)]}' { "log": [ { "commit": "20b2a1eb2de54d0fce4dee198546cc448589dad8", "tree": "46fa8e5282020453e9cefe42f8bef7d5c1db2552", "parents": [ "9fda0bdd950b09c42e26cc7e19590ce62e842fee" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Fri Sep 06 21:49:56 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "jfs: fix error path in ialloc\n\ncommit 8660998608cfa1077e560034db81885af8e1e885 upstream.\n\nIf insert_inode_locked() fails, we shouldn\u0027t be calling\nunlock_new_inode().\n\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nTested-by: Michael L. Semon \u003cmlsemon35@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6f4f3714260023be6ddfcc0bc56191acc450f0ca", "tree": "11cb02eeb78c20776e99d79a77f314ef42170925", "parents": [ "6fdea2fb23fe0a64af442f397b4e717e98e6aba8" ], "author": { "name": "Eric Sandeen", "email": "sandeen@redhat.com", "time": "Thu Apr 26 13:10:39 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:42 2013 -0800" }, "message": "ext3: return 32/64-bit dir name hash according to usage type\n\ncommit d7dab39b6e16d5eea78ed3c705d2a2d0772b4f06 upstream.\n\nThis is based on commit d1f5273e9adb40724a85272f248f210dc4ce919a\next4: return 32/64-bit dir name hash according to usage type\nby Fan Yong \u003cyong.fan@whamcloud.com\u003e\n\nTraditionally ext2/3/4 has returned a 32-bit hash value from llseek()\nto appease NFSv2, which can only handle a 32-bit cookie for seekdir()\nand telldir(). However, this causes problems if there are 32-bit hash\ncollisions, since the NFSv2 server can get stuck resending the same\nentries from the directory repeatedly.\n\nAllow ext3 to return a full 64-bit hash (both major and minor) for\ntelldir to decrease the chance of hash collisions.\n\nThis patch does implement a new ext3_dir_llseek op, because with 64-bit\nhashes, nfs will attempt to seek to a hash \"offset\" which is much\nlarger than ext3\u0027s s_maxbytes. So for dx dirs, we call\ngeneric_file_llseek_size() with the appropriate max hash value as the\nmaximum seekable size. Otherwise we just pass through to\ngeneric_file_llseek().\n\nPatch-updated-by: Bernd Schubert \u003cbernd.schubert@itwm.fraunhofer.de\u003e\nPatch-updated-by: Eric Sandeen \u003csandeen@redhat.com\u003e\n(blame us if something is not correct)\n\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Benjamin LaHaise \u003cbcrl@kvack.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "85005d18bddd858908230089476d64fc8ecb47aa", "tree": "91c6846c597500039dc463a67f75d6aa08e23bbf", "parents": [ "5187f535beeb3731677c6f6d05402f9adec6e034" ], "author": { "name": "Dave Jones", "email": "davej@redhat.com", "time": "Thu Oct 10 20:05:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 22 09:02:25 2013 +0100" }, "message": "ext4: fix memory leak in xattr\n\ncommit 6e4ea8e33b2057b85d75175dd89b93f5e26de3bc upstream.\n\nIf we take the 2nd retry path in ext4_expand_extra_isize_ea, we\npotentionally return from the function without having freed these\nallocations. If we don\u0027t do the return, we over-write the previous\nallocation pointers, so we leak either way.\n\nSpotted with Coverity.\n\n[ Fixed by tytso to set is and bs to NULL after freeing these\n pointers, in case in the retry loop we later end up triggering an\n error causing a jump to cleanup, at which point we could have a double\n free bug. -- Ted ]\n\nSigned-off-by: Dave Jones \u003cdavej@fedoraproject.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5187f535beeb3731677c6f6d05402f9adec6e034", "tree": "596071de1c33e391d0e17d86136f0c85ce386d82", "parents": [ "c2f271001295e9d4b1cca3a01502795e4f0d1639" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 30 08:35:10 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 22 09:02:25 2013 +0100" }, "message": "vfs: allow O_PATH file descriptors for fstatfs()\n\ncommit 9d05746e7b16d8565dddbe3200faa1e669d23bbf upstream.\n\nOlga reported that file descriptors opened with O_PATH do not work with\nfstatfs(), found during further development of ksh93\u0027s thread support.\n\nThere is no reason to not allow O_PATH file descriptors here (fstatfs is\nvery much a path operation), so use \"fdget_raw()\". See commit\n55815f70147d (\"vfs: make O_PATH file descriptors usable for \u0027fstat()\u0027\")\nfor a very similar issue reported for fstat() by the same team.\n\nReported-and-tested-by: ольга крыжановская \u003colga.kryzhanovska@gmail.com\u003e\nAcked-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "016a3592cc34fa349235b5a8b48af5cece2cbfeb", "tree": "d8a6d3cb8d1ee2871ae3db2b2f6d30ccb9cb9399", "parents": [ "027a76bf3d56c7d7ef17aadfaec826a5d33f28f3" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Dec 27 01:42:50 2012 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:50 2013 -0700" }, "message": "ext4: avoid hang when mounting non-journal filesystems with orphan list\n\ncommit 0e9a9a1ad619e7e987815d20262d36a2f95717ca upstream.\n\nWhen trying to mount a file system which does not contain a journal,\nbut which does have a orphan list containing an inode which needs to\nbe truncated, the mount call with hang forever in\next4_orphan_cleanup() because ext4_orphan_del() will return\nimmediately without removing the inode from the orphan list, leading\nto an uninterruptible loop in kernel code which will busy out one of\nthe CPU\u0027s on the system.\n\nThis can be trivially reproduced by trying to mount the file system\nfound in tests/f_orphan_extents_inode/image.gz from the e2fsprogs\nsource tree. If a malicious user were to put this on a USB stick, and\nmount it on a Linux desktop which has automatic mounts enabled, this\ncould be considered a potential denial of service attack. (Not a big\ndeal in practice, but professional paranoids worry about such things,\nand have even been known to allocate CVE numbers for such problems.)\n\n-js: This is a fix for CVE-2013-2015.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Zheng Liu \u003cwenqing.lz@taobao.com\u003e\nAcked-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "027a76bf3d56c7d7ef17aadfaec826a5d33f28f3", "tree": "159e664043c67f5535a4bada7aa0123857f66af2", "parents": [ "5df7085368ce132b9d93e5cff406df4684615419" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Tue Jul 30 16:30:30 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 13 15:42:50 2013 -0700" }, "message": "Btrfs: change how we queue blocks for backref checking\n\ncommit b6c60c8018c4e9beb2f83fc82c09f9d033766571 upstream.\n\nPreviously we only added blocks to the list to have their backrefs checked if\nthe level of the block is right above the one we are searching for. This is\nbecause we want to make sure we don\u0027t add the entire path up to the root to the\nlists to make sure we process things one at a time. This assumes that if any\nblocks in the path to the root are going to be not checked (shared in other\nwords) then they will be in the level right above the current block on up. This\nisn\u0027t quite right though since we can have blocks higher up the list that are\nshared because they are attached to a reloc root. But we won\u0027t add this block\nto be checked and then later on we will BUG_ON(!upper-\u003echecked). So instead\nkeep track of wether or not we\u0027ve queued a block to be checked in this current\nsearch, and if we haven\u0027t go ahead and queue it to be checked. This patch fixed\nthe panic I was seeing where we BUG_ON(!upper-\u003echecked). Thanks,\n\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Chris Mason \u003cchris.mason@fusionio.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "db68549fe3aee4045e1d7348b20d7c8baf4518c0", "tree": "9169045efdd981f5042ad103fbe3e816edce2892", "parents": [ "1d48ca6f38fa39298474708abebeffef4ef2cd2d" ], "author": { "name": "Lino Sanfilippo", "email": "LinoSanfilippo@gmx.de", "time": "Fri Mar 23 02:42:23 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 01 09:10:52 2013 -0700" }, "message": "fanotify: dont merge permission events\n\ncommit 03a1cec1f17ac1a6041996b3e40f96b5a2f90e1b upstream.\n\nBoyd Yang reported a problem for the case that multiple threads of the same\nthread group are waiting for a reponse for a permission event.\nIn this case it is possible that some of the threads are never woken up, even\nif the response for the event has been received\n(see http://marc.info/?l\u003dlinux-kernel\u0026m\u003d131822913806350\u0026w\u003d2).\n\nThe reason is that we are currently merging permission events if they belong to\nthe same thread group. But we are not prepared to wake up more than one waiter\nfor each event. We do\n\nwait_event(group-\u003efanotify_data.access_waitq, event-\u003eresponse ||\n\t\t\tatomic_read(\u0026group-\u003efanotify_data.bypass_perm));\nand after that\n event-\u003eresponse \u003d 0;\n\nwhich is the reason that even if we woke up all waiters for the same event\nsome of them may see event-\u003eresponse being already set 0 again, then go back to\nsleep and block forever.\n\nWith this patch we avoid that more than one thread is waiting for a response\nby not merging permission events for the same thread group any more.\n\nReported-by: Boyd Yang \u003cboyd.yang@gmail.com\u003e\nSigned-off-by: Lino Sanfilippo \u003cLinoSanfilipp@gmx.de\u003e\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Mihai Donțu \u003cmihai.dontu@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b6a40685765b7ce6f31244a80a5c5a936b29da32", "tree": "c32e39b038ec197b934d81b4a841c5348def763d", "parents": [ "ec00ecafdc391afb652c4115afb73085aa4decd3" ], "author": { "name": "Anand Avati", "email": "avati@redhat.com", "time": "Tue Aug 20 02:21:07 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:52 2013 -0700" }, "message": "fuse: invalidate inode attributes on xattr modification\n\ncommit d331a415aef98717393dda0be69b7947da08eba3 upstream.\n\nCalls like setxattr and removexattr result in updation of ctime.\nTherefore invalidate inode attributes to force a refresh.\n\nSigned-off-by: Anand Avati \u003cavati@redhat.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ec00ecafdc391afb652c4115afb73085aa4decd3", "tree": "3b5b82daa2c90752080962b06875b0c556a069c0", "parents": [ "579fc7a3f0f07cdf158e629a322121f25029d358" ], "author": { "name": "Maxim Patlasov", "email": "MPatlasov@parallels.com", "time": "Mon Aug 12 20:39:30 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:52 2013 -0700" }, "message": "fuse: postpone end_page_writeback() in fuse_writepage_locked()\n\ncommit 4a4ac4eba1010ef9a804569058ab29e3450c0315 upstream.\n\nThe patch fixes a race between ftruncate(2), mmap-ed write and write(2):\n\n1) An user makes a page dirty via mmap-ed write.\n2) The user performs shrinking truncate(2) intended to purge the page.\n3) Before fuse_do_setattr calls truncate_pagecache, the page goes to\n writeback. fuse_writepage_locked fills FUSE_WRITE request and releases\n the original page by end_page_writeback.\n4) fuse_do_setattr() completes and successfully returns. Since now, i_mutex\n is free.\n5) Ordinary write(2) extends i_size back to cover the page. Note that\n fuse_send_write_pages do wait for fuse writeback, but for another\n page-\u003eindex.\n6) fuse_writepage_locked proceeds by queueing FUSE_WRITE request.\n fuse_send_writepage is supposed to crop inarg-\u003esize of the request,\n but it doesn\u0027t because i_size has already been extended back.\n\nMoving end_page_writeback to the end of fuse_writepage_locked fixes the\nrace because now the fact that truncate_pagecache is successfully returned\ninfers that fuse_writepage_locked has already called end_page_writeback.\nAnd this, in turn, infers that fuse_flush_writepages has already called\nfuse_send_writepage, and the latter used valid (shrunk) i_size. write(2)\ncould not extend it because of i_mutex held by ftruncate(2).\n\nSigned-off-by: Maxim Patlasov \u003cmpatlasov@parallels.com\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "512ecf84714aa7f906807c5149cd4776d157d7ab", "tree": "7a0cf2765df17412ce3410e546a8ba96f80e9fb9", "parents": [ "d778ca56a22b5ca0c96e39db08b4994166d435d6" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Jul 25 11:49:11 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:51 2013 -0700" }, "message": "isofs: Refuse RW mount of the filesystem instead of making it RO\n\ncommit 17b7f7cf58926844e1dd40f5eb5348d481deca6a upstream.\n\nRefuse RW mount of isofs filesystem. So far we just silently changed it\nto RO mount but when the media is writeable, block layer won\u0027t notice\nthis change and thus will think device is used RW and will block eject\nbutton of the drive. That is unexpected by users because for\nnon-writeable media eject button works just fine.\n\nUserspace mount(8) command handles this just fine and retries mounting\nwith MS_RDONLY set so userspace shouldn\u0027t see any regression. Plus any\ntool mounting isofs is likely confronted with the case of read-only\nmedia where block layer already refuses to mount the filesystem without\nMS_RDONLY set so our behavior shouldn\u0027t be anything new for it.\n\nReported-by: Hui Wang \u003chui.wang@canonical.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "55ee351dc444224f7bb9697a98b2d06e8625f491", "tree": "fa356512517c9cc95313eb2471151b0ce1a7a85c", "parents": [ "4013fc200b4df078b77d2fc95de3446c65a9957d" ], "author": { "name": "Jie Liu", "email": "jeff.liu@oracle.com", "time": "Wed Sep 11 14:20:05 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:50 2013 -0700" }, "message": "ocfs2: fix the end cluster offset of FIEMAP\n\ncommit 28e8be31803b19d0d8f76216cb11b480b8a98bec upstream.\n\nCall fiemap ioctl(2) with given start offset as well as an desired mapping\nrange should show extents if possible. However, we somehow figure out the\nend offset of mapping via \u0027mapping_end -\u003d cpos\u0027 before iterating the\nextent records which would cause problems if the given fiemap length is\ntoo small to a cluster size, e.g,\n\nCluster size 4096:\ndebugfs.ocfs2 1.6.3\n Block Size Bits: 12 Cluster Size Bits: 12\n\nThe extended fiemap test utility From David:\nhttps://gist.github.com/anonymous/6172331\n\n# dd if\u003d/dev/urandom of\u003d/ocfs2/test_file bs\u003d1M count\u003d1000\n# ./fiemap /ocfs2/test_file 4096 10\nstart: 4096, length: 10\nFile /ocfs2/test_file has 0 extents:\n#\tLogical Physical Length Flags\n\t^^^^^ \u003c-- No extent is shown\n\nIn this case, at ocfs2_fiemap(): cpos \u003d\u003d mapping_end \u003d\u003d 1. Hence the\nloop of searching extent records was not executed at all.\n\nThis patch remove the in question \u0027mapping_end -\u003d cpos\u0027, and loops\nuntil the cpos is larger than the mapping_end as usual.\n\n# ./fiemap /ocfs2/test_file 4096 10\nstart: 4096, length: 10\nFile /ocfs2/test_file has 1 extents:\n#\tLogical Physical Length Flags\n0:\t0000000000000000 0000000056a01000 0000000006a00000 0000\n\nSigned-off-by: Jie Liu \u003cjeff.liu@oracle.com\u003e\nReported-by: David Weber \u003cwb@munzinger.de\u003e\nTested-by: David Weber \u003cwb@munzinger.de\u003e\nCc: Sunil Mushran \u003csunil.mushran@gmail.com\u003e\nCc: Mark Fashen \u003cmfasheh@suse.de\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b11dc97469e8cf6776c82d2cfe975cf8aa1bd51d", "tree": "f13610d456a3040e4b8ee9244c032f76f3ec9590", "parents": [ "8d1c1a3145ef78b17c3b46d6ee2ccf7f775456da" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Thu Sep 05 08:38:10 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Sep 26 17:15:31 2013 -0700" }, "message": "cifs: ensure that srv_mutex is held when dealing with ssocket pointer\n\ncommit 73e216a8a42c0ef3d08071705c946c38fdbe12b0 upstream.\n\nOleksii reported that he had seen an oops similar to this:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000088\nIP: [\u003cffffffff814dcc13\u003e] sock_sendmsg+0x93/0xd0\nPGD 0\nOops: 0000 [#1] PREEMPT SMP\nModules linked in: ipt_MASQUERADE xt_REDIRECT xt_tcpudp iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack ip_tables x_tables carl9170 ath usb_storage f2fs nfnetlink_log nfnetlink md4 cifs dns_resolver hid_generic usbhid hid af_packet uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev rfcomm btusb bnep bluetooth qmi_wwan qcserial cdc_wdm usb_wwan usbnet usbserial mii snd_hda_codec_hdmi snd_hda_codec_realtek iwldvm mac80211 coretemp intel_powerclamp kvm_intel kvm iwlwifi snd_hda_intel cfg80211 snd_hda_codec xhci_hcd e1000e ehci_pci snd_hwdep sdhci_pci snd_pcm ehci_hcd microcode psmouse sdhci thinkpad_acpi mmc_core i2c_i801 pcspkr usbcore hwmon snd_timer snd_page_alloc snd ptp rfkill pps_core soundcore evdev usb_common vboxnetflt(O) vboxdrv(O)Oops#2 Part8\n loop tun binfmt_misc fuse msr acpi_call(O) ipv6 autofs4\nCPU: 0 PID: 21612 Comm: kworker/0:1 Tainted: G W O 3.10.1SIGN #28\nHardware name: LENOVO 2306CTO/2306CTO, BIOS G2ET92WW (2.52 ) 02/22/2013\nWorkqueue: cifsiod cifs_echo_request [cifs]\ntask: ffff8801e1f416f0 ti: ffff880148744000 task.ti: ffff880148744000\nRIP: 0010:[\u003cffffffff814dcc13\u003e] [\u003cffffffff814dcc13\u003e] sock_sendmsg+0x93/0xd0\nRSP: 0000:ffff880148745b00 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff880148745b78 RCX: 0000000000000048\nRDX: ffff880148745c90 RSI: ffff880181864a00 RDI: ffff880148745b78\nRBP: ffff880148745c48 R08: 0000000000000048 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff880181864a00\nR13: ffff880148745c90 R14: 0000000000000048 R15: 0000000000000048\nFS: 0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000088 CR3: 000000020c42c000 CR4: 00000000001407b0\nOops#2 Part7\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nStack:\n ffff880148745b30 ffffffff810c4af9 0000004848745b30 ffff880181864a00\n ffffffff81ffbc40 0000000000000000 ffff880148745c90 ffffffff810a5aab\n ffff880148745bc0 ffffffff81ffbc40 ffff880148745b60 ffffffff815a9fb8\nCall Trace:\n [\u003cffffffff810c4af9\u003e] ? finish_task_switch+0x49/0xe0\n [\u003cffffffff810a5aab\u003e] ? lock_timer_base.isra.36+0x2b/0x50\n [\u003cffffffff815a9fb8\u003e] ? _raw_spin_unlock_irqrestore+0x18/0x40\n [\u003cffffffff810a673f\u003e] ? try_to_del_timer_sync+0x4f/0x70\n [\u003cffffffff815aa38f\u003e] ? _raw_spin_unlock_bh+0x1f/0x30\n [\u003cffffffff814dcc87\u003e] kernel_sendmsg+0x37/0x50\n [\u003cffffffffa081a0e0\u003e] smb_send_kvec+0xd0/0x1d0 [cifs]\n [\u003cffffffffa081a263\u003e] smb_send_rqst+0x83/0x1f0 [cifs]\n [\u003cffffffffa081ab6c\u003e] cifs_call_async+0xec/0x1b0 [cifs]\n [\u003cffffffffa08245e0\u003e] ? free_rsp_buf+0x40/0x40 [cifs]\nOops#2 Part6\n [\u003cffffffffa082606e\u003e] SMB2_echo+0x8e/0xb0 [cifs]\n [\u003cffffffffa0808789\u003e] cifs_echo_request+0x79/0xa0 [cifs]\n [\u003cffffffff810b45b3\u003e] process_one_work+0x173/0x4a0\n [\u003cffffffff810b52a1\u003e] worker_thread+0x121/0x3a0\n [\u003cffffffff810b5180\u003e] ? manage_workers.isra.27+0x2b0/0x2b0\n [\u003cffffffff810bae00\u003e] kthread+0xc0/0xd0\n [\u003cffffffff810bad40\u003e] ? kthread_create_on_node+0x120/0x120\n [\u003cffffffff815b199c\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff810bad40\u003e] ? kthread_create_on_node+0x120/0x120\nCode: 84 24 b8 00 00 00 4c 89 f1 4c 89 ea 4c 89 e6 48 89 df 4c 89 60 18 48 c7 40 28 00 00 00 00 4c 89 68 30 44 89 70 14 49 8b 44 24 28 \u003cff\u003e 90 88 00 00 00 3d ef fd ff ff 74 10 48 8d 65 e0 5b 41 5c 41\n RIP [\u003cffffffff814dcc13\u003e] sock_sendmsg+0x93/0xd0\n RSP \u003cffff880148745b00\u003e\nCR2: 0000000000000088\n\nThe client was in the middle of trying to send a frame when the\nserver-\u003essocket pointer got zeroed out. In most places, that we access\nthat pointer, the srv_mutex is held. There\u0027s only one spot that I see\nthat the server-\u003essocket pointer gets set and the srv_mutex isn\u0027t held.\nThis patch corrects that.\n\nThe upstream bug report was here:\n\n https://bugzilla.kernel.org/show_bug.cgi?id\u003d60557\n\nReported-by: Oleksii Shevchuk \u003calxchk@gmail.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3ba21877b9488abffd4528aa4b316ec5af27ea3", "tree": "3f6705e826e71f1a471a5fdd93d7e460fa16f374", "parents": [ "e51c435e8f955faeb93c8a10f71d7ebf43d887db" ], "author": { "name": "Roland Dreier", "email": "roland@purestorage.com", "time": "Mon Aug 05 17:55:01 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 07 21:58:16 2013 -0700" }, "message": "SCSI: sg: Fix user memory corruption when SG_IO is interrupted by a signal\n\ncommit 35dc248383bbab0a7203fca4d722875bc81ef091 upstream.\n\nThere is a nasty bug in the SCSI SG_IO ioctl that in some circumstances\nleads to one process writing data into the address space of some other\nrandom unrelated process if the ioctl is interrupted by a signal.\nWhat happens is the following:\n\n - A process issues an SG_IO ioctl with direction DXFER_FROM_DEV (ie the\n underlying SCSI command will transfer data from the SCSI device to\n the buffer provided in the ioctl)\n\n - Before the command finishes, a signal is sent to the process waiting\n in the ioctl. This will end up waking up the sg_ioctl() code:\n\n\t\tresult \u003d wait_event_interruptible(sfp-\u003eread_wait,\n\t\t\t(srp_done(sfp, srp) || sdp-\u003edetached));\n\n but neither srp_done() nor sdp-\u003edetached is true, so we end up just\n setting srp-\u003eorphan and returning to userspace:\n\n\t\tsrp-\u003eorphan \u003d 1;\n\t\twrite_unlock_irq(\u0026sfp-\u003erq_list_lock);\n\t\treturn result;\t/* -ERESTARTSYS because signal hit process */\n\n At this point the original process is done with the ioctl and\n blithely goes ahead handling the signal, reissuing the ioctl, etc.\n\n - Eventually, the SCSI command issued by the first ioctl finishes and\n ends up in sg_rq_end_io(). At the end of that function, we run through:\n\n\twrite_lock_irqsave(\u0026sfp-\u003erq_list_lock, iflags);\n\tif (unlikely(srp-\u003eorphan)) {\n\t\tif (sfp-\u003ekeep_orphan)\n\t\t\tsrp-\u003esg_io_owned \u003d 0;\n\t\telse\n\t\t\tdone \u003d 0;\n\t}\n\tsrp-\u003edone \u003d done;\n\twrite_unlock_irqrestore(\u0026sfp-\u003erq_list_lock, iflags);\n\n\tif (likely(done)) {\n\t\t/* Now wake up any sg_read() that is waiting for this\n\t\t * packet.\n\t\t */\n\t\twake_up_interruptible(\u0026sfp-\u003eread_wait);\n\t\tkill_fasync(\u0026sfp-\u003easync_qp, SIGPOLL, POLL_IN);\n\t\tkref_put(\u0026sfp-\u003ef_ref, sg_remove_sfp);\n\t} else {\n\t\tINIT_WORK(\u0026srp-\u003eew.work, sg_rq_end_io_usercontext);\n\t\tschedule_work(\u0026srp-\u003eew.work);\n\t}\n\n Since srp-\u003eorphan *is* set, we set done to 0 (assuming the\n userspace app has not set keep_orphan via an SG_SET_KEEP_ORPHAN\n ioctl), and therefore we end up scheduling sg_rq_end_io_usercontext()\n to run in a workqueue.\n\n - In workqueue context we go through sg_rq_end_io_usercontext() -\u003e\n sg_finish_rem_req() -\u003e blk_rq_unmap_user() -\u003e ... -\u003e\n bio_uncopy_user() -\u003e __bio_copy_iov() -\u003e copy_to_user().\n\n The key point here is that we are doing copy_to_user() on a\n workqueue -- that is, we\u0027re on a kernel thread with current-\u003emm\n equal to whatever random previous user process was scheduled before\n this kernel thread. So we end up copying whatever data the SCSI\n command returned to the virtual address of the buffer passed into\n the original ioctl, but it\u0027s quite likely we do this copying into a\n different address space!\n\nAs suggested by James Bottomley \u003cJames.Bottomley@hansenpartnership.com\u003e,\nadd a check for current-\u003emm (which is NULL if we\u0027re on a kernel thread\nwithout a real userspace address space) in bio_uncopy_user(), and skip\nthe copy if we\u0027re on a kernel thread.\n\nThere\u0027s no reason that I can think of for any caller of bio_uncopy_user()\nto want to do copying on a kernel thread with a random active userspace\naddress space.\n\nHuge thanks to Costa Sapuntzakis \u003ccosta@purestorage.com\u003e for the\noriginal pointer to this bug in the sg code.\n\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nTested-by: David Milburn \u003cdmilburn@redhat.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Parallels.com\u003e\n[lizf: backported to 3.4:\n - Use __bio_for_each_segment() instead of bio_for_each_segment_all()]\nSigned-off-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "e446ef9608a07af0cf07aa887ddf37224fd345d8", "tree": "72cb705768d5adb6a728ac4b9ed68e47ad789f52", "parents": [ "f571d16dee723cb888ce2bce2217cfa8c2ccebfe" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Thu Aug 15 15:36:49 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Sep 07 21:58:13 2013 -0700" }, "message": "jfs: fix readdir cookie incompatibility with NFSv4\n\ncommit 44512449c0ab368889dd13ae0031fba74ee7e1d2 upstream.\n\nNFSv4 reserves readdir cookie values 0-2 for special entries (. and ..),\nbut jfs allows a value of 2 for a non-special entry. This incompatibility\ncan result in the nfs client reporting a readdir loop.\n\nThis patch doesn\u0027t change the value stored internally, but adds one to\nthe value exposed to the iterate method.\n\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - s/ctx-\u003epos/filp-\u003ef_pos/]\nTested-by: Christian Kujau \u003clists@nerdbynature.de\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "03fec5cd1af33b7635db79542a85b03015356480", "tree": "50abc2ca4ab9b97b15fd07184bfc579ec0e96baa", "parents": [ "6ed43927ea4cf330d5f5b0aea6b8599e354aba3e" ], "author": { "name": "Vyacheslav Dubeyko", "email": "slava@dubeyko.com", "time": "Thu Aug 22 16:35:45 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 29 09:50:13 2013 -0700" }, "message": "nilfs2: fix issue with counting number of bio requests for BIO_EOPNOTSUPP error detection\n\ncommit 4bf93b50fd04118ac7f33a3c2b8a0a1f9fa80bc9 upstream.\n\nFix the issue with improper counting number of flying bio requests for\nBIO_EOPNOTSUPP error detection case.\n\nThe sb_nbio must be incremented exactly the same number of times as\ncomplete() function was called (or will be called) because\nnilfs_segbuf_wait() will call wail_for_completion() for the number of\ntimes set to sb_nbio:\n\n do {\n wait_for_completion(\u0026segbuf-\u003esb_bio_event);\n } while (--segbuf-\u003esb_nbio \u003e 0);\n\nTwo functions complete() and wait_for_completion() must be called the\nsame number of times for the same sb_bio_event. Otherwise,\nwait_for_completion() will hang or leak.\n\nSigned-off-by: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nTested-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6ed43927ea4cf330d5f5b0aea6b8599e354aba3e", "tree": "ecdabf454333b885eed800a29f947ad72f95d992", "parents": [ "00d0f98e9424e5df7bb06955a740b4df92c5eb3a" ], "author": { "name": "Vyacheslav Dubeyko", "email": "slava@dubeyko.com", "time": "Thu Aug 22 16:35:44 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 29 09:50:12 2013 -0700" }, "message": "nilfs2: remove double bio_put() in nilfs_end_bio_write() for BIO_EOPNOTSUPP error\n\ncommit 2df37a19c686c2d7c4e9b4ce1505b5141e3e5552 upstream.\n\nRemove double call of bio_put() in nilfs_end_bio_write() for the case of\nBIO_EOPNOTSUPP error detection. The issue was found by Dan Carpenter\nand he suggests first version of the fix too.\n\nSigned-off-by: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nAcked-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nTested-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9cfae3e2f1cac477673d211e9f6a06248dda5b8a", "tree": "4be6e3db7afc25c23639121407c7fb4087da301d", "parents": [ "dadf2af13293d83259645efeda3d84634bce2afb" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Aug 12 09:53:28 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:29 2013 -0700" }, "message": "jbd2: Fix use after free after error in jbd2_journal_dirty_metadata()\n\ncommit 91aa11fae1cf8c2fd67be0609692ea9741cdcc43 upstream.\n\nWhen jbd2_journal_dirty_metadata() returns error,\n__ext4_handle_dirty_metadata() stops the handle. However callers of this\nfunction do not count with that fact and still happily used now freed\nhandle. This use after free can result in various issues but very likely\nwe oops soon.\n\nThe motivation of adding __ext4_journal_stop() into\n__ext4_handle_dirty_metadata() in commit 9ea7a0df seems to be only to\nimprove error reporting. So replace __ext4_journal_stop() with\next4_journal_abort_handle() which was there before that commit and add\nWARN_ON_ONCE() to dump stack to provide useful information.\n\nReported-by: Sage Weil \u003csage@inktank.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d77d52563beaa75183580949cdce4330a2c6c84d", "tree": "45e02654a9a7d8a81e4fdc3fdfad7ae410480374", "parents": [ "2e42d79b7e06a080d55da0b05c823c0ba2abaa0c" ], "author": { "name": "yonghua zheng", "email": "younghua.zheng@gmail.com", "time": "Tue Aug 13 16:01:03 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:27 2013 -0700" }, "message": "fs/proc/task_mmu.c: fix buffer overflow in add_page_map()\n\ncommit 8c8296223f3abb142be8fc31711b18a704c0e7d8 upstream.\n\nRecently we met quite a lot of random kernel panic issues after enabling\nCONFIG_PROC_PAGE_MONITOR. After debuggind we found this has something\nto do with following bug in pagemap:\n\nIn struct pagemapread:\n\n struct pagemapread {\n int pos, len;\n pagemap_entry_t *buffer;\n bool v2;\n };\n\npos is number of PM_ENTRY_BYTES in buffer, but len is the size of\nbuffer, it is a mistake to compare pos and len in add_page_map() for\nchecking buffer is full or not, and this can lead to buffer overflow and\nrandom kernel panic issue.\n\nCorrect len to be total number of PM_ENTRY_BYTES in buffer.\n\n[akpm@linux-foundation.org: document pagemapread.pos and .len units, fix PM_ENTRY_BYTES definition]\nSigned-off-by: Yonghua Zheng \u003cyounghua.zheng@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7a0117d324b902737efa1ce7e26052d475b6649b", "tree": "e89560a2d1fe775f19cceee39111d31739895187", "parents": [ "4bcdbddd845a9c5bba705e949d9d3f6d9461eb96" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Nov 08 16:09:37 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:08 2013 -0700" }, "message": "vfs: d_obtain_alias() needs to use \"/\" as default name.\n\ncommit b911a6bdeef5848c468597d040e3407e0aee04ce upstream.\n\nNFS appears to use d_obtain_alias() to create the root dentry rather than\nd_make_root. This can cause \u0027prepend_path()\u0027 to complain that the root\nhas a weird name if an NFS filesystem is lazily unmounted. e.g. if\n\"/mnt\" is an NFS mount then\n\n { cd /mnt; umount -l /mnt ; ls -l /proc/self/cwd; }\n\nwill cause a WARN message like\n WARNING: at /home/git/linux/fs/dcache.c:2624 prepend_path+0x1d7/0x1e0()\n ...\n Root dentry has weird name \u003c\u003e\n\nto appear in kernel logs.\n\nSo change d_obtain_alias() to use \"/\" rather than \"\" as the anonymous\nname.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nCc: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[bwh: Backported to 3.2: use named initialisers instead of QSTR_INIT()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "65280b8ed1cca78ff7fe63ecfdb0fff87fe184a3", "tree": "b339319dff1cf38d958e379d202ef94b90ad839e", "parents": [ "8b45ff80d9d6e641e2518eddad76aafdadc8dc92" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Fri Jul 26 17:12:56 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:07 2013 -0700" }, "message": "debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)\n\ncommit 776164c1faac4966ab14418bb0922e1820da1d19 upstream.\n\ndebugfs_remove_recursive() is wrong,\n\n1. it wrongly assumes that !list_empty(d_subdirs) means that this\n dir should be removed.\n\n This is not that bad by itself, but:\n\n2. if d_subdirs does not becomes empty after __debugfs_remove()\n it gives up and silently fails, it doesn\u0027t even try to remove\n other entries.\n\n However -\u003ed_subdirs can be non-empty because it still has the\n already deleted !debugfs_positive() entries.\n\n3. simple_release_fs() is called even if __debugfs_remove() fails.\n\nSuppose we have\n\n\tdir1/\n\t\tdir2/\n\t\t\tfile2\n\t\tfile1\n\nand someone opens dir1/dir2/file2.\n\nNow, debugfs_remove_recursive(dir1/dir2) succeeds, and dir1/dir2 goes\naway.\n\nBut debugfs_remove_recursive(dir1) silently fails and doesn\u0027t remove\nthis directory. Because it tries to delete (the already deleted)\ndir1/dir2/file2 again and then fails due to \"Avoid infinite loop\"\nlogic.\n\nTest-case:\n\n\t#!/bin/sh\n\n\tcd /sys/kernel/debug/tracing\n\techo \u0027p:probe/sigprocmask sigprocmask\u0027 \u003e\u003e kprobe_events\n\tsleep 1000 \u003c events/probe/sigprocmask/id \u0026\n\techo -n \u003e| kprobe_events\n\n\t[ -d events/probe ] \u0026\u0026 echo \"ERR!! failed to rm probe\"\n\nAnd after that it is not possible to create another probe entry.\n\nWith this patch debugfs_remove_recursive() skips !debugfs_positive()\nfiles although this is not strictly needed. The most important change\nis that it does not try to make -\u003ed_subdirs empty, it simply scans\nthe whole list(s) recursively and removes as much as possible.\n\nLink: http://lkml.kernel.org/r/20130726151256.GC19472@redhat.com\n\nAcked-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3fbcb7f97cd2770e5d65490b57460844fb704f01", "tree": "b2d9dcd4dd09aa68947c7ad803a4904d4874efb2", "parents": [ "6cd45319625bfc226c3d52bdafd3e1f5d7e04a67" ], "author": { "name": "Chen Gang", "email": "gang.chen@asianux.com", "time": "Fri Jul 19 09:01:36 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:07 2013 -0700" }, "message": "cifs: extend the buffer length enought for sprintf() using\n\ncommit 057d6332b24a4497c55a761c83c823eed9e3f23b upstream.\n\nFor cifs_set_cifscreds() in \"fs/cifs/connect.c\", \u0027desc\u0027 buffer length\nis \u0027CIFSCREDS_DESC_SIZE\u0027 (56 is less than 256), and \u0027ses-\u003edomainName\u0027\nlength may be \"255 + \u0027\\0\u0027\".\n\nThe related sprintf() may cause memory overflow, so need extend related\nbuffer enough to hold all things.\n\nIt is also necessary to be sure of \u0027ses-\u003edomainName\u0027 must be less than\n256, and define the related macro instead of hard code number \u0027256\u0027.\n\nSigned-off-by: Chen Gang \u003cgang.chen@asianux.com\u003e\nReviewed-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nReviewed-by: Shirish Pargaonkar \u003cshirishpargaonkar@gmail.com\u003e\nReviewed-by: Scott Lovenberg \u003cscott.lovenberg@gmail.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6cd45319625bfc226c3d52bdafd3e1f5d7e04a67", "tree": "2dd7eab85ec3fd342c7da8a34fb8bac58b74ad26", "parents": [ "a57425e942b49e729a62ccb4d420ae7c83762fe2" ], "author": { "name": "Piotr Sarna", "email": "p.sarna@partner.samsung.com", "time": "Thu Aug 08 23:02:24 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:07 2013 -0700" }, "message": "ext4: fix mount/remount error messages for incompatible mount options\n\ncommit 6ae6514b33f941d3386da0dfbe2942766eab1577 upstream.\n\nCommit 5688978 (\"ext4: improve handling of conflicting mount options\")\nintroduced incorrect messages shown while choosing wrong mount options.\n\nFirst of all, both cases of incorrect mount options,\n\"data\u003djournal,delalloc\" and \"data\u003djournal,dioread_nolock\" result in\nthe same error message.\n\nSecondly, the problem above isn\u0027t solved for remount option: the\nmismatched parameter is simply ignored. Moreover, ext4_msg states\nthat remount with options \"data\u003djournal,delalloc\" succeeded, which is\nnot true.\n\nTo fix it up, I added a simple check after parse_options() call to\nensure that data\u003djournal and delalloc/dioread_nolock parameters are\nnot present at the same time.\n\nSigned-off-by: Piotr Sarna \u003cp.sarna@partner.samsung.com\u003e\nAcked-by: Bartlomiej Zolnierkiewicz \u003cb.zolnierkie@samsung.com\u003e\nSigned-off-by: Kyungmin Park \u003ckyungmin.park@samsung.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b2fea70a4a26d2946b470affd5582d7916be93ab", "tree": "118d6d33a6dcaadbbd059747d71d7a29786e4cd4", "parents": [ "3b8d21f4237f7ef442314feec300cdbce72592b5" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Fri Jul 26 15:15:46 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 14 22:57:06 2013 -0700" }, "message": "ext4: make sure group number is bumped after a inode allocation race\n\ncommit a34eb503742fd25155fd6cff6163daacead9fbc3 upstream.\n\nWhen we try to allocate an inode, and there is a race between two\nCPU\u0027s trying to grab the same inode, _and_ this inode is the last free\ninode in the block group, make sure the group number is bumped before\nwe continue searching the rest of the block groups. Otherwise, we end\nup searching the current block group twice, and we end up skipping\nsearching the last block group. So in the unlikely situation where\nalmost all of the inodes are allocated, it\u0027s possible that we will\nreturn ENOSPC even though there might be free inodes in that last\nblock group.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6c9ef8363ab2802bb8f418f32bb9f83d48c9da2a", "tree": "ca0c8ff7927aeefc68257afa2d37d461d434b98f", "parents": [ "1836cd176170d39f5b1fda9cd47d3c3f0f10dad2" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Mon Jul 08 15:59:40 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 11 15:38:43 2013 -0700" }, "message": "fanotify: info leak in copy_event_to_user()\n\ncommit de1e0c40aceb9d5bff09c3a3b97b2f1b178af53f upstream.\n\nThe -\u003ereserved field isn\u0027t cleared so we leak one byte of stack\ninformation to userspace.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Luis Henriques \u003cluis.henriques@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "257e1c5c8162d71b1006a4d46aaad6d6d7431011", "tree": "5a1b16caa93a0fab18e64ca483f474572fbbb287", "parents": [ "428f268ed0c72fb48e72029d8d0ca540d63ec717" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Jul 20 03:13:55 2013 +0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:25:59 2013 +0800" }, "message": "livelock avoidance in sget()\n\ncommit acfec9a5a892f98461f52ed5770de99a3e571ae2 upstream.\n\nEric Sandeen has found a nasty livelock in sget() - take a mount(2) about\nto fail. The superblock is on -\u003efs_supers, -\u003es_umount is held exclusive,\n-\u003es_active is 1. Along comes two more processes, trying to mount the same\nthing; sget() in each is picking that superblock, bumping -\u003es_count and\ntrying to grab -\u003es_umount. -\u003es_active is 3 now. Original mount(2)\nfinally gets to deactivate_locked_super() on failure; -\u003es_active is 2,\nsuperblock is still -\u003efs_supers because shutdown will *not* happen until\n-\u003es_active hits 0. -\u003es_umount is dropped and now we have two processes\nchasing each other:\ns_active \u003d 2, A acquired -\u003es_umount, B blocked\nA sees that the damn thing is stillborn, does deactivate_locked_super()\ns_active \u003d 1, A drops -\u003es_umount, B gets it\nA restarts the search and finds the same superblock. And bumps it -\u003es_active.\ns_active \u003d 2, B holds -\u003es_umount, A blocked on trying to get it\n... and we are in the earlier situation with A and B switched places.\n\nThe root cause, of course, is that -\u003es_active should not grow until we\u0027d\ngot MS_BORN. Then failing -\u003emount() will have deactivate_locked_super()\nshut the damn thing down. Fortunately, it\u0027s easy to do - the key point\nis that grab_super() is called only for superblocks currently on -\u003efs_supers,\nso it can bump -\u003es_count and grab -\u003es_umount first, then check MS_BORN and\nbump -\u003es_active; we must never increment -\u003es_count for superblocks past\n-\u003ekill_sb(), but grab_super() is never called for those.\n\nThe bug is pretty old; we would\u0027ve caught it by now, if not for accidental\nexclusion between sget() for block filesystems; the things like cgroup or\ne.g. mtd-based filesystems don\u0027t have anything of that sort, so they get\nbitten. The right way to deal with that is obviously to fix sget()...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e94d695ac4f0f047eef5c5b71dae1c2aefd59def", "tree": "306574d3623b3bfb4afff4a6ff0e6c62d9ea1ecc", "parents": [ "849f48aea9edb426a418b7b38f5c903fcc84fdf5" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Wed Jul 17 19:30:20 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:25:54 2013 +0800" }, "message": "Btrfs: re-add root to dead root list if we stop dropping it\n\ncommit d29a9f629e009c9b90e5859bce581070fd6247fc upstream.\n\nIf we stop dropping a root for whatever reason we need to add it back to the\ndead root list so that we will re-start the dropping next transaction commit.\nThe other case this happens is if we recover a drop because we will add a root\nwithout adding it to the fs radix tree, so we can leak it\u0027s root and commit root\nextent buffer, adding this to the dead root list makes this cleanup happen.\nThanks,\n\nReported-by: Alex Lyakas \u003calex.btrfs@zadarastorage.com\u003e\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "849f48aea9edb426a418b7b38f5c903fcc84fdf5", "tree": "c4cecb36ec2fdb004be8243239f95bc1a868a265", "parents": [ "cf63fbd49c23ad07983e629febfc3cbcc9382d05" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Mon Jul 15 12:41:42 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:25:54 2013 +0800" }, "message": "Btrfs: fix lock leak when resuming snapshot deletion\n\ncommit fec386ac1428f9c0e672df952cbca5cebd4e4e2f upstream.\n\nWe aren\u0027t setting path-\u003elocks[level] when we resume a snapshot deletion which\nmeans we won\u0027t unlock the buffer when we free the path. This causes deadlocks\nif we happen to re-allocate the block before we\u0027ve evicted the extent buffer\nfrom cache. Thanks,\n\nReported-by: Alex Lyakas \u003calex.btrfs@zadarastorage.com\u003e\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e2f918414ca99c5321ad352fa6dfa3147e3e31d8", "tree": "6ecec69e41cf7b2135506a5f1911a3d3a6ce654f", "parents": [ "5eae08bf9d6feff605b055d5f0964fc31a86b18e" ], "author": { "name": "David Jeffery", "email": "djeffery@redhat.com", "time": "Wed Jul 10 13:19:50 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:17 2013 -0700" }, "message": "lockd: protect nlm_blocked access in nlmsvc_retry_blocked\n\ncommit 1c327d962fc420aea046c16215a552710bde8231 upstream.\n\nIn nlmsvc_retry_blocked, the check that the list is non-empty and acquiring\nthe pointer of the first entry is unprotected by any lock. This allows a rare\nrace condition when there is only one entry on the list. A function such as\nnlmsvc_grant_callback() can be called, which will temporarily remove the entry\nfrom the list. Between the list_empty() and list_entry(),the list may become\nempty, causing an invalid pointer to be used as an nlm_block, leading to a\npossible crash.\n\nThis patch adds the nlm_block_lock around these calls to prevent concurrent\nuse of the nlm_blocked list.\n\nThis was a regression introduced by\nf904be9cc77f361d37d71468b13ff3d1a1823dea \"lockd: Mostly remove BKL from\nthe server\".\n\nSigned-off-by: David Jeffery \u003cdjeffery@redhat.com\u003e\nCc: Bryan Schumaker \u003cbjschuma@netapp.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1150363e16fb0b830131d70b2158664483fb0147", "tree": "2b7af09e235a4a8bcff35c7a109690aba1938df2", "parents": [ "4ae71fc80a0d7efdec8d1218cf188240eb655f38" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Jun 28 16:04:02 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:26:08 2013 -0700" }, "message": "writeback: Fix periodic writeback after fs mount\n\ncommit a5faeaf9109578e65e1a32e2a3e76c8b47e7dcb6 upstream.\n\nCode in blkdev.c moves a device inode to default_backing_dev_info when\nthe last reference to the device is put and moves the device inode back\nto its bdi when the first reference is acquired. This includes moving to\nwb.b_dirty list if the device inode is dirty. The code however doesn\u0027t\nsetup timer to wake corresponding flusher thread and while wb.b_dirty\nlist is non-empty __mark_inode_dirty() will not set it up either. Thus\nperiodic writeback is effectively disabled until a sync(2) call which can\nlead to unexpected data loss in case of crash or power failure.\n\nFix the problem by setting up a timer for periodic writeback in case we\nadd the first dirty inode to wb.b_dirty list in bdev_inode_switch_bdi().\n\nReported-by: Bert De Jonghe \u003cBert.DeJonghe@amplidata.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7fca905120f653a9ce074ac95d8cd25748544ef0", "tree": "b8b71dd79c89f6c11c1572b6a8b5fa0e39b93b76", "parents": [ "e278ba2f381512d4758fb587f711ea9aca1cad2d" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Wed Mar 20 14:39:05 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 28 16:25:40 2013 -0700" }, "message": "ext3: fix data\u003djournal fast mount/umount hang\n\ncommit e643692138cfa33528f054b071ba2583509bb217 upstream.\n\nIn data\u003djournal mode, if we unmount the file system before a\ntransaction has a chance to complete, when the journal inode is being\nevicted, we can end up calling into log_wait_commit() for the\nlast transaction, after the journalling machinery has been shut down.\nThat triggers the WARN_ONCE in __log_start_commit().\n\nArguably we should adjust ext3_should_journal_data() to return FALSE\nfor the journal inode, but the only place it matters is\next3_evict_inode(), and so it\u0027s to save a bit of CPU time, and to make\nthe patch much more obviously correct by inspection(tm), we\u0027ll fix it\nby explicitly not trying to waiting for a journal commit when we are\nevicting the journal inode, since it\u0027s guaranteed to never succeed in\nthis case.\n\nThis can be easily replicated via:\n\n mount -t ext3 -o data\u003djournal /dev/vdb /vdb ; umount /vdb\n\nThis is a port of ext4 fix from Ted Ts\u0027o.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Benjamin LaHaise \u003cbcrl@kvack.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c1ee953c457d8dcca26c8586576066a887b4e0dd", "tree": "a7d3ff976f4ed19e218a1ed63f8d7bd90d46a79a", "parents": [ "3b88a0664f4f9c14c82bc8d35319ec48603be97f" ], "author": { "name": "Steve French", "email": "smfrench@us.ibm.com", "time": "Tue Jun 25 14:03:16 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:02 2013 -0700" }, "message": "Handle big endianness in NTLM (ntlmv2) authentication\n\ncommit fdf96a907c1fbb93c633e2b7ede3b8df26d6a4c0 upstream.\n\nThis is RH bug 970891\nUppercasing of username during calculation of ntlmv2 hash fails\nbecause UniStrupr function does not handle big endian wchars.\n\nAlso fix a comment in the same code to reflect its correct usage.\n\n[To make it easier for stable (rather than require 2nd patch) fixed\nthis patch of Shirish\u0027s to remove endian warning generated\nby sparse -- steve f.]\n\nReported-by: steve \u003csanpatr1@in.ibm.com\u003e\nSigned-off-by: Shirish Pargaonkar \u003cshirishpargaonkar@gmail.com\u003e\nReviewed-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6e514ac663f8d9ad5d533d9beb163b9d3142632f", "tree": "5c83e6fd0bfda77ae8f7fb4c59c2fb92ea6e82cd", "parents": [ "39dfe5bb5f6adba9c4a127695440fa69b2f2f361" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Jul 13 00:40:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:02 2013 -0700" }, "message": "ext4: don\u0027t allow ext4_free_blocks() to fail due to ENOMEM\n\ncommit e7676a704ee0a1ef71a6b23760b5a8f6896cb1a1 upstream.\n\nThe filesystem should not be marked inconsistent if ext4_free_blocks()\nis not able to allocate memory. Unfortunately some callers (most\nnotably ext4_truncate) don\u0027t have a way to reflect an error back up to\nthe VFS. And even if we did, most userspace applications won\u0027t deal\nwith most system calls returning ENOMEM anyway.\n\nReported-by: Nagachandra P \u003cnagachandra@gmail.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "39dfe5bb5f6adba9c4a127695440fa69b2f2f361", "tree": "47986ec09eeb169bb55e7ec898edc67f23c665e4", "parents": [ "ee324d3e345d68772a6d0dc794759be39926e63d" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri May 31 19:39:56 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:01 2013 -0700" }, "message": "ext4: fix overflow when counting used blocks on 32-bit architectures\n\ncommit 8af8eecc1331dbf5e8c662022272cf667e213da5 upstream.\n\nThe arithmetics adding delalloc blocks to the number of used blocks in\next4_getattr() can easily overflow on 32-bit archs as we first multiply\nnumber of blocks by blocksize and then divide back by 512. Make the\narithmetics more clever and also use proper type (unsigned long long\ninstead of unsigned long).\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ee324d3e345d68772a6d0dc794759be39926e63d", "tree": "65408319e7ddf1fca42b6d69e04305b82dfb8b70", "parents": [ "7b1648b7dc2f1954a3492e5127a4b6a408814964" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri May 31 19:38:56 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:01 2013 -0700" }, "message": "ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs\n\ncommit a60697f411eb365fb09e639e6f183fe33d1eb796 upstream.\n\nOn 32-bit architectures with 32-bit sector_t computation of data offset\nin ext4_xattr_fiemap() can overflow resulting in reporting bogus data\nlocation. Fix the problem by typing block number to proper type before\nshifting.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "26a849f49fb3347d126a0ed6611173f903374ef4", "tree": "f689ea9f1ba612eae68eb91d07bcde44e7e2ef37", "parents": [ "c31ad446ab92f3da77f4800786302fb479bfcf97" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Wed Jul 03 15:01:03 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:01 2013 -0700" }, "message": "ocfs2: xattr: fix inlined xattr reflink\n\ncommit ef962df057aaafd714f5c22ba3de1be459571fdf upstream.\n\nInlined xattr shared free space of inode block with inlined data or data\nextent record, so the size of the later two should be adjusted when\ninlined xattr is enabled. See ocfs2_xattr_ibody_init(). But this isn\u0027t\ndone well when reflink. For inode with inlined data, its max inlined\ndata size is adjusted in ocfs2_duplicate_inline_data(), no problem. But\nfor inode with data extent record, its record count isn\u0027t adjusted. Fix\nit, or data extent record and inlined xattr may overwrite each other,\nthen cause data corruption or xattr failure.\n\nOne panic caused by this bug in our test environment is the following:\n\n kernel BUG at fs/ocfs2/xattr.c:1435!\n invalid opcode: 0000 [#1] SMP\n Pid: 10871, comm: multi_reflink_t Not tainted 2.6.39-300.17.1.el5uek #1\n RIP: ocfs2_xa_offset_pointer+0x17/0x20 [ocfs2]\n RSP: e02b:ffff88007a587948 EFLAGS: 00010283\n RAX: 0000000000000000 RBX: 0000000000000010 RCX: 00000000000051e4\n RDX: ffff880057092060 RSI: 0000000000000f80 RDI: ffff88007a587a68\n RBP: ffff88007a587948 R08: 00000000000062f4 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000010\n R13: ffff88007a587a68 R14: 0000000000000001 R15: ffff88007a587c68\n FS: 00007fccff7f06e0(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000\n CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b\n CR2: 00000000015cf000 CR3: 000000007aa76000 CR4: 0000000000000660\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n Process multi_reflink_t\n Call Trace:\n ocfs2_xa_reuse_entry+0x60/0x280 [ocfs2]\n ocfs2_xa_prepare_entry+0x17e/0x2a0 [ocfs2]\n ocfs2_xa_set+0xcc/0x250 [ocfs2]\n ocfs2_xattr_ibody_set+0x98/0x230 [ocfs2]\n __ocfs2_xattr_set_handle+0x4f/0x700 [ocfs2]\n ocfs2_xattr_set+0x6c6/0x890 [ocfs2]\n ocfs2_xattr_user_set+0x46/0x50 [ocfs2]\n generic_setxattr+0x70/0x90\n __vfs_setxattr_noperm+0x80/0x1a0\n vfs_setxattr+0xa9/0xb0\n setxattr+0xc3/0x120\n sys_fsetxattr+0xa8/0xd0\n system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nReviewed-by: Jie Liu \u003cjeff.liu@oracle.com\u003e\nAcked-by: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nCc: Sunil Mushran \u003csunil.mushran@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cd9c898c13afe7577790a32d29109386342045fe", "tree": "883c1808c6ce30819fbca475f773b866c5f2e6fa", "parents": [ "3cba6eb1c7cd51176b972ae47736d8e7a0720706" ], "author": { "name": "Al Viro", "email": "viro@ZenIV.linux.org.uk", "time": "Mon Jul 01 08:12:38 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:00 2013 -0700" }, "message": "ext3,ext4: don\u0027t mess with dir_file-\u003ef_pos in htree_dirblock_to_tree()\n\ncommit 64cb927371cd2ec43758d8a094a003d27bc3d0dc upstream.\n\nBoth ext3 and ext4 htree_dirblock_to_tree() is just filling the\nin-core rbtree for use by call_filldir(). All updates of -\u003ef_pos are\ndone by the latter; bumping it here (on error) is obviously wrong - we\nmight very well have it nowhere near the block we\u0027d found an error in.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3cba6eb1c7cd51176b972ae47736d8e7a0720706", "tree": "28ec853cb9bd3fdefd7e8a5f2bf63772295c9fac", "parents": [ "76a4f3b621d867ea7e27a1b985d7e1430355fac6" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Mon Jul 01 08:12:40 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:00 2013 -0700" }, "message": "jbd2: fix theoretical race in jbd2__journal_restart\n\ncommit 39c04153fda8c32e85b51c96eb5511a326ad7609 upstream.\n\nOnce we decrement transaction-\u003et_updates, if this is the last handle\nholding the transaction from closing, and once we release the\nt_handle_lock spinlock, it\u0027s possible for the transaction to commit\nand be released. In practice with normal kernels, this probably won\u0027t\nhappen, since the commit happens in a separate kernel thread and it\u0027s\nunlikely this could all happen within the space of a few CPU cycles.\n\nOn the other hand, with a real-time kernel, this could potentially\nhappen, so save the tid found in transaction-\u003et_tid before we release\nt_handle_lock. It would require an insane configuration, such as one\nwhere the jbd2 thread was set to a very high real-time priority,\nperhaps because a high priority real-time thread is trying to read or\nwrite to a file system. But some people who use real-time kernels\nhave been known to do insane things, including controlling\nlaser-wielding industrial robots. :-)\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e2c411cce27a933da365034968f431a874e0001a", "tree": "b01ac2b6582bda884c852c43a71b78e69bf86e79", "parents": [ "dd156c8db2ba5e40718fa7adfd25b3e846e6e83b" ], "author": { "name": "Steve French", "email": "smfrench@gmail.com", "time": "Thu Jul 04 14:38:48 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 21 18:19:00 2013 -0700" }, "message": "CIFS use sensible file nlink values if unprovided\n\ncommit 6658b9f70ebca5fc0795b1d6d733996af1e2caa7 upstream.\n\nCertain servers may not set the NumberOfLinks field in query file/path\ninfo responses. In such a case, cifs_inode_needs_reval() assumes that\nall regular files are hardlinks and triggers revalidation, leading to\nexcessive and unnecessary network traffic.\n\nThis change hardcodes cf_nlink (and subsequently i_nlink) when not\nreturned by the server, similar to what already occurs in cifs_mkdir().\n\nSigned-off-by: David Disseldorp \u003cddiss@suse.de\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ffdae5d98228dfbf7479cb777853ca031fbdfd3d", "tree": "299ebdc4b6bdf138033862be67ad5c2c1a27bd46", "parents": [ "6d2698aa29a15559b89c54b86523632ea4110b6c" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Fri Jun 21 11:48:11 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jul 13 11:03:41 2013 -0700" }, "message": "nfsd4: fix decoding of compounds across page boundaries\n\ncommit 247500820ebd02ad87525db5d9b199e5b66f6636 upstream.\n\nA freebsd NFSv4.0 client was getting rare IO errors expanding a tarball.\nA network trace showed the server returning BAD_XDR on the final getattr\nof a getattr+write+getattr compound. The final getattr started on a\npage boundary.\n\nI believe the Linux client ignores errors on the post-write getattr, and\nthat that\u0027s why we haven\u0027t seen this before.\n\nReported-by: Rick Macklem \u003crmacklem@uoguelph.ca\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5f855daf6487b64eae1f201483b5830f42b2e9bb", "tree": "ea7611865b0a3c52d3be717ece53e0f5e5ac14b1", "parents": [ "46796ed300f4f9ffa297ff548f0e2f08b7614f3b" ], "author": { "name": "Mikulas Patocka", "email": "mikulas@artax.karlin.mff.cuni.cz", "time": "Thu Jul 04 18:42:29 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jul 13 11:03:40 2013 -0700" }, "message": "hpfs: better test for errors\n\ncommit 3ebacb05044f82c5f0bb456a894eb9dc57d0ed90 upstream.\n\nThe test if bitmap access is out of bound could errorneously pass if the\ndevice size is divisible by 16384 sectors and we are asking for one bitmap\nafter the end.\n\nCheck for invalid size in the superblock. Invalid size could cause integer\noverflows in the rest of the code.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@artax.karlin.mff.cuni.cz\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4e3010bf3aab410b6a983fcd05fe65e671648f55", "tree": "3735783d6c4449ac29833f0ff9ef8731d45160de", "parents": [ "eafde0bc4fbb118408050b7f32dde3575930ef16" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Fri Jun 28 14:15:15 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:05 2013 -0700" }, "message": "UBIFS: fix a horrid bug\n\ncommit 605c912bb843c024b1ed173dc427cd5c08e5d54d upstream.\n\nAl Viro pointed me to the fact that \u0027-\u003ereaddir()\u0027 and \u0027-\u003ellseek()\u0027 have no\nmutual exclusion, which means the \u0027ubifs_dir_llseek()\u0027 can be run while we are\nin the middle of \u0027ubifs_readdir()\u0027.\n\nThis means that \u0027file-\u003eprivate_data\u0027 can be freed while \u0027ubifs_readdir()\u0027 uses\nit, and this is a very bad bug: not only \u0027ubifs_readdir()\u0027 can return garbage,\nbut this may corrupt memory and lead to all kinds of problems like crashes an\nsecurity holes.\n\nThis patch fixes the problem by using the \u0027file-\u003ef_version\u0027 field, which\n\u0027-\u003ellseek()\u0027 always unconditionally sets to zero. We set it to 1 in\n\u0027ubifs_readdir()\u0027 and whenever we detect that it became 0, we know there was a\nseek and it is time to clear the state saved in \u0027file-\u003eprivate_data\u0027.\n\nI tested this patch by writing a user-space program which runds readdir and\nseek in parallell. I could easily crash the kernel without these patches, but\ncould not crash it with these patches.\n\nReported-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nTested-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eafde0bc4fbb118408050b7f32dde3575930ef16", "tree": "1cbd0ca69bafdcab08585fd23def28e035bcc381", "parents": [ "f57f135abe8d94c8d83763de99b01d223b60e1df" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Fri Jun 28 14:15:14 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:05 2013 -0700" }, "message": "UBIFS: prepare to fix a horrid bug\n\ncommit 33f1a63ae84dfd9ad298cf275b8f1887043ced36 upstream.\n\nAl Viro pointed me to the fact that \u0027-\u003ereaddir()\u0027 and \u0027-\u003ellseek()\u0027 have no\nmutual exclusion, which means the \u0027ubifs_dir_llseek()\u0027 can be run while we are\nin the middle of \u0027ubifs_readdir()\u0027.\n\nFirst of all, this means that \u0027file-\u003eprivate_data\u0027 can be freed while\n\u0027ubifs_readdir()\u0027 uses it. But this particular patch does not fix the problem.\nThis patch is only a preparation, and the fix will follow next.\n\nIn this patch we make \u0027ubifs_readdir()\u0027 stop using \u0027file-\u003ef_pos\u0027 directly,\nbecause \u0027file-\u003ef_pos\u0027 can be changed by \u0027-\u003ellseek()\u0027 at any point. This may\nlead \u0027ubifs_readdir()\u0027 to returning inconsistent data: directory entry names\nmay correspond to incorrect file positions.\n\nSo here we introduce a local variable \u0027pos\u0027, read \u0027file-\u003ef_pose\u0027 once at very\nthe beginning, and then stick to \u0027pos\u0027. The result of this is that when\n\u0027ubifs_dir_llseek()\u0027 changes \u0027file-\u003ef_pos\u0027 while we are in the middle of\n\u0027ubifs_readdir()\u0027, the latter \"wins\".\n\nReported-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nTested-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f57f135abe8d94c8d83763de99b01d223b60e1df", "tree": "f6635ad22aefc3091cce49d5e3a11e9488dbe57d", "parents": [ "7e6932300a88ed1dfb2aa0f650aecc51e7839634" ], "author": { "name": "Stephane Eranian", "email": "eranian@google.com", "time": "Thu Jun 20 11:36:28 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 03 10:59:04 2013 -0700" }, "message": "perf: Disable monitoring on setuid processes for regular users\n\ncommit 2976b10f05bd7f6dab9f9e7524451ddfed656a89 upstream.\n\nThere was a a bug in setup_new_exec(), whereby\nthe test to disabled perf monitoring was not\ncorrect because the new credentials for the\nprocess were not yet committed and therefore\nthe get_dumpable() test was never firing.\n\nThe patch fixes the problem by moving the\nperf_event test until after the credentials\nare committed.\n\nSigned-off-by: Stephane Eranian \u003ceranian@google.com\u003e\nTested-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nAcked-by: Peter Zijlstra \u003ca.p.zijlstra@chello.nl\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3c103fee36561149e04587684e068a2854ba6e5b", "tree": "0008f41ac8597ac828db05264f3b8c0607491c6e", "parents": [ "4c3017e4b2d21feed4a510c1ee69aa77d2384493" ], "author": { "name": "Zhao Hongjiang", "email": "zhaohongjiang@huawei.com", "time": "Tue Apr 30 15:26:46 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 27 11:27:34 2013 -0700" }, "message": "inotify: invalid mask should return a error number but not set it\n\ncommit 04df32fa10ab9a6f0643db2949d42efc966bc844 upstream.\n\nWhen we run the crackerjack testsuite, the inotify_add_watch test is\nstalled.\n\nThis is caused by the invalid mask 0 - the task is waiting for the event\nbut it never comes. inotify_add_watch() should return -EINVAL as it did\nbefore commit 676a0675cf92 (\"inotify: remove broken mask checks causing\nunmount to be EINVAL\"). That commit removes the invalid mask check, but\nthat check is needed.\n\nCheck the mask\u0027s ALL_INOTIFY_BITS before the inotify_arg_to_mask() call.\nIf none are set, just return -EINVAL.\n\nBecause IN_UNMOUNT is in ALL_INOTIFY_BITS, this change will not trigger\nthe problem that above commit fixed.\n\n[akpm@linux-foundation.org: fix build]\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nAcked-by: Jim Somerville \u003cJim.Somerville@windriver.com\u003e\nCc: Paul Gortmaker \u003cpaul.gortmaker@windriver.com\u003e\nCc: Jerome Marchand \u003cjmarchan@redhat.com\u003e\nCc: Eric Paris \u003ceparis@parisplace.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "999899ad5860fb34e679ca2a853074e54fda9d93", "tree": "a3ea42fe1dc8a5236610dfffbc9e2df278de5b83", "parents": [ "7f259658b1f320b35040a14d7ace371b5cc15fbb" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Fri Feb 22 15:31:00 2013 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:47 2013 -0700" }, "message": "ceph: fix statvfs fr_size\n\ncommit 92a49fb0f79f3300e6e50ddf56238e70678e4202 upstream.\n\nDifferent versions of glibc are broken in different ways, but the short of\nit is that for the time being, frsize should \u003d\u003d bsize, and be used as the\nmultiple for the blocks, free, and available fields. This mirrors what is\ndone for NFS. The previous reporting of the page size for frsize meant\nthat newer glibc and df would report a very small value for the fs size.\n\nFixes http://tracker.ceph.com/issues/3793.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Greg Farnum \u003cgreg@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aa80dd9dbe86743ae6e52c836f6ab1472c469927", "tree": "1b5a77428bc53dd4cf0988c6328bbea34adaee1f", "parents": [ "29c65a277a64645af853e8c9a9b3dda0ddc421e0" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Mar 25 10:26:14 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:47 2013 -0700" }, "message": "libceph: wrap auth ops in wrapper functions\n\ncommit 27859f9773e4a0b2042435b13400ee2c891a61f4 upstream.\n\nUse wrapper functions that check whether the auth op exists so that callers\ndo not need a bunch of conditional checks. Simplifies the external\ninterface.\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "29c65a277a64645af853e8c9a9b3dda0ddc421e0", "tree": "c2dac081d3aed9b11ece51c4edc5664d963fb536", "parents": [ "aacd9c3626bac2960bbecd35cc6f032f8529d90b" ], "author": { "name": "Sage Weil", "email": "sage@inktank.com", "time": "Mon Mar 25 10:26:01 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:46 2013 -0700" }, "message": "libceph: add update_authorizer auth method\n\ncommit 0bed9b5c523d577378b6f83eab5835fe30c27208 upstream.\n\nCurrently the messenger calls out to a get_authorizer con op, which will\ncreate a new authorizer if it doesn\u0027t yet have one. In the meantime, when\nwe rotate our service keys, the authorizer doesn\u0027t get updated. Eventually\nit will be rejected by the server on a new connection attempt and get\ninvalidated, and we will then rebuild a new authorizer, but this is not\nideal.\n\nInstead, if we do have an authorizer, call a new update_authorizer op that\nwill verify that the current authorizer is using the latest secret. If it\nis not, we will build a new one that does. This avoids the transient\nfailure.\n\nThis fixes one of the sorry sequence of events for bug\n\n\thttp://tracker.ceph.com/issues/4282\n\nSigned-off-by: Sage Weil \u003csage@inktank.com\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c7ed0848c61d75c58f1c5b13c308f7fcaf94ed89", "tree": "941397d0c639b09e055fff8dcab4b7b142e4f042", "parents": [ "a169043d55452c50a80673f47ab30763cdba407a" ], "author": { "name": "Jim Schutt", "email": "jaschut@sandia.gov", "time": "Wed May 15 13:03:35 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:43 2013 -0700" }, "message": "ceph: ceph_pagelist_append might sleep while atomic\n\ncommit 39be95e9c8c0b5668c9f8806ffe29bf9f4bc0f40 upstream.\n\nCeph\u0027s encode_caps_cb() worked hard to not call __page_cache_alloc()\nwhile holding a lock, but it\u0027s spoiled because ceph_pagelist_addpage()\nalways calls kmap(), which might sleep. Here\u0027s the result:\n\n[13439.295457] ceph: mds0 reconnect start\n[13439.300572] BUG: sleeping function called from invalid context at include/linux/highmem.h:58\n[13439.309243] in_atomic(): 1, irqs_disabled(): 0, pid: 12059, name: kworker/1:1\n . . .\n[13439.376225] Call Trace:\n[13439.378757] [\u003cffffffff81076f4c\u003e] __might_sleep+0xfc/0x110\n[13439.384353] [\u003cffffffffa03f4ce0\u003e] ceph_pagelist_append+0x120/0x1b0 [libceph]\n[13439.391491] [\u003cffffffffa0448fe9\u003e] ceph_encode_locks+0x89/0x190 [ceph]\n[13439.398035] [\u003cffffffff814ee849\u003e] ? _raw_spin_lock+0x49/0x50\n[13439.403775] [\u003cffffffff811cadf5\u003e] ? lock_flocks+0x15/0x20\n[13439.409277] [\u003cffffffffa045e2af\u003e] encode_caps_cb+0x41f/0x4a0 [ceph]\n[13439.415622] [\u003cffffffff81196748\u003e] ? igrab+0x28/0x70\n[13439.420610] [\u003cffffffffa045e9f8\u003e] ? iterate_session_caps+0xe8/0x250 [ceph]\n[13439.427584] [\u003cffffffffa045ea25\u003e] iterate_session_caps+0x115/0x250 [ceph]\n[13439.434499] [\u003cffffffffa045de90\u003e] ? set_request_path_attr+0x2d0/0x2d0 [ceph]\n[13439.441646] [\u003cffffffffa0462888\u003e] send_mds_reconnect+0x238/0x450 [ceph]\n[13439.448363] [\u003cffffffffa0464542\u003e] ? ceph_mdsmap_decode+0x5e2/0x770 [ceph]\n[13439.455250] [\u003cffffffffa0462e42\u003e] check_new_map+0x352/0x500 [ceph]\n[13439.461534] [\u003cffffffffa04631ad\u003e] ceph_mdsc_handle_map+0x1bd/0x260 [ceph]\n[13439.468432] [\u003cffffffff814ebc7e\u003e] ? mutex_unlock+0xe/0x10\n[13439.473934] [\u003cffffffffa043c612\u003e] extra_mon_dispatch+0x22/0x30 [ceph]\n[13439.480464] [\u003cffffffffa03f6c2c\u003e] dispatch+0xbc/0x110 [libceph]\n[13439.486492] [\u003cffffffffa03eec3d\u003e] process_message+0x1ad/0x1d0 [libceph]\n[13439.493190] [\u003cffffffffa03f1498\u003e] ? read_partial_message+0x3e8/0x520 [libceph]\n . . .\n[13439.587132] ceph: mds0 reconnect success\n[13490.720032] ceph: mds0 caps stale\n[13501.235257] ceph: mds0 recovery completed\n[13501.300419] ceph: mds0 caps renewed\n\nFix it up by encoding locks into a buffer first, and when the number\nof encoded locks is stable, copy that into a ceph_pagelist.\n\n[elder@inktank.com: abbreviated the stack info a bit.]\n\nSigned-off-by: Jim Schutt \u003cjaschut@sandia.gov\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a169043d55452c50a80673f47ab30763cdba407a", "tree": "c4cde105b6faec43818be6e5c9dc9a801cc40e2c", "parents": [ "b84a4fc13ba928644833672442d29f6c7dff2622" ], "author": { "name": "Jim Schutt", "email": "jaschut@sandia.gov", "time": "Wed May 15 13:03:35 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:43 2013 -0700" }, "message": "ceph: add cpu_to_le32() calls when encoding a reconnect capability\n\ncommit c420276a532a10ef59849adc2681f45306166b89 upstream.\n\nIn his review, Alex Elder mentioned that he hadn\u0027t checked that\nnum_fcntl_locks and num_flock_locks were properly decoded on the\nserver side, from a le32 over-the-wire type to a cpu type.\nI checked, and AFAICS it is done; those interested can consult\n Locker::_do_cap_update()\nin src/mds/Locker.cc and src/include/encoding.h in the Ceph server\ncode (git://github.com/ceph/ceph).\n\nI also checked the server side for flock_len decoding, and I believe\nthat also happens correctly, by virtue of having been declared\n__le32 in struct ceph_mds_cap_reconnect, in src/include/ceph_fs.h.\n\nSigned-off-by: Jim Schutt \u003cjaschut@sandia.gov\u003e\nReviewed-by: Alex Elder \u003celder@inktank.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2e6c53ddade9836cb96821539c664cd6dff0be42", "tree": "73dab4682d8d5ea12815440367c4b4389a08d029", "parents": [ "e3f7e71f94234a4b10265e644d5e01d5c8ff7880" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Wed May 01 11:08:38 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:34 2013 -0700" }, "message": "jfs: fix a couple races\n\ncommit 73aaa22d5ffb2630456bac2f9a4ed9b81d0d7271 upstream.\n\nThis patch fixes races uncovered by xfstests testcase 068.\n\nOne race is the result of jfs_sync() trying to write a sync point to the\njournal after it has been frozen (or possibly in the process). Since\nfreezing sync\u0027s the journal, there is no need to write a sync point so\nwe simply want to return.\n\nThe second involves jfs_write_inode() being called on a deleted inode.\nIt calls jfs_flush_journal which is held up by the jfs_commit thread\ndoing the final iput on the same deleted inode, which itself is\nwaiting for the I_SYNC flag to be cleared. jfs_write_inode need not\ndo anything when i_nlink is zero, which is the easy fix.\n\nReported-by: Michael L. Semon \u003cmlsemon35@gmail.com\u003e\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d0436288c2286cc471b03bddf36c04f937b1e752", "tree": "3363e86a5f9b6a24b19139700c3f704cee74ffa0", "parents": [ "a43adb2a09ec54181238bd00117585c3e6014f56" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Fri May 24 07:40:04 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:31 2013 -0700" }, "message": "cifs: fix potential buffer overrun when composing a new options string\n\ncommit 166faf21bd14bc5c5295a44874bf7f3930c30b20 upstream.\n\nConsider the case where we have a very short ip\u003d string in the original\nmount options, and when we chase a referral we end up with a very long\nIPv6 address. Be sure to allow for that possibility when estimating the\nsize of the string to allocate.\n\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csfrench@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2968b9ab0a2b2f50ec825803b2e1ca151b9655ca", "tree": "ea126ab793afa8ca295f90279dc92db87b05ac65", "parents": [ "19091a7f278a5b20b2a15e18e34cb9579de0aa69" ], "author": { "name": "Dave Chinner", "email": "dchinner@redhat.com", "time": "Mon May 27 16:38:25 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:30 2013 -0700" }, "message": "xfs: kill suid/sgid through the truncate path.\n\ncommit 2962f5a5dcc56f69cbf62121a7be67cc15d6940b upstream.\n\nXFS has failed to kill suid/sgid bits correctly when truncating\nfiles of non-zero size since commit c4ed4243 (\"xfs: split\nxfs_setattr\") introduced in the 3.1 kernel. Fix it.\n\nFix it.\n\nSigned-off-by: Dave Chinner \u003cdchinner@redhat.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\nSigned-off-by: Ben Myers \u003cbpm@sgi.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "19091a7f278a5b20b2a15e18e34cb9579de0aa69", "tree": "fefff4f71ca3d019b2134e61037f31367c1e8c56", "parents": [ "7c12b0057706c0694c96c06a2988fed65c8c7515" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Wed May 29 15:36:40 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:30 2013 -0700" }, "message": "NFSv4: Fix a thinko in nfs4_try_open_cached\n\ncommit f448badd34700ae728a32ba024249626d49c10e1 upstream.\n\nWe need to pass the full open mode flags to nfs_may_open() when doing\na delegated open.\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c846d9bcb65f83a639709904af076ad82811156f", "tree": "d3f2cc13913072c7f3118b93aa9f57274f7c38ee", "parents": [ "954dc41937054d91766387ea2af400c185a1e96a" ], "author": { "name": "Ryusuke Konishi", "email": "konishi.ryusuke@lab.ntt.co.jp", "time": "Fri May 24 15:55:29 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:21 2013 -0700" }, "message": "nilfs2: fix issue of nilfs_set_page_dirty() for page at EOF boundary\n\ncommit 136e8770cd5d1fe38b3c613100dd6dc4db6d4fa6 upstream.\n\nnilfs2: fix issue of nilfs_set_page_dirty for page at EOF boundary\n\nDESCRIPTION:\n There are use-cases when NILFS2 file system (formatted with block size\nlesser than 4 KB) can be remounted in RO mode because of encountering of\n\"broken bmap\" issue.\n\nThe issue was reported by Anthony Doggett \u003cAnthony2486@interfaces.org.uk\u003e:\n \"The machine I\u0027ve been trialling nilfs on is running Debian Testing,\n Linux version 3.2.0-4-686-pae (debian-kernel@lists.debian.org) (gcc\n version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.35-2), but I\u0027ve\n also reproduced it (identically) with Debian Unstable amd64 and Debian\n Experimental (using the 3.8-trunk kernel). The problematic partitions\n were formatted with \"mkfs.nilfs2 -b 1024 -B 8192\".\"\n\nSYMPTOMS:\n(1) System log contains error messages likewise:\n\n [63102.496756] nilfs_direct_assign: invalid pointer: 0\n [63102.496786] NILFS error (device dm-17): nilfs_bmap_assign: broken bmap (inode number\u003d28)\n [63102.496798]\n [63102.524403] Remounting filesystem read-only\n\n(2) The NILFS2 file system is remounted in RO mode.\n\nREPRODUSING PATH:\n(1) Create volume group with name \"unencrypted\" by means of vgcreate utility.\n(2) Run script (prepared by Anthony Doggett \u003cAnthony2486@interfaces.org.uk\u003e):\n\n----------------[BEGIN SCRIPT]--------------------\n\nVG\u003dunencrypted\nlvcreate --size 2G --name ntest $VG\nmkfs.nilfs2 -b 1024 -B 8192 /dev/mapper/$VG-ntest\nmkdir /var/tmp/n\nmkdir /var/tmp/n/ntest\nmount /dev/mapper/$VG-ntest /var/tmp/n/ntest\nmkdir /var/tmp/n/ntest/thedir\ncd /var/tmp/n/ntest/thedir\nsleep 2\ndate\ndarcs init\nsleep 2\ndmesg|tail -n 5\ndate\ndarcs whatsnew || true\ndate\nsleep 2\ndmesg|tail -n 5\n----------------[END SCRIPT]--------------------\n\nREPRODUCIBILITY: 100%\n\nINVESTIGATION:\nAs it was discovered, the issue takes place during segment\nconstruction after executing such sequence of user-space operations:\n\n open(\"_darcs/index\", O_RDWR|O_CREAT|O_NOCTTY, 0666) \u003d 7\n fstat(7, {st_mode\u003dS_IFREG|0644, st_size\u003d0, ...}) \u003d 0\n ftruncate(7, 60)\n\nThe error message \"NILFS error (device dm-17): nilfs_bmap_assign: broken\nbmap (inode number\u003d28)\" takes place because of trying to get block\nnumber for third block of the file with logical offset #3072 bytes. As\nit is possible to see from above output, the file has 60 bytes of the\nwhole size. So, it is enough one block (1 KB in size) allocation for\nthe whole file. Trying to operate with several blocks instead of one\ntakes place because of discovering several dirty buffers for this file\nin nilfs_segctor_scan_file() method.\n\nThe root cause of this issue is in nilfs_set_page_dirty function which\nis called just before writing to an mmapped page.\n\nWhen nilfs_page_mkwrite function handles a page at EOF boundary, it\nfills hole blocks only inside EOF through __block_page_mkwrite().\n\nThe __block_page_mkwrite() function calls set_page_dirty() after filling\nhole blocks, thus nilfs_set_page_dirty function (\u003d\na_ops-\u003eset_page_dirty) is called. However, the current implementation\nof nilfs_set_page_dirty() wrongly marks all buffers dirty even for page\nat EOF boundary.\n\nAs a result, buffers outside EOF are inconsistently marked dirty and\nqueued for write even though they are not mapped with nilfs_get_block\nfunction.\n\nFIX:\nThis modifies nilfs_set_page_dirty() not to mark hole blocks dirty.\n\nThanks to Vyacheslav Dubeyko for his effort on analysis and proposals\nfor this issue.\n\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nReported-by: Anthony Doggett \u003cAnthony2486@interfaces.org.uk\u003e\nReported-by: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nCc: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nTested-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "91cf25f64bb79810e5dedff9eaca205b0f5e414f", "tree": "520d61a5b72842d0ded8405ff6b98122c0bdb7b6", "parents": [ "fd768f9e1102dddd46bc403537aaf75eb232e5f2" ], "author": { "name": "Joseph Qi", "email": "joseph.qi@huawei.com", "time": "Fri May 24 15:55:34 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:12 2013 -0700" }, "message": "ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap()\n\ncommit b4ca2b4b577c3530e34dcfaafccb2cc680ce95d1 upstream.\n\nLast time we found there is lock/unlock bug in ocfs2_file_aio_write, and\nthen we did a thorough search for all lock resources in\nocfs2_inode_info, including rw, inode and open lockres and found this\nbug. My kernel version is 3.0.13, and it is also in the lastest version\n3.9. In ocfs2_fiemap, once ocfs2_get_clusters_nocache failed, it should\ngoto out_unlock instead of out, because we need release buffer head, up\nread alloc sem and unlock inode.\n\nSigned-off-by: Joseph Qi \u003cjoseph.qi@huawei.com\u003e\nReviewed-by: Jie Liu \u003cjeff.liu@oracle.com\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nAcked-by: Sunil Mushran \u003csunil.mushran@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "4ae8c3c597f033134423903131b02f964a5f3b72", "tree": "f5cfd84a56072b795374144b9ea7dfbcf2373f65", "parents": [ "f6b6c15a9c4e1b5590b9524e1dc8f1e902e0aad7" ], "author": { "name": "OGAWA Hirofumi", "email": "hirofumi@mail.parknet.co.jp", "time": "Fri May 24 15:55:08 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:12 2013 -0700" }, "message": "fat: fix possible overflow for fat_clusters\n\ncommit 7b92d03c3239f43e5b86c9cc9630f026d36ee995 upstream.\n\nIntermediate value of fat_clusters can be overflowed on 32bits arch.\n\nReported-by: Krzysztof Strasburger \u003cstrasbur@chkw386.ch.pwr.wroc.pl\u003e\nSigned-off-by: OGAWA Hirofumi \u003chirofumi@mail.parknet.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f6b6c15a9c4e1b5590b9524e1dc8f1e902e0aad7", "tree": "2fc37c399435d2c73ee6a038b9c925ef8027cb37", "parents": [ "ee4998cca0218751458709c0db61d258adb6a86d" ], "author": { "name": "Jeff Layton", "email": "jlayton@redhat.com", "time": "Tue May 07 11:28:31 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 07 12:49:12 2013 -0700" }, "message": "cifs: only set ops for inodes in I_NEW state\n\ncommit c2b93e0699723700f886ce17bb65ffd771195a6d upstream.\n\nIt\u0027s generally not safe to reset the inode ops once they\u0027ve been set. In\nthe case where the inode was originally thought to be a directory and\nthen later found to be a DFS referral, this can lead to an oops when we\ntry to trigger an inode op on it after changing the ops to the blank\nreferral operations.\n\nReported-and-Tested-by: Sachin Prabhu \u003csprabhu@redhat.com\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "462e873c6461e26c6dc172fd5ee185896935598e", "tree": "a4c4effdd9b7e258183506c1ef2d28f452c67b14", "parents": [ "d9973ea05c48df87d0e18fdec61121930d5cde9d" ], "author": { "name": "Gabriel de Perthuis", "email": "g2p.code@gmail.com", "time": "Mon May 06 17:40:18 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri May 24 11:14:22 2013 -0700" }, "message": "btrfs: don\u0027t stop searching after encountering the wrong item\n\ncommit 03b71c6ca6286625d8f1ed44aabab9b5bf5dac10 upstream.\n\nThe search ioctl skips items that are too large for a result buffer, but\ninline items of a certain size occuring before any search result is\nfound would trigger an overflow and stop the search entirely.\n\nBug: https://bugzilla.kernel.org/show_bug.cgi?id\u003d57641\n\nSigned-off-by: Gabriel de Perthuis \u003cg2p.code+btrfs@gmail.com\u003e\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dab2d3dc45ae7343216635d981d43637e1cb7d45", "tree": "a79004a3fcee0ada81f9dd12ed77caf5807edc58", "parents": [ "dd77cf8cc7aca5902e759c26049730c151bc885f" ], "author": { "name": "Naoya Horiguchi", "email": "n-horiguchi@ah.jp.nec.com", "time": "Tue May 07 16:18:13 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:48 2013 -0700" }, "message": "hugetlbfs: fix mmap failure in unaligned size request\n\ncommit af73e4d9506d3b797509f3c030e7dcd554f7d9c4 upstream.\n\nThe current kernel returns -EINVAL unless a given mmap length is\n\"almost\" hugepage aligned. This is because in sys_mmap_pgoff() the\ngiven length is passed to vm_mmap_pgoff() as it is without being aligned\nwith hugepage boundary.\n\nThis is a regression introduced in commit 40716e29243d (\"hugetlbfs: fix\nalignment of huge page requests\"), where alignment code is pushed into\nhugetlb_file_setup() and the variable len in caller side is not changed.\n\nTo fix this, this patch partially reverts that commit, and adds\nalignment code in caller side. And it also introduces hstate_sizelog()\nin order to get proper hstate to specified hugepage size.\n\nAddresses https://bugzilla.kernel.org/show_bug.cgi?id\u003d56881\n\n[akpm@linux-foundation.org: fix warning when CONFIG_HUGETLB_PAGE\u003dn]\nSigned-off-by: Naoya Horiguchi \u003cn-horiguchi@ah.jp.nec.com\u003e\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReported-by: \u003ciceman_dvd@yahoo.com\u003e\nCc: Steven Truelove \u003csteven.truelove@utoronto.ca\u003e\nCc: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Jianguo Wu \u003cwujianguo@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d556c9b5a98ceee8b1d1d74d7277141da437bc26", "tree": "d9a20de60c4911459402911215987a1e85ca890a", "parents": [ "cba998b9b3799a5d6861a969d7b7d9b4f4f181f6" ], "author": { "name": "Lachlan McIlroy", "email": "lmcilroy@redhat.com", "time": "Sun May 05 23:10:00 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:40 2013 -0700" }, "message": "ext4: limit group search loop for non-extent files\n\ncommit e6155736ad76b2070652745f9e54cdea3f0d8567 upstream.\n\nIn the case where we are allocating for a non-extent file,\nwe must limit the groups we allocate from to those below\n2^32 blocks, and ext4_mb_regular_allocator() attempts to\ndo this initially by putting a cap on ngroups for the\nsubsequent search loop.\n\nHowever, the initial target group comes in from the\nallocation context (ac), and it may already be beyond\nthe artificially limited ngroups. In this case,\nthe limit\n\n\tif (group \u003d\u003d ngroups)\n\t\tgroup \u003d 0;\n\nat the top of the loop is never true, and the loop will\nrun away.\n\nCatch this case inside the loop and reset the search to\nstart at group 0.\n\n[sandeen@redhat.com: add commit msg \u0026 comments]\n\nSigned-off-by: Lachlan McIlroy \u003clmcilroy@redhat.com\u003e\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bca778136280b1ab9f2d23b94670ad5ba63c1f94", "tree": "86ead772fac4daa034f5dbf24f7703db2d17ac8d", "parents": [ "c89f6c7515b1713eebf62f67a48f9d6dcf5c3d94" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Fri May 03 16:09:09 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:38 2013 -0700" }, "message": "nfsd4: don\u0027t allow owner override on 4.1 CLAIM_FH opens\n\ncommit 9f415eb25574db4b73a9a712a4438e41dc284922 upstream.\n\nThe Linux client is using CLAIM_FH to implement regular opens, not just\nrecovery cases, so it depends on the server to check permissions\ncorrectly.\n\nTherefore the owner override, which may make sense in the delegation\nrecovery case, isn\u0027t right in the CLAIM_FH case.\n\nSymptoms: on a client with 49f9a0fafd844c32f2abada047c0b9a5ba0d6255\n\"NFSv4.1: Enable open-by-filehandle\", Bryan noticed this:\n\n\ttouch test.txt\n\tchmod 000 test.txt\n\techo test \u003e test.txt\n\nsucceeding.\n\nReported-by: Bryan Schumaker \u003cbjschuma@netapp.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5d96a5f6c32bc97f2f2ff8e614de09ce6e2431c0", "tree": "ec4e257aa6babbcdd420a683167c03d3b20b2151", "parents": [ "4cd9d968a1e09ea2dc765bca9184b8a7aaafb435" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Apr 21 22:56:32 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 11 13:48:09 2013 -0700" }, "message": "ext4: add check for inodes_count overflow in new resize ioctl\n\ncommit 3f8a6411fbada1fa482276591e037f3b1adcf55b upstream.\n\nAddresses-Red-Hat-Bugzilla: #913245\n\nReported-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Carlos Maiolino \u003ccmaiolino@redhat.com\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5cc4561cbfd436871f25c5bd8fc1bce7f199386d", "tree": "89170db54e851a89c454d7677456435a4cc83cb8", "parents": [ "d79b6cc8100dddc8b64d5a2724a591135cc766e7" ], "author": { "name": "David Jeffery", "email": "djeffery@redhat.com", "time": "Mon May 06 13:49:30 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat May 11 13:48:06 2013 -0700" }, "message": "autofs - remove autofs dentry mount check\n\ncommit ce8a5dbdf9e709bdaf4618d7ef8cceb91e8adc69 upstream.\n\nWhen checking if an autofs mount point is busy it isn\u0027t sufficient to\nonly check if it\u0027s a mount point.\n\nFor example, if the mount of an offset mountpoint in a tree is denied\nfor this host by its export and the dentry becomes a process working\ndirectory the check incorrectly returns the mount as not in use at\nexpire.\n\nThis can happen since the default when mounting within a tree is\nnostrict, which means ingnore mount fails on mounts within the tree and\ncontinue. The nostrict option is meant to allow mounting in this case.\n\nSigned-off-by: David Jeffery \u003cdjeffery@redhat.com\u003e\nSigned-off-by: Ian Kent \u003craven@themaw.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "165628d13556a2ea833b3e13d706a252491dc1fc", "tree": "442ce8329bf1bcccc370fa3c91291493848f955c", "parents": [ "7e30abf7548990e6db146221664fc10c2a90ead6" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Apr 21 20:32:03 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:57 2013 -0700" }, "message": "ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG\n\ncommit 7f3e3c7cfcec148ccca9c0dd2dbfd7b00b7ac10f upstream.\n\nFox the Kconfig documentation for CONFIG_EXT4_DEBUG to match the\nchange made by commit a0b30c1229: ext4: use module parameters instead\nof debugfs for mballoc_debug\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7e30abf7548990e6db146221664fc10c2a90ead6", "tree": "4a736717367584b6296e510d6be38b749a4f4c74", "parents": [ "f5b36426ea902c0000699024b9de3ace0ab48f39" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Apr 21 20:19:43 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:57 2013 -0700" }, "message": "ext4: fix online resizing for ext3-compat file systems\n\ncommit c5c72d814cf0f650010337c73638b25e6d14d2d4 upstream.\n\nCommit fb0a387dcdc restricts block allocations for indirect-mapped\nfiles to block groups less than s_blockfile_groups. However, the\nonline resizing code wasn\u0027t setting s_blockfile_groups, so the newly\nadded block groups were not available for non-extent mapped files.\n\nReported-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f5b36426ea902c0000699024b9de3ace0ab48f39", "tree": "de3e9d56b2fc5ba3700c0dfeda182c36966a2796", "parents": [ "213116e53f9fde7896be9958e73d4e59bfea980b" ], "author": { "name": "Dmitry Monakhov", "email": "dmonakhov@openvz.org", "time": "Wed Apr 03 22:08:52 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:57 2013 -0700" }, "message": "ext4: fix journal callback list traversal\n\ncommit 5d3ee20855e28169d711b394857ee608a5023094 upstream.\n\nIt is incorrect to use list_for_each_entry_safe() for journal callback\ntraversial because -\u003enext may be removed by other task:\n-\u003eext4_mb_free_metadata()\n -\u003eext4_mb_free_metadata()\n -\u003eext4_journal_callback_del()\n\nThis results in the following issue:\n\nWARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250()\nHardware name:\nlist_del corruption. prev-\u003enext should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b\nModules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod\nPid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107\nCall Trace:\n [\u003cffffffff8106fb0d\u003e] warn_slowpath_common+0xad/0xf0\n [\u003cffffffff8106fc06\u003e] warn_slowpath_fmt+0x46/0x50\n [\u003cffffffff813637e9\u003e] ? ext4_journal_commit_callback+0x99/0xc0\n [\u003cffffffff8148cae0\u003e] __list_del_entry+0x1c0/0x250\n [\u003cffffffff813637bf\u003e] ext4_journal_commit_callback+0x6f/0xc0\n [\u003cffffffff813ca336\u003e] jbd2_journal_commit_transaction+0x23a6/0x2570\n [\u003cffffffff8108aa42\u003e] ? try_to_del_timer_sync+0x82/0xa0\n [\u003cffffffff8108b491\u003e] ? del_timer_sync+0x91/0x1e0\n [\u003cffffffff813d3ecf\u003e] kjournald2+0x19f/0x6a0\n [\u003cffffffff810ad630\u003e] ? wake_up_bit+0x40/0x40\n [\u003cffffffff813d3d30\u003e] ? bit_spin_lock+0x80/0x80\n [\u003cffffffff810ac6be\u003e] kthread+0x10e/0x120\n [\u003cffffffff810ac5b0\u003e] ? __init_kthread_worker+0x70/0x70\n [\u003cffffffff818ff6ac\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff810ac5b0\u003e] ? __init_kthread_worker+0x70/0x70\n\nThis patch fix the issue as follows:\n- ext4_journal_commit_callback() make list truly traversial safe\n simply by always starting from list_head\n- fix race between two ext4_journal_callback_del() and\n ext4_journal_callback_try_del()\n\nSigned-off-by: Dmitry Monakhov \u003cdmonakhov@openvz.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "213116e53f9fde7896be9958e73d4e59bfea980b", "tree": "83050e644c69f12e6a3eaf5271a3ac7d87b33c1f", "parents": [ "e99e7562943ded071fbd77066b1e4aee1e3815c2" ], "author": { "name": "Dmitry Monakhov", "email": "dmonakhov@openvz.org", "time": "Wed Apr 03 22:06:52 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:57 2013 -0700" }, "message": "jbd2: fix race between jbd2_journal_remove_checkpoint and -\u003ej_commit_callback\n\ncommit 794446c6946513c684d448205fbd76fa35f38b72 upstream.\n\nThe following race is possible:\n\n[kjournald2] other_task\njbd2_journal_commit_transaction()\n j_state \u003d T_FINISHED;\n spin_unlock(\u0026journal-\u003ej_list_lock);\n -\u003ejbd2_journal_remove_checkpoint()\n\t\t\t\t\t -\u003ejbd2_journal_free_transaction();\n\t\t\t\t\t -\u003ekmem_cache_free(transaction)\n -\u003ej_commit_callback(journal, transaction);\n -\u003e USE_AFTER_FREE\n\nWARNING: at lib/list_debug.c:62 __list_del_entry+0x1c0/0x250()\nHardware name:\nlist_del corruption. prev-\u003enext should be ffff88019a4ec198, but was 6b6b6b6b6b6b6b6b\nModules linked in: cpufreq_ondemand acpi_cpufreq freq_table mperf coretemp kvm_intel kvm crc32c_intel ghash_clmulni_intel microcode sg xhci_hcd button sd_mod crc_t10dif aesni_intel ablk_helper cryptd lrw aes_x86_64 xts gf128mul ahci libahci pata_acpi ata_generic dm_mirror dm_region_hash dm_log dm_mod\nPid: 16400, comm: jbd2/dm-1-8 Tainted: G W 3.8.0-rc3+ #107\nCall Trace:\n [\u003cffffffff8106fb0d\u003e] warn_slowpath_common+0xad/0xf0\n [\u003cffffffff8106fc06\u003e] warn_slowpath_fmt+0x46/0x50\n [\u003cffffffff813637e9\u003e] ? ext4_journal_commit_callback+0x99/0xc0\n [\u003cffffffff8148cae0\u003e] __list_del_entry+0x1c0/0x250\n [\u003cffffffff813637bf\u003e] ext4_journal_commit_callback+0x6f/0xc0\n [\u003cffffffff813ca336\u003e] jbd2_journal_commit_transaction+0x23a6/0x2570\n [\u003cffffffff8108aa42\u003e] ? try_to_del_timer_sync+0x82/0xa0\n [\u003cffffffff8108b491\u003e] ? del_timer_sync+0x91/0x1e0\n [\u003cffffffff813d3ecf\u003e] kjournald2+0x19f/0x6a0\n [\u003cffffffff810ad630\u003e] ? wake_up_bit+0x40/0x40\n [\u003cffffffff813d3d30\u003e] ? bit_spin_lock+0x80/0x80\n [\u003cffffffff810ac6be\u003e] kthread+0x10e/0x120\n [\u003cffffffff810ac5b0\u003e] ? __init_kthread_worker+0x70/0x70\n [\u003cffffffff818ff6ac\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff810ac5b0\u003e] ? __init_kthread_worker+0x70/0x70\n\nIn order to demonstrace this issue one should mount ext4 with mount -o\ndiscard option on SSD disk. This makes callback longer and race\nwindow becomes wider.\n\nIn order to fix this we should mark transaction as finished only after\ncallbacks have completed\n\nSigned-off-by: Dmitry Monakhov \u003cdmonakhov@openvz.org\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2111a77044c72a3eeda88415e39d094752bbf25a", "tree": "a24bb33fd2788b7279a8d52a68a650aee5dad626", "parents": [ "f71ce17ff829f8bf9771f1c7b08daaddce40594f" ], "author": { "name": "Bryan Schumaker", "email": "bjschuma@netapp.com", "time": "Fri Apr 19 16:09:38 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "nfsd: Decode and send 64bit time values\n\ncommit bf8d909705e9d9bac31d9b8eac6734d2b51332a7 upstream.\n\nThe seconds field of an nfstime4 structure is 64bit, but we are assuming\nthat the first 32bits are zero-filled. So if the client tries to set\natime to a value before the epoch (touch -t 196001010101), then the\nserver will save the wrong value on disk.\n\nSigned-off-by: Bryan Schumaker \u003cbjschuma@netapp.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f71ce17ff829f8bf9771f1c7b08daaddce40594f", "tree": "1b0be26d04ffbbeb94f61ef0c561f923beae9d72", "parents": [ "ed9a34c5fc970e8371eb3a599db6ffc89bd56d9e" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Thu Mar 28 20:37:14 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "nfsd4: don\u0027t close read-write opens too soon\n\ncommit 0c7c3e67ab91ec6caa44bdf1fc89a48012ceb0c5 upstream.\n\nDon\u0027t actually close any opens until we don\u0027t need them at all.\n\nThis means being left with write access when it\u0027s not really necessary,\nbut that\u0027s better than putting a file that might still have posix locks\nheld on it, as we have been.\n\nReported-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ed9a34c5fc970e8371eb3a599db6ffc89bd56d9e", "tree": "9637ca9f2fc8d8defa2d3634774e10daa8e549bf", "parents": [ "6cd670f0ff34d314b88b8b7cc1c1b45617f08a78" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Mon Apr 01 15:34:05 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_open_delegation_recall\n\ncommit 8b6cc4d6f841d31f72fe7478453759166d366274 upstream.\n\nA server shouldn\u0027t normally return NFS4ERR_GRACE if the client holds a\ndelegation, since no conflicting lock reclaims can be granted, however\nthe spec does not require the server to grant the open in this\ninstance\n\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "02d1a16d6d89faa6f78625ea17be9f0b995e44ab", "tree": "0f03a668a0343c8fe4b36685e10c0281afe67d7a", "parents": [ "b51c8db5eb83b14921e6017aa9c67b82f80260b1" ], "author": { "name": "Trond Myklebust", "email": "Trond.Myklebust@netapp.com", "time": "Sun Apr 21 18:01:06 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "LOCKD: Ensure that nlmclnt_block resets block-\u003eb_status after a server reboot\n\ncommit 1dfd89af8697a299e7982ae740d4695ecd917eef upstream.\n\nAfter a server reboot, the reclaimer thread will recover all the existing\nlocks. For locks that are blocked, however, it will change the value\nof block-\u003eb_status to nlm_lck_denied_grace_period in order to signal that\nthey need to wake up and resend the original blocking lock request.\n\nDue to a bug, however, the block-\u003eb_status never gets reset after the\nblocked locks have been woken up, and so the process goes into an\ninfinite loop of resends until the blocked lock is satisfied.\n\nReported-by: Marc Eshel \u003ceshel@us.ibm.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b51c8db5eb83b14921e6017aa9c67b82f80260b1", "tree": "4afbac177507999a1bfb26c375d380e8c3759de9", "parents": [ "357093a8b82c10e6fff37d3c772ccc0e3b0549c4" ], "author": { "name": "Greg Thelen", "email": "gthelen@google.com", "time": "Tue Apr 30 15:26:48 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "fs/dcache.c: add cond_resched() to shrink_dcache_parent()\n\ncommit 421348f1ca0bf17769dee0aed4d991845ae0536d upstream.\n\nCall cond_resched() in shrink_dcache_parent() to maintain interactivity.\n\nBefore this patch:\n\n\tvoid shrink_dcache_parent(struct dentry * parent)\n\t{\n\t\twhile ((found \u003d select_parent(parent, \u0026dispose)) !\u003d 0)\n\t\t\tshrink_dentry_list(\u0026dispose);\n\t}\n\nselect_parent() populates the dispose list with dentries which\nshrink_dentry_list() then deletes. select_parent() carefully uses\nneed_resched() to avoid doing too much work at once. But neither\nshrink_dcache_parent() nor its called functions call cond_resched(). So\nonce need_resched() is set select_parent() will return single dentry\ndispose list which is then deleted by shrink_dentry_list(). This is\ninefficient when there are a lot of dentry to process. This can cause\nsoftlockup and hurts interactivity on non preemptable kernels.\n\nThis change adds cond_resched() in shrink_dcache_parent(). The benefit\nof this is that need_resched() is quickly cleared so that future calls\nto select_parent() are able to efficiently return a big batch of dentry.\n\nThese additional cond_resched() do not seem to impact performance, at\nleast for the workload below.\n\nHere is a program which can cause soft lockup if other system activity\nsets need_resched().\n\n\tint main()\n\t{\n\t struct rlimit rlim;\n\t int i;\n\t int f[100000];\n\t char buf[20];\n\t struct timeval t1, t2;\n\t double diff;\n\n\t /* cleanup past run */\n\t system(\"rm -rf x\");\n\n\t /* boost nfile rlimit */\n\t rlim.rlim_cur \u003d 200000;\n\t rlim.rlim_max \u003d 200000;\n\t if (setrlimit(RLIMIT_NOFILE, \u0026rlim))\n\t err(1, \"setrlimit\");\n\n\t /* make directory for files */\n\t if (mkdir(\"x\", 0700))\n\t err(1, \"mkdir\");\n\n\t if (gettimeofday(\u0026t1, NULL))\n\t err(1, \"gettimeofday\");\n\n\t /* populate directory with open files */\n\t for (i \u003d 0; i \u003c 100000; i++) {\n\t snprintf(buf, sizeof(buf), \"x/%d\", i);\n\t f[i] \u003d open(buf, O_CREAT);\n\t if (f[i] \u003d\u003d -1)\n\t err(1, \"open\");\n\t }\n\n\t /* close some of the files */\n\t for (i \u003d 0; i \u003c 85000; i++)\n\t close(f[i]);\n\n\t /* unlink all files, even open ones */\n\t system(\"rm -rf x\");\n\n\t if (gettimeofday(\u0026t2, NULL))\n\t err(1, \"gettimeofday\");\n\n\t diff \u003d (((double)t2.tv_sec * 1000000 + t2.tv_usec) -\n\t ((double)t1.tv_sec * 1000000 + t1.tv_usec));\n\n\t printf(\"done: %g elapsed\\n\", diff/1e6);\n\t return 0;\n\t}\n\nSigned-off-by: Greg Thelen \u003cgthelen@google.com\u003e\nSigned-off-by: Dave Chinner \u003cdavid@fromorbit.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "273a82bee94d42ba58b264bc427cd75df65b81fc", "tree": "29c58f1e1b209f4e6ab09fb0ea8188e52501d6db", "parents": [ "ede49f3642cce1fe60ac81cb1953e7a8fd91e8ce" ], "author": { "name": "Hugh Dickins", "email": "hughd@google.com", "time": "Mon Apr 29 15:07:44 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:55 2013 -0700" }, "message": "mm: allow arch code to control the user page table ceiling\n\ncommit 6ee8630e02be6dd89926ca0fbc21af68b23dc087 upstream.\n\nOn architectures where a pgd entry may be shared between user and kernel\n(e.g. ARM+LPAE), freeing page tables needs a ceiling other than 0.\nThis patch introduces a generic USER_PGTABLES_CEILING that arch code can\noverride. It is the responsibility of the arch code setting the ceiling\nto ensure the complete freeing of the page tables (usually in\npgd_free()).\n\n[catalin.marinas@arm.com: commit log; shift_arg_pages(), asm-generic/pgtables.h changes]\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Russell King \u003clinux@arm.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ede49f3642cce1fe60ac81cb1953e7a8fd91e8ce", "tree": "aafdbee17968e5f63535ab434d814c6943ce7713", "parents": [ "f9a0a8cd73178779c05df6d52a794b4ea432b413" ], "author": { "name": "Anurup m", "email": "anurup.m@huawei.com", "time": "Mon Apr 29 15:05:52 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:55 2013 -0700" }, "message": "fs/fscache/stats.c: fix memory leak\n\ncommit ec686c9239b4d472052a271c505d04dae84214cc upstream.\n\nThere is a kernel memory leak observed when the proc file\n/proc/fs/fscache/stats is read.\n\nThe reason is that in fscache_stats_open, single_open is called and the\nrespective release function is not called during release. Hence fix\nwith correct release function - single_release().\n\nAddresses https://bugzilla.kernel.org/show_bug.cgi?id\u003d57101\n\nSigned-off-by: Anurup m \u003canurup.m@huawei.com\u003e\nCc: shyju pv \u003cshyju.pv@huawei.com\u003e\nCc: Sanil kumar \u003csanil.kumar@huawei.com\u003e\nCc: Nataraj m \u003cnataraj.m@huawei.com\u003e\nCc: Li Zefan \u003clizefan@huawei.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6615e6db12bf29ab3d1062c9144c4e0828d2c588", "tree": "6c1c6b4d57131a375068cc26603c9bb24297c6e1", "parents": [ "0e079960ed813d36aa7625da4c388ae0d6e9d320" ], "author": { "name": "Ming Lei", "email": "ming.lei@canonical.com", "time": "Tue Apr 02 10:12:26 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:54 2013 -0700" }, "message": "sysfs: fix use after free in case of concurrent read/write and readdir\n\ncommit f7db5e7660b122142410dcf36ba903c73d473250 upstream.\n\nThe inode-\u003ei_mutex isn\u0027t hold when updating filp-\u003ef_pos\nin read()/write(), so the filp-\u003ef_pos might be read as\n0 or 1 in readdir() when there is concurrent read()/write()\non this same file, then may cause use after free in readdir().\n\nThe bug can be reproduced with Li Zefan\u0027s test code on the\nlink:\n\n\thttps://patchwork.kernel.org/patch/2160771/\n\nThis patch fixes the use after free under this situation.\n\nReported-by: Li Zefan \u003clizefan@huawei.com\u003e\nSigned-off-by: Ming Lei \u003cming.lei@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6bcd3002a29b597e2774a733b74c204c1b344026", "tree": "dcc922057f94881f9deaa8339b068a8e4499bb44", "parents": [ "a5a9e7c9c19b03b471d3ec148698e90a1958bfcb" ], "author": { "name": "Zhao Hongjiang", "email": "zhaohongjiang@huawei.com", "time": "Fri Apr 26 11:03:53 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed May 01 09:41:03 2013 -0700" }, "message": "aio: fix possible invalid memory access when DEBUG is enabled\n\ncommit 91d80a84bbc8f28375cca7e65ec666577b4209ad upstream.\n\ndprintk() shouldn\u0027t access @ring after it\u0027s unmapped.\n\nSigned-off-by: Zhao Hongjiang \u003czhaohongjiang@huawei.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8fdeb71b5022b4578e3339b861019c5a00c77700", "tree": "cc4927db4b7ffea456e2df5e330e18bceb5e5aa7", "parents": [ "b00919cd72ed9753390a9fbb5541cbba12e5e826" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Fri Apr 05 20:50:09 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:56 2013 -0700" }, "message": "Btrfs: make sure nbytes are right after log replay\n\ncommit 4bc4bee4595662d8bff92180d5c32e3313a704b0 upstream.\n\nWhile trying to track down a tree log replay bug I noticed that fsck was always\ncomplaining about nbytes not being right for our fsynced file. That is because\nthe new fsync stuff doesn\u0027t wait for ordered extents to complete, so the inodes\nnbytes are not necessarily updated properly when we log it. So to fix this we\nneed to set nbytes to whatever it is on the inode that is on disk, so when we\nreplay the extents we can just add the bytes that are being added as we replay\nthe extent. This makes it work for the case that we have the wrong nbytes or\nthe case that we logged everything and nbytes is actually correct. With this\nI\u0027m no longer getting nbytes errors out of btrfsck.\n\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Chris Mason \u003cchris.mason@fusionio.com\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e3aa8553976945b33cc83c6432fab7568ba11b04", "tree": "78029b7054800737c27506d84ca063d2d65a8fef", "parents": [ "cf276742f2dcdf5258aac98447e8b4b9fba55aaa" ], "author": { "name": "Vyacheslav Dubeyko", "email": "slava@dubeyko.com", "time": "Wed Apr 17 15:58:33 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Apr 25 21:19:54 2013 -0700" }, "message": "hfsplus: fix potential overflow in hfsplus_file_truncate()\n\ncommit 12f267a20aecf8b84a2a9069b9011f1661c779b4 upstream.\n\nChange a u32 to loff_t hfsplus_file_truncate().\n\nSigned-off-by: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Hin-Tak Leung \u003chtl10@users.sourceforge.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7077c66b3ab3a1d336648cf88f54df43709ebac3", "tree": "2afe6bfbe8770c1acd0bc4b715a46e0309b045ed", "parents": [ "eced4ec1b69c8cc5428ef29b947376bc6d57c8ce" ], "author": { "name": "Suleiman Souhlal", "email": "suleiman@google.com", "time": "Sat Apr 13 16:03:06 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "vfs: Revert spurious fix to spinning prevention in prune_icache_sb\n\ncommit 5b55d708335a9e3e4f61f2dadf7511502205ccd1 upstream.\n\nRevert commit 62a3ddef6181 (\"vfs: fix spinning prevention in prune_icache_sb\").\n\nThis commit doesn\u0027t look right: since we are looking at the tail of the\nlist (sb-\u003es_inode_lru.prev) if we want to skip an inode, we should put\nit back at the head of the list instead of the tail, otherwise we will\nkeep spinning on it.\n\nDiscovered when investigating why prune_icache_sb came top in perf\nreports of a swapping load.\n\nSigned-off-by: Suleiman Souhlal \u003csuleiman@google.com\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e0b4cef3446f77889a3699309a9aad5f70d9a939", "tree": "c99a47cd4eead0da7b2f21e6bccd665f7601c6b8", "parents": [ "b7dba0e4be51d0924af476456d2cb0f903e8aa77" ], "author": { "name": "Sachin Prabhu", "email": "sprabhu@redhat.com", "time": "Tue Apr 09 18:17:41 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Apr 16 21:27:26 2013 -0700" }, "message": "cifs: Allow passwords which begin with a delimitor\n\ncommit c369c9a4a7c82d33329d869cbaf93304cc7a0c40 upstream.\n\nFixes a regression in cifs_parse_mount_options where a password\nwhich begins with a delimitor is parsed incorrectly as being a blank\npassword.\n\nSigned-off-by: Sachin Prabhu \u003csprabhu@redhat.com\u003e\nAcked-by: Jeff Layton \u003cjlayton@redhat.com\u003e\nSigned-off-by: Steve French \u003csfrench@us.ibm.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b57644a59a635af74fde8e4548754de338752422", "tree": "cf1037468c6b9dce8b7a80793fe8af8d62ab4d03", "parents": [ "0d18994cb19855aa6ea892985c19aa54e4192fb0" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Mar 29 15:39:16 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:43 2013 -0700" }, "message": "reiserfs: Fix warning and inode leak when deleting inode with xattrs\n\ncommit 35e5cbc0af240778e61113286c019837e06aeec6 upstream.\n\nAfter commit 21d8a15a (lookup_one_len: don\u0027t accept . and ..) reiserfs\nstarted failing to delete xattrs from inode. This was due to a buggy\ntest for \u0027.\u0027 and \u0027..\u0027 in fill_with_dentries() which resulted in passing\n\u0027.\u0027 and \u0027..\u0027 entries to lookup_one_len() in some cases. That returned\nerror and so we failed to iterate over all xattrs of and inode.\n\nFix the test in fill_with_dentries() along the lines of the one in\nlookup_one_len().\n\nReported-by: Pawel Zawora \u003cpzawora@gmail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0d18994cb19855aa6ea892985c19aa54e4192fb0", "tree": "9ee55a7eb1a626eb2c248d79d6b65528e47872d1", "parents": [ "a41c384e8308a7d25fa778f0b24656ef50e05766" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Thu Mar 14 10:49:23 2013 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 12 09:38:43 2013 -0700" }, "message": "UBIFS: make space fixup work in the remount case\n\ncommit 67e753ca41782913d805ff4a8a2b0f60b26b7915 upstream.\n\nThe UBIFS space fixup is a useful feature which allows to fixup the \"broken\"\nflash space at the time of the first mount. The \"broken\" space is usually the\nresult of using a \"dumb\" industrial flasher which is not able to skip empty\nNAND pages and just writes all 0xFFs to the empty space, which has grave\nside-effects for UBIFS when UBIFS trise to write useful data to those empty\npages.\n\nThe fix-up feature works roughly like this:\n1. mkfs.ubifs sets the fixup flag in UBIFS superblock when creating the image\n (see -F option)\n2. when the file-system is mounted for the first time, UBIFS notices the fixup\n flag and re-writes the entire media atomically, which may take really a lot\n of time.\n3. UBIFS clears the fixup flag in the superblock.\n\nThis works fine when the file system is mounted R/W for the very first time.\nBut it did not really work in the case when we first mount the file-system R/O,\nand then re-mount R/W. The reason was that we started the fixup procedure too\nlate, which we cannot really do because we have to fixup the space before it\nstarts being used.\n\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nReported-by: Mark Jackson \u003cmpfj-list@mimc.co.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2457a4005a53bd8d9a266ab8f9f6388b57ca133a", "tree": "02f579c0eca7f90e7c5dd0ca1d494676a1f8fb1f", "parents": [ "46c14b9d861886d7abb66088ffeafa9301a34397" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Mon Mar 11 23:39:59 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:37 2013 -0700" }, "message": "ext4: use atomic64_t for the per-flexbg free_clusters count\n\ncommit 90ba983f6889e65a3b506b30dc606aa9d1d46cd2 upstream.\n\nA user who was using a 8TB+ file system and with a very large flexbg\nsize (\u003e 65536) could cause the atomic_t used in the struct flex_groups\nto overflow. This was detected by PaX security patchset:\n\nhttp://forums.grsecurity.net/viewtopic.php?f\u003d3\u0026t\u003d3289\u0026p\u003d12551#p12551\n\nThis bug was introduced in commit 9f24e4208f7e, so it\u0027s been around\nsince 2.6.30. :-(\n\nFix this by using an atomic64_t for struct orlav_stats\u0027s\nfree_clusters.\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Lukas Czerner \u003clczerner@redhat.com\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "46c14b9d861886d7abb66088ffeafa9301a34397", "tree": "69e2b64b43849c8a936cdf807cd350ee7365b372", "parents": [ "4025b05599996ca2866ceec0606c77d2ce2b4830" ], "author": { "name": "Lukas Czerner", "email": "lczerner@redhat.com", "time": "Sat Mar 02 17:18:58 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:36 2013 -0700" }, "message": "ext4: convert number of blocks to clusters properly\n\ncommit 810da240f221d64bf90020f25941b05b378186fe upstream.\n\nWe\u0027re using macro EXT4_B2C() to convert number of blocks to number of\nclusters for bigalloc file systems. However, we should be using\nEXT4_NUM_B2C().\n\nSigned-off-by: Lukas Czerner \u003clczerner@redhat.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2ee4a8e3c9b8225703611097a0a410ca52de3d51", "tree": "54ff51156d024dc286677555577b6769a0f64c26", "parents": [ "3c7fe7b4421b23733eddfb53167c78c0bee71169" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Mon Mar 25 16:03:35 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:36 2013 -0700" }, "message": "Btrfs: fix space leak when we fail to reserve metadata space\n\ncommit f4881bc7a83eff263789dd524b7c269d138d4af5 upstream.\n\nDave reported a warning when running xfstest 275. We have been leaking delalloc\nmetadata space when our reservations fail. This is because we were improperly\ncalculating how much space to free for our checksum reservations. The problem\nis we would sometimes free up space that had already been freed in another\nthread and we would end up with negative usage for the delalloc space. This\npatch fixes the problem by calculating how much space the other threads would\nhave already freed, and then calculate how much space we need to free had we not\ndone the reservation at all, and then freeing any excess space. This makes\nxfstests 275 no longer have leaked space. Thanks\n\nReported-by: David Sterba \u003cdsterba@suse.cz\u003e\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Lingzhu Xiang \u003clxiang@redhat.com\u003e\nReviewed-by: CAI Qian \u003ccaiqian@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "49e67244a577002dcb37bbfdb0698a5306e769ec", "tree": "20fe7ca2a57f45fa66e99533dc52327087e09a1f", "parents": [ "c14d7523633171e0a950047fe729ec2190c690b0" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue Mar 26 14:11:13 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:35 2013 -0700" }, "message": "nfsd4: reject \"negative\" acl lengths\n\ncommit 64a817cfbded8674f345d1117b117f942a351a69 upstream.\n\nSince we only enforce an upper bound, not a lower bound, a \"negative\"\nlength can get through here.\n\nThe symptom seen was a warning when we attempt to a kmalloc with an\nexcessive size.\n\nReported-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ccb3d567d5c7aef76879349a192339569da94c17", "tree": "b203946c299c34ab3cbf1472689448a55bae9e2c", "parents": [ "39d4978d231b56c2c39ddb784a8eb8bd48311456" ], "author": { "name": "Anatol Pomozov", "email": "anatol.pomozov@gmail.com", "time": "Mon Apr 01 09:47:56 2013 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:35 2013 -0700" }, "message": "loop: prevent bdev freeing while device in use\n\ncommit c1681bf8a7b1b98edee8b862a42c19c4e53205fd upstream.\n\nstruct block_device lifecycle is defined by its inode (see fs/block_dev.c) -\nblock_device allocated first time we access /dev/loopXX and deallocated on\nbdev_destroy_inode. When we create the device \"losetup /dev/loopXX afile\"\nwe want that block_device stay alive until we destroy the loop device\nwith \"losetup -d\".\n\nBut because we do not hold /dev/loopXX inode its counter goes 0, and\ninode/bdev can be destroyed at any moment. Usually it happens at memory\npressure or when user drops inode cache (like in the test below). When later in\nloop_clr_fd() we want to use bdev we have use-after-free error with following\nstack:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000280\n bd_set_size+0x10/0xa0\n loop_clr_fd+0x1f8/0x420 [loop]\n lo_ioctl+0x200/0x7e0 [loop]\n lo_compat_ioctl+0x47/0xe0 [loop]\n compat_blkdev_ioctl+0x341/0x1290\n do_filp_open+0x42/0xa0\n compat_sys_ioctl+0xc1/0xf20\n do_sys_open+0x16e/0x1d0\n sysenter_dispatch+0x7/0x1a\n\nTo prevent use-after-free we need to grab the device in loop_set_fd()\nand put it later in loop_clr_fd().\n\nThe issue is reprodusible on current Linus head and v3.3. Here is the test:\n\n dd if\u003d/dev/zero of\u003dloop.file bs\u003d1M count\u003d1\n while [ true ]; do\n losetup /dev/loop0 loop.file\n echo 2 \u003e /proc/sys/vm/drop_caches\n losetup -d /dev/loop0\n done\n\n[ Doing bdgrab/bput in loop_set_fd/loop_clr_fd is safe, because every\n time we call loop_set_fd() we check that loop_device-\u003elo_state is\n Lo_unbound and set it to Lo_bound If somebody will try to set_fd again\n it will get EBUSY. And if we try to loop_clr_fd() on unbound loop\n device we\u0027ll get ENXIO.\n\n loop_set_fd/loop_clr_fd (and any other loop ioctl) is called under\n loop_device-\u003elo_ctl_mutex. ]\n\nSigned-off-by: Anatol Pomozov \u003canatol.pomozov@gmail.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d50597f63bebaf9de515398c95f0ed4b88ea5224", "tree": "ff991a07077d8e8732b53faa8e0cd163dea3c8e9", "parents": [ "1c7b6ea87236a0c10943379a6476e2354c133cab" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Fri Mar 29 08:09:34 2013 -0600" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:34 2013 -0700" }, "message": "Btrfs: don\u0027t drop path when printing out tree errors in scrub\n\ncommit d8fe29e9dea8d7d61fd140d8779326856478fc62 upstream.\n\nA user reported a panic where we were panicing somewhere in\ntree_backref_for_extent from scrub_print_warning. He only captured the trace\nbut looking at scrub_print_warning we drop the path right before we mess with\nthe extent buffer to print out a bunch of stuff, which isn\u0027t right. So fix this\nby dropping the path after we use the eb if we need to. Thanks,\n\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Chris Mason \u003cchris.mason@fusionio.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1c7b6ea87236a0c10943379a6476e2354c133cab", "tree": "5dedda779b5d902ecb288893e0a1043086b22804", "parents": [ "84519c0cb119e2a025dc6496440acedc855d9b21" ], "author": { "name": "Josef Bacik", "email": "jbacik@fusionio.com", "time": "Tue Mar 26 15:31:45 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:34 2013 -0700" }, "message": "Btrfs: limit the global reserve to 512mb\n\ncommit fdf30d1c1b386e1b73116cc7e0fb14e962b763b0 upstream.\n\nA user reported a problem where he was getting early ENOSPC with hundreds of\ngigs of free data space and 6 gigs of free metadata space. This is because the\nglobal block reserve was taking up the entire free metadata space. This is\nridiculous, we have infrastructure in place to throttle if we start using too\nmuch of the global reserve, so instead of letting it get this huge just limit it\nto 512mb so that users can still get work done. This allowed the user to\ncomplete his rsync without issues. Thanks\n\nReported-and-tested-by: Stefan Priebe \u003cs.priebe@profihost.ag\u003e\nSigned-off-by: Josef Bacik \u003cjbacik@fusionio.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "84519c0cb119e2a025dc6496440acedc855d9b21", "tree": "b01bbab183ce84a817b90fd59d7176fb5a7a0cfe", "parents": [ "e18e8665134f6adb079861d3676e7d838ce658ca" ], "author": { "name": "Chris Mason", "email": "chris.mason@fusionio.com", "time": "Tue Mar 26 13:07:00 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:34 2013 -0700" }, "message": "Btrfs: fix race between mmap writes and compression\n\ncommit 4adaa611020fa6ac65b0ac8db78276af4ec04e63 upstream.\n\nBtrfs uses page_mkwrite to ensure stable pages during\ncrc calculations and mmap workloads. We call clear_page_dirty_for_io\nbefore we do any crcs, and this forces any application with the file\nmapped to wait for the crc to finish before it is allowed to change\nthe file.\n\nWith compression on, the clear_page_dirty_for_io step is happening after\nwe\u0027ve compressed the pages. This means the applications might be\nchanging the pages while we are compressing them, and some of those\nmodifications might not hit the disk.\n\nThis commit adds the clear_page_dirty_for_io before compression starts\nand makes sure to redirty the page if we have to fallback to\nuncompressed IO as well.\n\nSigned-off-by: Chris Mason \u003cchris.mason@fusionio.com\u003e\nReported-by: Alexandre Oliva \u003coliva@gnu.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "75e4839c59268b4880b82fa9584980478ef8ca29", "tree": "53983ab75f76f64d684f2ff1b899dd831b54877f", "parents": [ "e92c5efcb2af2afe9a7fa297dcc325f8d04469b3" ], "author": { "name": "fanchaoting", "email": "fanchaoting@cn.fujitsu.com", "time": "Thu Mar 21 09:15:30 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:30 2013 -0700" }, "message": "pnfs-block: removing DM device maybe cause oops when call dev_remove\n\ncommit 4376c94618c26225e69e17b7c91169c45a90b292 upstream.\n\nwhen pnfs block using device mapper,if umounting later,it maybe\ncause oops. we apply \"1 + sizeof(bl_umount_request)\" memory for\nmsg-\u003edata, the memory maybe overflow when we do \"memcpy(\u0026dataptr\n[sizeof(bl_msg)], \u0026bl_umount_request, sizeof(bl_umount_request))\",\nbecause the size of bl_msg is more than 1 byte.\n\nSigned-off-by: fanchaoting\u003cfanchaoting@cn.fujitsu.com\u003e\nSigned-off-by: Trond Myklebust \u003cTrond.Myklebust@netapp.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "cde9833c97c4ad06e569e1f0e7e6b1c84c948aa3", "tree": "f3331bd49143517413c85326385409ec45110890", "parents": [ "01fadbb46b6da196c594ac2266674136cda465a6" ], "author": { "name": "Ming Lei", "email": "ming.lei@canonical.com", "time": "Wed Mar 20 23:25:25 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:16 2013 -0700" }, "message": "sysfs: handle failure path correctly for readdir()\n\ncommit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream.\n\nIn case of \u0027if (filp-\u003ef_pos \u003d\u003d 0 or 1)\u0027 of sysfs_readdir(),\nthe failure from filldir() isn\u0027t handled, and the reference counter\nof the sysfs_dirent object pointed by filp-\u003eprivate_data will be\nreleased without clearing filp-\u003eprivate_data, so use after free\nbug will be triggered later.\n\nThis patch returns immeadiately under the situation for fixing the bug,\nand it is reasonable to return from readdir() when filldir() fails.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nTested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: Ming Lei \u003cming.lei@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "01fadbb46b6da196c594ac2266674136cda465a6", "tree": "d6618c8c8da329a875715c42dd37e913ffd6c90e", "parents": [ "d8022cb2b0ea2e5d926c9e2a041e411d71fd3d9e" ], "author": { "name": "Ming Lei", "email": "ming.lei@canonical.com", "time": "Wed Mar 20 23:25:24 2013 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Apr 05 10:04:16 2013 -0700" }, "message": "sysfs: fix race between readdir and lseek\n\ncommit 991f76f837bf22c5bb07261cfd86525a0a96650c upstream.\n\nWhile readdir() is running, lseek() may set filp-\u003ef_pos as zero,\nthen may leave filp-\u003eprivate_data pointing to one sysfs_dirent\nobject without holding its reference counter, so the sysfs_dirent\nobject may be used after free in next readdir().\n\nThis patch holds inode-\u003ei_mutex to avoid the problem since\nthe lock is always held in readdir path.\n\nReported-by: Dave Jones \u003cdavej@redhat.com\u003e\nTested-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: Ming Lei \u003cming.lei@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "023eae6de094c527f85c5fc3e9a8a364af56b1af", "tree": "899b193a9ba356d2ac6b404a93b1c2545407d709", "parents": [ "2f7dea37d1b0b3a26fb3c2bd97bbf836dfd04def" ], "author": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Mon Dec 17 16:03:20 2012 -0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:28 2013 -0700" }, "message": "exec: use -ELOOP for max recursion depth\n\ncommit d740269867021faf4ce38a449353d2b986c34a67 upstream.\n\nTo avoid an explosion of request_module calls on a chain of abusive\nscripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon\nas maximum recursion depth is hit, the error will fail all the way back\nup the chain, aborting immediately.\n\nThis also has the side-effect of stopping the user\u0027s shell from attempting\nto reexecute the top-level file as a shell script. As seen in the\ndash source:\n\n if (cmd !\u003d path_bshell \u0026\u0026 errno \u003d\u003d ENOEXEC) {\n *argv-- \u003d cmd;\n *argv \u003d cmd \u003d path_bshell;\n goto repeat;\n }\n\nThe above logic was designed for running scripts automatically that lacked\nthe \"#!\" header, not to re-try failed recursion. On a legitimate -ENOEXEC,\nthings continue to behave as the shell expects.\n\nAdditionally, when tracking recursion, the binfmt handlers should not be\ninvolved. The recursion being tracked is the depth of calls through\nsearch_binary_handler(), so that function should be exclusively responsible\nfor tracking the depth.\n\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: halfdog \u003cme@halfdog.net\u003e\nCc: P J P \u003cppandit@redhat.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "66de393d66371b070699ffcb6207cf1abc8b581a", "tree": "8a09ac4ccb2669d72e1a92653f742b639f032301", "parents": [ "19b437682b56a924993979dff408a72e2c5380e6" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Thu Jul 12 08:46:55 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:27 2013 -0700" }, "message": "udf: avoid info leak on export\n\ncommit 0143fc5e9f6f5aad4764801015bc8d4b4a278200 upstream.\n\nFor type 0x51 the udf.parent_partref member in struct fid gets copied\nuninitialized to userland. Fix this by initializing it to 0.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "19b437682b56a924993979dff408a72e2c5380e6", "tree": "963fb370a9a8d8773ca415e98176327b93303a0d", "parents": [ "b647ebe6e7c171efd2003b1a8d07dcc26e6fa748" ], "author": { "name": "Mathias Krause", "email": "minipli@googlemail.com", "time": "Thu Jul 12 08:46:54 2012 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:27 2013 -0700" }, "message": "isofs: avoid info leak on export\n\ncommit fe685aabf7c8c9f138e5ea900954d295bf229175 upstream.\n\nFor type 1 the parent_offset member in struct isofs_fid gets copied\nuninitialized to userland. Fix this by initializing it to 0.\n\nSigned-off-by: Mathias Krause \u003cminipli@googlemail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bc914c3b5ebcf158419c4901ec54ffbd7677d5a0", "tree": "dda7c66c9d090e3187eec3fb3390cd59b218d77a", "parents": [ "5899ef0b272b58f2927eb3376afaad2b02559180" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Tue Feb 05 13:59:56 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:27 2013 -0700" }, "message": "udf: Fix bitmap overflow on large filesystems with small block size\n\ncommit 89b1f39eb4189de745fae554b0d614d87c8d5c63 upstream.\n\nFor large UDF filesystems with 512-byte blocks the number of necessary\nbitmap blocks is larger than 2^16 so s_nr_groups in udf_bitmap overflows\n(the number will overflow for filesystems larger than 128 GB with\n512-byte blocks). That results in ENOSPC errors despite the filesystem\nhas plenty of free space.\n\nFix the problem by changing s_nr_groups\u0027 type to \u0027int\u0027. That is enough\neven for filesystems 2^32 blocks (UDF maximum) and 512-byte blocksize.\n\nReported-and-tested-by: v10lator@myway.de\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Jim Trigg \u003cjtrigg@spamcop.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2bb5c2c93a427a90c06b1c6b050642774912e7c8", "tree": "6af2c488a661e553f245539060bf357899f23863", "parents": [ "120c3558614078cbde7fb0d40a3e7db2d63b660b" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Wed Mar 20 09:42:11 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:25 2013 -0700" }, "message": "ext4: fix data\u003djournal fast mount/umount hang\n\ncommit 2b405bfa84063bfa35621d2d6879f52693c614b0 upstream.\n\nIn data\u003djournal mode, if we unmount the file system before a\ntransaction has a chance to complete, when the journal inode is being\nevicted, we can end up calling into jbd2_log_wait_commit() for the\nlast transaction, after the journalling machinery has been shut down.\n\nArguably we should adjust ext4_should_journal_data() to return FALSE\nfor the journal inode, but the only place it matters is\next4_evict_inode(), and so to save a bit of CPU time, and to make the\npatch much more obviously correct by inspection(tm), we\u0027ll fix it by\nexplicitly not trying to waiting for a journal commit when we are\nevicting the journal inode, since it\u0027s guaranteed to never succeed in\nthis case.\n\nThis can be easily replicated via:\n\n mount -t ext4 -o data\u003djournal /dev/vdb /vdb ; umount /vdb\n\n------------[ cut here ]------------\nWARNING: at /usr/projects/linux/ext4/fs/jbd2/journal.c:542 __jbd2_log_start_commit+0xba/0xcd()\nHardware name: Bochs\nJBD2: bad log_start_commit: 3005630206 3005630206 0 0\nModules linked in:\nPid: 2909, comm: umount Not tainted 3.8.0-rc3 #1020\nCall Trace:\n [\u003cc015c0ef\u003e] warn_slowpath_common+0x68/0x7d\n [\u003cc02b7e7d\u003e] ? __jbd2_log_start_commit+0xba/0xcd\n [\u003cc015c177\u003e] warn_slowpath_fmt+0x2b/0x2f\n [\u003cc02b7e7d\u003e] __jbd2_log_start_commit+0xba/0xcd\n [\u003cc02b8075\u003e] jbd2_log_start_commit+0x24/0x34\n [\u003cc0279ed5\u003e] ext4_evict_inode+0x71/0x2e3\n [\u003cc021f0ec\u003e] evict+0x94/0x135\n [\u003cc021f9aa\u003e] iput+0x10a/0x110\n [\u003cc02b7836\u003e] jbd2_journal_destroy+0x190/0x1ce\n [\u003cc0175284\u003e] ? bit_waitqueue+0x50/0x50\n [\u003cc028d23f\u003e] ext4_put_super+0x52/0x294\n [\u003cc020efe3\u003e] generic_shutdown_super+0x48/0xb4\n [\u003cc020f071\u003e] kill_block_super+0x22/0x60\n [\u003cc020f3e0\u003e] deactivate_locked_super+0x22/0x49\n [\u003cc020f5d6\u003e] deactivate_super+0x30/0x33\n [\u003cc0222795\u003e] mntput_no_expire+0x107/0x10c\n [\u003cc02233a7\u003e] sys_umount+0x2cf/0x2e0\n [\u003cc02233ca\u003e] sys_oldumount+0x12/0x14\n [\u003cc08096b8\u003e] syscall_call+0x7/0xb\n---[ end trace 6a954cc790501c1f ]---\njbd2_log_wait_commit: error: j_commit_request\u003d-1289337090, tid\u003d0\n\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d24f1399d1a527ba8c08df5f5ac96b9bd3c0e1d1", "tree": "de24ce49f49d251852ae7deeeaa02090bc97a89f", "parents": [ "ac4f52e0fff3a2b5523655250cc2e7d77ba8c09b" ], "author": { "name": "Zheng Liu", "email": "wenqing.lz@taobao.com", "time": "Sun Mar 10 21:20:23 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:18 2013 -0700" }, "message": "ext4: fix the wrong number of the allocated blocks in ext4_split_extent()\n\ncommit 3a2256702e47f68f921dfad41b1764d05c572329 upstream.\n\nThis commit fixes a wrong return value of the number of the allocated\nblocks in ext4_split_extent. When the length of blocks we want to\nallocate is greater than the length of the current extent, we return a\nwrong number. Let\u0027s see what happens in the following case when we\ncall ext4_split_extent().\n\n map: [48, 72]\n ex: [32, 64, u]\n\n\u0027ex\u0027 will be split into two parts:\n ex1: [32, 47, u]\n ex2: [48, 64, w]\n\n\u0027map-\u003em_len\u0027 is returned from this function, and the value is 24. But\nthe real length is 16. So it should be fixed.\n\nMeanwhile in this commit we use right length of the allocated blocks\nwhen get_reserved_cluster_alloc in ext4_ext_handle_uninitialized_extents\nis called.\n\nSigned-off-by: Zheng Liu \u003cwenqing.lz@taobao.com\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nCc: Dmitry Monakhov \u003cdmonakhov@openvz.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ac4f52e0fff3a2b5523655250cc2e7d77ba8c09b", "tree": "94f566e310b0f8eefdbf2237b414b0f03f243760", "parents": [ "056f8c8c85d53311530fd1940a68a390cc615bde" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Mar 11 13:24:56 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 28 12:12:15 2013 -0700" }, "message": "jbd2: fix use after free in jbd2_journal_dirty_metadata()\n\ncommit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream.\n\njbd2_journal_dirty_metadata() didn\u0027t get a reference to journal_head it\nwas working with. This is OK in most of the cases since the journal head\nshould be attached to a transaction but in rare occasions when we are\njournalling data, __ext4_journalled_writepage() can race with\njbd2_journal_invalidatepage() stripping buffers from a page and thus\njournal head can be freed under hands of jbd2_journal_dirty_metadata().\n\nFix the problem by getting own journal head reference in\njbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()\nwhich can possibly have the same issue).\n\nReported-by: Zheng Liu \u003cgnehzuil.liu@gmail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: \"Theodore Ts\u0027o\" \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "056f8c8c85d53311530fd1940a68a390cc615bde" }