)]}' { "log": [ { "commit": "fc83d2a48ec24c7836bcef1e67af16a84dc3f570", "tree": "7e9bcba5e03ae6e82b7cfcfdd794b9a8676eb689", "parents": [ "e92c54259e8d8bae9a3e1a4ce840ff0246cb8b3f" ], "author": { "name": "Eryu Guan", "email": "guaneryu@gmail.com", "time": "Thu May 14 19:00:45 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:40 2015 +0800" }, "message": "ext4: check for zero length extent explicitly\n\ncommit 2f974865ffdfe7b9f46a9940836c8b167342563d upstream.\n\nThe following commit introduced a bug when checking for zero length extent\n\n5946d08 ext4: check for overlapping extents in ext4_valid_extent_entries()\n\nZero length extent could pass the check if lblock is zero.\n\nAdding the explicit check for zero length back.\n\nSigned-off-by: Eryu Guan \u003cguaneryu@gmail.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "80fc8f6abe0a8fd267d7bd8d1eb873d4ce889293", "tree": "2fe64e64dd860fae08bc10ffa4dda95d20afbb56", "parents": [ "9f0a120b3b1e639db798896039b2e5055c014ff5" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Tue Apr 28 15:41:15 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:38 2015 +0800" }, "message": "nfsd: fix the check for confirmed openowner in nfs4_preprocess_stateid_op\n\ncommit ebe9cb3bb13e7b9b281969cd279ce70834f7500f upstream.\n\nIf we find a non-confirmed openowner we jump to exit the function, but do\nnot set an error value. Fix this by factoring out a helper to do the\ncheck and properly set the error from nfsd4_validate_stateid.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\n[lizf: adjust the changes for nfsd4_validate_stateid()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d939e53d62fd55fd83d243c3831ac44cd36a743d", "tree": "7d6f2813303585e50fae8242d8948c50bb0bc5d2", "parents": [ "a885169f03f6b84653b8418d2739397f0286d360" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Tue May 05 16:24:02 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:36 2015 +0800" }, "message": "ocfs2: dlm: fix race between purge and get lock resource\n\ncommit b1432a2a35565f538586774a03bf277c27fc267d upstream.\n\nThere is a race window in dlm_get_lock_resource(), which may return a\nlock resource which has been purged. This will cause the process to\nhang forever in dlmlock() as the ast msg can\u0027t be handled due to its\nlock resource not existing.\n\n dlm_get_lock_resource {\n ...\n spin_lock(\u0026dlm-\u003espinlock);\n tmpres \u003d __dlm_lookup_lockres_full(dlm, lockid, namelen, hash);\n if (tmpres) {\n spin_unlock(\u0026dlm-\u003espinlock);\n \u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e race window, dlm_run_purge_list() may run and purge\n the lock resource\n spin_lock(\u0026tmpres-\u003espinlock);\n ...\n spin_unlock(\u0026tmpres-\u003espinlock);\n }\n }\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Joseph Qi \u003cjoseph.qi@huawei.com\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a885169f03f6b84653b8418d2739397f0286d360", "tree": "a1803a328b2e17c8ab0b4ec74c03dc947cd26c96", "parents": [ "350b59e331e49c018e55f9b4ab7a9638f3ca2707" ], "author": { "name": "Ryusuke Konishi", "email": "konishi.ryusuke@lab.ntt.co.jp", "time": "Tue May 05 16:24:00 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:36 2015 +0800" }, "message": "nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()\n\ncommit d8fd150fe3935e1692bf57c66691e17409ebb9c1 upstream.\n\nThe range check for b-tree level parameter in nilfs_btree_root_broken()\nis wrong; it accepts the case of \"level \u003d\u003d NILFS_BTREE_LEVEL_MAX\" even\nthough the level is limited to values in the range of 0 to\n(NILFS_BTREE_LEVEL_MAX - 1).\n\nSince the level parameter is read from storage device and used to index\nnilfs_btree_path array whose element count is NILFS_BTREE_LEVEL_MAX, it\ncan cause memory overrun during btree operations if the boundary value\nis set to the level parameter on device.\n\nThis fixes the broken sanity check and adds a comment to clarify that\nthe upper bound NILFS_BTREE_LEVEL_MAX is exclusive.\n\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0c797892cfa290d60a425d863962d285801fee8b", "tree": "f2a53925f3100d34bba08a189d5e205e730a1797", "parents": [ "c79a54264db288e0fc221a4f39981feea15447ab" ], "author": { "name": "Davide Italiano", "email": "dccitaliano@gmail.com", "time": "Sat May 02 23:21:15 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:35 2015 +0800" }, "message": "ext4: move check under lock scope to close a race.\n\ncommit 280227a75b56ab5d35854f3a77ef74a7ad56a203 upstream.\n\nfallocate() checks that the file is extent-based and returns\nEOPNOTSUPP in case is not. Other tasks can convert from and to\nindirect and extent so it\u0027s safe to check only after grabbing\nthe inode mutex.\n\nSigned-off-by: Davide Italiano \u003cdccitaliano@gmail.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - return -EOPNOTSUPP instead of jumping to the \"out\" label]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a26f33c50cb736da55437cef761d48d72fe89d3e", "tree": "51d8d79937c6c8c3ab10511867f7d72a424cf490", "parents": [ "20db578815361ac06fca1c03ef555324f00111d0" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Apr 24 15:47:07 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:32 2015 +0800" }, "message": "RCU pathwalk breakage when running into a symlink overmounting something\n\ncommit 3cab989afd8d8d1bc3d99fef0e7ed87c31e7b647 upstream.\n\nCalling unlazy_walk() in walk_component() and do_last() when we find\na symlink that needs to be followed doesn\u0027t acquire a reference to vfsmount.\nThat\u0027s fine when the symlink is on the same vfsmount as the parent directory\n(which is almost always the case), but it\u0027s not always true - one _can_\nmanage to bind a symlink on top of something. And in such cases we end up\nwith excessive mntput().\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4: drop the changes to do_last()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "20db578815361ac06fca1c03ef555324f00111d0", "tree": "dc6db94746a925528935d0767ecc011f50d40b4d", "parents": [ "c9e5b3b7e731d070f5a95362281ea49718eb434d" ], "author": { "name": "Jeff Layton", "email": "jlayton@poochiereds.net", "time": "Fri Mar 20 15:15:14 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:32 2015 +0800" }, "message": "nfs: fix high load average due to callback thread sleeping\n\ncommit 5d05e54af3cdbb13cf19c557ff2184781b91a22c upstream.\n\nChuck pointed out a problem that crept in with commit 6ffa30d3f734 (nfs:\ndon\u0027t call blocking operations while !TASK_RUNNING). Linux counts tasks\nin uninterruptible sleep against the load average, so this caused the\nsystem\u0027s load average to be pinned at at least 1 when there was a\nNFSv4.1+ mount active.\n\nNot a huge problem, but it\u0027s probably worth fixing before we get too\nmany complaints about it. This patch converts the code back to use\nTASK_INTERRUPTIBLE sleep, simply has it flush any signals on each loop\niteration. In practice no one should really be signalling this thread at\nall, so I think this is reasonably safe.\n\nWith this change, there\u0027s also no need to game the hung task watchdog so\nwe can also convert the schedule_timeout call back to a normal schedule.\n\nReported-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nSigned-off-by: Jeff Layton \u003cjeff.layton@primarydata.com\u003e\nTested-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nFixes: commit 6ffa30d3f734 (“nfs: don\u0027t call blocking . . .”)\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c9e5b3b7e731d070f5a95362281ea49718eb434d", "tree": "4ca047832ff2e396ba49200906c4d28faa6c474d", "parents": [ "c15158153494485de5baba3ee7c1b2e6ce946a76" ], "author": { "name": "Jeff Layton", "email": "jlayton@primarydata.com", "time": "Wed Jan 14 13:08:57 2015 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:31 2015 +0800" }, "message": "nfs: don\u0027t call blocking operations while !TASK_RUNNING\n\ncommit 6ffa30d3f734d4f6b478081dfc09592021028f90 upstream.\n\nBruce reported seeing this warning pop when mounting using v4.1:\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 1121 at kernel/sched/core.c:7300 __might_sleep+0xbd/0xd0()\n do not call blocking ops when !TASK_RUNNING; state\u003d1 set at [\u003cffffffff810ff58f\u003e] prepare_to_wait+0x2f/0x90\n Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace sunrpc fscache ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw snd_hda_codec_generic snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_timer ppdev joydev snd virtio_console virtio_balloon pcspkr serio_raw parport_pc parport pvpanic floppy soundcore i2c_piix4 virtio_blk virtio_net qxl drm_kms_helper ttm drm virtio_pci virtio_ring ata_generic virtio pata_acpi\n CPU: 1 PID: 1121 Comm: nfsv4.1-svc Not tainted 3.19.0-rc4+ #25\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014\n 0000000000000000 000000004e5e3f73 ffff8800b998fb48 ffffffff8186ac78\n 0000000000000000 ffff8800b998fba0 ffff8800b998fb88 ffffffff810ac9da\n ffff8800b998fb68 ffffffff81c923e7 00000000000004d9 0000000000000000\n Call Trace:\n [\u003cffffffff8186ac78\u003e] dump_stack+0x4c/0x65\n [\u003cffffffff810ac9da\u003e] warn_slowpath_common+0x8a/0xc0\n [\u003cffffffff810aca65\u003e] warn_slowpath_fmt+0x55/0x70\n [\u003cffffffff810ff58f\u003e] ? prepare_to_wait+0x2f/0x90\n [\u003cffffffff810ff58f\u003e] ? prepare_to_wait+0x2f/0x90\n [\u003cffffffff810dd2ad\u003e] __might_sleep+0xbd/0xd0\n [\u003cffffffff8124c973\u003e] kmem_cache_alloc_trace+0x243/0x430\n [\u003cffffffff810d941e\u003e] ? groups_alloc+0x3e/0x130\n [\u003cffffffff810d941e\u003e] groups_alloc+0x3e/0x130\n [\u003cffffffffa0301b1e\u003e] svcauth_unix_accept+0x16e/0x290 [sunrpc]\n [\u003cffffffffa0300571\u003e] svc_authenticate+0xe1/0xf0 [sunrpc]\n [\u003cffffffffa02fc564\u003e] svc_process_common+0x244/0x6a0 [sunrpc]\n [\u003cffffffffa02fd044\u003e] bc_svc_process+0x1c4/0x260 [sunrpc]\n [\u003cffffffffa03d5478\u003e] nfs41_callback_svc+0x128/0x1f0 [nfsv4]\n [\u003cffffffff810ff970\u003e] ? wait_woken+0xc0/0xc0\n [\u003cffffffffa03d5350\u003e] ? nfs4_callback_svc+0x60/0x60 [nfsv4]\n [\u003cffffffff810d45bf\u003e] kthread+0x11f/0x140\n [\u003cffffffff810ea815\u003e] ? local_clock+0x15/0x30\n [\u003cffffffff810d44a0\u003e] ? kthread_create_on_node+0x250/0x250\n [\u003cffffffff81874bfc\u003e] ret_from_fork+0x7c/0xb0\n [\u003cffffffff810d44a0\u003e] ? kthread_create_on_node+0x250/0x250\n ---[ end trace 675220a11e30f4f2 ]---\n\nnfs41_callback_svc does most of its work while in TASK_INTERRUPTIBLE,\nwhich is just wrong. Fix that by finishing the wait immediately if we\u0027ve\nfound that the list has something on it.\n\nAlso, we don\u0027t expect this kthread to accept signals, so we should be\nusing a TASK_UNINTERRUPTIBLE sleep instead. That however, opens us up\nhung task warnings from the watchdog, so have the schedule_timeout\nwake up every 60s if there\u0027s no callback activity.\n\nReported-by: \"J. Bruce Fields\" \u003cbfields@fieldses.org\u003e\nSigned-off-by: Jeff Layton \u003cjlayton@primarydata.com\u003e\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c15158153494485de5baba3ee7c1b2e6ce946a76", "tree": "d102899739646c50522eded71ddde7bb4bebb35e", "parents": [ "4897576f6dd988ccdf4a0923e0e626fdc6e5f690" ], "author": { "name": "Giuseppe Cantavenera", "email": "giuseppe.cantavenera.ext@nokia.com", "time": "Mon Apr 20 18:00:08 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:31 2015 +0800" }, "message": "nfsd: fix nsfd startup race triggering BUG_ON\n\ncommit bb7ffbf29e76b89a86ca4c3ee0d4690641f2f772 upstream.\n\nnfsd triggered a BUG_ON in net_generic(...) when rpc_pipefs_event(...)\nin fs/nfsd/nfs4recover.c was called before assigning ntfsd_net_id.\nThe following was observed on a MIPS 32-core processor:\nkernel: Call Trace:\nkernel: [\u003cffffffffc00bc5e4\u003e] rpc_pipefs_event+0x7c/0x158 [nfsd]\nkernel: [\u003cffffffff8017a2a0\u003e] notifier_call_chain+0x70/0xb8\nkernel: [\u003cffffffff8017a4e4\u003e] __blocking_notifier_call_chain+0x4c/0x70\nkernel: [\u003cffffffff8053aff8\u003e] rpc_fill_super+0xf8/0x1a0\nkernel: [\u003cffffffff8022204c\u003e] mount_ns+0xb4/0xf0\nkernel: [\u003cffffffff80222b48\u003e] mount_fs+0x50/0x1f8\nkernel: [\u003cffffffff8023dc00\u003e] vfs_kern_mount+0x58/0xf0\nkernel: [\u003cffffffff802404ac\u003e] do_mount+0x27c/0xa28\nkernel: [\u003cffffffff80240cf0\u003e] SyS_mount+0x98/0xe8\nkernel: [\u003cffffffff80135d24\u003e] handle_sys64+0x44/0x68\nkernel:\nkernel:\n Code: 0040f809 00000000 2e020001 \u003c00020336\u003e 3c12c00d\n 3c02801a de100000 6442eb98 0040f809\nkernel: ---[ end trace 7471374335809536 ]---\n\nFixed this behaviour by calling register_pernet_subsys(\u0026nfsd_net_ops) before\nregistering rpc_pipefs_event(...) with the notifier chain.\n\nSigned-off-by: Giuseppe Cantavenera \u003cgiuseppe.cantavenera.ext@nokia.com\u003e\nSigned-off-by: Lorenzo Restelli \u003clorenzo.restelli.ext@nokia.com\u003e\nReviewed-by: Kinlong Mee \u003ckinglongmee@gmail.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a425d56c870dcd1273f46391c038289f420fc884", "tree": "5a6a85d12ef400cead6827bb46b658470374a53b", "parents": [ "c77676b7c6667e044ef4e5cc692cdb18d69df646" ], "author": { "name": "Michael Davidson", "email": "md@google.com", "time": "Tue Apr 14 15:47:38 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:30 2015 +0800" }, "message": "fs/binfmt_elf.c: fix bug in loading of PIE binaries\n\ncommit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 upstream.\n\nWith CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down\naddress allocation strategy, load_elf_binary() will attempt to map a PIE\nbinary into an address range immediately below mm-\u003emmap_base.\n\nUnfortunately, load_elf_ binary() does not take account of the need to\nallocate sufficient space for the entire binary which means that, while\nthe first PT_LOAD segment is mapped below mm-\u003emmap_base, the subsequent\nPT_LOAD segment(s) end up being mapped above mm-\u003emmap_base into the are\nthat is supposed to be the \"gap\" between the stack and the binary.\n\nSince the size of the \"gap\" on x86_64 is only guaranteed to be 128MB this\nmeans that binaries with large data segments \u003e 128MB can end up mapping\npart of their data segment over their stack resulting in corruption of the\nstack (and the data segment once the binary starts to run).\n\nAny PIE binary with a data segment \u003e 128MB is vulnerable to this although\naddress randomization means that the actual gap between the stack and the\nend of the binary is normally greater than 128MB. The larger the data\nsegment of the binary the higher the probability of failure.\n\nFix this by calculating the total size of the binary in the same way as\nload_elf_interp().\n\nSigned-off-by: Michael Davidson \u003cmd@google.com\u003e\nCc: Alexander Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Jiri Kosina \u003cjkosina@suse.cz\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c9ff0e39da0903f48ef93983f84338674192936b", "tree": "4d62599a568db54d75a097e3b7752411e4e98700", "parents": [ "c773eee8d24f5c376f33ba12e2d41cec6f587117" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Mon Mar 30 18:23:59 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:30 2015 +0800" }, "message": "Btrfs: fix inode eviction infinite loop after cloning into it\n\ncommit ccccf3d67294714af2d72a6fd6fd7d73b01c9329 upstream.\n\nIf we attempt to clone a 0 length region into a file we can end up\ninserting a range in the inode\u0027s extent_io tree with a start offset\nthat is greater then the end offset, which triggers immediately the\nfollowing warning:\n\n[ 3914.619057] WARNING: CPU: 17 PID: 4199 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]()\n[ 3914.620886] BTRFS: end \u003c start 4095 4096\n(...)\n[ 3914.638093] Call Trace:\n[ 3914.638636] [\u003cffffffff81425fd9\u003e] dump_stack+0x4c/0x65\n[ 3914.639620] [\u003cffffffff81045390\u003e] warn_slowpath_common+0xa1/0xbb\n[ 3914.640789] [\u003cffffffffa03ca44f\u003e] ? insert_state+0x4b/0x10b [btrfs]\n[ 3914.642041] [\u003cffffffff810453f0\u003e] warn_slowpath_fmt+0x46/0x48\n[ 3914.643236] [\u003cffffffffa03ca44f\u003e] insert_state+0x4b/0x10b [btrfs]\n[ 3914.644441] [\u003cffffffffa03ca729\u003e] __set_extent_bit+0x107/0x3f4 [btrfs]\n[ 3914.645711] [\u003cffffffffa03cb256\u003e] lock_extent_bits+0x65/0x1bf [btrfs]\n[ 3914.646914] [\u003cffffffff8142b2fb\u003e] ? _raw_spin_unlock+0x28/0x33\n[ 3914.648058] [\u003cffffffffa03cbac4\u003e] ? test_range_bit+0xcc/0xde [btrfs]\n[ 3914.650105] [\u003cffffffffa03cb3c3\u003e] lock_extent+0x13/0x15 [btrfs]\n[ 3914.651361] [\u003cffffffffa03db39e\u003e] lock_extent_range+0x3d/0xcd [btrfs]\n[ 3914.652761] [\u003cffffffffa03de1fe\u003e] btrfs_ioctl_clone+0x278/0x388 [btrfs]\n[ 3914.654128] [\u003cffffffff811226dd\u003e] ? might_fault+0x58/0xb5\n[ 3914.655320] [\u003cffffffffa03e0909\u003e] btrfs_ioctl+0xb51/0x2195 [btrfs]\n(...)\n[ 3914.669271] ---[ end trace 14843d3e2e622fc1 ]---\n\nThis later makes the inode eviction handler enter an infinite loop that\nkeeps dumping the following warning over and over:\n\n[ 3915.117629] WARNING: CPU: 22 PID: 4228 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]()\n[ 3915.119913] BTRFS: end \u003c start 4095 4096\n(...)\n[ 3915.137394] Call Trace:\n[ 3915.137913] [\u003cffffffff81425fd9\u003e] dump_stack+0x4c/0x65\n[ 3915.139154] [\u003cffffffff81045390\u003e] warn_slowpath_common+0xa1/0xbb\n[ 3915.140316] [\u003cffffffffa03ca44f\u003e] ? insert_state+0x4b/0x10b [btrfs]\n[ 3915.141505] [\u003cffffffff810453f0\u003e] warn_slowpath_fmt+0x46/0x48\n[ 3915.142709] [\u003cffffffffa03ca44f\u003e] insert_state+0x4b/0x10b [btrfs]\n[ 3915.143849] [\u003cffffffffa03ca729\u003e] __set_extent_bit+0x107/0x3f4 [btrfs]\n[ 3915.145120] [\u003cffffffffa038c1e3\u003e] ? btrfs_kill_super+0x17/0x23 [btrfs]\n[ 3915.146352] [\u003cffffffff811548f6\u003e] ? deactivate_locked_super+0x3b/0x50\n[ 3915.147565] [\u003cffffffffa03cb256\u003e] lock_extent_bits+0x65/0x1bf [btrfs]\n[ 3915.148785] [\u003cffffffff8142b7e2\u003e] ? _raw_write_unlock+0x28/0x33\n[ 3915.149931] [\u003cffffffffa03bc325\u003e] btrfs_evict_inode+0x196/0x482 [btrfs]\n[ 3915.151154] [\u003cffffffff81168904\u003e] evict+0xa0/0x148\n[ 3915.152094] [\u003cffffffff811689e5\u003e] dispose_list+0x39/0x43\n[ 3915.153081] [\u003cffffffff81169564\u003e] evict_inodes+0xdc/0xeb\n[ 3915.154062] [\u003cffffffff81154418\u003e] generic_shutdown_super+0x49/0xef\n[ 3915.155193] [\u003cffffffff811546d1\u003e] kill_anon_super+0x13/0x1e\n[ 3915.156274] [\u003cffffffffa038c1e3\u003e] btrfs_kill_super+0x17/0x23 [btrfs]\n(...)\n[ 3915.167404] ---[ end trace 14843d3e2e622fc2 ]---\n\nSo just bail out of the clone ioctl if the length of the region to clone\nis zero, without locking any extent range, in order to prevent this issue\n(same behaviour as a pwrite with a 0 length for example).\n\nThis is trivial to reproduce. For example, the steps for the test I just\nmade for fstests:\n\n mkfs.btrfs -f SCRATCH_DEV\n mount SCRATCH_DEV $SCRATCH_MNT\n\n touch $SCRATCH_MNT/foo\n touch $SCRATCH_MNT/bar\n\n $CLONER_PROG -s 0 -d 4096 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar\n umount $SCRATCH_MNT\n\nA test case for fstests follows soon.\n\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nReviewed-by: Omar Sandoval \u003cosandov@osandov.com\u003e\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "90b3fc7daf325f7d5b10301562ac2708839cacc7", "tree": "2d3cecc401a75907e6de2b181c94d3af038347c8", "parents": [ "ba115ad122eca872197ce2235caa57e0314fb370" ], "author": { "name": "Lukas Czerner", "email": "lczerner@redhat.com", "time": "Fri Apr 03 10:46:58 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:27 2015 +0800" }, "message": "ext4: make fsync to sync parent dir in no-journal for real this time\n\ncommit e12fb97222fc41e8442896934f76d39ef99b590a upstream.\n\nPreviously commit 14ece1028b3ed53ffec1b1213ffc6acaf79ad77c added a\nsupport for for syncing parent directory of newly created inodes to\nmake sure that the inode is not lost after a power failure in\nno-journal mode.\n\nHowever this does not work in majority of cases, namely:\n - if the directory has inline data\n - if the directory is already indexed\n - if the directory already has at least one block and:\n\t- the new entry fits into it\n\t- or we\u0027ve successfully converted it to indexed\n\nSo in those cases we might lose the inode entirely even after fsync in\nthe no-journal mode. This also includes ext2 default mode obviously.\n\nI\u0027ve noticed this while running xfstest generic/321 and even though the\ntest should fail (we need to run fsck after a crash in no-journal mode)\nI could not find a newly created entries even when if it was fsynced\nbefore.\n\nFix this by adjusting the ext4_add_entry() successful exit paths to set\nthe inode EXT4_STATE_NEWENTRY so that fsync has the chance to fsync the\nparent directory as well.\n\nSigned-off-by: Lukas Czerner \u003clczerner@redhat.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Frank Mayhar \u003cfmayhar@google.com\u003e\n[lizf: Backported to 3.4: remove a change from return to goto, as that\ndoesn\u0027t exist in 3.4]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "60ba3db7e79d02325f0ba2a11246c74e30427d41", "tree": "f44c90cd70479983e29d7e49e24ce5641091f5cf", "parents": [ "abe62247e0fd8ae561d13d803267241143ececa1" ], "author": { "name": "David Sterba", "email": "dsterba@suse.cz", "time": "Wed Mar 25 19:26:41 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:26 2015 +0800" }, "message": "btrfs: don\u0027t accept bare namespace as a valid xattr\n\ncommit 3c3b04d10ff1811a27f86684ccd2f5ba6983211d upstream.\n\nDue to insufficient check in btrfs_is_valid_xattr, this unexpectedly\nworks:\n\n $ touch file\n $ setfattr -n user. -v 1 file\n $ getfattr -d file\nuser.\u003d\"1\"\n\nie. the missing attribute name after the namespace.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d94291\nReported-by: William Douglas \u003cwilliam.douglas@intel.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.cz\u003e\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\n[lizf: Backported to 3.4:\n - 3.4 doesn\u0027t support XATTR_BTRFS_PREFIX]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "abe62247e0fd8ae561d13d803267241143ececa1", "tree": "97fd4c8c9532d91f6f5982d5af0e578bc91e4d6a", "parents": [ "7fd83f326fb8d0da3f59f704fd6bb27e457aa9df" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Mon Mar 23 14:07:40 2015 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Sep 18 09:20:26 2015 +0800" }, "message": "Btrfs: fix log tree corruption when fs mounted with -o discard\n\ncommit dcc82f4783ad91d4ab654f89f37ae9291cdc846a upstream.\n\nWhile committing a transaction we free the log roots before we write the\nnew super block. Freeing the log roots implies marking the disk location\nof every node/leaf (metadata extent) as pinned before the new super block\nis written. This is to prevent the disk location of log metadata extents\nfrom being reused before the new super block is written, otherwise we\nwould have a corrupted log tree if before the new super block is written\na crash/reboot happens and the location of any log tree metadata extent\nended up being reused and rewritten.\n\nEven though we pinned the log tree\u0027s metadata extents, we were issuing a\ndiscard against them if the fs was mounted with the -o discard option,\nresulting in corruption of the log tree if a crash/reboot happened before\nwriting the new super block - the next time the fs was mounted, during\nthe log replay process we would find nodes/leafs of the log btree with\na content full of zeroes, causing the process to fail and require the\nuse of the tool btrfs-zero-log to wipeout the log tree (and all data\npreviously fsynced becoming lost forever).\n\nFix this by not doing a discard when pinning an extent. The discard will\nbe done later when it\u0027s safe (after the new super block is committed) at\nextent-tree.c:btrfs_finish_extent_commit().\n\nFixes: e688b7252f78 (Btrfs: fix extent pinning bugs in the tree log)\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "981889fbaee9c2851727f534deb425b85a15e641", "tree": "1a3118f7ce5b3da3583128988620d5ed790c83f5", "parents": [ "bded67cc51db4e29af84f9ec1d671a86b0b6763b" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Sep 13 21:55:46 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:34 2015 +0800" }, "message": "don\u0027t bugger nd-\u003eseq on set_root_rcu() from follow_dotdot_rcu()\n\ncommit 7bd88377d482e1eae3c5329b12e33cfd664fa6a9 upstream.\n\nreturn the value instead, and have path_init() do the assignment. Broken by\n\"vfs: Fix absolute RCU path walk failures due to uninitialized seq number\",\nwhich was Cc-stable with 2.6.38+ as destination. This one should go where\nit went.\n\nTo avoid dummy value returned in case when root is already set (it would do\nno harm, actually, since the only caller that doesn\u0027t ignore the return value\nis guaranteed to have nd-\u003eroot *not* set, but it\u0027s more obvious that way),\nlift the check into callers. And do the same to set_root(), to keep them\nin sync.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Ian Jackson \u003cian.jackson@eu.citrix.com\u003e\n[lizf: the previous backport of this upstream commit is buggy. fix it]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a5822a0847e8d2980ee1d04f96ef78b9597928c8", "tree": "3141c620c5c76bf44f559a470cc31ac043d035f6", "parents": [ "4dd86a6aea75dba2284caa49817897582a0fe684" ], "author": { "name": "Sasha Levin", "email": "sasha.levin@oracle.com", "time": "Tue Apr 08 16:04:11 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:33 2015 +0800" }, "message": "autofs4: check dev ioctl size before allocating\n\ncommit e53d77eb8bb616e903e34cc7a918401bee3b5149 upstream.\n\nThere wasn\u0027t any check of the size passed from userspace before trying\nto allocate the memory required.\n\nThis meant that userspace might request more space than allowed,\ntriggering an OOM.\n\nSigned-off-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Ian Kent \u003craven@themaw.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e661bb1c6d22a28c9038f4c2888e1e3b52f5b247", "tree": "e797ebe2ad53fc979ec9c94eb628a222c42a102e", "parents": [ "fcafa22d451873a00bc97caa3abeeaa07b07685e" ], "author": { "name": "Jann Horn", "email": "jann@thejh.net", "time": "Sun Apr 19 02:48:39 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:33 2015 +0800" }, "message": "fs: take i_mutex during prepare_binprm for set[ug]id executables\n\ncommit 8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 upstream.\n\nThis prevents a race between chown() and execve(), where chowning a\nsetuid-user binary to root would momentarily make the binary setuid\nroot.\n\nThis patch was mostly written by Linus Torvalds.\n\nSigned-off-by: Jann Horn \u003cjann@thejh.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - remove task_no_new_priv and user namespace stuff\n - open-code file_inode()\n - s/READ_ONCE/ACCESS_ONCE]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "bff9edd65d2562a82d7ea2cdaf81c2ba8c7c231a", "tree": "6e19918f834f97739d21cb1cec71d6a03aaad6b5", "parents": [ "b674b0adae623283de4f49e1734de675678c456f" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Tue Feb 17 01:46:53 2015 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:32 2015 +0800" }, "message": "splice: Apply generic position and size checks to each write\n\n3.2.67-rc1 review patch. If anyone has any objections, please let me know.\n\n------------------\n\nFrom: Ben Hutchings \u003cben@decadent.org.uk\u003e\n\nWe need to check the position and size of file writes against various\nlimits, using generic_write_check(). This was not being done for\nthe splice write path. It was fixed upstream by commit 8d0207652cbe\n(\"-\u003esplice_write() via -\u003ewrite_iter()\") but we can\u0027t apply that.\n\nCVE-2014-7822\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "dfd04b4f2744170085f2dfcc66b7888fb130e0cc", "tree": "03e7fac79a7194eaa04ad1332d82399617a487ee", "parents": [ "419d4c989459c5fa2d3fa42c061c097e53dcaf19" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Apr 08 17:00:32 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:31 2015 +0800" }, "message": "ocfs2: _really_ sync the right range\n\ncommit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream.\n\n\"ocfs2 syncs the wrong range\" had been broken; prior to it the\ncode was doing the wrong thing in case of O_APPEND, all right,\nbut _after_ it we were syncing the wrong range in 100% cases.\n*ppos, aka iocb-\u003eki_pos is incremented prior to that point,\nso we are always doing sync on the area _after_ the one we\u0027d\nwritten to.\n\nSpotted by Joseph Qi \u003cjoseph.qi@huawei.com\u003e back in January;\nunfortunately, I\u0027d missed his mail back then ;-/\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "266bab33dfb499c8f1219beb36c99525c70f5f52", "tree": "67a5371b183e5d0bde7ece9a241d014e49df75ce", "parents": [ "9117c3b78c25cf57d6a83e83acd27dfbdfa0bcf7" ], "author": { "name": "David Disseldorp", "email": "ddiss@suse.de", "time": "Fri Mar 13 14:20:29 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:30 2015 +0800" }, "message": "cifs: fix use-after-free bug in find_writable_file\n\ncommit e1e9bda22d7ddf88515e8fe401887e313922823e upstream.\n\nUnder intermittent network outages, find_writable_file() is susceptible\nto the following race condition, which results in a user-after-free in\nthe cifs_writepages code-path:\n\nThread 1 Thread 2\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\ninv_file \u003d NULL\nrefind \u003d 0\nspin_lock(\u0026cifs_file_list_lock)\n\n// invalidHandle found on openFileList\n\ninv_file \u003d open_file\n// inv_file-\u003ecount currently 1\n\ncifsFileInfo_get(inv_file)\n// inv_file-\u003ecount \u003d 2\n\nspin_unlock(\u0026cifs_file_list_lock);\n\ncifs_reopen_file() cifs_close()\n// fails (rc !\u003d 0) -\u003ecifsFileInfo_put()\n spin_lock(\u0026cifs_file_list_lock)\n // inv_file-\u003ecount \u003d 1\n spin_unlock(\u0026cifs_file_list_lock)\n\nspin_lock(\u0026cifs_file_list_lock);\nlist_move_tail(\u0026inv_file-\u003eflist,\n \u0026cifs_inode-\u003eopenFileList);\nspin_unlock(\u0026cifs_file_list_lock);\n\ncifsFileInfo_put(inv_file);\n-\u003espin_lock(\u0026cifs_file_list_lock)\n\n // inv_file-\u003ecount \u003d 0\n list_del(\u0026cifs_file-\u003eflist);\n // cleanup!!\n kfree(cifs_file);\n\n spin_unlock(\u0026cifs_file_list_lock);\n\nspin_lock(\u0026cifs_file_list_lock);\n++refind;\n// refind \u003d 1\ngoto refind_writable;\n\nAt this point we loop back through with an invalid inv_file pointer\nand a refind value of 1. On second pass, inv_file is not overwritten on\nopenFileList traversal, and is subsequently dereferenced.\n\nSigned-off-by: David Disseldorp \u003cddiss@suse.de\u003e\nReviewed-by: Jeff Layton \u003cjlayton@samba.org\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1346295a3f729bb3705405fb69c6f6805aeb574f", "tree": "cf7fbaf4a085ac3f28a84f5ee5004b6f21f7edf3", "parents": [ "d4cd899d8665c75ebf36d4b101da5d990662281f" ], "author": { "name": "Sergei Antonov", "email": "saproj@gmail.com", "time": "Wed Mar 25 15:55:34 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:29 2015 +0800" }, "message": "hfsplus: fix B-tree corruption after insertion at position 0\n\ncommit 98cf21c61a7f5419d82f847c4d77bf6e96a76f5f upstream.\n\nFix B-tree corruption when a new record is inserted at position 0 in the\nnode in hfs_brec_insert(). In this case a hfs_brec_update_parent() is\ncalled to update the parent index node (if exists) and it is passed\nhfs_find_data with a search_key containing a newly inserted key instead\nof the key to be updated. This results in an inconsistent index node.\nThe bug reproduces on my machine after an extents overflow record for\nthe catalog file (CNID\u003d4) is inserted into the extents overflow B-tree.\nBecause of a low (reserved) value of CNID\u003d4, it has to become the first\nrecord in the first leaf node.\n\nThe resulting first leaf node is correct:\n\n ----------------------------------------------------\n | key0.CNID\u003d4 | key1.CNID\u003d123 | key2.CNID\u003d456, ... |\n ----------------------------------------------------\n\nBut the parent index key0 still contains the previous key CNID\u003d123:\n\n -----------------------\n | key0.CNID\u003d123 | ... |\n -----------------------\n\nA change in hfs_brec_insert() makes hfs_brec_update_parent() work\ncorrectly by preventing it from getting fd-\u003erecord\u003d-1 value from\n__hfs_brec_find().\n\nAlong the way, I removed duplicate code with unification of the if\ncondition. The resulting code is equivalent to the original code\nbecause node is never 0.\n\nAlso hfs_brec_update_parent() will now return an error after getting a\nnegative fd-\u003erecord value. However, the return value of\nhfs_brec_update_parent() is not checked anywhere in the file and I\u0027m\nleaving it unchanged by this patch. brec.c lacks error checking after\nsome other calls too, but this issue is of less importance than the one\nbeing fixed by this patch.\n\nSigned-off-by: Sergei Antonov \u003csaproj@gmail.com\u003e\nCc: Joe Perches \u003cjoe@perches.com\u003e\nReviewed-by: Vyacheslav Dubeyko \u003cslava@dubeyko.com\u003e\nAcked-by: Hin-Tak Leung \u003chtl10@users.sourceforge.net\u003e\nCc: Anton Altaparmakov \u003caia21@cam.ac.uk\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "182420b6521f728e1eb052c5659847d41b041682", "tree": "95d982fdae92e572574f86c9f1421363fe897652", "parents": [ "4ff89df0641aba81907245ba2caff741c6535fad" ], "author": { "name": "Miklos Szeredi", "email": "mszeredi@suse.cz", "time": "Thu Feb 26 11:45:47 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:24 2015 +0800" }, "message": "fuse: set stolen page uptodate\n\ncommit aa991b3b267e24f578bac7b09cc57579b660304b upstream.\n\nRegular pipe buffers\u0027 -\u003esteal method (generic_pipe_buf_steal()) doesn\u0027t set\nPG_uptodate.\n\nDon\u0027t warn on this condition, just set the uptodate flag.\n\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "4ff89df0641aba81907245ba2caff741c6535fad", "tree": "eb534365ea3c3d5c3b20477a554f4d632eb78363", "parents": [ "7b96cea2eb026957c042a5cf6785e60e25674709" ], "author": { "name": "Miklos Szeredi", "email": "mszeredi@suse.cz", "time": "Thu Feb 26 11:45:47 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:24 2015 +0800" }, "message": "fuse: notify: don\u0027t move pages\n\ncommit 0d2783626a53d4c922f82d51fa675cb5d13f0d36 upstream.\n\nfuse_try_move_page() is not prepared for replacing pages that have already\nbeen read.\n\nReported-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Miklos Szeredi \u003cmszeredi@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ba4e25ac180d5903320c42e4ef792e86c406fbfb", "tree": "9ec62976cfc937ccb9de74d67bb39b6d676fd14f", "parents": [ "eeaab591c8b308c2a0a0d94abd0e717cae7e8bd4" ], "author": { "name": "Tyler Hicks", "email": "tyhicks@canonical.com", "time": "Tue Feb 24 19:28:10 2015 -0600" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:20 2015 +0800" }, "message": "eCryptfs: don\u0027t pass fs-specific ioctl commands through\n\ncommit 6d65261a09adaa374c05de807f73a144d783669e upstream.\n\neCryptfs can\u0027t be aware of what to expect when after passing an\narbitrary ioctl command through to the lower filesystem. The ioctl\ncommand may trigger an action in the lower filesystem that is\nincompatible with eCryptfs.\n\nOne specific example is when one attempts to use the Btrfs clone\nioctl command when the source file is in the Btrfs filesystem that\neCryptfs is mounted on top of and the destination fd is from a new file\ncreated in the eCryptfs mount. The ioctl syscall incorrectly returns\nsuccess because the command is passed down to Btrfs which thinks that it\nwas able to do the clone operation. However, the result is an empty\neCryptfs file.\n\nThis patch allows the trim, {g,s}etflags, and {g,s}etversion ioctl\ncommands through and then copies up the inode metadata from the lower\ninode to the eCryptfs inode to catch any changes made to the lower\ninode\u0027s metadata. Those five ioctl commands are mostly common across all\nfilesystems but the whitelist may need to be further pruned in the\nfuture.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d93691\nhttps://launchpad.net/bugs/1305335\n\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nCc: Rocko \u003crockorequin@hotmail.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - there\u0027s no file_inode(), so open-code it]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "deee5f87a9f1f8d1d99fd6d0d30b56ac5aa839ad", "tree": "a4d9e25925048608301120ed11227c7a97d99d4a", "parents": [ "c7ef03ccf7dfaea06e75ef68c7b021f95ad2868b" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Thu Feb 26 12:54:46 2015 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:20 2015 +0800" }, "message": "NFSv4: Don\u0027t call put_rpccred() under the rcu_read_lock()\n\ncommit 7c0af9ffb7bb4e5355470fa60b3eb711ddf226fa upstream.\n\nput_rpccred() can sleep.\n\nFixes: 8f649c3762547 (\"NFSv4: Fix the locking in nfs_inode_reclaim_delegation()\")\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3dc8cc469f67f13128d65493b051bfeeb9178696", "tree": "68e8f093ad429ab1bcc5e3b6463dc5d8b2b57627", "parents": [ "7ea0e7edc3045ee48b962e2fe5444f325f3d8c47" ], "author": { "name": "Ryusuke Konishi", "email": "konishi.ryusuke@lab.ntt.co.jp", "time": "Fri Feb 27 15:51:56 2015 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:18 2015 +0800" }, "message": "nilfs2: fix potential memory overrun on inode\n\ncommit 957ed60b53b519064a54988c4e31e0087e47d091 upstream.\n\nEach inode of nilfs2 stores a root node of a b-tree, and it turned out to\nhave a memory overrun issue:\n\nEach b-tree node of nilfs2 stores a set of key-value pairs and the number\nof them (in \"bn_nchildren\" member of nilfs_btree_node struct), as well as\na few other \"bn_*\" members.\n\nSince the value of \"bn_nchildren\" is used for operations on the key-values\nwithin the b-tree node, it can cause memory access overrun if a large\nnumber is incorrectly set to \"bn_nchildren\".\n\nFor instance, nilfs_btree_node_lookup() function determines the range of\nbinary search with it, and too large \"bn_nchildren\" leads\nnilfs_btree_node_get_key() in that function to overrun.\n\nAs for intermediate b-tree nodes, this is prevented by a sanity check\nperformed when each node is read from a drive, however, no sanity check\nhas been done for root nodes stored in inodes.\n\nThis patch fixes the issue by adding missing sanity check against b-tree\nroot nodes so that it\u0027s called when on-memory inodes are read from ifile,\ninode metadata file.\n\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1519e726ad227cb0823d8965e115bc98d066c172", "tree": "45dcac30444025552287a33aad6784a6c53fcb15", "parents": [ "3f02b323742bb69a1ff9b73bc17d88fb63fb64ed" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Feb 21 22:19:57 2015 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:18 2015 +0800" }, "message": "autofs4 copy_dev_ioctl(): keep the value of -\u003esize we\u0027d used for allocation\n\ncommit 0a280962dc6e117e0e4baa668453f753579265d9 upstream.\n\nX-Coverup: just ask spender\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3f02b323742bb69a1ff9b73bc17d88fb63fb64ed", "tree": "d88021103874e117c76ad92768ab485e020d64eb", "parents": [ "bcf9fe97c24187e0590536886281a120e2bfbeba" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Feb 21 22:05:11 2015 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:18 2015 +0800" }, "message": "debugfs: leave freeing a symlink body until inode eviction\n\ncommit 0db59e59299f0b67450c5db21f7f316c8fb04e84 upstream.\n\nAs it is, we have debugfs_remove() racing with symlink traversals.\nSupply -\u003eevict_inode() and do freeing there - inode will remain\npinned until we are done with the symlink body.\n\nAnd rip the idiocy with checking if dentry is positive right after\nwe\u0027d verified debugfs_positive(), which is a stronger check...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4:\n - call end_writeback() instead of clear_inode()\n - call truncate_inode_pages() instead of truncate_inode_pages_final()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0fd0db3abbe16d32fbf41214dca9107c4c4f01f7", "tree": "0b77edee3cdc763c9d7fe63eef57470cde7a2f2f", "parents": [ "0f86e13f61bd10a726b43120e6b0f52ca5791c22" ], "author": { "name": "Chen Jie", "email": "chenjie6@huawei.com", "time": "Tue Feb 10 12:49:48 2015 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:16 2015 +0800" }, "message": "jffs2: fix handling of corrupted summary length\n\ncommit 164c24063a3eadee11b46575c5482b2f1417be49 upstream.\n\nsm-\u003eoffset maybe wrong but magic maybe right, the offset do not have CRC.\n\nBadness at c00c7580 [verbose debug info unavailable]\nNIP: c00c7580 LR: c00c718c CTR: 00000014\nREGS: df07bb40 TRAP: 0700 Not tainted (2.6.34.13-WR4.3.0.0_standard)\nMSR: 00029000 \u003cEE,ME,CE\u003e CR: 22084f84 XER: 00000000\nTASK \u003d df84d6e0[908] \u0027mount\u0027 THREAD: df07a000\nGPR00: 00000001 df07bbf0 df84d6e0 00000000 00000001 00000000 df07bb58 00000041\nGPR08: 00000041 c0638860 00000000 00000010 22084f88 100636c8 df814ff8 00000000\nGPR16: df84d6e0 dfa558cc c05adb90 00000048 c0452d30 00000000 000240d0 000040d0\nGPR24: 00000014 c05ae734 c05be2e0 00000000 00000001 00000000 00000000 c05ae730\nNIP [c00c7580] __alloc_pages_nodemask+0x4d0/0x638\nLR [c00c718c] __alloc_pages_nodemask+0xdc/0x638\nCall Trace:\n[df07bbf0] [c00c718c] __alloc_pages_nodemask+0xdc/0x638 (unreliable)\n[df07bc90] [c00c7708] __get_free_pages+0x20/0x48\n[df07bca0] [c00f4a40] __kmalloc+0x15c/0x1ec\n[df07bcd0] [c01fc880] jffs2_scan_medium+0xa58/0x14d0\n[df07bd70] [c01ff38c] jffs2_do_mount_fs+0x1f4/0x6b4\n[df07bdb0] [c020144c] jffs2_do_fill_super+0xa8/0x260\n[df07bdd0] [c020230c] jffs2_fill_super+0x104/0x184\n[df07be00] [c0335814] get_sb_mtd_aux+0x9c/0xec\n[df07be20] [c033596c] get_sb_mtd+0x84/0x1e8\n[df07be60] [c0201ed0] jffs2_get_sb+0x1c/0x2c\n[df07be70] [c0103898] vfs_kern_mount+0x78/0x1e8\n[df07bea0] [c0103a58] do_kern_mount+0x40/0x100\n[df07bec0] [c011fe90] do_mount+0x240/0x890\n[df07bf10] [c0120570] sys_mount+0x90/0xd8\n[df07bf40] [c00110d8] ret_from_syscall+0x0/0x4\n\n\u003d\u003d\u003d Exception: c01 at 0xff61a34\n LR \u003d 0x100135f0\nInstruction dump:\n38800005 38600000 48010f41 4bfffe1c 4bfc2d15 4bfffe8c 72e90200 4082fc28\n3d20c064 39298860 8809000d 68000001 \u003c0f000000\u003e 2f800000 419efc0c 38000001\nmount: mounting /dev/mtdblock3 on /common failed: Input/output error\n\nSigned-off-by: Chen Jie \u003cchenjie6@huawei.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9c71f4c287aeedfe75efa7280537c1368b5a9e13", "tree": "3f38a3d55bbc4952a139b585636fa67d4cf188bb", "parents": [ "c93fc8932e95ace45c35fe7a7220acd866bc5ae0" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Wed Feb 11 17:27:55 2015 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Fri Jun 19 11:40:14 2015 +0800" }, "message": "NFSv4.1: Fix a kfree() of uninitialised pointers in decode_cb_sequence_args\n\ncommit d8ba1f971497c19cf80da1ea5391a46a5f9fbd41 upstream.\n\nIf the call to decode_rc_list() fails due to a memory allocation error,\nthen we need to truncate the array size to ensure that we only call\nkfree() on those pointer that were allocated.\n\nReported-by: David Ramos \u003cdaramos@stanford.edu\u003e\nFixes: 4aece6a19cf7f (\"nfs41: cb_sequence xdr implementation\")\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a4cb7e348f461ce380708623f82f3020e6b89e5b", "tree": "aa072f3b152635803200dcc528cab1be47b51592", "parents": [ "8b19cfea81e37f215399a3d5481f899ba24f30c5" ], "author": { "name": "Ryusuke Konishi", "email": "konishi.ryusuke@lab.ntt.co.jp", "time": "Thu Mar 12 16:26:00 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:34:04 2015 +0800" }, "message": "nilfs2: fix deadlock of segment constructor during recovery\n\ncommit 283ee1482f349d6c0c09dfb725db5880afc56813 upstream.\n\nAccording to a report from Yuxuan Shui, nilfs2 in kernel 3.19 got stuck\nduring recovery at mount time. The code path that caused the deadlock was\nas follows:\n\n nilfs_fill_super()\n load_nilfs()\n nilfs_salvage_orphan_logs()\n * Do roll-forwarding, attach segment constructor for recovery,\n and kick it.\n\n nilfs_segctor_thread()\n nilfs_segctor_thread_construct()\n * A lock is held with nilfs_transaction_lock()\n nilfs_segctor_do_construct()\n nilfs_segctor_drop_written_files()\n iput()\n iput_final()\n write_inode_now()\n writeback_single_inode()\n __writeback_single_inode()\n do_writepages()\n nilfs_writepage()\n nilfs_construct_dsync_segment()\n nilfs_transaction_lock() --\u003e deadlock\n\nThis can happen if commit 7ef3ff2fea8b (\"nilfs2: fix deadlock of segment\nconstructor over I_SYNC flag\") is applied and roll-forward recovery was\nperformed at mount time. The roll-forward recovery can happen if datasync\nwrite is done and the file system crashes immediately after that. For\ninstance, we can reproduce the issue with the following steps:\n\n \u003c nilfs2 is mounted on /nilfs (device: /dev/sdb1) \u003e\n # dd if\u003d/dev/zero of\u003d/nilfs/test bs\u003d4k count\u003d1 \u0026\u0026 sync\n # dd if\u003d/dev/zero of\u003d/nilfs/test conv\u003dnotrunc oflag\u003ddsync bs\u003d4k\n count\u003d1 \u0026\u0026 reboot -nfh\n \u003c the system will immediately reboot \u003e\n # mount -t nilfs2 /dev/sdb1 /nilfs\n\nThe deadlock occurs because iput() can run segment constructor through\nwriteback_single_inode() if MS_ACTIVE flag is not set on sb-\u003es_flags. The\nabove commit changed segment constructor so that it calls iput()\nasynchronously for inodes with i_nlink \u003d\u003d 0, but that change was\nimperfect.\n\nThis fixes the another deadlock by deferring iput() in segment constructor\neven for the case that mount is not finished, that is, for the case that\nMS_ACTIVE flag is not set.\n\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nReported-by: Yuxuan Shui \u003cyshuiv7@gmail.com\u003e\nTested-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "917a35f64e9279b03988d88ef1acfd19f6d6f7b3", "tree": "03cf5b1d3a09b64cb9ccab9b55a8f72c6ee21955", "parents": [ "adc507681d2dba391d97b0e8f65313737be64d65" ], "author": { "name": "Jerry Hoemann", "email": "jerry.hoemann@hp.com", "time": "Wed Oct 29 14:50:22 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:34:03 2015 +0800" }, "message": "fsnotify: next_i is freed during fsnotify_unmount_inodes.\n\ncommit 6424babfd68dd8a83d9c60a5242d27038856599f upstream.\n\nDuring file system stress testing on 3.10 and 3.12 based kernels, the\numount command occasionally hung in fsnotify_unmount_inodes in the\nsection of code:\n\n spin_lock(\u0026inode-\u003ei_lock);\n if (inode-\u003ei_state \u0026 (I_FREEING|I_WILL_FREE|I_NEW)) {\n spin_unlock(\u0026inode-\u003ei_lock);\n continue;\n }\n\nAs this section of code holds the global inode_sb_list_lock, eventually\nthe system hangs trying to acquire the lock.\n\nMultiple crash dumps showed:\n\nThe inode-\u003ei_state \u003d\u003d 0x60 and i_count \u003d\u003d 0 and i_sb_list would point\nback at itself. As this is not the value of list upon entry to the\nfunction, the kernel never exits the loop.\n\nTo help narrow down problem, the call to list_del_init in\ninode_sb_list_del was changed to list_del. This poisons the pointers in\nthe i_sb_list and causes a kernel to panic if it transverse a freed\ninode.\n\nSubsequent stress testing paniced in fsnotify_unmount_inodes at the\nbottom of the list_for_each_entry_safe loop showing next_i had become\nfree.\n\nWe believe the root cause of the problem is that next_i is being freed\nduring the window of time that the list_for_each_entry_safe loop\ntemporarily releases inode_sb_list_lock to call fsnotify and\nfsnotify_inode_delete.\n\nThe code in fsnotify_unmount_inodes attempts to prevent the freeing of\ninode and next_i by calling __iget. However, the code doesn\u0027t do the\n__iget call on next_i\n\n\tif i_count \u003d\u003d 0 or\n\tif i_state \u0026 (I_FREEING | I_WILL_FREE)\n\nThe patch addresses this issue by advancing next_i in the above two cases\nuntil we either find a next_i which we can __iget or we reach the end of\nthe list. This makes the handling of next_i more closely match the\nhandling of the variable \"inode.\"\n\nThe time to reproduce the hang is highly variable (from hours to days.) We\nran the stress test on a 3.10 kernel with the proposed patch for a week\nwithout failure.\n\nDuring list_for_each_entry_safe, next_i is becoming free causing\nthe loop to never terminate. Advance next_i in those cases where\n__iget is not done.\n\nSigned-off-by: Jerry Hoemann \u003cjerry.hoemann@hp.com\u003e\nCc: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\nCc: Ken Helias \u003ckenhelias@firemail.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "729105426a47812acf524651ee5f85dae368685c", "tree": "5d0875eb347a59a4e9a8443f7173b153c5c6f700", "parents": [ "fd3fc8026677e37d2db63e2bd8ab0a5323f6d302" ], "author": { "name": "Dave Kleikamp", "email": "dave.kleikamp@oracle.com", "time": "Mon Mar 23 16:06:26 2015 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:34:02 2015 +0800" }, "message": "jfs: fix readdir regression\n\nUpstream commit 44512449, \"jfs: fix readdir cookie incompatibility\nwith NFSv4\", was backported incorrectly into the stable trees which\nused the filldir callback (rather than dir_emit). The position is\nbeing incorrectly passed to filldir for the . and .. entries.\n\nThe still-maintained stable trees that need to be fixed are 3.2.y,\n3.4.y and 3.10.y.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id\u003d94741\n\nSigned-off-by: Dave Kleikamp \u003cdave.kleikamp@oracle.com\u003e\nCc: jfs-discussion@lists.sourceforge.net\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "6a688d1c2effaecd0988c0e2ad784f189206958c", "tree": "238ca2bf868078dd5d8795b2526d67b523c26f95", "parents": [ "3022d3dd56f905d34054a62f569c16d5749e1e85" ], "author": { "name": "Kirill A. Shutemov", "email": "kirill.shutemov@linux.intel.com", "time": "Mon Mar 09 23:11:12 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:34:02 2015 +0800" }, "message": "pagemap: do not leak physical addresses to non-privileged userspace\n\ncommit ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce upstream.\n\nAs pointed by recent post[1] on exploiting DRAM physical imperfection,\n/proc/PID/pagemap exposes sensitive information which can be used to do\nattacks.\n\nThis disallows anybody without CAP_SYS_ADMIN to read the pagemap.\n\n[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html\n\n[ Eventually we might want to do anything more finegrained, but for now\n this is the simple model. - Linus ]\n\nSigned-off-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nAcked-by: Konstantin Khlebnikov \u003ckhlebnikov@openvz.org\u003e\nAcked-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Pavel Emelyanov \u003cxemul@parallels.com\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Mark Seaborn \u003cmseaborn@chromium.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n[mancha: Backported to 3.10]\nSigned-off-by: mancha security \u003cmancha1@zoho.com\u003e\n" }, { "commit": "28cd54f27d309bd65db8ff4b8e6275345287484c", "tree": "bcbaf91e296cfe010e334b747fab92603651ba43", "parents": [ "708ef3375975121fbe187397f478e17877c67168" ], "author": { "name": "Ryusuke Konishi", "email": "konishi.ryusuke@lab.ntt.co.jp", "time": "Thu Feb 05 12:25:20 2015 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:34:00 2015 +0800" }, "message": "nilfs2: fix deadlock of segment constructor over I_SYNC flag\n\ncommit 7ef3ff2fea8bf5e4a21cef47ad87710a3d0fdb52 upstream.\n\nNilfs2 eventually hangs in a stress test with fsstress program. This\nissue was caused by the following deadlock over I_SYNC flag between\nnilfs_segctor_thread() and writeback_sb_inodes():\n\n nilfs_segctor_thread()\n nilfs_segctor_thread_construct()\n nilfs_segctor_unlock()\n nilfs_dispose_list()\n iput()\n iput_final()\n evict()\n inode_wait_for_writeback() * wait for I_SYNC flag\n\n writeback_sb_inodes()\n * set I_SYNC flag on inode-\u003ei_state\n __writeback_single_inode()\n do_writepages()\n nilfs_writepages()\n nilfs_construct_dsync_segment()\n nilfs_segctor_sync()\n * wait for completion of segment constructor\n inode_sync_complete()\n * clear I_SYNC flag after __writeback_single_inode() completed\n\nwriteback_sb_inodes() calls do_writepages() for dirty inodes after\nsetting I_SYNC flag on inode-\u003ei_state. do_writepages() in turn calls\nnilfs_writepages(), which can run segment constructor and wait for its\ncompletion. On the other hand, segment constructor calls iput(), which\ncan call evict() and wait for the I_SYNC flag on\ninode_wait_for_writeback().\n\nSince segment constructor doesn\u0027t know when I_SYNC will be set, it\ncannot know whether iput() will block or not unless inode-\u003ei_nlink has a\nnon-zero count. We can prevent evict() from being called in iput() by\nimplementing sop-\u003edrop_inode(), but it\u0027s not preferable to leave inodes\nwith i_nlink \u003d\u003d 0 for long periods because it even defers file\ntruncation and inode deallocation. So, this instead resolves the\ndeadlock by calling iput() asynchronously with a workqueue for inodes\nwith i_nlink \u003d\u003d 0.\n\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nTested-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a91da0b39a785448ef420c4ac389d03f4743a836", "tree": "f18117976b4806af88a387d776cddc46782db1fd", "parents": [ "6fd17def6d964c81205230e02b4208c653106d51" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Oct 26 19:31:10 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:58 2015 +0800" }, "message": "deal with deadlock in d_walk()\n\ncommit ca5358ef75fc69fee5322a38a340f5739d997c10 upstream.\n\n... by not hitting rename_retry for reasons other than rename having\nhappened. In other words, do _not_ restart when finding that\nbetween unlocking the child and locking the parent the former got\ninto __dentry_kill(). Skip the killed siblings instead...\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[bwh: Backported to 3.2:\n - As we only have try_to_ascend() and not d_walk(), apply this\n change to all callers of try_to_ascend()\n - Adjust context to make __dentry_kill() apply to d_kill()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[lizf: Backported to 3.4: fold the fix 2d5a2e6775fa in 3.2.y into this patch]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "6fd17def6d964c81205230e02b4208c653106d51", "tree": "1253f07591fe80dc3442db927536c1b3f66b5cd7", "parents": [ "a42e15a485c14f6d994192af4c16775fbd6c1126" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sun Oct 26 19:19:16 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:58 2015 +0800" }, "message": "move d_rcu from overlapping d_child to overlapping d_alias\n\ncommit 946e51f2bf37f1656916eb75bd0742ba33983c28 upstream.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[bwh: Backported to 3.2:\n - Apply name changes in all the different places we use d_alias and d_child\n - Move the WARN_ON() in __d_free() to d_free() as we don\u0027t have dentry_free()]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - need one more name change in debugfs]\n" }, { "commit": "565d34077a24bf7819e8fbbb6c93e4d6271c992f", "tree": "9ed8e81c7661757169a8de33c6181dfeb26473da", "parents": [ "b0f741c5d11b1b2bafd8392f0cb4d8ac25be9164" ], "author": { "name": "Hector Marco-Gisbert", "email": "hecmargi@upv.es", "time": "Sat Feb 14 09:33:50 2015 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:58 2015 +0800" }, "message": "x86, mm/ASLR: Fix stack randomization on 64-bit systems\n\ncommit 4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 upstream.\n\nThe issue is that the stack for processes is not properly randomized on\n64 bit architectures due to an integer overflow.\n\nThe affected function is randomize_stack_top() in file\n\"fs/binfmt_elf.c\":\n\n static unsigned long randomize_stack_top(unsigned long stack_top)\n {\n unsigned int random_variable \u003d 0;\n\n if ((current-\u003eflags \u0026 PF_RANDOMIZE) \u0026\u0026\n !(current-\u003epersonality \u0026 ADDR_NO_RANDOMIZE)) {\n random_variable \u003d get_random_int() \u0026 STACK_RND_MASK;\n random_variable \u003c\u003c\u003d PAGE_SHIFT;\n }\n return PAGE_ALIGN(stack_top) + random_variable;\n return PAGE_ALIGN(stack_top) - random_variable;\n }\n\nNote that, it declares the \"random_variable\" variable as \"unsigned int\".\nSince the result of the shifting operation between STACK_RND_MASK (which\nis 0x3fffff on x86_64, 22 bits) and PAGE_SHIFT (which is 12 on x86_64):\n\n\t random_variable \u003c\u003c\u003d PAGE_SHIFT;\n\nthen the two leftmost bits are dropped when storing the result in the\n\"random_variable\". This variable shall be at least 34 bits long to hold\nthe (22+12) result.\n\nThese two dropped bits have an impact on the entropy of process stack.\nConcretely, the total stack entropy is reduced by four: from 2^28 to\n2^30 (One fourth of expected entropy).\n\nThis patch restores back the entropy by correcting the types involved\nin the operations in the functions randomize_stack_top() and\nstack_maxrandom_size().\n\nThe successful fix can be tested with:\n\n $ for i in `seq 1 10`; do cat /proc/self/maps | grep stack; done\n 7ffeda566000-7ffeda587000 rw-p 00000000 00:00 0 [stack]\n 7fff5a332000-7fff5a353000 rw-p 00000000 00:00 0 [stack]\n 7ffcdb7a1000-7ffcdb7c2000 rw-p 00000000 00:00 0 [stack]\n 7ffd5e2c4000-7ffd5e2e5000 rw-p 00000000 00:00 0 [stack]\n ...\n\nOnce corrected, the leading bytes should be between 7ffc and 7fff,\nrather than always being 7fff.\n\nSigned-off-by: Hector Marco-Gisbert \u003checmargi@upv.es\u003e\nSigned-off-by: Ismael Ripoll \u003ciripoll@upv.es\u003e\n[ Rebased, fixed 80 char bugs, cleaned up commit message, added test example and CVE ]\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nFixes: CVE-2015-1593\nLink: http://lkml.kernel.org/r/20150214173350.GA18393@www.outflux.net\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7e7154ffc2cacf2165fa88f5927d992a85413e6b", "tree": "377a2beab618c4876b66f9f0db7872b0f4506fa3", "parents": [ "bd2b759a41eebdf2ced0c262502a45e088bcc67c" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Dec 19 14:27:55 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:48 2015 +0800" }, "message": "udf: Check component length before reading it\n\ncommit e237ec37ec154564f8690c5bd1795339955eeef9 upstream.\n\nCheck that length specified in a component of a symlink fits in the\ninput buffer we are reading. Also properly ignore component length for\ncomponent types that do not use it. Otherwise we read memory after end\nof buffer for corrupted udf image.\n\nReported-by: Carl Henrik Lunde \u003cchlunde@ping.uio.no\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "99961be4f571a89b2213d459ec2b970b99839654", "tree": "2d1858cc0cff2029d6767058882528c0e1870479", "parents": [ "fb1b20745fd0ac7a7c48f589842e70225bae1426" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Dec 18 22:37:50 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:48 2015 +0800" }, "message": "udf: Check path length when reading symlink\n\ncommit 0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 upstream.\n\nSymlink reading code does not check whether the resulting path fits into\nthe page provided by the generic code. This isn\u0027t as easy as just\nchecking the symlink size because of various encoding conversions we\nperform on path. So we have to check whether there is still enough space\nin the buffer on the fly.\n\nReported-by: Carl Henrik Lunde \u003cchlunde@ping.uio.no\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n[lizf: Backported to 3.4: udf_get_filename() is called in do_udf_readdir()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "fb1b20745fd0ac7a7c48f589842e70225bae1426", "tree": "acb6fa88c16f681da344f3ab406578023a048749", "parents": [ "f9063aff1c0a589d225267e895b180d097f62409" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Dec 19 12:21:47 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:48 2015 +0800" }, "message": "udf: Verify symlink size before loading it\n\ncommit a1d47b262952a45aae62bd49cfaf33dd76c11a2c upstream.\n\nUDF specification allows arbitrarily large symlinks. However we support\nonly symlinks at most one block large. Check the length of the symlink\nso that we don\u0027t access memory beyond end of the symlink block.\n\nReported-by: Carl Henrik Lunde \u003cchlunde@gmail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f9063aff1c0a589d225267e895b180d097f62409", "tree": "f50c55f054150570b5f996267ea187c02bef8bb1", "parents": [ "e44da0a95a798cbfbc1ec6760b3d1cfa531a9797" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Fri Dec 19 12:03:53 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:47 2015 +0800" }, "message": "udf: Verify i_size when loading inode\n\ncommit e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 upstream.\n\nVerify that inode size is sane when loading inode with data stored in\nICB. Otherwise we may get confused later when working with the inode and\ninode size is too big.\n\nReported-by: Carl Henrik Lunde \u003cchlunde@ping.uio.no\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\n[lizf: Backported to 3.4: just return on error, as there\u0027s no \"out\" label]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e44da0a95a798cbfbc1ec6760b3d1cfa531a9797", "tree": "cc0fb94902e962d9769828f60548cdd51ff94501", "parents": [ "9939834ccd271dde9b020447ff01e0939b058346" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Dec 18 17:26:10 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:47 2015 +0800" }, "message": "isofs: Fix unchecked printing of ER records\n\ncommit 4e2024624e678f0ebb916e6192bd23c1f9fdf696 upstream.\n\nWe didn\u0027t check length of rock ridge ER records before printing them.\nThus corrupted isofs image can cause us to access and print some memory\nbehind the buffer with obvious consequences.\n\nReported-and-tested-by: Carl Henrik Lunde \u003cchlunde@ping.uio.no\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9939834ccd271dde9b020447ff01e0939b058346", "tree": "9711aa6cacee3b6b262ea262c0d57a057ae3985b", "parents": [ "46ca2c2cbe84b9a87f105c20182f2274501a0604" ], "author": { "name": "Junxiao Bi", "email": "junxiao.bi@oracle.com", "time": "Thu Dec 18 16:17:37 2014 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:47 2015 +0800" }, "message": "ocfs2: fix journal commit deadlock\n\ncommit 136f49b9171074872f2a14ad0ab10486d1ba13ca upstream.\n\nFor buffer write, page lock will be got in write_begin and released in\nwrite_end, in ocfs2_write_end_nolock(), before it unlock the page in\nocfs2_free_write_ctxt(), it calls ocfs2_run_deallocs(), this will ask\nfor the read lock of journal-\u003ej_trans_barrier. Holding page lock and\nask for journal-\u003ej_trans_barrier breaks the locking order.\n\nThis will cause a deadlock with journal commit threads, ocfs2cmt will\nget write lock of journal-\u003ej_trans_barrier first, then it wakes up\nkjournald2 to do the commit work, at last it waits until done. To\ncommit journal, kjournald2 needs flushing data first, it needs get the\ncache page lock.\n\nSince some ocfs2 cluster locks are holding by write process, this\ndeadlock may hung the whole cluster.\n\nunlock pages before ocfs2_run_deallocs() can fix the locking order, also\nput unlock before ocfs2_commit_trans() to make page lock is unlocked\nbefore j_trans_barrier to preserve unlocking order.\n\nSigned-off-by: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nReviewed-by: Wengang Wang \u003cwen.gang.wang@oracle.com\u003e\nReviewed-by: Mark Fasheh \u003cmfasheh@suse.de\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "96e44adce250199ec9b2b928be66365779ff1b59", "tree": "348aa104584d0a23297d3746826a67b18f87b794", "parents": [ "68aa0365a6a71c8fc4b2aaded74511c87614e1fb" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Mon Dec 15 14:22:46 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:47 2015 +0800" }, "message": "isofs: Fix infinite looping over CE entries\n\ncommit f54e18f1b831c92f6512d2eedb224cd63d607d3d upstream.\n\nRock Ridge extensions define so called Continuation Entries (CE) which\ndefine where is further space with Rock Ridge data. Corrupted isofs\nimage can contain arbitrarily long chain of these, including a one\ncontaining loop and thus causing kernel to end in an infinite loop when\ntraversing these entries.\n\nLimit the traversal to 32 entries which should be more than enough space\nto store all the Rock Ridge data.\n\nReported-by: P J P \u003cppandit@redhat.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0d030473658c7760c4cdd4fd0cc61e287b6023b3", "tree": "0e66b9c5b5a6760e43c38bb8899fb2964bf5deba", "parents": [ "81cc271d2c4a179aae41c503562af9e11ce94adc" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Dec 11 23:01:41 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:46 2015 +0800" }, "message": "genirq: Prevent proc race against freeing of irq descriptors\n\ncommit c291ee622165cb2c8d4e7af63fffd499354a23be upstream.\n\nSince the rework of the sparse interrupt code to actually free the\nunused interrupt descriptors there exists a race between the /proc\ninterfaces to the irq subsystem and the code which frees the interrupt\ndescriptor.\n\nCPU0\t\t\t\tCPU1\n\t\t\t\tshow_interrupts()\n\t\t\t\t desc \u003d irq_to_desc(X);\nfree_desc(desc)\n remove_from_radix_tree();\n kfree(desc);\n\t\t\t\t raw_spinlock_irq(\u0026desc-\u003elock);\n\n/proc/interrupts is the only interface which can actively corrupt\nkernel memory via the lock access. /proc/stat can only read from freed\nmemory. Extremly hard to trigger, but possible.\n\nThe interfaces in /proc/irq/N/ are not affected by this because the\nremoval of the proc file is serialized in procfs against concurrent\nreaders/writers. The removal happens before the descriptor is freed.\n\nFor architectures which have CONFIG_SPARSE_IRQ\u003dn this is a non issue\nas the descriptor is never freed. It\u0027s merely cleared out with the irq\ndescriptor lock held. So any concurrent proc access will either see\nthe old correct value or the cleared out ones.\n\nProtect the lookup and access to the irq descriptor in\nshow_interrupts() with the sparse_irq_lock.\n\nProvide kstat_irqs_usr() which is protecting the lookup and access\nwith sparse_irq_lock and switch /proc/stat to use it.\n\nDocument the existing kstat_irqs interfaces so it\u0027s clear that the\ncaller needs to take care about protection. The users of these\ninterfaces are either not affected due to SPARSE_IRQ\u003dn or already\nprotected against removal.\n\nFixes: 1f5a5b87f78f \"genirq: Implement a sane sparse_irq allocator\"\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n[lizf: Backported to 3.4:\n - define kstat_irqs() for CONFIG_GENERIC_HARDIRQS\n - add ifdef/endif CONFIG_SPARSE_IRQ]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0b3edd6b31e997cb95208ce0afb7f46f60146d35", "tree": "a352a485227cb1d36ab886f504f74059c4c01e24", "parents": [ "11b814e3597eeffa475e2e41323aa52d2e2289fa" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Wed Dec 10 15:52:22 2014 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:46 2015 +0800" }, "message": "ncpfs: return proper error from NCP_IOC_SETROOT ioctl\n\ncommit a682e9c28cac152e6e54c39efcf046e0c8cfcf63 upstream.\n\nIf some error happens in NCP_IOC_SETROOT ioctl, the appropriate error\nreturn value is then (in most cases) just overwritten before we return.\nThis can result in reporting success to userspace although error happened.\n\nThis bug was introduced by commit 2e54eb96e2c8 (\"BKL: Remove BKL from\nncpfs\"). Propagate the errors correctly.\n\nCoverity id: 1226925.\n\nFixes: 2e54eb96e2c80 (\"BKL: Remove BKL from ncpfs\")\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Petr Vandrovec \u003cpetr@vandrovec.name\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "11b814e3597eeffa475e2e41323aa52d2e2289fa", "tree": "ea5d1b8fb1e5b5bfd13596ede4e5951b74d5d7dd", "parents": [ "187c38d0b6fbcc6a17cae6754148eb3f3f117458" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Sun Dec 07 21:31:47 2014 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:45 2015 +0800" }, "message": "Btrfs: fix fs corruption on transaction abort if device supports discard\n\ncommit 678886bdc6378c1cbd5072da2c5a3035000214e3 upstream.\n\nWhen we abort a transaction we iterate over all the ranges marked as dirty\nin fs_info-\u003efreed_extents[0] and fs_info-\u003efreed_extents[1], clear them\nfrom those trees, add them back (unpin) to the free space caches and, if\nthe fs was mounted with \"-o discard\", perform a discard on those regions.\nAlso, after adding the regions to the free space caches, a fitrim ioctl call\ncan see those ranges in a block group\u0027s free space cache and perform a discard\non the ranges, so the same issue can happen without \"-o discard\" as well.\n\nThis causes corruption, affecting one or multiple btree nodes (in the worst\ncase leaving the fs unmountable) because some of those ranges (the ones in\nthe fs_info-\u003epinned_extents tree) correspond to btree nodes/leafs that are\nreferred by the last committed super block - breaking the rule that anything\nthat was committed by a transaction is untouched until the next transaction\ncommits successfully.\n\nI ran into this while running in a loop (for several hours) the fstest that\nI recently submitted:\n\n [PATCH] fstests: add btrfs test to stress chunk allocation/removal and fstrim\n\nThe corruption always happened when a transaction aborted and then fsck complained\nlike this:\n\n _check_btrfs_filesystem: filesystem on /dev/sdc is inconsistent\n *** fsck.btrfs output ***\n Check tree block failed, want\u003d94945280, have\u003d0\n Check tree block failed, want\u003d94945280, have\u003d0\n Check tree block failed, want\u003d94945280, have\u003d0\n Check tree block failed, want\u003d94945280, have\u003d0\n Check tree block failed, want\u003d94945280, have\u003d0\n read block failed check_tree_block\n Couldn\u0027t open file system\n\nIn this case 94945280 corresponded to the root of a tree.\nUsing frace what I observed was the following sequence of steps happened:\n\n 1) transaction N started, fs_info-\u003epinned_extents pointed to\n fs_info-\u003efreed_extents[0];\n\n 2) node/eb 94945280 is created;\n\n 3) eb is persisted to disk;\n\n 4) transaction N commit starts, fs_info-\u003epinned_extents now points to\n fs_info-\u003efreed_extents[1], and transaction N completes;\n\n 5) transaction N + 1 starts;\n\n 6) eb is COWed, and btrfs_free_tree_block() called for this eb;\n\n 7) eb range (94945280 to 94945280 + 16Kb) is added to\n fs_info-\u003epinned_extents (fs_info-\u003efreed_extents[1]);\n\n 8) Something goes wrong in transaction N + 1, like hitting ENOSPC\n for example, and the transaction is aborted, turning the fs into\n readonly mode. The stack trace I got for example:\n\n [112065.253935] [\u003cffffffff8140c7b6\u003e] dump_stack+0x4d/0x66\n [112065.254271] [\u003cffffffff81042984\u003e] warn_slowpath_common+0x7f/0x98\n [112065.254567] [\u003cffffffffa0325990\u003e] ? __btrfs_abort_transaction+0x50/0x10b [btrfs]\n [112065.261674] [\u003cffffffff810429e5\u003e] warn_slowpath_fmt+0x48/0x50\n [112065.261922] [\u003cffffffffa032949e\u003e] ? btrfs_free_path+0x26/0x29 [btrfs]\n [112065.262211] [\u003cffffffffa0325990\u003e] __btrfs_abort_transaction+0x50/0x10b [btrfs]\n [112065.262545] [\u003cffffffffa036b1d6\u003e] btrfs_remove_chunk+0x537/0x58b [btrfs]\n [112065.262771] [\u003cffffffffa033840f\u003e] btrfs_delete_unused_bgs+0x1de/0x21b [btrfs]\n [112065.263105] [\u003cffffffffa0343106\u003e] cleaner_kthread+0x100/0x12f [btrfs]\n (...)\n [112065.264493] ---[ end trace dd7903a975a31a08 ]---\n [112065.264673] BTRFS: error (device sdc) in btrfs_remove_chunk:2625: errno\u003d-28 No space left\n [112065.264997] BTRFS info (device sdc): forced readonly\n\n 9) The clear kthread sees that the BTRFS_FS_STATE_ERROR bit is set in\n fs_info-\u003efs_state and calls btrfs_cleanup_transaction(), which in\n turn calls btrfs_destroy_pinned_extent();\n\n 10) Then btrfs_destroy_pinned_extent() iterates over all the ranges\n marked as dirty in fs_info-\u003efreed_extents[], and for each one\n it calls discard, if the fs was mounted with \"-o discard\", and\n adds the range to the free space cache of the respective block\n group;\n\n 11) btrfs_trim_block_group(), invoked from the fitrim ioctl code path,\n sees the free space entries and performs a discard;\n\n 12) After an umount and mount (or fsck), our eb\u0027s location on disk was full\n of zeroes, and it should have been untouched, because it was marked as\n dirty in the fs_info-\u003epinned_extents tree, and therefore used by the\n trees that the last committed superblock points to.\n\nFix this by not performing a discard and not adding the ranges to the free space\ncaches - it\u0027s useless from this point since the fs is now in readonly mode and\nwe won\u0027t write free space caches to disk anymore (otherwise we would leak space)\nnor any new superblock. By not adding the ranges to the free space caches, it\nprevents other code paths from allocating that space and write to it as well,\ntherefore being safer and simpler.\n\nThis isn\u0027t a new problem, as it\u0027s been present since 2011 (git commit\nacce952b0263825da32cf10489413dec78053347).\n\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "04fb28bc511cf14807810d0563c7f07e00829edd", "tree": "ad4768379ee06d584bb88d3a6e62761d3398ca16", "parents": [ "e660b2f263de95566ffa53f9f0cc229e239311a7" ], "author": { "name": "Michael Halcrow", "email": "mhalcrow@google.com", "time": "Wed Nov 26 09:09:16 2014 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:43 2015 +0800" }, "message": "eCryptfs: Remove buggy and unnecessary write in file name decode routine\n\ncommit 942080643bce061c3dd9d5718d3b745dcb39a8bc upstream.\n\nDmitry Chernenkov used KASAN to discover that eCryptfs writes past the\nend of the allocated buffer during encrypted filename decoding. This\nfix corrects the issue by getting rid of the unnecessary 0 write when\nthe current bit offset is 2.\n\nSigned-off-by: Michael Halcrow \u003cmhalcrow@google.com\u003e\nReported-by: Dmitry Chernenkov \u003cdmitryc@google.com\u003e\nSuggested-by: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a6a93e455b97786412ceacfb60c8fcfd1e865fc8", "tree": "11ab34b4966adacb12b3446e71abccecb2b4938c", "parents": [ "4dc54f7a72ad145f774ad78b4c0af12fc9ab28e0" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Fri Oct 24 15:38:21 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:41 2015 +0800" }, "message": "writeback: fix a subtle race condition in I_DIRTY clearing\n\ncommit 9c6ac78eb3521c5937b2dd8a7d1b300f41092f45 upstream.\n\nAfter invoking -\u003edirty_inode(), __mark_inode_dirty() does smp_mb() and\ntests inode-\u003ei_state locklessly to see whether it already has all the\nnecessary I_DIRTY bits set. The comment above the barrier doesn\u0027t\ncontain any useful information - memory barriers can\u0027t ensure \"changes\nare seen by all cpus\" by itself.\n\nAnd it sure enough was broken. Please consider the following\nscenario.\n\n CPU 0\t\t\t\t\tCPU 1\n -------------------------------------------------------------------------------\n\n\t\t\t\t\tenters __writeback_single_inode()\n\t\t\t\t\tgrabs inode-\u003ei_lock\n\t\t\t\t\ttests PAGECACHE_TAG_DIRTY which is clear\n enters __set_page_dirty()\n grabs mapping-\u003etree_lock\n sets PAGECACHE_TAG_DIRTY\n releases mapping-\u003etree_lock\n leaves __set_page_dirty()\n\n enters __mark_inode_dirty()\n smp_mb()\n sees I_DIRTY_PAGES set\n leaves __mark_inode_dirty()\n\t\t\t\t\tclears I_DIRTY_PAGES\n\t\t\t\t\treleases inode-\u003ei_lock\n\nNow @inode has dirty pages w/ I_DIRTY_PAGES clear. This doesn\u0027t seem\nto lead to an immediately critical problem because requeue_inode()\nlater checks PAGECACHE_TAG_DIRTY instead of I_DIRTY_PAGES when\ndeciding whether the inode needs to be requeued for IO and there are\nenough unintentional memory barriers inbetween, so while the inode\nends up with inconsistent I_DIRTY_PAGES flag, it doesn\u0027t fall off the\nIO list.\n\nThe lack of explicit barrier may also theoretically affect the other\nI_DIRTY bits which deal with metadata dirtiness. There is no\nguarantee that a strong enough barrier exists between\nI_DIRTY_[DATA]SYNC clearing and write_inode() writing out the dirtied\ninode. Filesystem inode writeout path likely has enough stuff which\ncan behave as full barrier but it\u0027s theoretically possible that the\nwriteout may not see all the updates from -\u003edirty_inode().\n\nFix it by adding an explicit smp_mb() after I_DIRTY clearing. Note\nthat I_DIRTY_PAGES needs a special treatment as it always needs to be\ncleared to be interlocked with the lockless test on\n__mark_inode_dirty() side. It\u0027s cleared unconditionally and\nreinstated after smp_mb() if the mapping still has dirty pages.\n\nAlso add comments explaining how and why the barriers are paired.\n\nLightly tested.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "4dc54f7a72ad145f774ad78b4c0af12fc9ab28e0", "tree": "e76de7b0117b56582c510f3285cabbedb0b8cf7d", "parents": [ "073b1bc26cdc00a47a6ee2eb52d757b3dd27ef28" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu May 03 14:47:57 2012 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:40 2015 +0800" }, "message": "writeback: Move I_DIRTY_PAGES handling\n\ncommit 6290be1c1dc6589eeda213aa40946b27fa4faac8 upstream.\n\nInstead of clearing I_DIRTY_PAGES and resetting it when we didn\u0027t succeed in\nwriting them all, just clear the bit only when we succeeded writing all the\npages. We also move the clearing of the bit close to other i_state handling to\nseparate it from writeback list handling. This is desirable because list\nhandling will differ for flusher thread and other writeback_single_inode()\ncallers in future. No filesystem plays any tricks with I_DIRTY_PAGES (like\nchecking it in -\u003ewritepages or -\u003ewrite_inode implementation) so this movement\nis safe.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "073b1bc26cdc00a47a6ee2eb52d757b3dd27ef28", "tree": "cec1f54548a97bd67e96e307b6d64e8101089f90", "parents": [ "a3b7e569c56240f1604ae499f9a9481cd1f2dece" ], "author": { "name": "Tyler Hicks", "email": "tyhicks@canonical.com", "time": "Tue Oct 07 15:51:55 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:40 2015 +0800" }, "message": "eCryptfs: Force RO mount when encrypted view is enabled\n\ncommit 332b122d39c9cbff8b799007a825d94b2e7c12f2 upstream.\n\nThe ecryptfs_encrypted_view mount option greatly changes the\nfunctionality of an eCryptfs mount. Instead of encrypting and decrypting\nlower files, it provides a unified view of the encrypted files in the\nlower filesystem. The presence of the ecryptfs_encrypted_view mount\noption is intended to force a read-only mount and modifying files is not\nsupported when the feature is in use. See the following commit for more\ninformation:\n\n e77a56d [PATCH] eCryptfs: Encrypted passthrough\n\nThis patch forces the mount to be read-only when the\necryptfs_encrypted_view mount option is specified by setting the\nMS_RDONLY flag on the superblock. Additionally, this patch removes some\nbroken logic in ecryptfs_open() that attempted to prevent modifications\nof files when the encrypted view feature was in use. The check in\necryptfs_open() was not sufficient to prevent file modifications using\nsystem calls that do not operate on a file descriptor.\n\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nReported-by: Priya Bansal \u003cp.bansal@samsung.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b198b71168a4739627d5e2c763153a8c9c618a2f", "tree": "ff3e4b278467f261ec6aecafae00f633e7c867af", "parents": [ "63ed3573ab1611645f6b15e6622b718b6bf6082c" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Wed Nov 19 12:47:50 2014 -0500" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Tue Apr 14 17:33:37 2015 +0800" }, "message": "nfsd: Fix slot wake up race in the nfsv4.1 callback code\n\ncommit c6c15e1ed303ffc47e696ea1c9a9df1761c1f603 upstream.\n\nThe currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no\nlocking in order to guarantee atomicity, and so allows for races of\nthe form.\n\nTask 1 Task 2\n\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\nif (test_and_set_bit(0) !\u003d 0) {\n clear_bit(0)\n rpc_wake_up_next(queue)\n rpc_sleep_on(queue)\n return false;\n}\n\nThis patch breaks the race condition by adding a retest of the bit\nafter the call to rpc_sleep_on().\n\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "552f4eccfeeb34a4152d9f8190ec0f23e4afa26f", "tree": "a82a9013ab731a208dbf090b76b957e392e79bd4", "parents": [ "6aaa1e03cb296b1824b3150723909d740f6b293e" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Fri Oct 17 15:10:25 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:20 2015 +0800" }, "message": "NFSv4: Ensure that we remove NFSv4.0 delegations when state has expired\n\ncommit 4dfd4f7af0afd201706ad186352ca423b0f17d4b upstream.\n\nNFSv4.0 does not have TEST_STATEID/FREE_STATEID functionality, so\nunlike NFSv4.1, the recovery procedure when stateids have expired or\nhave been revoked requires us to just forget the delegation.\n\nhttp://lkml.kernel.org/r/CAN-5tyHwG\u003dCn2Q9KsHWadewjpTTy_K26ee+UnSvHvG4192p-Xw@mail.gmail.com\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "6aaa1e03cb296b1824b3150723909d740f6b293e", "tree": "bf1c9d9564d40312905b034092640486b92da433", "parents": [ "bf5dbba17a6816e0b7f33abc034f5ca089884e10" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 23 14:02:47 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:19 2015 +0800" }, "message": "nfs: Fix use of uninitialized variable in nfs_getattr()\n\ncommit 16caf5b6101d03335b386e77e9e14136f989be87 upstream.\n\nVariable \u0027err\u0027 needn\u0027t be initialized when nfs_getattr() uses it to\ncheck whether it should call generic_fillattr() or not. That can result\nin spurious error returns. Initialize \u0027err\u0027 properly.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "14194d6c2736eb1129579814dabb6e1751c7c964", "tree": "6a47aea5edf3d44eeb2f0eb6d09de2bf9e8df6cc", "parents": [ "0ec7236b1a62c0308b1249c9304f23335a72902b" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 30 20:43:38 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:17 2015 +0800" }, "message": "block: Fix computation of merged request priority\n\ncommit ece9c72accdc45c3a9484dacb1125ce572647288 upstream.\n\nPriority of a merged request is computed by ioprio_best(). If one of the\nrequests has undefined priority (IOPRIO_CLASS_NONE) and another request\nhas priority from IOPRIO_CLASS_BE, the function will return the\nundefined priority which is wrong. Fix the function to properly return\npriority of a request with the defined priority.\n\nFixes: d58cdfb89ce0c6bd5f81ae931a984ef298dbda20\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed-by: Jeff Moyer \u003cjmoyer@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "547f9e81ecec3e649ab565bf484fdd840bd6dc11", "tree": "b891084b9b23f6d0a57000ce62c1e6ad5467a65c", "parents": [ "0350de0eab3268372dca504504688286d8d18df9" ], "author": { "name": "Chris Mason", "email": "clm@fb.com", "time": "Tue Nov 04 06:59:04 2014 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:13 2015 +0800" }, "message": "Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup\n\ncommit 6e5aafb27419f32575b27ef9d6a31e5d54661aca upstream.\n\nIf we hit any errors in btrfs_lookup_csums_range, we\u0027ll loop through all\nthe csums we allocate and free them. But the code was using list_entry\nincorrectly, and ended up trying to free the on-stack list_head instead.\n\nThis bug came from commit 0678b6185\n\nbtrfs: Don\u0027t BUG_ON kzalloc error in btrfs_lookup_csums_range()\n\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\nReported-by: Erik Berg \u003cbtrfs@slipsprogrammoer.no\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c4a4211292d9b4ab4f94b985ebf37a9d16fb8a93", "tree": "60a70b46c75a3c6a5c3cb3a8fd7424a7b189efb8", "parents": [ "9922dba85d9a2d752297ff6030f6af84156472a7" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 30 10:53:17 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:09 2015 +0800" }, "message": "ext4: bail out from make_indexed_dir() on first error\n\ncommit 6050d47adcadbb53582434d919ed7f038d936712 upstream.\n\nWhen ext4_handle_dirty_dx_node() or ext4_handle_dirty_dirent_node()\nfail, there\u0027s really something wrong with the fs and there\u0027s no point in\ncontinuing further. Just return error from make_indexed_dir() in that\ncase. Also initialize frames array so that if we return early due to\nerror, dx_release() doesn\u0027t try to dereference uninitialized memory\n(which could happen also due to error in do_split()).\n\nCoverity-id: 741300\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - replace ext4_handle_dirty_{dx,dirent}_node() with\n ext4_handle_dirty_metadata()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8f71a69fa42f842824e488be11c84af325e5feac", "tree": "8b4d079192c5b61441315e54f852c40ad8d6f247", "parents": [ "64c7113dc103815f5631f8ed18e10b2b275fa1a0" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 30 10:53:16 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:08 2015 +0800" }, "message": "ext4: fix oops when loading block bitmap failed\n\ncommit 599a9b77ab289d85c2d5c8607624efbe1f552b0f upstream.\n\nWhen we fail to load block bitmap in __ext4_new_inode() we will\ndereference NULL pointer in ext4_journal_get_write_access(). So check\nfor error from ext4_read_block_bitmap().\n\nCoverity-id: 989065\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "64c7113dc103815f5631f8ed18e10b2b275fa1a0", "tree": "f02ad97172a3a9257ed74cecb433573c28211ac8", "parents": [ "638c69e2d59422dd2bd63d80f4d0b322ba9a14fb" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Oct 30 10:52:57 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:08 2015 +0800" }, "message": "ext4: fix overflow when updating superblock backups after resize\n\ncommit 9378c6768e4fca48971e7b6a9075bc006eda981d upstream.\n\nWhen there are no meta block groups update_backups() will compute the\nbackup block in 32-bit arithmetics thus possibly overflowing the block\nnumber and corrupting the filesystem. OTOH filesystems without meta\nblock groups larger than 16 TB should be rare. Fix the problem by doing\nthe counting in 64-bit arithmetics.\n\nCoverity-id: 741252\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Lukas Czerner \u003clczerner@redhat.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "971918b8e4fbe202b6be1fa1a31f1991c08164dc", "tree": "0aa76c613dd2668729bf356bc20976e34181c19b", "parents": [ "6b91578a5af27dbba3c9b26bc918165eefcff7d3" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Wed Oct 22 14:46:29 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:04 2015 +0800" }, "message": "nfsd4: fix crash on unknown operation number\n\ncommit 51904b08072a8bf2b9ed74d1bd7a5300a614471d upstream.\n\nUnknown operation numbers are caught in nfsd4_decode_compound() which\nsets op-\u003eopnum to OP_ILLEGAL and op-\u003estatus to nfserr_op_illegal. The\nerror causes the main loop in nfsd4_proc_compound() to skip most\nprocessing. But nfsd4_proc_compound also peeks ahead at the next\noperation in one case and doesn\u0027t take similar precautions there.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "67ff8829e6954ec9894f55db93bb6db297aaf1b7", "tree": "cd9b0614dfb907382e09b84eda05e0d116b23fb5", "parents": [ "0169c97f99ba46668a0da5a650defa29c424b343" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Tue Sep 16 22:23:10 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:05:00 2015 +0800" }, "message": "ext3: Don\u0027t check quota format when there are no quota files\n\ncommit 7938db449bbc55bbeb164bec7af406212e7e98f1 upstream.\n\nThe check whether quota format is set even though there are no\nquota files with journalled quota is pointless and it actually\nmakes it impossible to turn off journalled quotas (as there\u0027s\nno way to unset journalled quota format). Just remove the check.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e7ce7b473f9131b3073baa6dae63cd22de1c4d23", "tree": "56a8ebecfa56024a717fe29b6605fcfc12e717aa", "parents": [ "07cf4db32b426b6b9d649cac784a4b199001fbd1" ], "author": { "name": "Eric Sandeen", "email": "sandeen@redhat.com", "time": "Sat Oct 11 19:51:17 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:53 2015 +0800" }, "message": "ext4: fix reservation overflow in ext4_da_write_begin\n\ncommit 0ff8947fc5f700172b37cbca811a38eb9cb81e08 upstream.\n\nDelalloc write journal reservations only reserve 1 credit,\nto update the inode if necessary. However, it may happen\nonce in a filesystem\u0027s lifetime that a file will cross\nthe 2G threshold, and require the LARGE_FILE feature to\nbe set in the superblock as well, if it was not set already.\n\nThis overruns the transaction reservation, and can be\ndemonstrated simply on any ext4 filesystem without the LARGE_FILE\nfeature already set:\n\ndd if\u003d/dev/zero of\u003dtestfile bs\u003d1 seek\u003d2147483646 count\u003d1 \\\n\tconv\u003dnotrunc of\u003dtestfile\nsync\ndd if\u003d/dev/zero of\u003dtestfile bs\u003d1 seek\u003d2147483647 count\u003d1 \\\n\tconv\u003dnotrunc of\u003dtestfile\n\nleads to:\n\nEXT4-fs: ext4_do_update_inode:4296: aborting transaction: error 28 in __ext4_handle_dirty_super\nEXT4-fs error (device loop0) in ext4_do_update_inode:4301: error 28\nEXT4-fs error (device loop0) in ext4_reserve_inode_write:4757: Readonly filesystem\nEXT4-fs error (device loop0) in ext4_dirty_inode:4876: error 28\nEXT4-fs error (device loop0) in ext4_da_write_end:2685: error 28\n\nAdjust the number of credits based on whether the flag is\nalready set, and whether the current write may extend past the\nLARGE_FILE limit.\n\nSigned-off-by: Eric Sandeen \u003csandeen@redhat.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Andreas Dilger \u003cadilger@dilger.ca\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - ext4_journal_start() has no parameter type]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "07cf4db32b426b6b9d649cac784a4b199001fbd1", "tree": "3cb4711ecbc0c33f82bc32dcc424cfc61e162cdc", "parents": [ "07048f9e15e456be7d216e6f4515c33cafc6fc2b" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Oct 05 22:56:00 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:53 2015 +0800" }, "message": "ext4: add ext4_iget_normal() which is to be used for dir tree lookups\n\ncommit f4bb2981024fc91b23b4d09a8817c415396dbabb upstream.\n\nIf there is a corrupted file system which has directory entries that\npoint at reserved, metadata inodes, prohibit them from being used by\ntreating them the same way we treat Boot Loader inodes --- that is,\nmark them to be bad inodes. This prohibits them from being opened,\ndeleted, or modified via chmod, chown, utimes, etc.\n\nIn particular, this prevents a corrupted file system which has a\ndirectory entry which points at the journal inode from being deleted\nand its blocks released, after which point Much Hilarity Ensues.\n\nReported-by: Sami Liedes \u003csami.liedes@iki.fi\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "07048f9e15e456be7d216e6f4515c33cafc6fc2b", "tree": "4e6ad2fad0e9c6c43cdd4cdab6bc0d2571986c55", "parents": [ "60e7100a311b7b0d4ad87f20d6a13f1f4a4d786d" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sun Oct 05 22:47:07 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:52 2015 +0800" }, "message": "ext4: don\u0027t orphan or truncate the boot loader inode\n\ncommit e2bfb088fac03c0f621886a04cffc7faa2b49b1d upstream.\n\nThe boot loader inode (inode #5) should never be visible in the\ndirectory hierarchy, but it\u0027s possible if the file system is corrupted\nthat there will be a directory entry that points at inode #5. In\norder to avoid accidentally trashing it, when such a directory inode\nis opened, the inode will be marked as a bad inode, so that it\u0027s not\npossible to modify (or read) the inode from userspace.\n\nUnfortunately, when we unlink this (invalid/illegal) directory entry,\nwe will put the bad inode on the ophan list, and then when try to\nunlink the directory, we don\u0027t actually remove the bad inode from the\norphan list before freeing in-memory inode structure. This means the\nin-memory orphan list is corrupted, leading to a kernel oops.\n\nIn addition, avoid truncating a bad inode in ext4_destroy_inode(),\nsince truncating the boot loader inode is not a smart thing to do.\n\nReported-by: Sami Liedes \u003csami.liedes@iki.fi\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "60e7100a311b7b0d4ad87f20d6a13f1f4a4d786d", "tree": "1134746c46072c2d7a061fb1a5fff0cedb22ac14", "parents": [ "e306b0daae1fe8ad4b581dcc2f12917732a5fb1b" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Wed Oct 01 21:49:18 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:52 2015 +0800" }, "message": "vfs: fix data corruption when blocksize \u003c pagesize for mmaped data\n\ncommit 90a8020278c1598fafd071736a0846b38510309c upstream.\n\n-\u003epage_mkwrite() is used by filesystems to allocate blocks under a page\nwhich is becoming writeably mmapped in some process\u0027 address space. This\nallows a filesystem to return a page fault if there is not enough space\navailable, user exceeds quota or similar problem happens, rather than\nsilently discarding data later when writepage is called.\n\nHowever VFS fails to call -\u003epage_mkwrite() in all the cases where\nfilesystems need it when blocksize \u003c pagesize. For example when\nblocksize \u003d 1024, pagesize \u003d 4096 the following is problematic:\n ftruncate(fd, 0);\n pwrite(fd, buf, 1024, 0);\n map \u003d mmap(NULL, 1024, PROT_WRITE, MAP_SHARED, fd, 0);\n map[0] \u003d \u0027a\u0027; ----\u003e page_mkwrite() for index 0 is called\n ftruncate(fd, 10000); /* or even pwrite(fd, buf, 1, 10000) */\n mremap(map, 1024, 10000, 0);\n map[4095] \u003d \u0027a\u0027; ----\u003e no page_mkwrite() called\n\nAt the moment -\u003epage_mkwrite() is called, filesystem can allocate only\none block for the page because i_size \u003d\u003d 1024. Otherwise it would create\nblocks beyond i_size which is generally undesirable. But later at\n-\u003ewritepage() time, we also need to store data at offset 4095 but we\ndon\u0027t have block allocated for it.\n\nThis patch introduces a helper function filesystems can use to have\n-\u003epage_mkwrite() called at all the necessary moments.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - truncate_setsize() already has an oldsize variable]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a38c4d8a974e03044f208dfdf09a5a5d55d1dd4d", "tree": "00cc656464e1dd15af4388f85a74ab996a1a60e2", "parents": [ "b0fea9c1a057c4e4d30046b26a9309366aaf1ad6" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Thu Sep 18 01:12:15 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:51 2015 +0800" }, "message": "ext4: don\u0027t check quota format when there are no quota files\n\ncommit 279bf6d390933d5353ab298fcc306c391a961469 upstream.\n\nThe check whether quota format is set even though there are no\nquota files with journalled quota is pointless and it actually\nmakes it impossible to turn off journalled quotas (as there\u0027s\nno way to unset journalled quota format). Just remove the check.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b0fea9c1a057c4e4d30046b26a9309366aaf1ad6", "tree": "e9edb54a0d3d4c8a76914637288934532eb4b97d", "parents": [ "4e2c6422ab866ca9ea23714b32be9fbfad77743e" ], "author": { "name": "Darrick J. Wong", "email": "darrick.wong@oracle.com", "time": "Tue Sep 16 14:34:59 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:51 2015 +0800" }, "message": "ext4: check EA value offset when loading\n\ncommit a0626e75954078cfacddb00a4545dde821170bc5 upstream.\n\nWhen loading extended attributes, check each entry\u0027s value offset to\nmake sure it doesn\u0027t collide with the entries.\n\nWithout this check it is easy to crash the kernel by mounting a\nmalicious FS containing a file with an EA wherein e_value_offs \u003d 0 and\ne_value_size \u003e 0 and then deleting the EA, which corrupts the name\nlist.\n\n(See the f_ea_value_crash test\u0027s FS image in e2fsprogs for an example.)\n\nSigned-off-by: Darrick J. Wong \u003cdarrick.wong@oracle.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9f7d53c09a1f87ebe228b55a83c1b8f952d76260", "tree": "7b3e09db1364b8ac9acc0513780b6ba9fd5cfe0c", "parents": [ "e65c1a23f47148d534970cbdd6646cf8fba924c3" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Wed Oct 08 10:42:27 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:50 2015 +0800" }, "message": "mnt: Prevent pivot_root from creating a loop in the mount tree\n\ncommit 0d0826019e529f21c84687521d03f60cd241ca7d upstream.\n\nAndy Lutomirski recently demonstrated that when chroot is used to set\nthe root path below the path for the new ``root\u0027\u0027 passed to pivot_root\nthe pivot_root system call succeeds and leaks mounts.\n\nIn examining the code I see that starting with a new root that is\nbelow the current root in the mount tree will result in a loop in the\nmount tree after the mounts are detached and then reattached to one\nanother. Resulting in all kinds of ugliness including a leak of that\nmounts involved in the leak of the mount loop.\n\nPrevent this problem by ensuring that the new mount is reachable from\nthe current root of the mount tree.\n\n[Added stable cc. Fixes CVE-2014-7970. --Andy]\n\nReported-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nReviewed-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\nLink: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nSigned-off-by: Andy Lutomirski \u003cluto@amacapital.net\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7baa56f6e80d72ab594b55465b2f42a5e13698c0", "tree": "9ff4dd73979f5db20dc2c8ff1fb44ec4ea270155", "parents": [ "c76a73b3d03e08074d08a7cbf1acb386a022a367" ], "author": { "name": "Yann Droneaud", "email": "ydroneaud@opteya.com", "time": "Thu Oct 09 15:24:40 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:49 2015 +0800" }, "message": "fanotify: enable close-on-exec on events\u0027 fd when requested in fanotify_init()\n\ncommit 0b37e097a648aa71d4db1ad108001e95b69a2da4 upstream.\n\nAccording to commit 80af258867648 (\"fanotify: groups can specify their\nf_flags for new fd\"), file descriptors created as part of file access\nnotification events inherit flags from the event_f_flags argument passed\nto syscall fanotify_init(2)[1].\n\nUnfortunately O_CLOEXEC is currently silently ignored.\n\nIndeed, event_f_flags are only given to dentry_open(), which only seems to\ncare about O_ACCMODE and O_PATH in do_dentry_open(), O_DIRECT in\nopen_check_o_direct() and O_LARGEFILE in generic_file_open().\n\nIt\u0027s a pity, since, according to some lookup on various search engines and\nhttp://codesearch.debian.net/, there\u0027s already some userspace code which\nuse O_CLOEXEC:\n\n- in systemd\u0027s readahead[2]:\n\n fanotify_fd \u003d fanotify_init(FAN_CLOEXEC|FAN_NONBLOCK, O_RDONLY|O_LARGEFILE|O_CLOEXEC|O_NOATIME);\n\n- in clsync[3]:\n\n #define FANOTIFY_EVFLAGS (O_LARGEFILE|O_RDONLY|O_CLOEXEC)\n\n int fanotify_d \u003d fanotify_init(FANOTIFY_FLAGS, FANOTIFY_EVFLAGS);\n\n- in examples [4] from \"Filesystem monitoring in the Linux\n kernel\" article[5] by Aleksander Morgado:\n\n if ((fanotify_fd \u003d fanotify_init (FAN_CLOEXEC,\n O_RDONLY | O_CLOEXEC | O_LARGEFILE)) \u003c 0)\n\nAdditionally, since commit 48149e9d3a7e (\"fanotify: check file flags\npassed in fanotify_init\"). having O_CLOEXEC as part of fanotify_init()\nsecond argument is expressly allowed.\n\nSo it seems expected to set close-on-exec flag on the file descriptors if\nuserspace is allowed to request it with O_CLOEXEC.\n\nBut Andrew Morton raised[6] the concern that enabling now close-on-exec\nmight break existing applications which ask for O_CLOEXEC but expect the\nfile descriptor to be inherited across exec().\n\nIn the other hand, as reported by Mihai Dontu[7] close-on-exec on the file\ndescriptor returned as part of file access notify can break applications\ndue to deadlock. So close-on-exec is needed for most applications.\n\nMore, applications asking for close-on-exec are likely expecting it to be\nenabled, relying on O_CLOEXEC being effective. If not, it might weaken\ntheir security, as noted by Jan Kara[8].\n\nSo this patch replaces call to macro get_unused_fd() by a call to function\nget_unused_fd_flags() with event_f_flags value as argument. This way\nO_CLOEXEC flag in the second argument of fanotify_init(2) syscall is\ninterpreted and close-on-exec get enabled when requested.\n\n[1] http://man7.org/linux/man-pages/man2/fanotify_init.2.html\n[2] http://cgit.freedesktop.org/systemd/systemd/tree/src/readahead/readahead-collect.c?id\u003dv208#n294\n[3] https://github.com/xaionaro/clsync/blob/v0.2.1/sync.c#L1631\n https://github.com/xaionaro/clsync/blob/v0.2.1/configuration.h#L38\n[4] http://www.lanedo.com/~aleksander/fanotify/fanotify-example.c\n[5] http://www.lanedo.com/2013/filesystem-monitoring-linux-kernel/\n[6] http://lkml.kernel.org/r/20141001153621.65e9258e65a6167bf2e4cb50@linux-foundation.org\n[7] http://lkml.kernel.org/r/20141002095046.3715eb69@mdontu-l\n[8] http://lkml.kernel.org/r/20141002104410.GB19748@quack.suse.cz\n\nLink: http://lkml.kernel.org/r/cover.1411562410.git.ydroneaud@opteya.com\nSigned-off-by: Yann Droneaud \u003cydroneaud@opteya.com\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nReviewed by: Heinrich Schuchardt \u003cxypron.glpk@gmx.de\u003e\nTested-by: Heinrich Schuchardt \u003cxypron.glpk@gmx.de\u003e\nCc: Mihai Don\\u021bu \u003cmihai.dontu@gmail.com\u003e\nCc: Pádraig Brady \u003cP@draigBrady.com\u003e\nCc: Heinrich Schuchardt \u003cxypron.glpk@gmx.de\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nCc: Valdis Kletnieks \u003cValdis.Kletnieks@vt.edu\u003e\nCc: Michael Kerrisk-manpages \u003cmtk.manpages@gmail.com\u003e\nCc: Lino Sanfilippo \u003cLinoSanfilippo@gmx.de\u003e\nCc: Richard Guy Briggs \u003crgb@redhat.com\u003e\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Michael Kerrisk \u003cmtk.manpages@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2551b5ed84a7cfe5e414544bb9ad95ebf43b3ff3", "tree": "73da55734a049f564f3e038d880291c3a6eab161", "parents": [ "2ea17e6740ac0e15f86854973dbd22100579bbf8" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Sun Jul 27 13:00:41 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:48 2015 +0800" }, "message": "fs: make cont_expand_zero interruptible\n\ncommit c2ca0fcd202863b14bd041a7fece2e789926c225 upstream.\n\nThis patch makes it possible to kill a process looping in\ncont_expand_zero. A process may spend a lot of time in this function, so\nit is desirable to be able to kill it.\n\nIt happened to me that I wanted to copy a piece data from the disk to a\nfile. By mistake, I used the \"seek\" parameter to dd instead of \"skip\". Due\nto the \"seek\" parameter, dd attempted to extend the file and became stuck\ndoing so - the only possibility was to reset the machine or wait many\nhours until the filesystem runs out of space and cont_expand_zero fails.\nWe need this patch to be able to terminate the process.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2ea17e6740ac0e15f86854973dbd22100579bbf8", "tree": "4db201f54ea452f9bfda0fa80fa4907205c2f2a8", "parents": [ "db55550da4a9ca71d76f47286a5a9790f12a2868" ], "author": { "name": "Tetsuo Handa", "email": "penguin-kernel@I-love.SAKURA.ne.jp", "time": "Sat May 17 20:56:38 2014 +0900" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:48 2015 +0800" }, "message": "fs: Fix theoretical division by 0 in super_cache_scan().\n\ncommit 475d0db742e3755c6b267f48577ff7cbb7dfda0d upstream.\n\ntotal_objects could be 0 and is used as a denom.\n\nWhile total_objects is a \"long\", total_objects \u003d\u003d 0 unlikely happens for\n3.12 and later kernels because 32-bit architectures would not be able to\nhold (1 \u003c\u003c 32) objects. However, total_objects \u003d\u003d 0 may happen for kernels\nbetween 3.1 and 3.11 because total_objects in prune_super() was an \"int\"\nand (e.g.) x86_64 architecture might be able to hold (1 \u003c\u003c 32) objects.\n\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "771f8a87c7e09184a411702313917e2a6db0359e", "tree": "21f9f8cc029c130780b72680289fb4f7e3eae680", "parents": [ "dbd43539a8faff93490475bccbf9e4d0b7ebc2cb" ], "author": { "name": "Chao Yu", "email": "chao2.yu@samsung.com", "time": "Thu Jul 24 17:25:42 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:47 2015 +0800" }, "message": "ecryptfs: avoid to access NULL pointer when write metadata in xattr\n\ncommit 35425ea2492175fd39f6116481fe98b2b3ddd4ca upstream.\n\nChristopher Head 2014-06-28 05:26:20 UTC described:\n\"I tried to reproduce this on 3.12.21. Instead, when I do \"echo hello \u003e foo\"\nin an ecryptfs mount with ecryptfs_xattr specified, I get a kernel crash:\n\nBUG: unable to handle kernel NULL pointer dereference at (null)\nIP: [\u003cffffffff8110eb39\u003e] fsstack_copy_attr_all+0x2/0x61\nPGD d7840067 PUD b2c3c067 PMD 0\nOops: 0002 [#1] SMP\nModules linked in: nvidia(PO)\nCPU: 3 PID: 3566 Comm: bash Tainted: P O 3.12.21-gentoo-r1 #2\nHardware name: ASUSTek Computer Inc. G60JX/G60JX, BIOS 206 03/15/2010\ntask: ffff8801948944c0 ti: ffff8800bad70000 task.ti: ffff8800bad70000\nRIP: 0010:[\u003cffffffff8110eb39\u003e] [\u003cffffffff8110eb39\u003e] fsstack_copy_attr_all+0x2/0x61\nRSP: 0018:ffff8800bad71c10 EFLAGS: 00010246\nRAX: 00000000000181a4 RBX: ffff880198648480 RCX: 0000000000000000\nRDX: 0000000000000004 RSI: ffff880172010450 RDI: 0000000000000000\nRBP: ffff880198490e40 R08: 0000000000000000 R09: 0000000000000000\nR10: ffff880172010450 R11: ffffea0002c51e80 R12: 0000000000002000\nR13: 000000000000001a R14: 0000000000000000 R15: ffff880198490e40\nFS: 00007ff224caa700(0000) GS:ffff88019fcc0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000bb07f000 CR4: 00000000000007e0\nStack:\nffffffff811826e8 ffff8800a39d8000 0000000000000000 000000000000001a\nffff8800a01d0000 ffff8800a39d8000 ffffffff81185fd5 ffffffff81082c2c\n00000001a39d8000 53d0abbc98490e40 0000000000000037 ffff8800a39d8220\nCall Trace:\n[\u003cffffffff811826e8\u003e] ? ecryptfs_setxattr+0x40/0x52\n[\u003cffffffff81185fd5\u003e] ? ecryptfs_write_metadata+0x1b3/0x223\n[\u003cffffffff81082c2c\u003e] ? should_resched+0x5/0x23\n[\u003cffffffff8118322b\u003e] ? ecryptfs_initialize_file+0xaf/0xd4\n[\u003cffffffff81183344\u003e] ? ecryptfs_create+0xf4/0x142\n[\u003cffffffff810f8c0d\u003e] ? vfs_create+0x48/0x71\n[\u003cffffffff810f9c86\u003e] ? do_last.isra.68+0x559/0x952\n[\u003cffffffff810f7ce7\u003e] ? link_path_walk+0xbd/0x458\n[\u003cffffffff810fa2a3\u003e] ? path_openat+0x224/0x472\n[\u003cffffffff810fa7bd\u003e] ? do_filp_open+0x2b/0x6f\n[\u003cffffffff81103606\u003e] ? __alloc_fd+0xd6/0xe7\n[\u003cffffffff810ee6ab\u003e] ? do_sys_open+0x65/0xe9\n[\u003cffffffff8157d022\u003e] ? system_call_fastpath+0x16/0x1b\nRIP [\u003cffffffff8110eb39\u003e] fsstack_copy_attr_all+0x2/0x61\nRSP \u003cffff8800bad71c10\u003e\nCR2: 0000000000000000\n---[ end trace df9dba5f1ddb8565 ]---\"\n\nIf we create a file when we mount with ecryptfs_xattr_metadata option, we will\nencounter a crash in this path:\n-\u003eecryptfs_create\n -\u003eecryptfs_initialize_file\n -\u003eecryptfs_write_metadata\n -\u003eecryptfs_write_metadata_to_xattr\n -\u003eecryptfs_setxattr\n -\u003efsstack_copy_attr_all\nIt\u0027s because our dentry-\u003ed_inode used in fsstack_copy_attr_all is NULL, and it\nwill be initialized when ecryptfs_initialize_file finish.\n\nSo we should skip copying attr from lower inode when the value of -\u003ed_inode is\ninvalid.\n\nSigned-off-by: Chao Yu \u003cchao2.yu@samsung.com\u003e\nSigned-off-by: Tyler Hicks \u003ctyhicks@canonical.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2c9d556d14bc8d18cfa6635d1d5e751508dc7ec8", "tree": "4f7e5969990fa66596680f550c9bd0b5ed5411e0", "parents": [ "f4c4b923165f5c6342898a3428b1997dbc54f8f1" ], "author": { "name": "Andy Adamson", "email": "andros@netapp.com", "time": "Mon Sep 29 12:31:57 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:46 2015 +0800" }, "message": "NFSv4.1: Fix an NFSv4.1 state renewal regression\n\ncommit d1f456b0b9545f1606a54cd17c20775f159bd2ce upstream.\n\nCommit 2f60ea6b8ced (\"NFSv4: The NFSv4.0 client must send RENEW calls if it holds a delegation\") set the NFS4_RENEW_TIMEOUT flag in nfs4_renew_state, and does\nnot put an nfs41_proc_async_sequence call, the NFSv4.1 lease renewal heartbeat\ncall, on the wire to renew the NFSv4.1 state if the flag was not set.\n\nThe NFS4_RENEW_TIMEOUT flag is set when \"now\" is after the last renewal\n(cl_last_renewal) plus the lease time divided by 3. This is arbitrary and\nsometimes does the following:\n\nIn normal operation, the only way a future state renewal call is put on the\nwire is via a call to nfs4_schedule_state_renewal, which schedules a\nnfs4_renew_state workqueue task. nfs4_renew_state determines if the\nNFS4_RENEW_TIMEOUT should be set, and the calls nfs41_proc_async_sequence,\nwhich only gets sent if the NFS4_RENEW_TIMEOUT flag is set.\nThen the nfs41_proc_async_sequence rpc_release function schedules\nanother state remewal via nfs4_schedule_state_renewal.\n\nWithout this change we can get into a state where an application stops\naccessing the NFSv4.1 share, state renewal calls stop due to the\nNFS4_RENEW_TIMEOUT flag _not_ being set. The only way to recover\nfrom this situation is with a clientid re-establishment, once the application\nresumes and the server has timed out the lease and so returns\nNFS4ERR_BAD_SESSION on the subsequent SEQUENCE operation.\n\nAn example application:\nopen, lock, write a file.\n\nsleep for 6 * lease (could be less)\n\nulock, close.\n\nIn the above example with NFSv4.1 delegations enabled, without this change,\nthere are no OP_SEQUENCE state renewal calls during the sleep, and the\nclientid is recovered due to lease expiration on the close.\n\nThis issue does not occur with NFSv4.1 delegations disabled, nor with\nNFSv4.0, with or without delegations enabled.\n\nSigned-off-by: Andy Adamson \u003candros@netapp.com\u003e\nLink: http://lkml.kernel.org/r/1411486536-23401-1-git-send-email-andros@netapp.com\nFixes: 2f60ea6b8ced (NFSv4: The NFSv4.0 client must send RENEW calls...)\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "5a0b8b70d79afe7d77d3737fb6012abcf4157cf2", "tree": "f6b4647b748806c968bc00cfc9de9bc7b6e12026", "parents": [ "39aca9c1368c298189f95a77e789bc7f42ff80fc" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Sat Sep 27 17:41:51 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:45 2015 +0800" }, "message": "NFSv4: fix open/lock state recovery error handling\n\ncommit df817ba35736db2d62b07de6f050a4db53492ad8 upstream.\n\nThe current open/lock state recovery unfortunately does not handle errors\nsuch as NFS4ERR_CONN_NOT_BOUND_TO_SESSION correctly. Instead of looping,\njust proceeds as if the state manager is finished recovering.\nThis patch ensures that we loop back, handle higher priority errors\nand complete the open/lock state recovery.\n\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8e65d449fb0fd36359fbcfef34198135d223a4d0", "tree": "ddea046e20f6dda8837c5409c4c5cf75f1f16f51", "parents": [ "ca3a4163bb5d66c346801c83c9296e7fe97b6132" ], "author": { "name": "Benjamin Coddington", "email": "bcodding@redhat.com", "time": "Tue Sep 23 12:26:20 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:42 2015 +0800" }, "message": "lockd: Try to reconnect if statd has moved\n\ncommit 173b3afceebe76fa2205b2c8808682d5b541fe3c upstream.\n\nIf rpc.statd is restarted, upcalls to monitor hosts can fail with\nECONNREFUSED. In that case force a lookup of statd\u0027s new port and retry the\nupcall.\n\nSigned-off-by: Benjamin Coddington \u003cbcodding@redhat.com\u003e\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "82508e0f0bdd4fd1090fc8ee09c6b94e170f78a5", "tree": "ee230ebbd462972bd7e4101c301e360478eee4d7", "parents": [ "db73d4fcba98f8427d820b9e3cae01f1ec604233" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Wed Jul 16 15:22:29 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:36 2015 +0800" }, "message": "UBIFS: fix free log space calculation\n\ncommit ba29e721eb2df6df8f33c1f248388bb037a47914 upstream.\n\nHu (hujianyang \u003chujianyang@huawei.com\u003e) discovered an issue in the\n\u0027empty_log_bytes()\u0027 function, which calculates how many bytes are left in the\nlog:\n\n\"\nIf \u0027c-\u003elhead_lnum + 1 \u003d\u003d c-\u003eltail_lnum\u0027 and \u0027c-\u003elhead_offs \u003d\u003d c-\u003eleb_size\u0027, \u0027h\u0027\nwould equalent to \u0027t\u0027 and \u0027empty_log_bytes()\u0027 would return \u0027c-\u003elog_bytes\u0027\ninstead of 0.\n\"\n\nAt this point it is not clear what would be the consequences of this, and\nwhether this may lead to any problems, but this patch addresses the issue just\nin case.\n\nTested-by: hujianyang \u003chujianyang@huawei.com\u003e\nReported-by: hujianyang \u003chujianyang@huawei.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "db73d4fcba98f8427d820b9e3cae01f1ec604233", "tree": "4b0eaf26456902d39005248aa18c2a43e969401a", "parents": [ "a5b4755f4bd37cef9498e2d53a8cd666361e3cbe" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Sun Jun 29 17:00:45 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:36 2015 +0800" }, "message": "UBIFS: fix a race condition\n\ncommit 052c28073ff26f771d44ef33952a41d18dadd255 upstream.\n\nHu (hujianyang@huawei.com) discovered a race condition which may lead to a\nsituation when UBIFS is unable to mount the file-system after an unclean\nreboot. The problem is theoretical, though.\n\nIn UBIFS, we have the log, which basically a set of LEBs in a certain area. The\nlog has the tail and the head.\n\nEvery time user writes data to the file-system, the UBIFS journal grows, and\nthe log grows as well, because we append new reference nodes to the head of the\nlog. So the head moves forward all the time, while the log tail stays at the\nsame position.\n\nAt any time, the UBIFS master node points to the tail of the log. When we mount\nthe file-system, we scan the log, and we always start from its tail, because\nthis is where the master node points to. The only occasion when the tail of the\nlog changes is the commit operation.\n\nThe commit operation has 2 phases - \"commit start\" and \"commit end\". The former\nis relatively short, and does not involve much I/O. During this phase we mostly\njust build various in-memory lists of the things which have to be written to\nthe flash media during \"commit end\" phase.\n\nDuring the commit start phase, what we do is we \"clean\" the log. Indeed, the\ncommit operation will index all the data in the journal, so the entire journal\n\"disappears\", and therefore the data in the log become unneeded. So we just\nmove the head of the log to the next LEB, and write the CS node there. This LEB\nwill be the tail of the new log when the commit operation finishes.\n\nWhen the \"commit start\" phase finishes, users may write more data to the\nfile-system, in parallel with the ongoing \"commit end\" operation. At this point\nthe log tail was not changed yet, it is the same as it had been before we\nstarted the commit. The log head keeps moving forward, though.\n\nThe commit operation now needs to write the new master node, and the new master\nnode should point to the new log tail. After this the LEBs between the old log\ntail and the new log tail can be unmapped and re-used again.\n\nAnd here is the possible problem. We do 2 operations: (a) We first update the\nlog tail position in memory (see \u0027ubifs_log_end_commit()\u0027). (b) And then we\nwrite the master node (see the big lock of code in \u0027do_commit()\u0027).\n\nBut nothing prevents the log head from moving forward between (a) and (b), and\nthe log head may \"wrap\" now to the old log tail. And when the \"wrap\" happens,\nthe contends of the log tail gets erased. Now a power cut happens and we are in\ntrouble. We end up with the old master node pointing to the old tail, which was\nerased. And replay fails because it expects the master node to point to the\ncorrect log tail at all times.\n\nThis patch merges the abovementioned (a) and (b) operations by moving the master\nnode change code to the \u0027ubifs_log_end_commit()\u0027 function, so that it runs with\nthe log mutex locked, which will prevent the log from being changed benween\noperations (a) and (b).\n\nReported-by: hujianyang \u003chujianyang@huawei.com\u003e\nTested-by: hujianyang \u003chujianyang@huawei.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a5b4755f4bd37cef9498e2d53a8cd666361e3cbe", "tree": "db71b55d23c4b3a36ff86801606e63c8cccfb885", "parents": [ "9083cb065a03722697dc5b81cfb2d0d426a73f82" ], "author": { "name": "Artem Bityutskiy", "email": "artem.bityutskiy@linux.intel.com", "time": "Sun Jun 29 16:55:02 2014 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Feb 02 17:04:35 2015 +0800" }, "message": "UBIFS: remove mst_mutex\n\ncommit 07e19dff63e3d5d6500d831e36554ac9b1b0560e upstream.\n\nThe \u0027mst_mutex\u0027 is not needed since because \u0027ubifs_write_master()\u0027 is only\ncalled on the mount path and commit path. The mount path is sequential and\nthere is no parallelism, and the commit path is also serialized - there is only\none commit going on at a time.\n\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b47d65db8f8e765ef0267d13681c9bf12a148fb5", "tree": "bae1470ac9ca843e700bbf3a6008f179c377dbe8", "parents": [ "ae552f6b54840fc7fb7a7ee688632b55e7eb9cef" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Mon Jul 28 16:26:53 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:42 2014 +0800" }, "message": "mnt: Only change user settable mount flags in remount\n\ncommit a6138db815df5ee542d848318e5dae681590fccd upstream.\n\nKenton Varda \u003ckenton@sandstorm.io\u003e discovered that by remounting a\nread-only bind mount read-only in a user namespace the\nMNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user\nto the remount a read-only mount read-write.\n\nCorrect this by replacing the mask of mount flags to preserve\nwith a mask of mount flags that may be changed, and preserve\nall others. This ensures that any future bugs with this mask and\nremount will fail in an easy to detect way where new mount flags\nsimply won\u0027t change.\n\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@ubuntu.com\u003e\nSigned-off-by: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Francis Moreau \u003cfrancis.moro@gmail.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "69724a603fc759242348f931068b97c6634e40f9", "tree": "ee1494d332a6b706006658789135a62068101469", "parents": [ "efdbbff6f413513eb11aaa7bce3b289faee88f29" ], "author": { "name": "Sergio Gelato", "email": "Sergio.Gelato@astro.su.se", "time": "Fri Oct 10 22:46:36 2014 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:42 2014 +0800" }, "message": "NFS: fix stable regression\n\nBugLink: http://bugs.launchpad.net/bugs/1348670\n\nFix regression introduced in pre-3.14 kernels by cherry-picking\naa07c713ecfc0522916f3cd57ac628ea6127c0ec\n(NFSD: Call -\u003eset_acl with a NULL ACL structure if no entries).\n\nThe affected code was removed in 3.14 by commit\n4ac7249ea5a0ceef9f8269f63f33cc873c3fac61\n(nfsd: use get_acl and -\u003eset_acl).\nThe -\u003eset_acl methods are already able to cope with a NULL argument.\n\nSigned-off-by: Sergio Gelato \u003cSergio.Gelato@astro.su.se\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "efdbbff6f413513eb11aaa7bce3b289faee88f29", "tree": "6d43fb009b3b2e68ef2e13815478a274e0e97ff8", "parents": [ "df22b9ebd5c3b63bfb2582470b53771bf276f252" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Wed Sep 03 09:33:00 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:41 2014 +0800" }, "message": "ext4: avoid trying to kfree an ERR_PTR pointer\n\ncommit a9cfcd63e8d206ce4235c355d857c4fbdf0f4587 upstream.\n\nThanks to Dan Carpenter for extending smatch to find bugs like this.\n(This was found using a development version of smatch.)\n\nFixes: 36de928641ee48b2078d3fe9514242aaa2f92013\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n- s/new.bh/new_bh/\n- drop the change to ext4_cross_rename()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "df22b9ebd5c3b63bfb2582470b53771bf276f252", "tree": "be6647d8b44023474cd11eba135a6c5bfce9cf03", "parents": [ "50d6b91ac79a7ca600f62dbd917dec65e7751c85" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Aug 23 17:47:19 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:41 2014 +0800" }, "message": "ext4: propagate errors up to ext4_find_entry()\u0027s callers\n\ncommit 36de928641ee48b2078d3fe9514242aaa2f92013 upstream.\n\nIf we run into some kind of error, such as ENOMEM, while calling\next4_getblk() or ext4_dx_find_entry(), we need to make sure this error\ngets propagated up to ext4_find_entry() and then to its callers. This\nway, transient errors such as ENOMEM can get propagated to the VFS.\nThis is important so that the system calls return the appropriate\nerror, and also so that in the case of ext4_lookup(), we return an\nerror instead of a NULL inode, since that will result in a negative\ndentry cache entry that will stick around long past the OOM condition\nwhich caused a transient ENOMEM error.\n\nGoogle-Bug-Id: #17142205\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n[lizf: Backported to 3.4:\n- adjust context\n- s/old.bh/old_bh/g\n- s/new.bh/new_bh/g\n- drop the changes to ext4_find_delete_entry() and ext4_cross_rename()\n- add return value check for one more exr4_find_entry() in ext4_rename()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8b4675102596aa0f550fd7c32b9ed576b30e020a", "tree": "e0b3a9abce7cc70bd839a12601cf76fc57595bb0", "parents": [ "78d8eefded616224fc40ba2f9269bb53b7e6604e" ], "author": { "name": "Joseph Qi", "email": "joseph.qi@huawei.com", "time": "Thu Sep 25 16:05:16 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:39 2014 +0800" }, "message": "ocfs2/dlm: do not get resource spinlock if lockres is new\n\ncommit 5760a97c7143c208fa3a8f8cad0ed7dd672ebd28 upstream.\n\nThere is a deadlock case which reported by Guozhonghua:\n https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html\n\nThis case is caused by \u0026res-\u003espinlock and \u0026dlm-\u003emaster_lock\nmisordering in different threads.\n\nIt was introduced by commit 8d400b81cc83 (\"ocfs2/dlm: Clean up refmap\nhelpers\"). Since lockres is new, it doesn\u0027t not require the\n\u0026res-\u003espinlock. So remove it.\n\nFixes: 8d400b81cc83 (\"ocfs2/dlm: Clean up refmap helpers\")\nSigned-off-by: Joseph Qi \u003cjoseph.qi@huawei.com\u003e\nReviewed-by: joyce.xue \u003cxuejiufei@huawei.com\u003e\nReported-by: Guozhonghua \u003cguozhonghua@h3c.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Mark Fasheh \u003cmfasheh@suse.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "78d8eefded616224fc40ba2f9269bb53b7e6604e", "tree": "065b9945fc4e96b508fa5d8270f4fe335b4afb9e", "parents": [ "504c4611c9da8b2cade4a45a31376293a4d53ed1" ], "author": { "name": "Andreas Rohner", "email": "andreas.rohner@gmx.net", "time": "Thu Sep 25 16:05:14 2014 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:38 2014 +0800" }, "message": "nilfs2: fix data loss with mmap()\n\ncommit 56d7acc792c0d98f38f22058671ee715ff197023 upstream.\n\nThis bug leads to reproducible silent data loss, despite the use of\nmsync(), sync() and a clean unmount of the file system. It is easily\nreproducible with the following script:\n\n ----------------[BEGIN SCRIPT]--------------------\n mkfs.nilfs2 -f /dev/sdb\n mount /dev/sdb /mnt\n\n dd if\u003d/dev/zero bs\u003d1M count\u003d30 of\u003d/mnt/testfile\n\n umount /mnt\n mount /dev/sdb /mnt\n CHECKSUM_BEFORE\u003d\"$(md5sum /mnt/testfile)\"\n\n /root/mmaptest/mmaptest /mnt/testfile 30 10 5\n\n sync\n CHECKSUM_AFTER\u003d\"$(md5sum /mnt/testfile)\"\n umount /mnt\n mount /dev/sdb /mnt\n CHECKSUM_AFTER_REMOUNT\u003d\"$(md5sum /mnt/testfile)\"\n umount /mnt\n\n echo \"BEFORE MMAP:\\t$CHECKSUM_BEFORE\"\n echo \"AFTER MMAP:\\t$CHECKSUM_AFTER\"\n echo \"AFTER REMOUNT:\\t$CHECKSUM_AFTER_REMOUNT\"\n ----------------[END SCRIPT]--------------------\n\nThe mmaptest tool looks something like this (very simplified, with\nerror checking removed):\n\n ----------------[BEGIN mmaptest]--------------------\n data \u003d mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,\n MAP_SHARED, fd, file_offset);\n\n for (i \u003d 0; i \u003c write_count; ++i) {\n memcpy(data + i * 4096, buf, sizeof(buf));\n msync(data, file_size - file_offset, MS_SYNC))\n }\n ----------------[END mmaptest]--------------------\n\nThe output of the script looks something like this:\n\n BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile\n AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile\n AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile\n\nSo it is clear, that the changes done using mmap() do not survive a\nremount. This can be reproduced a 100% of the time. The problem was\nintroduced in commit 136e8770cd5d (\"nilfs2: fix issue of\nnilfs_set_page_dirty() for page at EOF boundary\").\n\nIf the page was read with mpage_readpage() or mpage_readpages() for\nexample, then it has no buffers attached to it. In that case\npage_has_buffers(page) in nilfs_set_page_dirty() will be false.\nTherefore nilfs_set_file_dirty() is never called and the pages are never\ncollected and never written to disk.\n\nThis patch fixes the problem by also calling nilfs_set_file_dirty() if the\npage has no buffers attached to it.\n\n[akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]\nSigned-off-by: Andreas Rohner \u003candreas.rohner@gmx.net\u003e\nTested-by: Andreas Rohner \u003candreas.rohner@gmx.net\u003e\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@lab.ntt.co.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "7433a2a7ac62c02e072069e51d69a511b2026d7f", "tree": "f85815dd4d741059ae14b86c00510027fffc26d7", "parents": [ "d7bbf15e60a6368bb958a52d2e8ac5a18fd4c37e" ], "author": { "name": "Anton Altaparmakov", "email": "aia21@cam.ac.uk", "time": "Mon Sep 22 01:53:03 2014 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:37 2014 +0800" }, "message": "Fix nasty 32-bit overflow bug in buffer i/o code.\n\ncommit f2d5a94436cc7cc0221b9a81bba2276a25187dd3 upstream.\n\nOn 32-bit architectures, the legacy buffer_head functions are not always\nhandling the sector number with the proper 64-bit types, and will thus\nfail on 4TB+ disks.\n\nAny code that uses __getblk() (and thus bread(), breadahead(),\nsb_bread(), sb_breadahead(), sb_getblk()), and calls it using a 64-bit\nblock on a 32-bit arch (where \"long\" is 32-bit) causes an inifinite loop\nin __getblk_slow() with an infinite stream of errors logged to dmesg\nlike this:\n\n __find_get_block_slow() failed. block\u003d6740375944, b_blocknr\u003d2445408648\n b_state\u003d0x00000020, b_size\u003d512\n device sda1 blocksize: 512\n\nNote how in hex block is 0x191C1F988 and b_blocknr is 0x91C1F988 i.e. the\ntop 32-bits are missing (in this case the 0x1 at the top).\n\nThis is because grow_dev_page() is broken and has a 32-bit overflow due\nto shifting the page index value (a pgoff_t - which is just 32 bits on\n32-bit architectures) left-shifted as the block number. But the top\nbits to get lost as the pgoff_t is not type cast to sector_t / 64-bit\nbefore the shift.\n\nThis patch fixes this issue by type casting \"index\" to sector_t before\ndoing the left shift.\n\nNote this is not a theoretical bug but has been seen in the field on a\n4TiB hard drive with logical sector size 512 bytes.\n\nThis patch has been verified to fix the infinite loop problem on 3.17-rc5\nkernel using a 4TB disk image mounted using \"-o loop\". Without this patch\ndoing a \"find /nt\" where /nt is an NTFS volume causes the inifinite loop\n100% reproducibly whilst with the patch it works fine as expected.\n\nSigned-off-by: Anton Altaparmakov \u003caia21@cantab.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b6cab216d3bf0b0f302a229a28037a088c7ada01", "tree": "9a519c40a0c104fc8708816326b4f382d35a010d", "parents": [ "0965d12e7ee793a911fed1b674ba3464680b959a" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Thu Sep 18 11:51:32 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:34 2014 +0800" }, "message": "NFSv4: Fix another bug in the close/open_downgrade code\n\ncommit cd9288ffaea4359d5cfe2b8d264911506aed26a4 upstream.\n\nJames Drew reports another bug whereby the NFS client is now sending\nan OPEN_DOWNGRADE in a situation where it should really have sent a\nCLOSE: the client is opening the file for O_RDWR, but then trying to\ndo a downgrade to O_RDONLY, which is not allowed by the NFSv4 spec.\n\nReported-by: James Drews \u003cdrews@engr.wisc.edu\u003e\nLink: http://lkml.kernel.org/r/541AD7E5.8020409@engr.wisc.edu\nFixes: aee7af356e15 (NFSv4: Fix problems with close in the presence...)\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a90ec2a8bbd22a90dfdb5ca1b294c900226b7ff8", "tree": "ef7deed717405b30b968df907c37e16ace60f250", "parents": [ "e06503426ebc296f1ae67bfd4733afadb69076cb" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Sep 13 21:55:46 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:31 2014 +0800" }, "message": "don\u0027t bugger nd-\u003eseq on set_root_rcu() from follow_dotdot_rcu()\n\ncommit 7bd88377d482e1eae3c5329b12e33cfd664fa6a9 upstream.\n\nreturn the value instead, and have path_init() do the assignment. Broken by\n\"vfs: Fix absolute RCU path walk failures due to uninitialized seq number\",\nwhich was Cc-stable with 2.6.38+ as destination. This one should go where\nit went.\n\nTo avoid dummy value returned in case when root is already set (it would do\nno harm, actually, since the only caller that doesn\u0027t ignore the return value\nis guaranteed to have nd-\u003eroot *not* set, but it\u0027s more obvious that way),\nlift the check into callers. And do the same to set_root(), to keep them\nin sync.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4:\n - remove the changes to follow_link() as it doesn\u0027t call set_root()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f9c3484ebd0a5a4918c50612c8400e4ab91ebf92", "tree": "cebe659d48131e32ff6bbcbc7aab423b27c287e0", "parents": [ "9b9d7b3078f8f4a8fa4b72aa2abd118602f942f2" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Aug 18 15:09:26 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:21 2014 +0800" }, "message": "get rid of propagate_umount() mistakenly treating slaves as busy.\n\ncommit 88b368f27a094277143d8ecd5a056116f6a41520 upstream.\n\nThe check in __propagate_umount() (\"has somebody explicitly mounted\nsomething on that slave?\") is done *before* taking the already doomed\nvictims out of the child lists.\n\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - s/hlist_for_each_entry/list_for_each_entry/]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3a8f61352a884762e6485ab21af08054b76cff69", "tree": "d2fd8c697703799b1eae0d0c21b1fa7c9ec5b6b0", "parents": [ "f79bb94b5ae6581d81f7b65cfc8f11e86bc2c8de" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Tue Nov 05 01:15:38 2013 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Sep 25 11:49:19 2014 +0800" }, "message": "ext2: Fix fs corruption in ext2_get_xip_mem()\n\ncommit 7ba3ec5749ddb61f79f7be17b5fd7720eebc52de upstream.\n\nCommit 8e3dffc651cb \"Ext2: mark inode dirty after the function\ndquot_free_block_nodirty is called\" unveiled a bug in __ext2_get_block()\ncalled from ext2_get_xip_mem(). That function called ext2_get_block()\nmistakenly asking it to map 0 blocks while 1 was intended. Before the\nabove mentioned commit things worked out fine by luck but after that commit\nwe started returning that we allocated 0 blocks while we in fact\nallocated 1 block and thus allocation was looping until all blocks in\nthe filesystem were exhausted.\n\nFix the problem by properly asking for one block and also add assertion\nin ext2_get_blocks() to catch similar problems.\n\nReported-and-tested-by: Andiry Xu \u003candiry.xu@gmail.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: Wang Nan \u003cwangnan0@huawei.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0bfb000447ffec4e7245c9c761fd0770acba504d", "tree": "2bb3296fa8b61bd47b85387aea3f20cb097e8db2", "parents": [ "818ee415d57c89ab36cbd2b9a57cc3c257afc1b9" ], "author": { "name": "Trond Myklebust", "email": "trond.myklebust@primarydata.com", "time": "Mon Aug 25 22:33:12 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Sep 25 11:49:15 2014 +0800" }, "message": "NFSv4: Fix problems with close in the presence of a delegation\n\ncommit aee7af356e151494d5014f57b33460b162f181b5 upstream.\n\nIn the presence of delegations, we can no longer assume that the\nstate-\u003en_rdwr, state-\u003en_rdonly, state-\u003en_wronly reflect the open\nstateid share mode, and so we need to calculate the initial value\nfor calldata-\u003earg.fmode using the state-\u003eflags.\n\nReported-by: James Drews \u003cdrews@engr.wisc.edu\u003e\nFixes: 88069f77e1ac5 (NFSv41: Fix a potential state leakage when...)\nSigned-off-by: Trond Myklebust \u003ctrond.myklebust@primarydata.com\u003e\n[lizf: Backport to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d06e4b08aa764b2999b6a67f1cf2b7794ae5b0e1", "tree": "65783bdbf7d8adb45b2701b0bdf6e72c68c14cc7", "parents": [ "a0e5b9d2c3cdaf1f980409ec1a84db22abfd6958" ], "author": { "name": "Pavel Shilovsky", "email": "pshilovsky@samba.org", "time": "Mon Aug 18 20:49:58 2014 +0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Sep 25 11:49:11 2014 +0800" }, "message": "CIFS: Fix wrong directory attributes after rename\n\ncommit b46799a8f28c43c5264ac8d8ffa28b311b557e03 upstream.\n\nWhen we requests rename we also need to update attributes\nof both source and target parent directories. Not doing it\ncauses generic/309 xfstest to fail on SMB2 mounts. Fix this\nby marking these directories for force revalidating.\n\nSigned-off-by: Pavel Shilovsky \u003cpshilovsky@samba.org\u003e\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "5ccd3e2a9ec54a2e9a9b0a7d9256f2433304fa24", "tree": "8953d59eb22b48a1630a3f9092b13701f607cb46", "parents": [ "c945ed6b7e5812cfba4d292c3c54fc750bb9f65b" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Sun Aug 17 11:49:57 2014 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Sep 25 11:49:10 2014 +0800" }, "message": "isofs: Fix unbounded recursion when processing relocated directories\n\ncommit 410dd3cf4c9b36f27ed4542ee18b1af5e68645a4 upstream.\n\nWe did not check relocated directory in any way when processing Rock\nRidge \u0027CL\u0027 tag. Thus a corrupted isofs image can possibly have a CL\nentry pointing to another CL entry leading to possibly unbounded\nrecursion in kernel code and thus stack overflow or deadlocks (if there\nis a loop created from CL entries).\n\nFix the problem by not allowing CL entry to point to a directory entry\nwith CL entry (such use makes no good sense anyway) and by checking\nwhether CL entry doesn\u0027t point to itself.\n\nReported-by: Chris Evans \u003ccevans@google.com\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "b06b5c6204bdc7c571feedb6b16188ba62feb9a6", "tree": "91f752326bfe880af1170cc9a9a55b8af21c7e50", "parents": [ "883ea134ae75eb03c9f08553a81957a808cee96b" ], "author": { "name": "Xi Wang", "email": "xi.wang@gmail.com", "time": "Thu May 31 16:26:04 2012 -0700" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 31 12:54:53 2014 -0700" }, "message": "introduce SIZE_MAX\n\ncommit a3860c1c5dd1137db23d7786d284939c5761d517 upstream.\n\nULONG_MAX is often used to check for integer overflow when calculating\nallocation size. While ULONG_MAX happens to work on most systems, there\nis no guarantee that `size_t\u0027 must be the same size as `long\u0027.\n\nThis patch introduces SIZE_MAX, the maximum value of `size_t\u0027, to improve\nportability and readability for allocation size validation.\n\nSigned-off-by: Xi Wang \u003cxi.wang@gmail.com\u003e\nAcked-by: Alex Elder \u003celder@dreamhost.com\u003e\nCc: David Airlie \u003cairlied@linux.ie\u003e\nCc: Pekka Enberg \u003cpenberg@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Qiang Huang \u003ch.huangqiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ef018263c824ec34d06419502555dbd8889e8182", "tree": "824a73db73139112eaa5a4c991e2fe4556eaa66c", "parents": [ "7b9eab8f52499099d3b6351a7fd4277455666fa7" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Sat Jul 05 18:40:52 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 17 15:39:50 2014 -0700" }, "message": "ext4: clarify error count warning messages\n\ncommit ae0f78de2c43b6fadd007c231a352b13b5be8ed2 upstream.\n\nMake it clear that values printed are times, and that it is error\nsince last fsck. Also add note about fsck version required.\n\nSigned-off-by: Pavel Machek \u003cpavel@ucw.cz\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Andreas Dilger \u003cadilger@dilger.ca\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a22a7e7ba7d3b7f4288bfde1f9ab552905366f32", "tree": "4448cdb9b4ca775f5f58417d161379eab9cc8cc8", "parents": [ "a96a557e2573a81ca6d62e6c5a0cee119f25ef78" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Thu Jun 19 16:44:48 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 09 10:51:20 2014 -0700" }, "message": "nfsd: fix rare symlink decoding bug\n\ncommit 76f47128f9b33af1e96819746550d789054c9664 upstream.\n\nAn NFS operation that creates a new symlink includes the symlink data,\nwhich is xdr-encoded as a length followed by the data plus 0 to 3 bytes\nof zero-padding as required to reach a 4-byte boundary.\n\nThe vfs, on the other hand, wants null-terminated data.\n\nThe simple way to handle this would be by copying the data into a newly\nallocated buffer with space for the final null.\n\nThe current nfsd_symlink code tries to be more clever by skipping that\nstep in the (likely) case where the byte following the string is already\n0.\n\nBut that assumes that the byte following the string is ours to look at.\nIn fact, it might be the first byte of a page that we can\u0027t read, or of\nsome object that another task might modify.\n\nWorse, the NFSv4 code tries to fix the problem by actually writing to\nthat byte.\n\nIn the NFSv2/v3 cases this actually appears to be safe:\n\n\t- nfs3svc_decode_symlinkargs explicitly null-terminates the data\n\t (after first checking its length and copying it to a new\n\t page).\n\t- NFSv2 limits symlinks to 1k. The buffer holding the rpc\n\t request is always at least a page, and the link data (and\n\t previous fields) have maximum lengths that prevent the request\n\t from reaching the end of a page.\n\nIn the NFSv4 case the CREATE op is potentially just one part of a long\ncompound so can end up on the end of a page if you\u0027re unlucky.\n\nThe minimal fix here is to copy and null-terminate in the NFSv4 case.\nThe nfsd_symlink() interface here seems too fragile, though. It should\nreally either do the copy itself every time or just require a\nnull-terminated string.\n\nReported-by: Jeff Layton \u003cjlayton@primarydata.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6e44d311e993f364bbf4d99e2b6beac25f03bdbe", "tree": "c5724d189dcfeac65ef397e4d97300eba5fb45f2", "parents": [ "74be85d10748a196626d8c0e531c75c11d26ad95" ], "author": { "name": "Steve French", "email": "smfrench@gmail.com", "time": "Sun Jun 22 20:38:49 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 09 10:51:20 2014 -0700" }, "message": "CIFS: fix mount failure with broken pathnames when smb3 mount with mapchars option\n\ncommit ce36d9ab3bab06b7b5522f5c8b68fac231b76ffb upstream.\n\nWhen we SMB3 mounted with mapchars (to allow reserved characters : \\ / \u003e \u003c * ?\nvia the Unicode Windows to POSIX remap range) empty paths\n(eg when we open \"\" to query the root of the SMB3 directory on mount) were not\nnull terminated so we sent garbarge as a path name on empty paths which caused\nSMB2/SMB2.1/SMB3 mounts to fail when mapchars was specified. mapchars is\nparticularly important since Unix Extensions for SMB3 are not supported (yet)\n\nSigned-off-by: Steve French \u003csmfrench@gmail.com\u003e\nReviewed-by: David Disseldorp \u003cddiss@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bdef8307cc822a0121698ad619d1fdb3191795ba", "tree": "9adc03846a36e38a54063f8064dd8c80006486bb", "parents": [ "eb55ed0cdd1bcb9bfba644c1d577b8b008de92b5" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Wed May 28 10:46:13 2014 +0200" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 06 18:49:19 2014 -0700" }, "message": "nfsd: getattr for FATTR4_WORD0_FILES_AVAIL needs the statfs buffer\n\ncommit 12337901d654415d9f764b5f5ba50052e9700f37 upstream.\n\nNote nobody\u0027s ever noticed because the typical client probably never\nrequests FILES_AVAIL without also requesting something else on the list.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "eb55ed0cdd1bcb9bfba644c1d577b8b008de92b5", "tree": "c81ff9cc7748d945b40a18a5d0cd5352c7d68668", "parents": [ "d0d9888d713c1cc3737d5c4e90dd705e633df55a" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Tue May 27 11:14:26 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 06 18:49:19 2014 -0700" }, "message": "nfsd4: fix FREE_STATEID lockowner leak\n\ncommit 48385408b45523d9a432c66292d47ef43efcbb94 upstream.\n\n27b11428b7de (\"nfsd4: remove lockowner when removing lock stateid\")\nintroduced a memory leak.\n\nReported-by: Jeff Layton \u003cjeff.layton@primarydata.com\u003e\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0834497455a06f7772e82a812e05dff446472b21", "tree": "382cbd1e342157c9c90c9414a4f5879ccaba8834", "parents": [ "df5c07b84d2744b8b4e3f8a240b21698405feeb3" ], "author": { "name": "hujianyang", "email": "hujianyang@huawei.com", "time": "Sat May 31 11:39:32 2014 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 06 18:49:19 2014 -0700" }, "message": "UBIFS: Remove incorrect assertion in shrink_tnc()\n\ncommit 72abc8f4b4e8574318189886de627a2bfe6cd0da upstream.\n\nI hit the same assert failed as Dolev Raviv reported in Kernel v3.10\nshows like this:\n\n[ 9641.164028] UBIFS assert failed in shrink_tnc at 131 (pid 13297)\n[ 9641.234078] CPU: 1 PID: 13297 Comm: mmap.test Tainted: G O 3.10.40 #1\n[ 9641.234116] [\u003cc0011a6c\u003e] (unwind_backtrace+0x0/0x12c) from [\u003cc000d0b0\u003e] (show_stack+0x20/0x24)\n[ 9641.234137] [\u003cc000d0b0\u003e] (show_stack+0x20/0x24) from [\u003cc0311134\u003e] (dump_stack+0x20/0x28)\n[ 9641.234188] [\u003cc0311134\u003e] (dump_stack+0x20/0x28) from [\u003cbf22425c\u003e] (shrink_tnc_trees+0x25c/0x350 [ubifs])\n[ 9641.234265] [\u003cbf22425c\u003e] (shrink_tnc_trees+0x25c/0x350 [ubifs]) from [\u003cbf2245ac\u003e] (ubifs_shrinker+0x25c/0x310 [ubifs])\n[ 9641.234307] [\u003cbf2245ac\u003e] (ubifs_shrinker+0x25c/0x310 [ubifs]) from [\u003cc00cdad8\u003e] (shrink_slab+0x1d4/0x2f8)\n[ 9641.234327] [\u003cc00cdad8\u003e] (shrink_slab+0x1d4/0x2f8) from [\u003cc00d03d0\u003e] (do_try_to_free_pages+0x300/0x544)\n[ 9641.234344] [\u003cc00d03d0\u003e] (do_try_to_free_pages+0x300/0x544) from [\u003cc00d0a44\u003e] (try_to_free_pages+0x2d0/0x398)\n[ 9641.234363] [\u003cc00d0a44\u003e] (try_to_free_pages+0x2d0/0x398) from [\u003cc00c6a60\u003e] (__alloc_pages_nodemask+0x494/0x7e8)\n[ 9641.234382] [\u003cc00c6a60\u003e] (__alloc_pages_nodemask+0x494/0x7e8) from [\u003cc00f62d8\u003e] (new_slab+0x78/0x238)\n[ 9641.234400] [\u003cc00f62d8\u003e] (new_slab+0x78/0x238) from [\u003cc031081c\u003e] (__slab_alloc.constprop.42+0x1a4/0x50c)\n[ 9641.234419] [\u003cc031081c\u003e] (__slab_alloc.constprop.42+0x1a4/0x50c) from [\u003cc00f80e8\u003e] (kmem_cache_alloc_trace+0x54/0x188)\n[ 9641.234459] [\u003cc00f80e8\u003e] (kmem_cache_alloc_trace+0x54/0x188) from [\u003cbf227908\u003e] (do_readpage+0x168/0x468 [ubifs])\n[ 9641.234553] [\u003cbf227908\u003e] (do_readpage+0x168/0x468 [ubifs]) from [\u003cbf2296a0\u003e] (ubifs_readpage+0x424/0x464 [ubifs])\n[ 9641.234606] [\u003cbf2296a0\u003e] (ubifs_readpage+0x424/0x464 [ubifs]) from [\u003cc00c17c0\u003e] (filemap_fault+0x304/0x418)\n[ 9641.234638] [\u003cc00c17c0\u003e] (filemap_fault+0x304/0x418) from [\u003cc00de694\u003e] (__do_fault+0xd4/0x530)\n[ 9641.234665] [\u003cc00de694\u003e] (__do_fault+0xd4/0x530) from [\u003cc00e10c0\u003e] (handle_pte_fault+0x480/0xf54)\n[ 9641.234690] [\u003cc00e10c0\u003e] (handle_pte_fault+0x480/0xf54) from [\u003cc00e2bf8\u003e] (handle_mm_fault+0x140/0x184)\n[ 9641.234716] [\u003cc00e2bf8\u003e] (handle_mm_fault+0x140/0x184) from [\u003cc0316688\u003e] (do_page_fault+0x150/0x3ac)\n[ 9641.234737] [\u003cc0316688\u003e] (do_page_fault+0x150/0x3ac) from [\u003cc000842c\u003e] (do_DataAbort+0x3c/0xa0)\n[ 9641.234759] [\u003cc000842c\u003e] (do_DataAbort+0x3c/0xa0) from [\u003cc0314e38\u003e] (__dabt_usr+0x38/0x40)\n\nAfter analyzing the code, I found a condition that may cause this failed\nin correct operations. Thus, I think this assertion is wrong and should be\nremoved.\n\nSuppose there are two clean znodes and one dirty znode in TNC. So the\nper-filesystem atomic_t @clean_zn_cnt is (2). If commit start, dirty_znode\nis set to COW_ZNODE in get_znodes_to_commit() in case of potentially ops\non this znode. We clear COW bit and DIRTY bit in write_index() without\n@tnc_mutex locked. We don\u0027t increase @clean_zn_cnt in this place. As the\ncomments in write_index() shows, if another process hold @tnc_mutex and\ndirty this znode after we clean it, @clean_zn_cnt would be decreased to (1).\nWe will increase @clean_zn_cnt to (2) with @tnc_mutex locked in\nfree_obsolete_znodes() to keep it right.\n\nIf shrink_tnc() performs between decrease and increase, it will release\nother 2 clean znodes it holds and found @clean_zn_cnt is less than zero\n(1 - 2 \u003d -1), then hit the assertion. Because free_obsolete_znodes() will\nsoon correct @clean_zn_cnt and no harm to fs in this case, I think this\nassertion could be removed.\n\n2 clean zondes and 1 dirty znode, @clean_zn_cnt \u003d\u003d 2\n\nThread A (commit) Thread B (write or others) Thread C (shrinker)\n-\u003ewrite_index\n -\u003eclear_bit(DIRTY_NODE)\n -\u003eclear_bit(COW_ZNODE)\n\n @clean_zn_cnt \u003d\u003d 2\n -\u003emutex_locked(\u0026tnc_mutex)\n -\u003edirty_cow_znode\n -\u003e!ubifs_zn_cow(znode)\n -\u003e!test_and_set_bit(DIRTY_NODE)\n -\u003eatomic_dec(\u0026clean_zn_cnt)\n -\u003emutex_unlocked(\u0026tnc_mutex)\n\n @clean_zn_cnt \u003d\u003d 1\n -\u003emutex_locked(\u0026tnc_mutex)\n -\u003eshrink_tnc\n -\u003edestroy_tnc_subtree\n -\u003eatomic_sub(\u0026clean_zn_cnt, 2)\n -\u003eubifs_assert \u003c- hit\n -\u003emutex_unlocked(\u0026tnc_mutex)\n\n @clean_zn_cnt \u003d\u003d -1\n-\u003emutex_lock(\u0026tnc_mutex)\n-\u003efree_obsolete_znodes\n -\u003eatomic_inc(\u0026clean_zn_cnt)\n-\u003emutux_unlock(\u0026tnc_mutex)\n\n @clean_zn_cnt \u003d\u003d 0 (correct after shrink)\n\nSigned-off-by: hujianyang \u003chujianyang@huawei.com\u003e\nSigned-off-by: Artem Bityutskiy \u003cartem.bityutskiy@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" } ], "next": "e18bac2cae5d6efa474611a2dc825b7749760af4" }