(). https://bugzilla.kernel.org/show_bug.cgi?id=15827 Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Acked-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit 6a68fa01f9eb787419ce10d4481617ed241f4b44 Author: Theodore Ts'o Date: Sun May 30 22:50:02 2010 -0400 ext4: Clear the EXT4_EOFBLOCKS_FL flag only when warranted commit 786ec7915e530936b9eb2e3d12274145cab7aa7d upstream (as of v2.6.34-git13) Dimitry Monakhov discovered an edge case where it was possible for the EXT4_EOFBLOCKS_FL flag could get cleared unnecessarily. This is true; I have a test case that can be exercised via downloading and decompressing the file: wget ftp://ftp.kernel.org/pub/linux/kernel/people/tytso/ext4-testcases/eofblocks-fl-test-case.img.bz2 bunzip2 eofblocks-fl-test-case.img dd if=/dev/zero of=eofblocks-fl-test-case.img bs=1k seek=17925 bs=1k count=1 conv=notrunc However, triggering it in real life is highly unlikely since it requires an extremely fragmented sparse file with a hole in exactly the right place in the extent tree. (It actually took quite a bit of work to generate this test case.) Still, it's nice to get even extreme corner cases to be correct, so this patch makes sure that we don't clear the EXT4_EOFBLOCKS_FL incorrectly even in this corner case. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit b47b979f9d5c199e34a32d3fbbe64a7fbf1ddcb2 Author: Theodore Ts'o Date: Sun May 30 22:50:01 2010 -0400 ext4: Avoid crashing on NULL ptr dereference on a filesystem error commit f70f362b4a6fe47c239dbfb3efc0cc2c10e4f09c upstream (as of v2.6.34-git13) If the EOFBLOCK_FL flag is set when it should not be and the inode is zero length, then eh_entries is zero, and ex is NULL, so dereferencing ex to print ex->ee_block causes a kernel OOPS in ext4_ext_map_blocks(). On top of that, the error message which is printed isn't very helpful. So we fix this by printing something more explanatory which doesn't involve trying to print ex->ee_block. Addresses-Google-Bug: #2655740 Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit b6eaf5813482cd0f7a26be329845518100097181 Author: Dmitry Monakhov Date: Sun May 30 22:50:00 2010 -0400 ext4: Use bitops to read/modify i_flags in struct ext4_inode_info commit 12e9b892002d9af057655d35b44db8ee9243b0dc upstream (as of v2.6.34-git13) At several places we modify EXT4_I(inode)->i_flags without holding i_mutex (ext4_do_update_inode, ...). These modifications are racy and we can lose updates to i_flags. So convert handling of i_flags to use bitops which are atomic. https://bugzilla.kernel.org/show_bug.cgi?id=15792 Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 714b56001acd9d382772f2bf89b8219ca50342c3 Author: Jan Kara Date: Sun May 30 22:49:59 2010 -0400 ext4: Show journal_checksum option commit 39a4bade8c1826b658316d66ee81c09b0a4d7d42 upstream (as of v2.6.34-git13) We failed to show journal_checksum option in /proc/mounts. Fix it. Signed-off-by: Jan Kara Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit f6784b3b11fb38c1f3f4be686720b022babfd1e8 Author: Curt Wohlgemuth Date: Sun May 30 22:49:58 2010 -0400 ext4: check for a good block group before loading buddy pages commit 8a57d9d61a6e361c7bb159dda797672c1df1a691 upstream (as of v2.6.34-git13) This adds a new field in ext4_group_info to cache the largest available block range in a block group; and don't load the buddy pages until *after* we've done a sanity check on the block group. With large allocation requests (e.g., fallocate(), 8MiB) and relatively full partitions, it's easy to have no block groups with a block extent large enough to satisfy the input request length. This currently causes the loop during cr == 0 in ext4_mb_regular_allocator() to load the buddy bitmap pages for EVERY block group. That can be a lot of pages. The patch below allows us to call ext4_mb_good_group() BEFORE we load the buddy pages (although we have check again after we lock the block group). Addresses-Google-Bug: #2578108 Addresses-Google-Bug: #2704453 Signed-off-by: Curt Wohlgemuth Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 0a27a9e513fa9a229745fe94e42b020f66a7ec10 Author: Nikanth Karthikesan Date: Sun May 30 22:49:57 2010 -0400 ext4: Prevent creation of files larger than RLIMIT_FSIZE using fallocate commit 6d19c42b7cf81c39632b6d4dbc514e8449bcd346 upstream (as of v2.6.34-git13) Currently using posix_fallocate one can bypass an RLIMIT_FSIZE limit and create a file larger than the limit. Add a check for that. Signed-off-by: Nikanth Karthikesan Signed-off-by: Amit Arora Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 2421348fe2154e9ddadf25794d19833649790db5 Author: Curt Wohlgemuth Date: Sun May 30 22:49:56 2010 -0400 ext4: Remove extraneous newlines in ext4_msg() calls commit fbe845ddf368f77f86aa7500f8fd2690f54c66a8 upstream (as of v2.6.34-git13) Addresses-Google-Bug: #2562325 Signed-off-by: Curt Wohlgemuth Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit b502cbd52881b5a7f86fc126f6b1e0e58fbc9b0c Author: Dmitry Monakhov Date: Sun May 30 22:49:55 2010 -0400 ext4: init statistics after journal recovery commit 84061e07c5fbbbf9dc8aef8fb750fc3a2dfc31f3 upstream (as of v2.6.34-git13) Currently block/inode/dir counters initialized before journal was recovered. In fact after journal recovery this info will probably change. And freeblocks it critical for correct delalloc mode accounting. https://bugzilla.kernel.org/show_bug.cgi?id=15768 Signed-off-by: Dmitry Monakhov Acked-by: Jan Kara Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 55a83256dc7c79c85531b003a71bba37852a48af Author: Dmitry Monakhov Date: Sun May 30 22:49:54 2010 -0400 ext4: clean up inode bitmaps manipulation in ext4_free_inode commit d17413c08cd2b1dd2bf2cfdbb0f7b736b2b2b15c upstrea (as of v2..34-git13) - Reorganize locking scheme to batch two atomic operation in to one. This also allow us to state what healthy group must obey following rule ext4_free_inodes_count(sb, gdp) == ext4_count_free(inode_bitmap, NUM); - Fix possible undefined pointer dereference. - Even if group descriptor stats aren't accessible we have to update inode bitmaps. - Move non-group members update out of group_lock. Note: this commit has been observed to fix fs corruption problems under heavy fs load Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit ff2d83ca9df8202d9d8cff73c695ec1f0a596028 Author: Dmitry Monakhov Date: Sun May 30 22:49:53 2010 -0400 ext4: Do not zero out uninitialized extents beyond i_size commit 21ca087a3891efab4d45488db8febee474d26c68 upstream (as of v2.6.34-git13) The extents code will sometimes zero out blocks and mark them as initialized instead of splitting an extent into several smaller ones. This optimization however, causes problems if the extent is beyond i_size because fsck will complain if there are uninitialized blocks after i_size as this can not be distinguished from an inode that has an incorrect i_size field. https://bugzilla.kernel.org/show_bug.cgi?id=15742 Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 342c35e4f561cefbd927248fbcd45bf68afc12a9 Author: Eric Sandeen Date: Sun May 30 22:49:52 2010 -0400 ext4: don't scan/accumulate more pages than mballoc will allocate commit c445e3e0a5c2804524dec6e55f66d63f6bc5bc3e upstream (as of v2.6.34-git13) There was a bug reported on RHEL5 that a 10G dd on a 12G box had a very, very slow sync after that. At issue was the loop in write_cache_pages scanning all the way to the end of the 10G file, even though the subsequent call to mpage_da_submit_io would only actually write a smallish amt; then we went back to the write_cache_pages loop ... wasting tons of time in calling __mpage_da_writepage for thousands of pages we would just revisit (many times) later. Upstream it's not such a big issue for sys_sync because we get to the loop with a much smaller nr_to_write, which limits the loop. However, talking with Aneesh he realized that fsync upstream still gets here with a very large nr_to_write and we face the same problem. This patch makes mpage_add_bh_to_extent stop the loop after we've accumulated 2048 pages, by setting mpd->io_done = 1; which ultimately causes the write_cache_pages loop to break. Repeating the test with a dirty_ratio of 80 (to leave something for fsync to do), I don't see huge IO performance gains, but the reduction in cpu usage is striking: 80% usage with stock, and 2% with the below patch. Instrumenting the loop in write_cache_pages clearly shows that we are wasting time here. Eventually we need to change mpage_da_map_pages() also submit its I/O to the block layer, subsuming mpage_da_submit_io(), and then change it call ext4_get_blocks() multiple times. Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 7a5fb6dc311ddb933e8299cb89fab289bc846c9b Author: Eric Sandeen Date: Sun May 30 22:49:51 2010 -0400 ext4: stop issuing discards if not supported by device commit a30eec2a8650a77f754e84b2e15f062fe652baa7 upstream (as of v2.6.34-git13) Turn off issuance of discard requests if the device does not support it - similar to the action we take for barriers. This will save a little computation time if a non-discardable device is mounted with -o discard, and also makes it obvious that it's not doing what was asked at mount time ... Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit e6afda19e101a5c85eb43ec49f00b8336002f2cd Author: Eric Sandeen Date: Sun May 30 22:49:50 2010 -0400 ext4: don't return to userspace after freezing the fs with a mutex held commit 6b0310fbf087ad6e9e3b8392adca97cd77184084 upstream (as of v2.6.34-git13) ext4_freeze() used jbd2_journal_lock_updates() which takes the j_barrier mutex, and then returns to userspace. The kernel does not like this: ================================================ [ BUG: lock held when returning to user space! ] ------------------------------------------------ lvcreate/1075 is leaving the kernel with locks still held! 1 lock held by lvcreate/1075: #0: (&journal->j_barrier){+.+...}, at: [] jbd2_journal_lock_updates+0xe1/0xf0 Use vfs_check_frozen() added to ext4_journal_start_sb() and ext4_force_commit() instead. Addresses-Red-Hat-Bugzilla: #568503 Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit ad86a2309c447ebd7fb238f6bafb268e6b7e95b5 Author: Eric Sandeen Date: Sun May 30 22:49:49 2010 -0400 ext4: check s_log_groups_per_flex in online resize code commit 42007efd569f1cf3bfb9a61da60ef6c2179508ca upstream (as of v2.6.34-git13) If groups_per_flex < 2, sbi->s_flex_groups[] doesn't get filled out, and every other access to this first tests s_log_groups_per_flex; same thing needs to happen in resize or we'll wander off into a null pointer when doing an online resize of the file system. Thanks to Christoph Biedl, who came up with the trivial testcase: # truncate --size 128M fsfile # mkfs.ext3 -F fsfile # tune2fs -O extents,uninit_bg,dir_index,flex_bg,huge_file,dir_nlink,extra_isize fsfile # e2fsck -yDf -C0 fsfile # truncate --size 132M fsfile # losetup /dev/loop0 fsfile # mount /dev/loop0 mnt # resize2fs -p /dev/loop0 https://bugzilla.kernel.org/show_bug.cgi?id=13549 Reported-by: Alessandro Polverini Test-case-by: Christoph Biedl Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 6c6671bf3517688371200d8b7e0aaf81e8d82bcc Author: Dmitry Monakhov Date: Sun May 30 22:49:48 2010 -0400 ext4: fix quota accounting in case of fallocate commit 35121c9860316d7799cea0fbc359a9186e7c2747 upstream (as of v2.6.34-git13) allocated_meta_data is already included in 'used' variable. Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit a625298da6c693825126b7054d8ff4a95f2b5668 Author: Christian Borntraeger Date: Sun May 30 22:49:47 2010 -0400 ext4: allow defrag (EXT4_IOC_MOVE_EXT) in 32bit compat mode commit b684b2ee9409f2890a8b3aea98525bbe5f84e276 upstream (as of v2.6.34-git13) I have an x86_64 kernel with i386 userspace. e4defrag fails on the EXT4_IOC_MOVE_EXT ioctl because it is not wired up for the compat case. It seems that struct move_extent is compat save, only types with fixed widths are used: { __u32 reserved; /* should be zero */ __u32 donor_fd; /* donor file descriptor */ __u64 orig_start; /* logical start offset in block for orig */ __u64 donor_start; /* logical start offset in block for donor */ __u64 len; /* block length to be moved */ __u64 moved_len; /* moved block length */ }; Lets just wire up EXT4_IOC_MOVE_EXT for the compat case. Signed-off-by: Christian Borntraeger Signed-off-by: "Theodore Ts'o" Reviewed-by: Eric Sandeen CC: Akira Fujita Signed-off-by: Greg Kroah-Hartman commit 60986a16a01df755929ec52bf31175f8dce8e724 Author: Jing Zhang Date: Sun May 30 22:49:46 2010 -0400 ext4: rename ext4_mb_release_desc() to ext4_mb_unload_buddy() commit e39e07fdfd98be8650385f12a7b81d6adc547510 upstream (as of v2.6.34-git13) This function cleans up after ext4_mb_load_buddy(), so the renaming makes the code clearer. Signed-off-by: Jing Zhang Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 99e25a991d55ab727710829555cf79a24578ea02 Author: Jing Zhang Date: Sun May 30 22:49:45 2010 -0400 ext4: Remove unnecessary call to ext4_get_group_desc() in mballoc commit 62e823a2cba18509ee826d775270e8ef9071b5bc upstream (as of v2.6.34-git13) Signed-off-by: Jing Zhang Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit caf4fd5d6a45bf7f1db7a966354207475b212322 Author: Jing Zhang Date: Sun May 30 22:49:44 2010 -0400 ext4: fix memory leaks in error path handling of ext4_ext_zeroout() commit b720303df7352d4a7a1f61e467e0a124913c0d41 upstream (as of v2.6.34-git13) When EIO occurs after bio is submitted, there is no memory free operation for bio, which results in memory leakage. And there is also no check against bio_alloc() for bio. Acked-by: Dave Kleikamp Signed-off-by: Jing Zhang Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit ee02586911929717c8a1ff47d0b447c615da0b70 Author: Dmitry Monakhov Date: Sun May 30 22:49:43 2010 -0400 ext4: check missed return value in ext4_sync_file() commit 0671e704658b9f26f85e78d51176daa861f955c7 upstream (as of v2.6.34-git13) Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 43a1669ae07d79d6462f99bccf649dc3ae39e451 Author: Theodore Ts'o Date: Sun May 30 22:49:42 2010 -0400 ext4: Issue the discard operation *before* releasing the blocks to be reused commit b90f687018e6d6c77d981b09203780f7001407e5 upstream (as of v2.6.34-rc6) Otherwise, we can end up having data corruption because the blocks could get reused and then discarded! https://bugzilla.kernel.org/show_bug.cgi?id=15579 Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit adaf14bef627b08726d0f91aeff2594e21451010 Author: Curt Wohlgemuth Date: Sun May 30 22:49:41 2010 -0400 ext4: Fix buffer head leaks after calls to ext4_get_inode_loc() commit fd2dd9fbaf9e498ec63eef298921e36556f7214c upstream (as of v2.6.34-rc6) Calls to ext4_get_inode_loc() returns with a reference to a buffer head in iloc->bh. The callers of this function in ext4_write_inode() when in no journal mode and in ext4_xattr_fiemap() don't release the buffer head after using it. Addresses-Google-Bug: #2548165 Signed-off-by: Curt Wohlgemuth Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit e30014924c6ea0c42ec4caeaa7782f11299d2ee9 Author: Curt Wohlgemuth Date: Sun May 30 22:49:40 2010 -0400 ext4: Fix possible lost inode write in no journal mode commit 8b472d739b2ddd8ab7fb278874f696cd95b25a5e upstream (as of v2.6.34-rc6) In the no-journal case, ext4_write_inode() will fetch the bh and call sync_dirty_buffer() on it. However, if the bh has already been written and the bh reclaimed for some other purpose, AND if the inode is the only one in the inode table block in use, then ext4_get_inode_loc() will not read the inode table block from disk, but as an optimization, fill the block with zero's assuming that its caller will copy in the on-disk version of the inode. This is not done by ext4_write_inode(), so the contents of the inode can simply get lost. The fix is to use __ext4_get_inode_loc() with in_mem set to 0, instead of ext4_get_inode_loc(). Long term the API needs to be fixed so it's obvious why latter is not safe. Addresses-Google-Bug: #2526446 Signed-off-by: Curt Wohlgemuth Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 84b29e4a5037d97d72da25fc40d879a29bf1846d Author: Eric Sandeen Date: Sun May 30 22:49:39 2010 -0400 ext4: Fixed inode allocator to correctly track a flex_bg's used_dirs commit c4caae25187ff3f5e837c6f04eb1acc2723c72d3 upstream (as of v2.6.34-rc3) When used_dirs was introduced for the flex_groups struct, it looks like the accounting was not put into place properly, in some places manipulating free_inodes rather than used_dirs. Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 112ba39e2f19652f2baa3823e5ca76848717d905 Author: Jan Kara Date: Sun May 30 22:49:38 2010 -0400 ext4: Fix estimate of # of blocks needed to write indirect-mapped files commit d330a5befb88875a9b3d2db62f9b74dadf660b13 upstream (as of v2.6.34-rc3) http://bugzilla.kernel.org/show_bug.cgi?id=15420 Signed-off-by: Jan Kara Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 77795ad5902a93ea8f5978da54687b701220a5e5 Author: Akira Fujita Date: Sun May 30 22:49:37 2010 -0400 ext4: Code cleanup for EXT4_IOC_MOVE_EXT ioctl commit c437b2733520599a2c6e0dbcdeae611319f84707 upstream (as of v2.6.33-git11) a) Fix sparse warning in ext4_ioctl() b) Remove unneeded variable in mext_leaf_block() c) Fix spelling typo in mext_check_arguments() Signed-off-by: Akira Fujita Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit bff3bb48504169e26c55da6847322310e7a0b36e Author: Akira Fujita Date: Sun May 30 22:49:36 2010 -0400 ext4: Fix the NULL reference in double_down_write_data_sem() commit 7247c0caa23d94a1cb6b307edba9dc45fb0798d4 upstream (as of v2.6.33-git11) If EXT4_IOC_MOVE_EXT ioctl is called with NULL donor_fd, fget() in ext4_ioctl() gets inappropriate file structure for donor; so we need to do this check earlier, before calling double_down_write_data_sem(). Signed-off-by: Akira Fujita Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 68285a49fce5634e194be0de1aec6e423d74e1cc Author: Akira Fujita Date: Sun May 30 22:49:35 2010 -0400 ext4: Fix insertion point of extent in mext_insert_across_blocks() commit 5fd5249aa36fad98c9fd5edced352939e54f9324 upstream (as of v2.6.33-git11) If the leaf node has 2 extent space or fewer and EXT4_IOC_MOVE_EXT ioctl is called with the file offset where after the 2nd extent covers, mext_insert_across_blocks() always tries to insert extent into the first extent. As a result, the file gets corrupted because of wrong extent order. The patch fixes this problem. Signed-off-by: Akira Fujita Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 2b8aa5edf84a8e7cc432cbfda2be7cefa0a46347 Author: Toshiyuki Okajima Date: Sun May 30 22:49:34 2010 -0400 ext4: make "offset" consistent in ext4_check_dir_entry() commit b8b8afe236e97b6359d46d3a3f8c46455e192271 upstream (as of v2.6.33-git11) The callers of ext4_check_dir_entry() usually pass in the "file offset" (ext4_readdir, htree_dirblock_to_tree, search_dirblock, ext4_dx_find_entry, empty_dir), but a few callers (add_dirent_to_buf, ext4_delete_entry) only pass in the buffer offset. To accomodate those last two (which would be hard to fix otherwise), this patch changes ext4_check_dir_entry() to print the physical block number and the relative offset as well as the passed-in offset. Signed-off-by: Toshiyuki Okajima Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 449147576c7045a183fc2283b103c9a4f290b3de Author: Dmitry Monakhov Date: Sun May 30 22:49:33 2010 -0400 ext4: Handle non empty on-disk orphan link commit 6e3617e579e070d3655a93ee9ed7149113e795e0 upstream (as of v2.6.33-git11) In case of truncate errors we explicitly remove inode from in-core orphan list via orphan_del(NULL, inode) without modifying the on-disk list. But later on, the same inode may be inserted in the orphan list again which will result the on-disk linked list getting corrupted. If inode i_dtime contains valid value, then skip on-disk list modification. Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 2c20b11766ad108f31b550fe28a32cf2ec445b19 Author: Dmitry Monakhov Date: Sun May 30 22:49:32 2010 -0400 ext4: explicitly remove inode from orphan list after failed direct io commit da1dafca84413145f5ac59998b4cdd06fb89f721 upstream (as of v2.6.33-git11) Otherwise non-empty orphan list will be triggered on umount. Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 338ae6b7be4525d210a49c3e0433ff6a1a34f35d Author: Dmitry Monakhov Date: Sun May 30 22:49:31 2010 -0400 ext4: fix error handling in migrate commit f39490bcd1691d65dc33689222a12e1fc13dd824 upstream (as of v2.6.33-git11) Set i_nlink to zero for temporary inode from very beginning. otherwise we may fail to start new journal handle and this inode will be unreferenced but with i_nlink == 1 Since we hold inode reference it can not be pruned. Also add missed journal_start retval check. Signed-off-by: Dmitry Monakhov Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit cc4e25d160d611156c74cfca62f1fe331c07ac62 Author: Tao Ma Date: Sun May 30 22:49:30 2010 -0400 ext4: Fix fencepost error in chosing choosing group vs file preallocation. commit cc483f102c3f703e853c96f95a654f0106fb2603 upstream (as of v2.6.33-git11) The ext4 multiblock allocator decides whether to use group or file preallocation based on the file size. When the file size reaches s_mb_stream_request (default is 16 blocks), it changes to use a file-specific preallocation. This is cool, but it has a tiny problem. See a simple script: mkfs.ext4 -b 1024 /dev/sda8 1000000 mount -t ext4 -o nodelalloc /dev/sda8 /mnt/ext4 for((i=0;i<5;i++)) do cat /mnt/4096>>/mnt/ext4/a #4096 is a file with 4096 characters. cat /mnt/4096>>/mnt/ext4/b done debuge4fs -R 'stat a' /dev/sda8|grep BLOCKS -A 1 And you get BLOCKS: (0-14):8705-8719, (15):2356, (16-19):8465-8468 So there are 3 extents, a bit strange for the lonely 15th logical block. As we write to the 16 blocks, we choose file preallocation in ext4_mb_group_or_file, but in ext4_mb_normalize_request, we meet with the 16*1024 range, so no preallocation will be carried. file b then reserves the space after '2356', so when when write 16, we start from another part. This patch just change the check in ext4_mb_group_or_file, so that for the lonely 15 we will still use group preallocation. After the patch, we will get: debuge4fs -R 'stat a' /dev/sda8|grep BLOCKS -A 1 BLOCKS: (0-15):8705-8720, (16-19):8465-8468 Looks more sane. Thanks. Signed-off-by: Tao Ma Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 196739244e2720a6fa8cca8889993fe77ea59501 Author: Jiaying Zhang Date: Sun May 30 22:49:29 2010 -0400 ext4: Add flag to files with blocks intentionally past EOF commit c8d46e41bc744c8fa0092112af3942fcd46c8b18 upstream (as of v2.6.33-git11) fallocate() may potentially instantiate blocks past EOF, depending on the flags used when it is called. e2fsck currently has a test for blocks past i_size, and it sometimes trips up - noticeably on xfstests 013 which runs fsstress. This patch from Jiayang does fix it up - it (along with e2fsprogs updates and other patches recently from Aneesh) has survived many fsstress runs in a row. Signed-off-by: Eric Sandeen Signed-off-by: Jiaying Zhang Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 7085239d9d0eb35533f9ec824346ea09143a3ab3 Author: Curt Wohlgemuth Date: Sun May 30 22:49:28 2010 -0400 ext4: Fix BUG_ON at fs/buffer.c:652 in no journal mode commit 73b50c1c92666d326b5fa2c945d46509f2f6d91f upstream (as of v2.6.33-git11) Calls to ext4_handle_dirty_metadata should only pass in an inode pointer for inode-specific metadata, and not for shared metadata blocks such as inode table blocks, block group descriptors, the superblock, etc. The BUG_ON can get tripped when updating a special device (such as a block device) that is opened (so that i_mapping is set in fs/block_dev.c) and the file system is mounted in no journal mode. Addresses-Google-Bug: #2404870 Signed-off-by: Curt Wohlgemuth Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 884aefaa8bbc07cdce4e77637f810cdab5940957 Author: Theodore Ts'o Date: Sun May 30 22:49:27 2010 -0400 ext4: Use bitops to read/modify EXT4_I(inode)->i_state commit 19f5fb7ad679bb361222c7916086435020c37cce upstream (as of v2.6.33-git11) At several places we modify EXT4_I(inode)->i_state without holding i_mutex (ext4_release_file, ext4_bmap, ext4_journalled_writepage, ext4_do_update_inode, ...). These modifications are racy and we can lose updates to i_state. So convert handling of i_state to use bitops which are atomic. Cc: Jan Kara Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 6595162b533a3e8d450dd13caec28758892d1be1 Author: Aneesh Kumar K.V Date: Sun May 30 22:49:26 2010 -0400 ext4: Drop EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE flag commit 1296cc85c26e94eb865d03f82140f27d598de467 upstream (as of v2.6.33-rc6) We should update reserve space if it is delalloc buffer and that is indicated by EXT4_GET_BLOCKS_DELALLOC_RESERVE flag. So use EXT4_GET_BLOCKS_DELALLOC_RESERVE in place of EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE [ Stable note: This fixes a corruption cuased by the following reproduction case: rm -f $TEST_FN touch $TEST_FN fallocate -n -o 656712 -l 858907 $TEST_FN dd if=/dev/zero of=$TEST_FN conv=notrunc bs=1 seek=1011020 count=36983 sync dd if=/dev/zero of=$TEST_FN conv=notrunc bs=1 seek=332121 count=24005 dd if=/dev/zero of=$TEST_FN conv=notrunc bs=1 seek=1040179 count=93319 If the filesystem is then unmounted and e2fsck run forced, the i_blocks field for the file $TEST_FN will be found to be incorrect. ] Signed-off-by: Aneesh Kumar K.V Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 8b1213929317c582956da6c76400c8ba3898d35e Author: Aneesh Kumar K.V Date: Sun May 30 22:49:25 2010 -0400 ext4: Fix quota accounting error with fallocate commit 5f634d064c709ea02c3cdaa850a08323a4a4bf28 upstream (as of v2.6.33-rc6) When we fallocate a region of the file which we had recently written, and which is still in the page cache marked as delayed allocated blocks we need to make sure we don't do the quota update on writepage path. This is because the needed quota updated would have already be done by fallocate. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Greg Kroah-Hartman commit d285d892115759f005207ea7bb9e08e3c213e550 Author: Aneesh Kumar K.V Date: Sun May 30 22:49:24 2010 -0400 ext4: Handle -EDQUOT error on write commit 1db913823c0f8360fccbd24ca67eb073966a5ffd upstream (as of v2.6.33-rc6) We need to release the journal before we do a write_inode. Otherwise we could deadlock. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Greg Kroah-Hartman commit c9b832385f007ceac33b7515f24f2f2dcfd9c2ce Author: Theodore Ts'o Date: Sun May 30 22:49:23 2010 -0400 ext4: Calculate metadata requirements more accurately commit 9d0be50230b333005635967f7ecd4897dbfd181b upstream (as of v2.6.33-rc3) In the past, ext4_calc_metadata_amount(), and its sub-functions ext4_ext_calc_metadata_amount() and ext4_indirect_calc_metadata_amount() badly over-estimated the number of metadata blocks that might be required for delayed allocation blocks. This didn't matter as much when functions which managed the reserved metadata blocks were more aggressive about dropping reserved metadata blocks as delayed allocation blocks were written, but unfortunately they were too aggressive. This was fixed in commit 0637c6f, but as a result the over-estimation by ext4_calc_metadata_amount() would lead to reserving 2-3 times the number of pending delayed allocation blocks as potentially required metadata blocks. So if there are 1 megabytes of blocks which have been not yet been allocation, up to 3 megabytes of space would get reserved out of the user's quota and from the file system free space pool until all of the inode's data blocks have been allocated. This commit addresses this problem by much more accurately estimating the number of metadata blocks that will be required. It will still somewhat over-estimate the number of blocks needed, since it must make a worst case estimate not knowing which physical blocks will be needed, but it is much more accurate than before. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 5d11fc79a018ac6f347b6e8cc39d8dc5c52bb064 Author: Theodore Ts'o Date: Sun May 30 22:49:22 2010 -0400 ext4: Fix accounting of reserved metadata blocks commit ee5f4d9cdf32fd99172d11665c592a288c2b1ff4 upstream (as of v2.6.33-rc3) Commit 0637c6f had a typo which caused the reserved metadata blocks to not be released correctly. Fix this. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit beb62f7a7f25fe3b0eeca660d2af3949cde768b4 Author: Theodore Ts'o Date: Sun May 30 22:49:21 2010 -0400 ext4: Patch up how we claim metadata blocks for quota purposes commit 0637c6f4135f592f094207c7c21e7c0fc5557834 upstream (as of v2.6.33-rc3) As reported in Kernel Bugzilla #14936, commit d21cd8f triggered a BUG in the function ext4_da_update_reserve_space() found in fs/ext4/inode.c. The root cause of this BUG() was caused by the fact that ext4_calc_metadata_amount() can severely over-estimate how many metadata blocks will be needed, especially when using direct block-mapped files. In addition, it can also badly *under* estimate how much space is needed, since ext4_calc_metadata_amount() assumes that the blocks are contiguous, and this is not always true. If the application is writing blocks to a sparse file, the number of metadata blocks necessary can be severly underestimated by the functions ext4_da_reserve_space(), ext4_da_update_reserve_space() and ext4_da_release_space(). This was the cause of the dq_claim_space reports found on kerneloops.org. Unfortunately, doing this right means that we need to massively over-estimate the amount of free space needed. So in some cases we may need to force the inode to be written to disk asynchronously in to avoid spurious quota failures. http://bugzilla.kernel.org/show_bug.cgi?id=14936 Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 13a4fbba7adcdc9ea1ec832babe2ddfc44d25042 Author: Aneesh Kumar K.V Date: Sun May 30 22:49:20 2010 -0400 ext4: Ensure zeroout blocks have no dirty metadata commit 515f41c33a9d44a964264c9511ad2c869af1fac3 upstream (as of v2.6.33-rc3) This fixes a bug (found by Curt Wohlgemuth) in which new blocks returned from an extent created with ext4_ext_zeroout() can have dirty metadata still associated with them. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Curt Wohlgemuth Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit fe018ae1417dd3e02bdf42190b688afc17ccda46 Author: Richard Kennedy Date: Sun May 30 22:49:19 2010 -0400 ext4: return correct wbc.nr_to_write in ext4_da_writepages commit 2faf2e19dd0e060eeb32442858ef495ac3083277 upstream (as of v2.6.33-rc3) When ext4_da_writepages increases the nr_to_write in writeback_control then it must always re-base the return value. Originally there was a (misguided) attempt prevent wbc.nr_to_write from going negative. In fact, it's necessary to allow nr_to_write to be negative so that wb_writeback() can correctly calculate how many pages were actually written. Signed-off-by: Richard Kennedy Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit b387026e9ffb1167ab14b40a81bc37fbb0068e04 Author: Julia Lawall Date: Sun May 30 22:49:18 2010 -0400 ext4: Eliminate potential double free on error path commit d3533d72e7478a61a3e1936956fc825289a2acf4 upstream (as of v2.6.33-rc3) b_entry_name and buffer are initially NULL, are initialized within a loop to the result of calling kmalloc, and are freed at the bottom of this loop. The loop contains gotos to cleanup, which also frees b_entry_name and buffer. Some of these gotos are before the reinitializations of b_entry_name and buffer. To maintain the invariant that b_entry_name and buffer are NULL at the top of the loop, and thus acceptable arguments to kfree, these variables are now set to NULL after the kfrees. This seems to be the simplest solution. A more complicated solution would be to introduce more labels in the error handling code at the end of the function. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r@ identifier E; expression E1; iterator I; statement S; @@ *kfree(E); ... when != E = E1 when != I(E,...) S when != &E *kfree(E); // Signed-off-by: Julia Lawall Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 7589529d0a233f28bd20e1b7775324dcf9cfb499 Author: Theodore Ts'o Date: Sun May 30 22:49:17 2010 -0400 ext4, jbd2: Add barriers for file systems with exernal journals commit cc3e1bea5d87635c519da657303690f5538bb4eb upstream (as of v2.6.33-rc3) This is a bit complicated because we are trying to optimize when we send barriers to the fs data disk. We could just throw in an extra barrier to the data disk whenever we send a barrier to the journal disk, but that's not always strictly necessary. We only need to send a barrier during a commit when there are data blocks which are must be written out due to an inode written in ordered mode, or if fsync() depends on the commit to force data blocks to disk. Finally, before we drop transactions from the beginning of the journal during a checkpoint operation, we need to guarantee that any blocks that were flushed out to the data disk are firmly on the rust platter before we drop the transaction from the journal. Thanks to Oleg Drokin for pointing out this flaw in ext3/ext4. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit b235a77c0fb44fd428525591a968da14844b6f4d Author: Surbhi Palande