)]}' { "log": [ { "commit": "b44fee87a735689c6d0d68989a64a3f680701fdf", "tree": "7c3c723903c4a76a4d8104c4335fb5878d83a523", "parents": [ "6c67daf0989f83894ce381b5754b11bc1304f3fc" ], "author": { "name": "Heinz Mauelshagen", "email": "heinzm@redhat.com", "time": "Fri Oct 17 13:38:50 2014 +0200" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:02:47 2015 -0400" }, "message": "dm raid: ensure superblock\u0027s size matches device\u0027s logical block size\n\ncommit 40d43c4b4cac4c2647bf07110d7b07d35f399a84 upstream.\n\nThe dm-raid superblock (struct dm_raid_superblock) is padded to 512\nbytes and that size is being used to read it in from the metadata\ndevice into one preallocated page.\n\nReading or writing this on a 512-byte sector device works fine but on\na 4096-byte sector device this fails.\n\nSet the dm-raid superblock\u0027s size to the logical block size of the\nmetadata device, because IO at that size is guaranteed too work. Also\nadd a size check to avoid silent partial metadata loss in case the\nsuperblock should ever grow past the logical block size or PAGE_SIZE.\n\n[includes pointer math fix from Dan Carpenter]\nReported-by: \"Liuhua Wang\" \u003clwang@suse.com\u003e\nSigned-off-by: Heinz Mauelshagen \u003cheinzm@redhat.com\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3277d6873ea47eded707511c1245298e6c0b1ccd", "tree": "bbde3bba44d36862cb72f4930a00127e19517985", "parents": [ "7adf978b5056c04103ab8969d46d1dfcaf75a9b6" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Oct 16 14:45:20 2014 -0400" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:02:45 2015 -0400" }, "message": "dm bufio: change __GFP_IO to __GFP_FS in shrinker callbacks\n\ncommit 9d28eb12447ee08bb5d1e8bb3195cf20e1ecd1c0 upstream.\n\nThe shrinker uses gfp flags to indicate what kind of operation can the\ndriver wait for. If __GFP_IO flag is present, the driver can wait for\nblock I/O operations, if __GFP_FS flag is present, the driver can wait on\noperations involving the filesystem.\n\ndm-bufio tested for __GFP_IO. However, dm-bufio can run on a loop block\ndevice that makes calls into the filesystem. If __GFP_IO is present and\n__GFP_FS isn\u0027t, dm-bufio could still block on filesystem operations if it\nruns on a loop block device.\n\nThe change from __GFP_IO to __GFP_FS supposedly fixes one observed (though\nunreproducible) deadlock involving dm-bufio and loop device.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported to 3.4:\n - drop changes to dm_bufio_shrink_scan() and dm_bufio_shrink_count()\n - change __GFP_IO to __GFP_FS in shrink()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "204f7719a6f3164c6d0ff4c676199049db848313", "tree": "7e93417ee2078c8337a1af846b3e198ccbf3828f", "parents": [ "f23df04f9a0d4bee65fa33cb7c3b1a642534f383" ], "author": { "name": "Alexey Khoroshilov", "email": "khoroshilov@ispras.ru", "time": "Wed Oct 01 22:58:35 2014 +0200" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:01:08 2015 -0400" }, "message": "dm log userspace: fix memory leak in dm_ulog_tfr_init failure path\n\ncommit 56ec16cb1e1ce46354de8511eef962a417c32c92 upstream.\n\nIf cn_add_callback() fails in dm_ulog_tfr_init(), it does not\ndeallocate prealloced memory but calls cn_del_callback().\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Alexey Khoroshilov \u003ckhoroshilov@ispras.ru\u003e\nReviewed-by: Jonathan Brassow \u003cjbrassow@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f23df04f9a0d4bee65fa33cb7c3b1a642534f383", "tree": "6ea95e1ce97f9484f414cb7b31d4ec070db07f24", "parents": [ "4b2b04402737b19ebbe83e82739ecb35e8045501" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Tue Sep 30 09:32:46 2014 +0100" }, "committer": { "name": "flintman", "email": "flintman@flintmancomputers.com", "time": "Mon Apr 27 08:01:07 2015 -0400" }, "message": "dm bufio: update last_accessed when relinking a buffer\n\ncommit eb76faf53b1ff7a77ce3f78cc98ad392ac70c2a0 upstream.\n\nThe \u0027last_accessed\u0027 member of the dm_buffer structure was only set when\nthe the buffer was created. This led to each buffer being discarded\nafter dm_bufio_max_age time even if it was used recently. In practice\nthis resulted in all thinp metadata being evicted soon after being read\n-- this is particularly problematic for metadata intensive workloads\nlike multithreaded small random IO.\n\n\u0027last_accessed\u0027 is now updated each time the buffer is moved to the head\nof the LRU list, so the buffer is now properly discarded if it was not\nused in dm_bufio_max_age time.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1097d78180e1a2916c2bcdb15cb90ba131af9cd8", "tree": "5910f8fc0dcb85c71011ccccee18895769699390", "parents": [ "3ded4adc97887ddde3c1855f29f062e015d19425", "7fd7a446b1c2b96252e4389746e5419eae04faef" ], "author": { "name": "Paul", "email": "javelinanddart@gmail.com", "time": "Sun Jan 11 17:15:40 2015 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Jan 11 17:20:45 2015 -0800" }, "message": "Merge tag \u0027v3.4.105\u0027 into cm-12.0\n\nThis is the 3.4.105 stable release\n\nConflicts:\n\tarch/arm/mm/proc-v7.S\n\tdrivers/bluetooth/hci_ldisc.c\n\tdrivers/media/dvb/dvb-core/dmxdev.c\n\tdrivers/usb/core/driver.c\n\tdrivers/usb/dwc3/core.c\n\tdrivers/usb/host/xhci-hub.c\n\tdrivers/usb/host/xhci.c\n\tdrivers/usb/serial/qcserial.c\n\tdrivers/usb/serial/usb_wwan.c\n\tkernel/events/core.c\n\tkernel/time/tick-sched.ck\n\tkernel/futex.c\n\tmm/memory_hotplug.c\n\tmm/vmscan.c\n\tnet/bluetooth/hci_conn.c\n\tnet/bluetooth/hci_event.c\n\tnet/bluetooth/l2cap_core.c\n\tnet/ipv4/ping.c\n\tnet/wireless/nl80211.c\n\tsound/soc/soc-core.c\n\nChange-Id: Id09da84afb427ba1a32ff26e74f2bb86458d4a2e\n" }, { "commit": "be73621bd21353b97ba55fb5ad9b4c35aa09271a", "tree": "445b9b3aedb2a36af450d3a923a5b76847035047", "parents": [ "b47d65db8f8e765ef0267d13681c9bf12a148fb5" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Aug 28 11:09:31 2014 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Dec 01 18:02:43 2014 +0800" }, "message": "dm crypt: fix access beyond the end of allocated space\n\ncommit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.\n\nThe DM crypt target accesses memory beyond allocated space resulting in\na crash on 32 bit x86 systems.\n\nThis bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 \"dm\ncrypt: use async crypto\"). However, this bug was masked by the fact\nthat kmalloc rounds the size up to the next power of two. This bug\nwasn\u0027t exposed until 3.17-rc1 commit 298a9fa08a (\"dm crypt: use per-bio\ndata\"). By switching to using per-bio data there was no longer any\npadding beyond the end of a dm-crypt allocated memory block.\n\nTo minimize allocation overhead dm-crypt puts several structures into one\nblock allocated with kmalloc. The block holds struct ablkcipher_request,\ncipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))),\nstruct dm_crypt_request and an initialization vector.\n\nThe variable dmreq_start is set to offset of struct dm_crypt_request\nwithin this memory block. dm-crypt allocates the block with this size:\ncc-\u003edmreq_start + sizeof(struct dm_crypt_request) + cc-\u003eiv_size.\n\nWhen accessing the initialization vector, dm-crypt uses the function\niv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq\n+ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).\n\ndm-crypt allocated \"cc-\u003eiv_size\" bytes beyond the end of dm_crypt_request\nstructure. However, when dm-crypt accesses the initialization vector, it\ntakes a pointer to the end of dm_crypt_request, aligns it, and then uses\nit as the initialization vector. If the end of dm_crypt_request is not\naligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the\nalignment causes the initialization vector to point beyond the allocated\nspace.\n\nFix this bug by calculating the variable iv_size_padding and adding it\nto the allocated size.\n\nAlso correct the alignment of dm_crypt_request. struct dm_crypt_request\nis specific to dm-crypt (it isn\u0027t used by the crypto subsystem at all),\nso it is aligned on __alignof__(struct dm_crypt_request).\n\nAlso align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is\naligned as if the block was allocated with kmalloc.\n\nReported-by: Krzysztof Kolasa \u003ckkolasa@winsoft.pl\u003e\nTested-by: Milan Broz \u003cgmazyland@gmail.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported by Mikulas]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a0e5b9d2c3cdaf1f980409ec1a84db22abfd6958", "tree": "f73a3d79c04ee5b460447e6ba83335d1960d360f", "parents": [ "77e5657567adc61ab425a070c5a9ec13b20913e8" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Aug 13 09:57:07 2014 +1000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Sep 25 11:49:11 2014 +0800" }, "message": "md/raid6: avoid data corruption during recovery of double-degraded RAID6\n\ncommit 9c4bdf697c39805078392d5ddbbba5ae5680e0dd upstream.\n\nDuring recovery of a double-degraded RAID6 it is possible for\nsome blocks not to be recovered properly, leading to corruption.\n\nIf a write happens to one block in a stripe that would be written to a\nmissing device, and at the same time that stripe is recovering data\nto the other missing device, then that recovered data may not be written.\n\nThis patch skips, in the double-degraded case, an optimisation that is\nonly safe for single-degraded arrays.\n\nBug was introduced in 2.6.32 and fix is suitable for any kernel since\nthen. In an older kernel with separate handle_stripe5() and\nhandle_stripe6() functions the patch must change handle_stripe6().\n\nFixes: 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8\nCc: Yuri Tikhonov \u003cyur@emcraft.com\u003e\nCc: Dan Williams \u003cdan.j.williams@intel.com\u003e\nReported-by: \"Manibalan P\" \u003cpmanibalan@amiindia.co.in\u003e\nTested-by: \"Manibalan P\" \u003cpmanibalan@amiindia.co.in\u003e\nResolves: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1090423\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nAcked-by: Dan Williams \u003cdan.j.williams@intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d3ef6557f0130b07ff09c962593b9cf51f9f6346", "tree": "5de82dca7ca9f0a7b42f3374048183002cba73e8", "parents": [ "21057e4a4d6155e0594573e7d5d8dd7dcf537774" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Jul 02 12:04:14 2014 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jul 09 10:51:21 2014 -0700" }, "message": "md: flush writes before starting a recovery.\n\ncommit 133d4527eab8d199a62eee6bd433f0776842df2e upstream.\n\nWhen we write to a degraded array which has a bitmap, we\nmake sure the relevant bit in the bitmap remains set when\nthe write completes (so a \u0027re-add\u0027 can quickly rebuilt a\ntemporarily-missing device).\n\nIf, immediately after such a write starts, we incorporate a spare,\ncommence recovery, and skip over the region where the write is\nhappening (because the \u0027needs recovery\u0027 flag isn\u0027t set yet),\nthen that write will not get to the new device.\n\nOnce the recovery finishes the new device will be trusted, but will\nhave incorrect data, leading to possible corruption.\n\nWe cannot set the \u0027needs recovery\u0027 flag when we start the write as we\ndo not know easily if the write will be \"degraded\" or not. That\ndepends on details of the particular raid level and particular write\nrequest.\n\nThis patch fixes a corruption issue of long standing and so it\nsuitable for any -stable kernel. It applied correctly to 3.0 at\nleast and will minor editing to earlier kernels.\n\nReported-by: Bill \u003cbillstuff2001@sbcglobal.net\u003e\nTested-by: Bill \u003cbillstuff2001@sbcglobal.net\u003e\nLink: http://lkml.kernel.org/r/53A518BB.60709@sbcglobal.net\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0b78a4287b8cc7c0817b7bc4894d8c9c177bb751", "tree": "a79f52db36124cced0f72ad992b7d7d05b603ec7", "parents": [ "d6e81d4f7b4e8cea2817c7568e3756798cd29aae" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed May 28 13:39:23 2014 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jun 11 12:04:11 2014 -0700" }, "message": "md: always set MD_RECOVERY_INTR when aborting a reshape or other \"resync\".\n\ncommit 3991b31ea072b070081ca3bfa860a077eda67de5 upstream.\n\nIf mddev-\u003ero is set, md_to_sync will (correctly) abort.\nHowever in that case MD_RECOVERY_INTR isn\u0027t set.\n\nIf a RESHAPE had been requested, then -\u003efinish_reshape() will be\ncalled and it will think the reshape was successful even though\nnothing happened.\n\nNormally a resync will not be requested if -\u003ero is set, but if an\narray is stopped while a reshape is on-going, then when the array is\nstarted, the reshape will be restarted. If the array is also set\nread-only at this point, the reshape will instantly appear to success,\nresulting in data corruption.\n\nConsequently, this patch is suitable for any -stable kernel.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "87dba703d0d9eb4352506dbd8f8878e3e2ee92f0", "tree": "0c82b8672fee4d91c2df7ff267115fd8f8fff23a", "parents": [ "5e301eba0a521b3682aec467eb13a94dd6c4027a" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Wed Mar 20 17:21:24 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:05 2014 -0700" }, "message": "dm thin: fix discard corruption\n\ncommit f046f89a99ccfd9408b94c653374ff3065c7edb3 upstream.\n\nFix a bug in dm_btree_remove that could leave leaf values with incorrect\nreference counts. The effect of this was that removal of a shared block\ncould result in the space maps thinking the block was no longer used.\nMore concretely, if you have a thin device and a snapshot of it, sending\na discard to a shared region of the thin could corrupt the snapshot.\n\nThinp uses a 2-level nested btree to store it\u0027s mappings. This first\nlevel is indexed by thin device, and the second level by logical\nblock.\n\nOften when we\u0027re removing an entry in this mapping tree we need to\nrebalance nodes, which can involve shadowing them, possibly creating a\ncopy if the block is shared. If we do create a copy then children of\nthat node need to have their reference counts incremented. In this\nway reference counts percolate down the tree as shared trees diverge.\n\nThe rebalance functions were incrementing the children at the\nappropriate time, but they were always assuming the children were\ninternal nodes. This meant the leaf values (in our case packed\nblock/flags entries) were not being incremented.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n[bwh: Backported to 3.2: bump target version numbers from 1.0.1 to 1.0.2]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[xr: Backported to 3.4: bump target version numbers to 1.1.1]\nSigned-off-by: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5e301eba0a521b3682aec467eb13a94dd6c4027a", "tree": "192beec291df5993ea837b601fb4e45b6e22492e", "parents": [ "d110fd5113953b6f539dee75dbabd9a86dce790f" ], "author": { "name": "Shiva Krishna Merla", "email": "shivakrishna.merla@netapp.com", "time": "Wed Oct 30 03:26:38 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:05 2014 -0700" }, "message": "dm mpath: fix race condition between multipath_dtr and pg_init_done\n\ncommit 954a73d5d3073df2231820c718fdd2f18b0fe4c9 upstream.\n\nWhenever multipath_dtr() is happening we must prevent queueing any\nfurther path activation work. Implement this by adding a new\n\u0027pg_init_disabled\u0027 flag to the multipath structure that denotes future\npath activation work should be skipped if it is set. By disabling\npg_init and then re-enabling in flush_multipath_work() we also avoid the\npotential for pg_init to be initiated while suspending an mpath device.\n\nWithout this patch a race condition exists that may result in a kernel\npanic:\n\n1) If after pg_init_done() decrements pg_init_in_progress to 0, a call\n to wait_for_pg_init_completion() assumes there are no more pending path\n management commands.\n2) If pg_init_required is set by pg_init_done(), due to retryable\n mode_select errors, then process_queued_ios() will again queue the\n path activation work.\n3) If free_multipath() completes before activate_path() work is called a\n NULL pointer dereference like the following can be seen when\n accessing members of the recently destructed multipath:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000090\nRIP: 0010:[\u003cffffffffa003db1b\u003e] [\u003cffffffffa003db1b\u003e] activate_path+0x1b/0x30 [dm_multipath]\n[\u003cffffffff81090ac0\u003e] worker_thread+0x170/0x2a0\n[\u003cffffffff81096c80\u003e] ? autoremove_wake_function+0x0/0x40\n\n[switch to disabling pg_init in flush_multipath_work \u0026 header edits by Mike Snitzer]\nSigned-off-by: Shiva Krishna Merla \u003cshivakrishna.merla@netapp.com\u003e\nReviewed-by: Krishnasamy Somasundaram \u003csomasundaram.krishnasamy@netapp.com\u003e\nTested-by: Speagle Andy \u003cAndy.Speagle@netapp.com\u003e\nAcked-by: Junichi Nomura \u003cj-nomura@ce.jp.nec.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Bump version to 1.3.2 not 1.6.0]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\n[xr: Backported to 3.4: Adjust context]\nSigned-off-by: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d110fd5113953b6f539dee75dbabd9a86dce790f", "tree": "bd45fc5490e04d544fda192f7c892c55f9bfcb97", "parents": [ "4834ca940bf17fd203487ad93b69276ebff49688" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Nov 29 18:13:37 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:05 2014 -0700" }, "message": "dm snapshot: avoid snapshot space leak on crash\n\ncommit 230c83afdd9cd384348475bea1e14b80b3b6b1b8 upstream.\n\nThere is a possible leak of snapshot space in case of crash.\n\nThe reason for space leaking is that chunks in the snapshot device are\nallocated sequentially, but they are finished (and stored in the metadata)\nout of order, depending on the order in which copying finished.\n\nFor example, supposed that the metadata contains the following records\nSUPERBLOCK\nMETADATA (blocks 0 ... 250)\nDATA 0\nDATA 1\nDATA 2\n...\nDATA 250\n\nNow suppose that you allocate 10 new data blocks 251-260. Suppose that\ncopying of these blocks finish out of order (block 260 finished first\nand the block 251 finished last). Now, the snapshot device looks like\nthis:\nSUPERBLOCK\nMETADATA (blocks 0 ... 250, 260, 259, 258, 257, 256)\nDATA 0\nDATA 1\nDATA 2\n...\nDATA 250\nDATA 251\nDATA 252\nDATA 253\nDATA 254\nDATA 255\nMETADATA (blocks 255, 254, 253, 252, 251)\nDATA 256\nDATA 257\nDATA 258\nDATA 259\nDATA 260\n\nNow, if the machine crashes after writing the first metadata block but\nbefore writing the second metadata block, the space for areas DATA 250-255\nis leaked, it contains no valid data and it will never be used in the\nfuture.\n\nThis patch makes dm-snapshot complete exceptions in the same order they\nwere allocated, thus fixing this bug.\n\nNote: when backporting this patch to the stable kernel, change the version\nfield in the following way:\n* if version in the stable kernel is {1, 11, 1}, change it to {1, 12, 0}\n* if version in the stable kernel is {1, 10, 0} or {1, 10, 1}, change it\n to {1, 10, 2}\nUserspace reads the version to determine if the bug was fixed, so the\nversion change is needed.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[xr: Backported to 3.4: adjust version]\nSigned-off-by: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "352f526f91dca8673d9be1ba3166411fd8fea918", "tree": "9e667fe780468e2d394a6c109f636602ac2d3ead", "parents": [ "e4bf93019b63da30c8f9e9edb436862998865865" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Sep 27 12:35:21 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:05 2014 -0700" }, "message": "md/raid10: fix \"enough\" function for detecting if array is failed.\n\ncommit 80b4812407c6b1f66a4f2430e69747a13f010839 upstream.\n\nThe \u0027enough\u0027 function is written to work with \u0027near\u0027 arrays only\nin that is implicitly assumes that the offset from one \u0027group\u0027 of\ndevices to the next is the same as the number of copies.\nIn reality it is the number of \u0027near\u0027 copies.\n\nSo change it to make this number explicit.\n\nThis bug makes it possible to run arrays without enough drives\npresent, which is dangerous.\nIt is appropriate for an -stable kernel, but will almost certainly\nneed to be modified for some of them.\n\nReported-by: Jakub Husák \u003cjakub@gooseman.cz\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\n[bwh: Backported to 3.2: s/geo-\u003e/conf-\u003e/]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e4bf93019b63da30c8f9e9edb436862998865865", "tree": "f5986dabf4269e3037f2888bd010f4c7bd099b79", "parents": [ "bed74df4fd8380c87adb576c121f40cb1037435b" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Mar 01 22:45:47 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:05 2014 -0700" }, "message": "dm snapshot: add missing module aliases\n\ncommit 23cb21092eb9dcec9d3604b68d95192b79915890 upstream.\n\nAdd module aliases so that autoloading works correctly if the user\ntries to activate \"snapshot-origin\" or \"snapshot-merge\" targets.\n\nReference: https://bugzilla.redhat.com/889973\n\nReported-by: Chao Yang \u003cchyang@redhat.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "bed74df4fd8380c87adb576c121f40cb1037435b", "tree": "911abe60db16479c76fbf129c1ef942b4f6e4c11", "parents": [ "ba7959277325911b09944c5aedf3c4bf139be2f2" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri May 10 14:37:15 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:05 2014 -0700" }, "message": "dm bufio: avoid a possible __vmalloc deadlock\n\ncommit 502624bdad3dba45dfaacaf36b7d83e39e74b2d2 upstream.\n\nThis patch uses memalloc_noio_save to avoid a possible deadlock in\ndm-bufio. (it could happen only with large block size, at most\nPAGE_SIZE \u003c\u003c MAX_ORDER (typically 8MiB).\n\n__vmalloc doesn\u0027t fully respect gfp flags. The specified gfp flags are\nused for allocation of requested pages, structures vmap_area, vmap_block\nand vm_struct and the radix tree nodes.\n\nHowever, the kernel pagetables are allocated always with GFP_KERNEL.\nThus the allocation of pagetables can recurse back to the I/O layer and\ncause a deadlock.\n\nThis patch uses the function memalloc_noio_save to set per-process\nPF_MEMALLOC_NOIO flag and the function memalloc_noio_restore to restore\nit. When this flag is set, all allocations in the process are done with\nimplied GFP_NOIO flag, thus the deadlock can\u0027t happen.\n\nThis should be backported to stable kernels, but they don\u0027t have the\nPF_MEMALLOC_NOIO flag and memalloc_noio_save/memalloc_noio_restore\nfunctions. So, PF_MEMALLOC should be set and restored instead.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n[bwh: Backported to 3.2 as recommended]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: Rui Xiang \u003crui.xiang@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "546c518fb111a753a00f55af9052ea275ab69f12", "tree": "5d83179ba188a7d5ae77df4f17f6f2a8f5aed8c4", "parents": [ "11f87a6a6049455cd0d1e6db13c0b984a888a4b4" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue May 06 09:36:08 2014 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Jun 07 16:02:01 2014 -0700" }, "message": "md: avoid possible spinning md thread at shutdown.\n\ncommit 0f62fb220aa4ebabe8547d3a9ce4a16d3c045f21 upstream.\n\nIf an md array with externally managed metadata (e.g. DDF or IMSM)\nis in use, then we should not set safemode\u003d\u003d2 at shutdown because:\n\n1/ this is ineffective: user-space need to be involved in any \u0027safemode\u0027 handling,\n2/ The safemode management code doesn\u0027t cope with safemode\u003d\u003d2 on external metadata\n and md_check_recover enters an infinite loop.\n\nEven at shutdown, an infinite-looping process can be problematic, so this\ncould cause shutdown to hang.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "53b67ae8d3d01efbdfd7ae431d8d46cba70084b9", "tree": "ba99052e5ad2a0d44b2b2dda74d715be3ce5793e", "parents": [ "b4e472edda0a5993ede690aca9a3fa3d8750c5f2" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Fri Mar 28 02:15:02 2014 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 13 14:11:32 2014 +0200" }, "message": "dm thin: fix dangling bio in process_deferred_bios error path\n\ncommit fe76cd88e654124d1431bb662a0fc6e99ca811a5 upstream.\n\nIf unable to ensure_next_mapping() we must add the current bio, which\nwas removed from the @bios list via bio_list_pop, back to the\ndeferred_bios list before all the remaining @bios.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nAcked-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8371cffe8a9c704e3d240d5cb73142b6bd62245b", "tree": "f5edd1c9daa90b33aafffab542d17f9df84d5f2d", "parents": [ "8d8e4839b5457e20e371a5f7485ce7855c7870c9" ], "author": { "name": "Hannes Reinecke", "email": "hare@suse.de", "time": "Wed Feb 26 10:07:04 2014 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Mar 11 16:10:02 2014 -0700" }, "message": "dm mpath: fix stalls when handling invalid ioctls\n\ncommit a1989b330093578ea5470bea0a00f940c444c466 upstream.\n\nAn invalid ioctl will never be valid, irrespective of whether multipath\nhas active paths or not. So for invalid ioctls we do not have to wait\nfor multipath to activate any paths, but can rather return an error\ncode immediately. This fix resolves numerous instances of:\n\n udevd[]: worker [] unexpectedly returned with status 0x0100\n\nthat have been seen during testing.\n\nSigned-off-by: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "66d383de0963dd351051304e36247e9a6fa66b77", "tree": "5cd17ffcb6edfa4385a2ceddb63ada9efdea2ee1", "parents": [ "c523abc466c9b7c693e4a528ca2f54c6e931b6a6", "2606524141e4ff9b6a5d0bcbd9d601dfc5a8285c" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Fri Mar 07 11:56:04 2014 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Fri Mar 07 11:56:04 2014 -0800" }, "message": "Merge tag \u0027v3.4.82\u0027 into cm-11.0\n\nThis is the 3.4.82 stable release\n\nConflicts:\n\tarch/arm/kernel/traps.c\n\tmm/internal.h\n\nChange-Id: Ie3b1ffdfe133e76cfa3eaaa4305535af8490d7cc\n" }, { "commit": "cd6f6b709eebe70d80a3e542d218228bcf189654", "tree": "8a3b6c068e8764faeac9473cc9b4570e5e0e1d64", "parents": [ "5a0d43c3374c287711f4191922835e18fc8ae3ec" ], "author": { "name": "Oleg Nesterov", "email": "oleg@redhat.com", "time": "Thu Feb 06 03:42:45 2014 +0530" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Feb 22 10:32:46 2014 -0800" }, "message": "md/raid5: Fix CPU hotplug callback registration\n\ncommit 789b5e0315284463617e106baad360cb9e8db3ac upstream.\n\nSubsystems that want to register CPU hotplug callbacks, as well as perform\ninitialization for the CPUs that are already online, often do it as shown\nbelow:\n\n\tget_online_cpus();\n\n\tfor_each_online_cpu(cpu)\n\t\tinit_cpu(cpu);\n\n\tregister_cpu_notifier(\u0026foobar_cpu_notifier);\n\n\tput_online_cpus();\n\nThis is wrong, since it is prone to ABBA deadlocks involving the\ncpu_add_remove_lock and the cpu_hotplug.lock (when running concurrently\nwith CPU hotplug operations).\n\nInterestingly, the raid5 code can actually prevent double initialization and\nhence can use the following simplified form of callback registration:\n\n\tregister_cpu_notifier(\u0026foobar_cpu_notifier);\n\n\tget_online_cpus();\n\n\tfor_each_online_cpu(cpu)\n\t\tinit_cpu(cpu);\n\n\tput_online_cpus();\n\nA hotplug operation that occurs between registering the notifier and calling\nget_online_cpus(), won\u0027t disrupt anything, because the code takes care to\nperform the memory allocations only once.\n\nSo reorganize the code in raid5 this way to fix the deadlock with callback\nregistration.\n\nCc: linux-raid@vger.kernel.org\nFixes: 36d1c6476be51101778882897b315bd928c8c7b5\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\n[Srivatsa: Fixed the unregister_cpu_notifier() deadlock, added the\nfree_scratch_buffer() helper to condense code further and wrote the changelog.]\nSigned-off-by: Srivatsa S. Bhat \u003csrivatsa.bhat@linux.vnet.ibm.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "a7333f3d237f3007d14a2ee0456b96a4b33522d0", "tree": "1dc0d9ad4bd6986b35ea6566faa1e91bb471140f", "parents": [ "3fea8b0a9f978cce6d0685464d4e8acb9bbd1acc" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon Jan 13 19:37:54 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 20 10:45:32 2014 -0800" }, "message": "dm sysfs: fix a module unload race\n\ncommit 2995fa78e423d7193f3b57835f6c1c75006a0315 upstream.\n\nThis reverts commit be35f48610 (\"dm: wait until embedded kobject is\nreleased before destroying a device\") and provides an improved fix.\n\nThe kobject release code that calls the completion must be placed in a\nnon-module file, otherwise there is a module unload race (if the process\ncalling dm_kobject_release is preempted and the DM module unloaded after\nthe completion is triggered, but before dm_kobject_release returns).\n\nTo fix this race, this patch moves the completion code to dm-builtin.c\nwhich is always compiled directly into the kernel if BLK_DEV_DM is\nselected.\n\nThe patch introduces a new dm_kobject_holder structure, its purpose is\nto keep the completion and kobject in one place, so that it can be\naccessed from non-module code without the need to export the layout of\nstruct mapped_device to that code.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "11690e1491de3c35b09bff55336c14aacbdf1627", "tree": "55d4879bb25d9455b1140b5c90d82caa3096e989", "parents": [ "39bbeb69ace5742f3cbad2ae77c27bc2fa3c2c0f" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Tue Jan 07 15:47:59 2014 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 13 11:51:14 2014 -0800" }, "message": "dm space map common: make sure new space is used during extend\n\ncommit 12c91a5c2d2a8e8cc40a9552313e1e7b0a2d9ee3 upstream.\n\nWhen extending a low level space map we should update nr_blocks at\nthe start so the new space is used for the index entries.\n\nOtherwise extend can fail, e.g.: sm_metadata_extend call sequence\nthat fails:\n -\u003e sm_ll_extend\n -\u003e dm_tm_new_block -\u003e dm_sm_new_block -\u003e sm_bootstrap_new_block\n \u003d\u003e returns -ENOSPC because smm-\u003ebegin \u003d\u003d smm-\u003ell.nr_blocks\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "39bbeb69ace5742f3cbad2ae77c27bc2fa3c2c0f", "tree": "229e81113da919b062f39ef5f9de6668fd697f9a", "parents": [ "b0c0d5a3ee2a62e5cbeef3e2089bbd624e6869fa" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Mon Jan 06 23:01:22 2014 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 13 11:51:14 2014 -0800" }, "message": "dm: wait until embedded kobject is released before destroying a device\n\ncommit be35f486108227e10fe5d96fd42fb2b344c59983 upstream.\n\nThere may be other parts of the kernel holding a reference on the dm\nkobject. We must wait until all references are dropped before\ndeallocating the mapped_device structure.\n\nThe dm_kobject_release method signals that all references are dropped\nvia completion. But dm_kobject_release doesn\u0027t free the kobject (which\nis embedded in the mapped_device structure).\n\nThis is the sequence of operations:\n* when destroying a DM device, call kobject_put from dm_sysfs_exit\n* wait until all users stop using the kobject, when it happens the\n release method is called\n* the release method signals the completion and should return without\n delay\n* the dm device removal code that waits on the completion continues\n* the dm device removal code drops the dm_mod reference the device had\n* the dm device removal code frees the mapped_device structure that\n contains the kobject\n\nUsing kobject this way should avoid the module unload race that was\nmentioned at the beginning of this thread:\nhttps://lkml.org/lkml/2014/1/4/83\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "18c8053c6b59f11bcd941850c1d13b3b502e1e74", "tree": "9b3ceec268e69b89f17b4502645d1c2e6e6ea1f5", "parents": [ "a13224074af5f2813d52d15e67fc97e4c5741501" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Jan 16 09:35:38 2014 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Feb 06 11:05:46 2014 -0800" }, "message": "md/raid5: fix long-standing problem with bitmap handling on write failure.\n\ncommit 9f97e4b128d2ea90a5f5063ea0ee3b0911f4c669 upstream.\n\nBefore a write starts we set a bit in the write-intent bitmap.\nWhen the write completes we clear that bit if the write was successful\nto all devices. However if the write wasn\u0027t fully successful we\nshould not clear the bit. If the faulty drive is subsequently\nre-added, the fact that the bit is still set ensure that we will\nre-write the data that is missing.\n\nThis logic is mediated by the STRIPE_DEGRADED flag - we only clear the\nbitmap bit when this flag is not set.\nCurrently we correctly set the flag if a write starts when some\ndevices are failed or missing. But we do *not* set the flag if some\ndevice failed during the write attempt.\nThis is wrong and can result in clearing the bit inappropriately.\n\nSo: set the flag when a write fails.\n\nThis bug has been present since bitmaps were introduces, so the fix is\nsuitable for any -stable kernel.\n\nReported-by: Ethan Wilson \u003cethan.wilson@shiftmail.org\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7e34f43dcc317f24ccc36c26f906909de9058b5c", "tree": "bfcb8ad9230528d379fa544191b92a743ba7be62", "parents": [ "511375d15b111abe2806aed91acb9a4f9d09b4cb" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue Jan 14 10:38:09 2014 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jan 29 05:10:42 2014 -0800" }, "message": "md/raid10: fix two bugs in handling of known-bad-blocks.\n\ncommit b50c259e25d9260b9108dc0c2964c26e5ecbe1c1 upstream.\n\nIf we discover a bad block when reading we split the request and\npotentially read some of it from a different device.\n\nThe code path of this has two bugs in RAID10.\n1/ we get a spin_lock with _irq, but unlock without _irq!!\n2/ The calculation of \u0027sectors_handled\u0027 is wrong, as can be clearly\n seen by comparison with raid1.c\n\nThis leads to at least 2 warnings and a probable crash is a RAID10\never had known bad blocks.\n\nFixes: 856e08e23762dfb92ffc68fd0a8d228f9e152160\nReported-by: Damian Nowak \u003cspam@nowaker.net\u003e\nURL: https://bugzilla.kernel.org/show_bug.cgi?id\u003d68181\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "511375d15b111abe2806aed91acb9a4f9d09b4cb", "tree": "6cba825e6607ad9f0aea6325b10155086157c38b", "parents": [ "ddcb318f633ddd7354561fabfe6dd3c90ebbe4d5" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Mon Jan 06 10:35:34 2014 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Jan 29 05:10:42 2014 -0800" }, "message": "md/raid10: fix bug when raid10 recovery fails to recover a block.\n\ncommit e8b849158508565e0cd6bc80061124afc5879160 upstream.\n\ncommit e875ecea266a543e643b19e44cf472f1412708f9\n md/raid10 record bad blocks as needed during recovery.\n\nadded code to the \"cannot recover this block\" path to record a bad\nblock rather than fail the whole recovery.\nUnfortunately this new case was placed *after* r10bio was freed rather\nthan *before*, yet it still uses r10bio.\nThis is will crash with a null dereference.\n\nSo move the freeing of r10bio down where it is safe.\n\nFixes: e875ecea266a543e643b19e44cf472f1412708f9\nReported-by: Damian Nowak \u003cspam@nowaker.net\u003e\nURL: https://bugzilla.kernel.org/show_bug.cgi?id\u003d68181\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "de0f9a5a9d7932086e623560d66655cc8507cfec", "tree": "d9e4678d68da38d7670b79c8b5e8782445c5ad7e", "parents": [ "e1a3c5a3706d580390c02c69cb14dcd679d31d91", "84dfcb758ba7cce52ef475ac96861a558e1a20ca" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Dec 21 14:22:41 2013 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sat Dec 21 14:22:41 2013 -0800" }, "message": "Merge tag \u0027v3.4.75\u0027 into cm-11.0\n\nThis is the 3.4.75 stable release\n\nConflicts:\n\tdrivers/md/dm-crypt.c\n\tdrivers/mmc/card/block.c\n\tdrivers/net/ethernet/smsc/smc91x.h\n\nChange-Id: I39f38ef5530c5fef07583beb9d76b983e71b9ff3\n" }, { "commit": "d84ae92281ac08a47fcfd14e43a092407be45b60", "tree": "237638227b35347b96ae033eeca6cf81a2194e57", "parents": [ "b0d16fe070836cc8090524fe16aa5ae2dfab72fc" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Nov 22 19:52:06 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Dec 20 07:34:20 2013 -0800" }, "message": "dm table: fail dm_table_create on dm_round_up overflow\n\ncommit 5b2d06576c5410c10d95adfd5c4d8b24de861d87 upstream.\n\nThe dm_round_up function may overflow to zero. In this case,\ndm_table_create() must fail rather than go on to allocate an empty array\nwith alloc_targets().\n\nThis fixes a possible memory corruption that could be caused by passing\ntoo large a number in \"param-\u003etarget_count\".\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b0d16fe070836cc8090524fe16aa5ae2dfab72fc", "tree": "d70a220df4ea6e909d3f21b15cedbde862ba2443", "parents": [ "aa42ac11510cd2584a04cdd5dacb3f4bf8e82af0" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Nov 15 16:12:20 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Dec 20 07:34:20 2013 -0800" }, "message": "dm delay: fix a possible deadlock due to shared workqueue\n\ncommit 718822c1c112dc99e0c72c8968ee1db9d9d910f0 upstream.\n\nThe dm-delay target uses a shared workqueue for multiple instances. This\ncan cause deadlock if two or more dm-delay targets are stacked on the top\nof each other.\n\nThis patch changes dm-delay to use a per-instance workqueue.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aa42ac11510cd2584a04cdd5dacb3f4bf8e82af0", "tree": "ddd9dff2a378320b853ae4ef81008772702d42d1", "parents": [ "57ca30028c51d6aaa380b4063f13fbf61e8e5d76" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Dec 05 17:33:29 2013 -0500" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Dec 20 07:34:20 2013 -0800" }, "message": "dm bufio: initialize read-only module parameters\n\ncommit 4cb57ab4a2e61978f3a9b7d4f53988f30d61c27f upstream.\n\nSome module parameters in dm-bufio are read-only. These parameters\ninform the user about memory consumption. They are not supposed to be\nchanged by the user.\n\nHowever, despite being read-only, these parameters can be set on\nmodprobe or insmod command line, for example:\nmodprobe dm-bufio current_allocated_bytes\u003d12345\n\nThe kernel doesn\u0027t expect that these variables can be non-zero at module\ninitialization and if the user sets them, it results in BUG.\n\nThis patch initializes the variables in the module init routine, so that\nuser-supplied values are ignored.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2a38ada0f1ab9f894eea4428731ebc811b51c3f3", "tree": "759c765808a23a3a35e4ba10d8306c847c0205b7", "parents": [ "19218e895cefdd389c96af12c93c89e7276bbaad", "44d19f5a04ae4e433548ba2f25e4d2ccfcac765e" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Dec 08 12:50:38 2013 -0800" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Sun Dec 08 12:50:38 2013 -0800" }, "message": "Merge tag \u0027v3.4.72\u0027 into tmp\n\nThis is the 3.4.72 stable release\n\nConflicts:\n\tarch/arm/Kconfig\n\tarch/arm/include/asm/mutex.h\n\tarch/arm/kernel/perf_event.c\n\tarch/arm/kernel/traps.c\n\tarch/arm/mm/dma-mapping.c\n\tdrivers/base/power/main.c\n\tdrivers/bluetooth/ath3k.c\n\tdrivers/bluetooth/btusb.c\n\tdrivers/gpu/drm/radeon/radeon_mode.h\n\tdrivers/mmc/card/block.c\n\tdrivers/mmc/host/sdhci.c\n\tdrivers/usb/core/message.c\n\tdrivers/usb/host/xhci-plat.c\n\tdrivers/usb/host/xhci.h\n\tdrivers/virtio/virtio_ring.c\n\tfs/ubifs/dir.c\n\tinclude/linux/freezer.h\n\tinclude/linux/virtio.h\n\tinclude/media/v4l2-ctrls.h\n\tinclude/net/bluetooth/hci_core.h\n\tinclude/net/bluetooth/mgmt.h\n\tkernel/cgroup.c\n\tkernel/futex.c\n\tkernel/signal.c\n\tnet/bluetooth/hci_conn.c\n\tnet/bluetooth/hci_core.c\n\tnet/bluetooth/hci_event.c\n\tnet/bluetooth/l2cap_core.c\n\tnet/bluetooth/mgmt.c\n\tnet/bluetooth/rfcomm/sock.c\n\tnet/bluetooth/smp.c\n\nChange-Id: I4fb0d5de74ca76f933d95d98e1a9c2c859402f34\n" }, { "commit": "d8b8a43e0f3c99bb29f258ef508969793f8e43bd", "tree": "275f0d0bfedf91eed51f22c7be6bed227cbf5b77", "parents": [ "9e23d8bd64e49062faf4aa4abcedd3943cf1d09d" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Mar 01 22:45:44 2013 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Dec 08 07:29:43 2013 -0800" }, "message": "dm: fix truncated status strings\n\ncommit fd7c092e711ebab55b2688d3859d95dfd0301f73 upstream.\n\nAvoid returning a truncated table or status string instead of setting\nthe DM_BUFFER_FULL_FLAG when the last target of a table fills the\nbuffer.\n\nWhen processing a table or status request, the function retrieve_status\ncalls ti-\u003etype-\u003estatus. If ti-\u003etype-\u003estatus returns non-zero,\nretrieve_status assumes that the buffer overflowed and sets\nDM_BUFFER_FULL_FLAG.\n\nHowever, targets don\u0027t return non-zero values from their status method\non overflow. Most targets returns always zero.\n\nIf a buffer overflow happens in a target that is not the last in the\ntable, it gets noticed during the next iteration of the loop in\nretrieve_status; but if a buffer overflow happens in the last target, it\ngoes unnoticed and erroneously truncated data is returned.\n\nIn the current code, the targets behave in the following way:\n* dm-crypt returns -ENOMEM if there is not enough space to store the\n key, but it returns 0 on all other overflows.\n* dm-thin returns errors from the status method if a disk error happened.\n This is incorrect because retrieve_status doesn\u0027t check the error\n code, it assumes that all non-zero values mean buffer overflow.\n* all the other targets always return 0.\n\nThis patch changes the ti-\u003etype-\u003estatus function to return void (because\nmost targets don\u0027t use the return code). Overflow is detected in\nretrieve_status: if the status method fills up the remaining space\ncompletely, it is assumed that buffer overflow happened.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f69a26d2cff8533570ca3ef3c59f2e1174b084b1", "tree": "158224fbed9c322fbb8c49f18a9d26490a323324", "parents": [ "3ae78536556792344cad475b78aecaf66e9ab3a6" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Nov 14 15:16:15 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:33 2013 -0800" }, "message": "md: fix calculation of stacking limits on level change.\n\ncommit 02e5f5c0a0f726e66e3d8506ea1691e344277969 upstream.\n\nThe various -\u003erun routines of md personalities assume that the \u0027queue\u0027\nhas been initialised by the blk_set_stacking_limits() call in\nmd_alloc().\n\nHowever when the level is changed (by level_store()) the -\u003erun routine\nfor the new level is called for an array which has already had the\nstacking limits modified. This can result in incorrect final\nsettings.\n\nSo call blk_set_stacking_limits() before -\u003erun in level_store().\n\nA specific consequence of this bug is that it causes\ndiscard_granularity to be set incorrectly when reshaping a RAID4 to a\nRAID0.\n\nThis is suitable for any -stable kernel since 3.3 in which\nblk_set_stacking_limits() was introduced.\n\nReported-and-tested-by: \"Baldysiak, Pawel\" \u003cpawel.baldysiak@intel.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "3ccb527f871a225b8eada036d24d41c59e40a2e4", "tree": "ea00568bfa02c2f7eda7a5ef17a52efeef2d9808", "parents": [ "b725146ee9fed4d4c19ae5a6b028d5e856730454" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Thu Oct 31 13:55:45 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Dec 04 10:50:31 2013 -0800" }, "message": "dm: allocate buffer for messages with small number of arguments using GFP_NOIO\n\ncommit f36afb3957353d2529cb2b00f78fdccd14fc5e9c upstream.\n\ndm-mpath and dm-thin must process messages even if some device is\nsuspended, so we allocate argv buffer with GFP_NOIO. These messages have\na small fixed number of arguments.\n\nOn the other hand, dm-switch needs to process bulk data using messages\nso excessive use of GFP_NOIO could cause trouble.\n\nThe patch also lowers the default number of arguments from 64 to 8, so\nthat there is smaller load on GFP_NOIO allocations.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "268417aeea96a1941c2cd14f0f8b5b39c374ad25", "tree": "1ecf8a31d004e68f12040642dde8a31ddd9beb50", "parents": [ "49028693152b88ae7ab2d444df7f73d2f0e3bbfd" ], "author": { "name": "Lukasz Dorau", "email": "lukasz.dorau@intel.com", "time": "Thu Oct 24 12:55:17 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Nov 13 12:01:48 2013 +0900" }, "message": "md: Fix skipping recovery for read-only arrays.\n\ncommit 61e4947c99c4494336254ec540c50186d186150b upstream.\n\nSince:\n commit 7ceb17e87bde79d285a8b988cfed9eaeebe60b86\n md: Allow devices to be re-added to a read-only array.\n\nspares are activated on a read-only array. In case of raid1 and raid10\npersonalities it causes that not-in-sync devices are marked in-sync\nwithout checking if recovery has been finished.\n\nIf a read-only array is degraded and one of its devices is not in-sync\n(because the array has been only partially recovered) recovery will be skipped.\n\nThis patch adds checking if recovery has been finished before marking a device\nin-sync for raid1 and raid10 personalities. In case of raid5 personality\nsuch condition is already present (at raid5.c:6029).\n\nBug was introduced in 3.10 and causes data corruption.\n\nSigned-off-by: Pawel Baldysiak \u003cpawel.baldysiak@intel.com\u003e\nSigned-off-by: Lukasz Dorau \u003clukasz.dorau@intel.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "df6516ade182c732e3d2691e0b60190f7abc1261", "tree": "7f309f6746c81179eda63ff6b324e6b7480c8faa", "parents": [ "6f4f3714260023be6ddfcc0bc56191acc450f0ca" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Oct 16 03:17:47 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 04 04:23:42 2013 -0800" }, "message": "dm snapshot: fix data corruption\n\ncommit e9c6a182649f4259db704ae15a91ac820e63b0ca upstream.\n\nThis patch fixes a particular type of data corruption that has been\nencountered when loading a snapshot\u0027s metadata from disk.\n\nWhen we allocate a new chunk in persistent_prepare, we increment\nps-\u003enext_free and we make sure that it doesn\u0027t point to a metadata area\nby further incrementing it if necessary.\n\nWhen we load metadata from disk on device activation, ps-\u003enext_free is\npositioned after the last used data chunk. However, if this last used\ndata chunk is followed by a metadata area, ps-\u003enext_free is positioned\nerroneously to the metadata area. A newly-allocated chunk is placed at\nthe same location as the metadata area, resulting in data or metadata\ncorruption.\n\nThis patch changes the code so that ps-\u003enext_free skips the metadata\narea when metadata are loaded in function read_exceptions.\n\nThe patch also moves a piece of code from persistent_prepare_exception\nto a separate function skip_metadata to avoid code duplication.\n\nCVE-2013-4299\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nCc: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "182410bd95348ef1ee5b1bccff8c2c75cec72b44", "tree": "5b27d9df70d66cf8d3e44f4f1c57a3090d0135d7", "parents": [ "594eaa187a86da35487f59b9f2913e0f28fc5826" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 18 19:40:42 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "dm-snapshot: fix performance degradation due to small hash size\n\ncommit 60e356f381954d79088d0455e357db48cfdd6857 upstream.\n\nLVM2, since version 2.02.96, creates origin with zero size, then loads\nthe snapshot driver and then loads the origin. Consequently, the\nsnapshot driver sees the origin size zero and sets the hash size to the\nlower bound 64. Such small hash table causes performance degradation.\n\nThis patch changes it so that the hash size is determined by the size of\nsnapshot volume, not minimum of origin and snapshot size. It doesn\u0027t\nmake sense to set the snapshot size significantly larger than the origin\nsize, so we do not need to take origin size into account when\ncalculating the hash size.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "594eaa187a86da35487f59b9f2913e0f28fc5826", "tree": "14ae81622a3403a6f9f1750000ff38f6f1f45268", "parents": [ "d6dda665ed19ba37bd2657005f56c984f0dbb724" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 18 19:14:22 2013 -0400" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sat Oct 05 07:06:54 2013 -0700" }, "message": "dm snapshot: workaround for a false positive lockdep warning\n\ncommit 5ea330a75bd86b2b2a01d7b85c516983238306fb upstream.\n\nThe kernel reports a lockdep warning if a snapshot is invalidated because\nit runs out of space.\n\nThe lockdep warning was triggered by commit 0976dfc1d0cd80a4e9dfaf87bd87\n(\"workqueue: Catch more locking problems with flush_work()\") in v3.5.\n\nThe warning is false positive. The real cause for the warning is that\nthe lockdep engine treats different instances of md-\u003elock as a single\nlock.\n\nThis patch is a workaround - we use flush_workqueue instead of flush_work.\nThis code path is not performance sensitive (it is called only on\ninitialization or invalidation), thus it doesn\u0027t matter that we flush the\nwhole workqueue.\n\nThe real fix for the problem would be to teach the lockdep engine to treat\ndifferent instances of md-\u003elock as separate locks.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAcked-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1b9203bb4c658c0242afa6fdb025c71d2fc3ad76", "tree": "1dfbea2025be2872abb7b435b630bce988b6e032", "parents": [ "efb5fbe89cdcc97ce170bf53c0764d7d00b7a4a6" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Jun 12 11:01:22 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Aug 20 08:26:28 2013 -0700" }, "message": "md/raid1,raid10: use freeze_array in place of raise_barrier in various places.\n\ncommit e2d59925221cd562e07fee38ec8839f7209ae603 upstream.\n\nVarious places in raid1 and raid10 are calling raise_barrier when they\nreally should call freeze_array.\nThe former is only intended to be called from \"make_request\".\nThe later has extra checks for \u0027nr_queued\u0027 and makes a call to\nflush_pending_writes(), so it is safe to call it from within the\nmanagement thread.\n\nUsing raise_barrier will sometimes deadlock. Using freeze_array\nshould not.\n\nAs \u0027freeze_array\u0027 currently expects one request to be pending (in\nhandle_read_error - the only previous caller), we need to pass\nit the number of pending requests (extra) to ignore.\n\nThe deadlock was made particularly noticeable by commits\n050b66152f87c7 (raid10) and 6b740b8d79252f13 (raid1) which\nappeared in 3.4, so the fix is appropriate for any -stable\nkernel since then.\n\nThis patch probably won\u0027t apply directly to some early kernels and\nwill need to be applied by hand.\n\nCc: stable@vger.kernel.org\nReported-by: Alexander Lyakas \u003calex.bolshoy@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\n[adjust context to make it can be apply on top of 3.4 ]\nSigned-off-by: Jack Wang \u003cjinpu.wang@profitbricks.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "aa2f8abe27dd7058fd7bfe52401121037a285406", "tree": "241e0890bf19f715834bb5ee6584a4cebab7ef5b", "parents": [ "0761d079bbc23ffd309c586ddd142b3cb5f11e0d" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Jul 24 15:37:42 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:26:00 2013 +0800" }, "message": "md/raid10: remove use-after-free bug.\n\ncommit 0eb25bb027a100f5a9df8991f2f628e7d851bc1e upstream.\n\nWe always need to be careful when calling generic_make_request, as it\ncan start a chain of events which might free something that we are\nusing.\n\nHere is one place I wasn\u0027t careful enough. If the wbio2 is not in\nuse, then it might get freed at the first generic_make_request call.\nSo perform all necessary tests first.\n\nThis bug was introduced in 3.3-rc3 (24afd80d99) and can cause an\noops, so fix is suitable for any -stable since then.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0761d079bbc23ffd309c586ddd142b3cb5f11e0d", "tree": "e9f3a8a2710d8258a6aadb3eff22cfab7a12b83e", "parents": [ "257e1c5c8162d71b1006a4d46aaad6d6d7431011" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Mon Jul 22 12:57:21 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:26:00 2013 +0800" }, "message": "md/raid5: fix interaction of \u0027replace\u0027 and \u0027recovery\u0027.\n\ncommit f94c0b6658c7edea8bc19d13be321e3860a3fa54 upstream.\n\nIf a device in a RAID4/5/6 is being replaced while another is being\nrecovered, then the writes to the replacement device currently don\u0027t\nhappen, resulting in corruption when the replacement completes and the\nnew drive takes over.\n\nThis is because the replacement writes are only triggered when\n\u0027s.replacing\u0027 is set and not when the similar \u0027s.sync\u0027 is set (which\nis the case during resync and recovery - it means all devices need to\nbe read).\n\nSo schedule those writes when s.replacing is set as well.\n\nIn this case we cannot use \"STRIPE_INSYNC\" to record that the\nreplacement has happened as that is needed for recording that any\nparity calculation is complete. So introduce STRIPE_REPLACED to\nrecord if the replacement has happened.\n\nFor safety we should also check that STRIPE_COMPUTE_RUN is not set.\nThis has a similar effect to the \"s.locked \u003d\u003d 0\" test. The latter\nensure that now IO has been flagged but not started. The former\nchecks if any parity calculation has been flagged by not started.\nWe must wait for both of these to complete before triggering the\n\u0027replace\u0027.\n\nAdd a similar test to the subsequent check for \"are we finished yet\".\nThis possibly isn\u0027t needed (is subsumed in the STRIPE_INSYNC test),\nbut it makes it more obvious that the REPLACE will happen before we\nthink we are finished.\n\nFinally if a NeedReplace device is not UPTODATE then that is an\nerror. We really must trigger a warning.\n\nThis bug was introduced in commit 9a3e1101b827a59ac9036a672f5fa8d5279d0fe2\n(md/raid5: detect and handle replacements during recovery.)\nwhich introduced replacement for raid5.\nThat was in 3.3-rc3, so any stable kernel since then would benefit\nfrom this fix.\n\nReported-by: qindehua \u003c13691222965@163.com\u003e\nTested-by: qindehua \u003cqindehua@163.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0990072e0fd7d50e08b9ea77e77ff936ae41705c", "tree": "ff9894dc96eb387166ca4526f636d4b193d0c97f", "parents": [ "5201cbf11ac566b2eee6eebf334f71ecec3e1724" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Jul 10 23:41:16 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Aug 04 16:25:55 2013 +0800" }, "message": "dm verity: fix inability to use a few specific devices sizes\n\ncommit b1bf2de07271932326af847a3c6a01fdfd29d4be upstream.\n\nFix a boundary condition that caused failure for certain device sizes.\n\nThe problem is reported at\n http://code.google.com/p/cryptsetup/issues/detail?id\u003d160\n\nFor certain device sizes the number of hashes at a specific level was\ncalculated incorrectly.\n\nIt happens for example for a device with data and metadata block size 4096\nthat has 16385 blocks and algorithm sha256.\n\nThe user can test if he is affected by this bug by running the\n\"veritysetup verify\" command and also by activating the dm-verity kernel\ndriver and reading the whole block device. If it passes without an error,\nthen the user is not affected.\n\nThe condition for the bug is:\n\nSplit the total number of data blocks (data_block_bits) into bit strings,\neach string has hash_per_block_bits bits. hash_per_block_bits is\nrounddown(log2(metadata_block_size/hash_digest_size)). Equivalently, you\ncan say that you convert data_blocks_bits to 2^hash_per_block_bits base.\n\nIf there some zero bit string below the most significant bit string and at\nleast one bit below this zero bit string is set, then the bug happens.\n\nThe same bug exists in the userspace veritysetup tool, so you must use\nfixed veritysetup too if you want to use devices that are affected by\nthis boundary condition.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nCc: Milan Broz \u003cgmazyland@gmail.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "0938e135aa8513f9bc379a408d3c6c1fd24eb46a", "tree": "466eb744cd9b8eb52134453d8871b7212ff2b6c0", "parents": [ "c09c35b2ae5ea7f62b0fd5369935b8e6af25e9cd" ], "author": { "name": "Alex Lyakas", "email": "alex@zadarastorage.com", "time": "Tue Jun 04 20:42:21 2013 +0300" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jun 20 11:58:46 2013 -0700" }, "message": "md/raid1: consider WRITE as successful only if at least one non-Faulty and non-rebuilding drive completed it.\n\ncommit 3056e3aec8d8ba61a0710fb78b2d562600aa2ea7 upstream.\n\nWithout that fix, the following scenario could happen:\n\n- RAID1 with drives A and B; drive B was freshly-added and is rebuilding\n- Drive A fails\n- WRITE request arrives to the array. It is failed by drive A, so\nr1_bio is marked as R1BIO_WriteError, but the rebuilding drive B\nsucceeds in writing it, so the same r1_bio is marked as\nR1BIO_Uptodate.\n- r1_bio arrives to handle_write_finished, badblocks are disabled,\nmd_error()-\u003eerror() does nothing because we don\u0027t fail the last drive\nof raid1\n- raid_end_bio_io() calls call_bio_endio()\n- As a result, in call_bio_endio():\n if (!test_bit(R1BIO_Uptodate, \u0026r1_bio-\u003estate))\n clear_bit(BIO_UPTODATE, \u0026bio-\u003ebi_flags);\nthis code doesn\u0027t clear the BIO_UPTODATE flag, and the whole master\nWRITE succeeds, back to the upper layer.\n\nSo we returned success to the upper layer, even though we had written\nthe data onto the rebuilding drive only. But when we want to read the\ndata back, we would not read from the rebuilding drive, so this data\nis lost.\n\n[neilb - applied identical change to raid10 as well]\n\nThis bug can result in lost data, so it is suitable for any\n-stable kernel.\n\nSigned-off-by: Alex Lyakas \u003calex@zadarastorage.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "dde448d95d8698ee4c8373bb48fe08a22f41052f", "tree": "7fe87fa93bfa5b81e6f87b147e32512d2e8198e3", "parents": [ "ac4f6190fae02a3dc30133f90488b996f726bf7a", "f95b978981a7d154ba40d14c18e8ed5c694e6124" ], "author": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Thu Jun 20 11:32:42 2013 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Thu Jun 20 11:32:42 2013 -0700" }, "message": "Merge tag \u0027v3.4.10\u0027 into cm-10.1\n\nThis is the 3.4.10 stable release\n\nConflicts:\n\tarch/arm/mm/tlb-v7.S\n\tarch/arm/vfp/entry.S\n\tdrivers/base/power/main.c\n\tdrivers/mmc/host/sdhci.c\n\tdrivers/net/tun.c\n\tdrivers/usb/core/hub.c\n\tdrivers/usb/host/xhci.h\n\tinclude/linux/sched.h\n\tkernel/power/suspend.c\n\nChange-Id: Ia2477ec93ceb64b13dd1a2d8aa646cb233387d14\n" }, { "commit": "22f9c13508be586b3cf6a531dc980b169c1320fe", "tree": "a22bb6558f6dc403425d4b85739c181b712a56cd", "parents": [ "a98124aac0b5adc5de8ae54f11322781cb4d85c3" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Wed Sep 26 23:45:39 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:48 2013 -0700" }, "message": "dm thin: do not set discard_zeroes_data\n\ncommit 307615a26e95406c42c95916a66ba50434567e0f upstream.\n\nThe dm thin pool target claims to support the zeroing of discarded\ndata areas. This turns out to be incorrect when processing discards\nthat do not exactly cover a complete number of blocks, so the target\nmust always set discard_zeroes_data_unsupported.\n\nThe thin pool target will zero blocks when they are allocated if the\nskip_block_zeroing feature is not specified. The block layer\nmay send a discard that only partly covers a block. If a thin pool\nblock is partially discarded then there is no guarantee that the\ndiscarded data will get zeroed before it is accessed again.\nDue to this, thin devices cannot claim discards will always zero data.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nCc: Libo Chen \u003clibo.chen@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c89f6c7515b1713eebf62f67a48f9d6dcf5c3d94", "tree": "dd332c6f02e5a80b0833ef6f6dfd1dfb45490864", "parents": [ "a85550214614cd7e66d995592dbd54b14db50c01" ], "author": { "name": "Wei Yongjun", "email": "yongjun_wei@trendmicro.com.cn", "time": "Fri May 10 14:37:15 2013 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun May 19 10:54:37 2013 -0700" }, "message": "dm snapshot: fix error return code in snapshot_ctr\n\ncommit 09e8b813897a0f85bb401435d009228644c81214 upstream.\n\nReturn -ENOMEM instead of success if unable to allocate pending\nexception mempool in snapshot_ctr.\n\nSigned-off-by: Wei Yongjun \u003cyongjun_wei@trendmicro.com.cn\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6cd670f0ff34d314b88b8b7cc1c1b45617f08a78", "tree": "6a2167528d40e2faed471195230bf8fc1ffc070d", "parents": [ "02d1a16d6d89faa6f78625ea17be9f0b995e44ab" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Apr 24 11:42:44 2013 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue May 07 19:51:56 2013 -0700" }, "message": "md: bad block list should default to disabled.\n\ncommit 486adf72ccc0c235754923d47a2270c5dcb0c98b upstream.\n\nMaintenance of a bad-block-list currently defaults to \u0027enabled\u0027\nand is then disabled when it cannot be supported.\nThis is backwards and causes problem for dm-raid which didn\u0027t know\nto disable it.\n\nSo fix the defaults, and only enabled for v1.x metadata which\nexplicitly has bad blocks enabled.\n\nThe problem with dm-raid has been present since badblock support was\nadded in v3.1, so this patch is suitable for any -stable from 3.1\nonwards.\n\nReported-by: Jonathan Brassow \u003cjbrassow@redhat.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fbad8075baa695da5da4952969682172966a4fac", "tree": "4de9c4b8a6363687a93b79d9a3ee342b3d75b831", "parents": [ "c443082d1998879713ecf9f97ee4ba8c76f8b7f0" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Feb 21 15:36:38 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 14 11:29:49 2013 -0700" }, "message": "md: raid0: fix error return from create_stripe_zones.\n\ncommit 58ebb34c49fcfcaa029e4b1c1453d92583900f9a upstream.\n\nCreate_stripe_zones returns an error slightly differently to\nraid0_run and to raid0_takeover_*.\n\nThe error returned used by the second was wrong and an error would\nresult in mddev-\u003eprivate being set to NULL and sooner or later a\ncrash.\n\nSo never return NULL, return ERR_PTR(err), not NULL from\ncreate_stripe_zones.\n\nThis bug has been present since 2.6.35 so the fix is suitable\nfor any kernel since then.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c443082d1998879713ecf9f97ee4ba8c76f8b7f0", "tree": "37f83d7390c5b3abc206ee45a5d327cb9b5ce5bb", "parents": [ "517557f2323d11a1a355e9c9155a1e315d87d487" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Feb 21 14:33:17 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 14 11:29:49 2013 -0700" }, "message": "md: fix two bugs when attempting to resize RAID0 array.\n\ncommit a64685399181780998281fe07309a94b25dd24c3 upstream.\n\nYou cannot resize a RAID0 array (in terms of making the devices\nbigger), but the code doesn\u0027t entirely stop you.\nSo:\n\n disable setting of the available size on each device for\n RAID0 and Linear devices. This must not change as doing so\n can change the effective layout of data.\n\n Make sure that the size that raid0_size() reports is accurate,\n but rounding devices sizes to chunk sizes. As the device sizes\n cannot change now, this isn\u0027t so important, but it is best to be\n safe.\n\nWithout this change:\n mdadm --grow /dev/md0 -z max\n mdadm --grow /dev/md0 -Z max\n then read to the end of the array\n\ncan cause a BUG in a RAID0 array.\n\nThese bugs have been present ever since it became possible\nto resize any device, which is a long time. So the fix is\nsuitable for any -stable kerenl.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "517557f2323d11a1a355e9c9155a1e315d87d487", "tree": "8809012bed39c1ba189e248a8f9aba3185c45c91", "parents": [ "f9c89dac69cb99c00d4c273cad43f466fb9a1c8b" ], "author": { "name": "Sebastian Riemer", "email": "sebastian.riemer@profitbricks.com", "time": "Thu Feb 21 13:28:09 2013 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 14 11:29:48 2013 -0700" }, "message": "md: protect against crash upon fsync on ro array\n\ncommit bbfa57c0f2243a7c31fd248d22e9861a2802cad5 upstream.\n\nIf an fsync occurs on a read-only array, we need to send a\ncompletion for the IO and may not increment the active IO count.\nOtherwise, we hit a bug trace and can\u0027t stop the MD array anymore.\n\nBy advice of Christoph Hellwig we return success upon a flush\nrequest but we return -EROFS for other writes.\nWe detect flush requests by checking if the bio has zero sectors.\n\nThis patch is suitable to any -stable kernel to which it applies.\n\nSigned-off-by: Sebastian Riemer \u003csebastian.riemer@profitbricks.com\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: Ben Hutchings \u003cben@decadent.org.uk\u003e\nCc: NeilBrown \u003cneilb@suse.de\u003e\nReported-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nAcked-by: Paul Menzel \u003cpaulepanter@users.sourceforge.net\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "61652b1acea31009aff707b975a171567095df81", "tree": "b6a8b9c804aaa0ba3d8065ed3984b7e86b11500a", "parents": [ "38d67580f65e46ec13c65c8ebb0666134f167658" ], "author": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Fri Dec 21 20:23:30 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:50:51 2013 -0800" }, "message": "dm ioctl: prevent unsafe change to dm_ioctl data_size\n\ncommit e910d7ebecd1aac43125944a8641b6cb1a0dfabe upstream.\n\nAbort dm ioctl processing if userspace changes the data_size parameter\nafter we validated it but before we finished copying the data buffer\nfrom userspace.\n\nThe dm ioctl parameters are processed in the following sequence:\n 1. ctl_ioctl() calls copy_params();\n 2. copy_params() makes a first copy of the fixed-sized portion of the\n userspace parameters into the local variable \"tmp\";\n 3. copy_params() then validates tmp.data_size and allocates a new\n structure big enough to hold the complete data and copies the whole\n userspace buffer there;\n 4. ctl_ioctl() reads userspace data the second time and copies the whole\n buffer into the pointer \"param\";\n 5. ctl_ioctl() reads param-\u003edata_size without any validation and stores it\n in the variable \"input_param_size\";\n 6. \"input_param_size\" is further used as the authoritative size of the\n kernel buffer.\n\nThe problem is that userspace code could change the contents of user\nmemory between steps 2 and 4. In particular, the data_size parameter\ncan be changed to an invalid value after the kernel has validated it.\nThis lets userspace force the kernel to access invalid kernel memory.\n\nThe fix is to ensure that the size has not changed at step 4.\n\nThis patch shouldn\u0027t have a security impact because CAP_SYS_ADMIN is\nrequired to run this code, but it should be fixed anyway.\n\nReported-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "38d67580f65e46ec13c65c8ebb0666134f167658", "tree": "f78da509e7265f57aa3fc2fded4da299bbe4c61c", "parents": [ "4d7981bfc21f7b6ef48f9a819d2c9969ad6eea71" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Dec 21 20:23:30 2012 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jan 17 08:50:51 2013 -0800" }, "message": "dm persistent data: rename node to btree_node\n\ncommit 550929faf89e2e2cdb3e9945ea87d383989274cf upstream.\n\nThis patch fixes a compilation failure on sparc32 by renaming struct node.\n\nstruct node is already defined in include/linux/node.h. On sparc32, it\nhappens to be included through other dependencies and persistent-data\ndoesn\u0027t compile because of conflicting declarations.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f3921710aa40ae72bd2580282548f763b008a1d0", "tree": "f622dc7bf80f31334bb9849876fe45a03d92a879", "parents": [ "dbdd7f0c98e8ee0d49da5e8b462ad2ba07d0f358" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Nov 22 14:42:49 2012 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 10 10:59:40 2012 -0800" }, "message": "md/raid10: close race that lose writes lost when replacement completes.\n\ncommit e7c0c3fa29280d62aa5e11101a674bb3064bd791 upstream.\n\nWhen a replacement operation completes there is a small window\nwhen the original device is marked \u0027faulty\u0027 and the replacement\nstill looks like a replacement. The faulty should be removed and\nthe replacement moved in place very quickly, bit it isn\u0027t instant.\n\nSo the code write out to the array must handle the possibility that\nthe only working device for some slot in the replacement - but it\ndoesn\u0027t. If the primary device is faulty it just gives up. This\ncan lead to corruption.\n\nSo make the code more robust: if either the primary or the\nreplacement is present and working, write to them. Only when\nneither are present do we give up.\n\nThis bug has been present since replacement was introduced in\n3.3, so it is suitable for any -stable kernel since then.\n\nReported-by: \"George Spelvin\" \u003clinux@horizon.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f42513b9fd98a0f3afa8fe9bc23700b4226e1f6f", "tree": "5176c37db1f8520cab12fe122cb46c3045d20d47", "parents": [ "ecf049ce86e1d93bc9a3376facf31d7244338089" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Tue Nov 06 12:24:26 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:07 2012 -0800" }, "message": "dm: fix deadlock with request based dm and queue request_fn recursion\n\ncommit a8c32a5c98943d370ea606a2e7dc04717eb92206 upstream.\n\nRequest based dm attempts to re-run the request queue off the\nrequest completion path. If used with a driver that potentially does\nend_io from its request_fn, we could deadlock trying to recurse\nback into request dispatch. Fix this by punting the request queue\nrun to kblockd.\n\nTested to fix a quickly reproducible deadlock in such a scenario.\n\nAcked-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "ecf049ce86e1d93bc9a3376facf31d7244338089", "tree": "1143b5ca06537fb8e35a8e2584d7059247df904d", "parents": [ "8c98fbaa55508732bb5a9f46b3c6cf60daa8e526" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Nov 22 15:12:09 2012 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:07 2012 -0800" }, "message": "md/raid10: decrement correct pending counter when writing to replacement.\n\ncommit 884162df2aadd7414bef4935e1a54976fd4e3988 upstream.\n\nWhen a write to a replacement device completes, we carefully\nand correctly found the rdev that the write actually went to\nand the blithely called rdev_dec_pending on the primary rdev,\neven if this write was to the replacement.\n\nThis means that any writes to an array while a replacement\nwas ongoing would cause the nr_pending count for the primary\ndevice to go negative, so it could never be removed.\n\nThis bug has been present since replacement was introduced in\n3.3, so it is suitable for any -stable kernel since then.\n\nReported-by: \"George Spelvin\" \u003clinux@horizon.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8c98fbaa55508732bb5a9f46b3c6cf60daa8e526", "tree": "7ff077f3f6fbb1db0766c721bf867f069aa8e558", "parents": [ "45bc5c6913e04f1346bfe3401d2f52ad2164b3b2" ], "author": { "name": "majianpeng", "email": "majianpeng@gmail.com", "time": "Thu Nov 08 08:56:27 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:06 2012 -0800" }, "message": "md: Avoid write invalid address if read_seqretry returned true.\n\ncommit 35f9ac2dcec8f79d7059ce174fd7b7ee3290d620 upstream.\n\nIf read_seqretry returned true and bbp was changed, it will write\ninvalid address which can cause some serious problem.\n\nThis bug was introduced by commit v3.0-rc7-130-g2699b67.\nSo fix is suitable for 3.0.y thru 3.6.y.\n\nReported-by: zhuwenfeng@kedacom.com\nTested-by: zhuwenfeng@kedacom.com\nSigned-off-by: Jianpeng Ma \u003cmajianpeng@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "45bc5c6913e04f1346bfe3401d2f52ad2164b3b2", "tree": "27bfd93fe81f8b1d514b7d075d3c4aecde23c1ce", "parents": [ "262a70e8fbf870359ced2059becf116a249bb2d5" ], "author": { "name": "majianpeng", "email": "majianpeng@gmail.com", "time": "Tue Nov 06 17:13:44 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Dec 03 11:47:06 2012 -0800" }, "message": "md: Reassigned the parameters if read_seqretry returned true in func md_is_badblock.\n\ncommit ab05613a0646dcc11049692d54bae76ca9ffa910 upstream.\n\nThis bug was introduced by commit(v3.0-rc7-126-g2230dfe).\nSo fix is suitable for 3.0.y thru 3.6.y.\n\nSigned-off-by: Jianpeng Ma \u003cmajianpeng@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "32f25ea28ad28fbb4080d0b7a279279c7e21b1d0", "tree": "fc11456cdcda18f81d4534b26dd2e0549f41c70e", "parents": [ "e7355f1112773a015e914b4f815460b7bbe88954" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Oct 31 11:42:03 2012 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Nov 05 09:50:41 2012 +0100" }, "message": "md/raid1: Fix assembling of arrays containing Replacements.\n\ncommit 02b898f2f04e418094f0093a3ad0b415bcdbe8eb upstream.\n\nsetup_conf in raid1.c uses conf-\u003eraid_disks before assigning\na value. It is used when including \u0027Replacement\u0027 devices.\n\nThe consequence is that assembling an array which contains a\nreplacement will misbehave and either not include the replacement, or\nnot include the device being replaced.\n\nThough this doesn\u0027t lead directly to data corruption, it could lead to\nreduced data safety.\n\nSo use mddev-\u003eraid_disks, which is initialised, instead.\n\nBug was introduced by commit c19d57980b38a5bb613a898937a1cf85f422fb9b\n md/raid1: recognise replacements when assembling arrays.\n\nin 3.3, so fix is suitable for 3.3.y thru 3.6.y.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "9b38cc4a70f2c83857fd37707570a18c1027effe", "tree": "a9841de8c174c5c0e37522ceba2ce9ad59170396", "parents": [ "a0fee8de3ae5784d4308b7bd18c303a4144ece18" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Thu Oct 11 14:20:58 2012 +1100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 21 09:27:59 2012 -0700" }, "message": "md/raid10: use correct limit variable\n\ncommit 91502f099dfc5a1e8812898e26ee280713e1d002 upstream.\n\nClang complains that we are assigning a variable to itself. This should\nbe using bad_sectors like the similar earlier check does.\n\nBug has been present since 3.1-rc1. It is minor but could\nconceivably cause corruption or other bad behaviour.\n\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "c0b50b292c41e0a1c6a1ef6df665fe7fb8eac2e1", "tree": "00bdc183dd5bd765f27d24bb99aee7ec024c48b1", "parents": [ "7d77f4776e3fc8770f90244f1f5d1c9181b834c7" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 26 23:45:48 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:32:22 2012 -0700" }, "message": "dm verity: fix overflow check\n\ncommit 1d55f6bcc0331d744cd5b56c4ee79e3809438161 upstream.\n\nThis patch fixes sector_t overflow checking in dm-verity.\n\nWithout this patch, the code checks for overflow only if sector_t is\nsmaller than long long, not if sector_t and long long have the same size.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7d77f4776e3fc8770f90244f1f5d1c9181b834c7", "tree": "531d3b3a3fb26aa78608fa92817b0ef0ccaae162", "parents": [ "f9954ca80cc595852db6e913e65808819b9dc413" ], "author": { "name": "Milan Broz", "email": "mbroz@redhat.com", "time": "Wed Sep 26 23:45:43 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:32:22 2012 -0700" }, "message": "dm table: clear add_random unless all devices have it set\n\ncommit c3c4555edd10dbc0b388a0125b9c50de5e79af05 upstream.\n\nAlways clear QUEUE_FLAG_ADD_RANDOM if any underlying device does not\nhave it set. Otherwise devices with predictable characteristics may\ncontribute entropy.\n\nQUEUE_FLAG_ADD_RANDOM specifies whether or not queue IO timings\ncontribute to the random pool.\n\nFor bio-based targets this flag is always 0 because such devices have no\nreal queue.\n\nFor request-based devices this flag was always set to 1 by default.\n\nNow set it according to the flags on underlying devices. If there is at\nleast one device which should not contribute, set the flag to zero: If a\ndevice, such as fast SSD storage, is not suitable for supplying entropy,\na request-based queue stacked over it will not be either.\n\nBecause the checking logic is exactly same as for the rotational flag,\nshare the iteration function with device_is_nonrot().\n\nSigned-off-by: Milan Broz \u003cmbroz@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f9954ca80cc595852db6e913e65808819b9dc413", "tree": "44d16ae268264563895327b5d100f837d5e8dc41", "parents": [ "9316bed3701438b79644e80cc4dd4903a40c756b" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Wed Sep 26 23:45:42 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Oct 07 08:32:22 2012 -0700" }, "message": "dm: handle requests beyond end of device instead of using BUG_ON\n\ncommit ba1cbad93dd47223b1f3b8edd50dd9ef2abcb2ed upstream.\n\nThe access beyond the end of device BUG_ON that was introduced to\ndm_request_fn via commit 29e4013de7ad950280e4b2208 (\"dm: implement\nREQ_FLUSH/FUA support for request-based dm\") was an overly\ndrastic (but simple) response to this situation.\n\nI have received a report that this BUG_ON was hit and now think\nit would be better to use dm_kill_unmapped_request() to fail the clone\nand original request with -EIO.\n\nmap_request() will assign the valid target returned by\ndm_table_find_target to tio-\u003eti. But when the target\nisn\u0027t valid tio-\u003eti is never assigned (because map_request isn\u0027t\ncalled); so add a check for tio-\u003eti !\u003d NULL to dm_done().\n\nReported-by: Mike Christie \u003cmichaelc@cs.wisc.edu\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Jun\u0027ichi Nomura \u003cj-nomura@ce.jp.nec.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "956b165f9e89e37aff44d615321d1e3166589701", "tree": "eefe7da63af690ee5b1be1f6c799338f6336f94b", "parents": [ "1f7edfcc0a87e5daf273981135e376ed61d284e4" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Sat Aug 18 09:51:42 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:30:33 2012 -0700" }, "message": "md/raid10: fix problem with on-stack allocation of r10bio structure.\n\ncommit e0ee778528bbaad28a5c69d2e219269a3a096607 upstream.\n\nA \u0027struct r10bio\u0027 has an array of per-copy information at the end.\nThis array is declared with size [0] and r10bio_pool_alloc allocates\nenough extra space to store the per-copy information depending on the\nnumber of copies needed.\n\nSo declaring a \u0027struct r10bio on the stack isn\u0027t going to work. It\nwon\u0027t allocate enough space, and memory corruption will ensue.\n\nSo in the two places where this is done, declare a sufficiently large\nstructure and use that instead.\n\nThe two call-sites of this bug were introduced in 3.4 and 3.5\nso this is suitable for both those kernels. The patch will have to\nbe modified for 3.4 as it only has one bug.\n\nReported-by: Ivan Vasilyev \u003civan.vasilyev@gmail.com\u003e\nTested-by: Ivan Vasilyev \u003civan.vasilyev@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n\n" }, { "commit": "9fd0132a29b4e40e5cf5ff82a02227b7f603bba7", "tree": "8116196b1b2b4ec092a71a7a6f4feb59444ca028", "parents": [ "d765682ea82fb83fd8d01b7663f78b5d2f9fd839" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Sep 19 12:52:30 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:55 2012 -0700" }, "message": "md/raid5: fix calculate of \u0027degraded\u0027 when a replacement becomes active.\n\ncommit e5c86471f933608db5d43679f84cb4346c32033e upstream.\n\nWhen a replacement device becomes active, we mark the device that it\nreplaces as \u0027faulty\u0027 so that it can subsequently get removed.\nHowever \u0027calc_degraded\u0027 only pays attention to the primary device, not\nthe replacement, so the array appears to become degraded, which is\nwrong.\n\nSo teach \u0027calc_degraded\u0027 to consider any replacement if a primary\ndevice is faulty.\n\nThis is suitable for -stable as an incorrect \u0027degraded\u0027 value can\nconfuse md and could lead to data corruption.\nThis is only relevant for 3.3 and later.\n\nReported-by: Robin Hill \u003crobin@robinhill.me.uk\u003e\nReported-by: John Drescher \u003cdrescherjm@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d765682ea82fb83fd8d01b7663f78b5d2f9fd839", "tree": "9fa4d0763768e38d8538a713202378df00f7dc51", "parents": [ "1c55a12c2a3d5b54598e7ba04e2d0fcf858b9023" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Wed Sep 19 12:54:22 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:55 2012 -0700" }, "message": "md: make sure metadata is updated when spares are activated or removed.\n\ncommit 6dafab6b1383e912cd252fa809570b484eb6e0dc upstream.\n\nIt isn\u0027t always necessary to update the metadata when spares are\nremoved as the presence-or-not of a spare isn\u0027t really important to\nthe integrity of an array.\nAlso activating a spare doesn\u0027t always require updating the metadata\nas the update on \u0027recovery-completed\u0027 is usually sufficient.\n\nHowever the introduction of \u0027replacement\u0027 devices have made these\ntransitions sometimes more important. For example the \u0027Replacement\u0027\nflag isn\u0027t cleared until the original device is removed, so we need\nto ensure a metadata update after that \u0027spare\u0027 is removed.\n\nSo set MD_CHANGE_DEVS whenever a spare is activated or removed, to\ncomplement the current situation where it is set when a spare is added\nor a device is failed (or a number of other less common situations).\n\nThis is suitable for -stable as out-of-data metadata could lead\nto data corruption.\nThis is only relevant for 3.3 and later 9when \u0027replacement\u0027 as\nintroduced.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "1c55a12c2a3d5b54598e7ba04e2d0fcf858b9023", "tree": "754c39d7c113cbfe9ffdfd83c5db9b63f842726b", "parents": [ "dd8121960467e40388876403758334fa91516db2" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Aug 16 16:46:12 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Tue Oct 02 10:29:55 2012 -0700" }, "message": "md: Don\u0027t truncate size at 4TB for RAID0 and Linear\n\ncommit 667a5313ecd7308d79629c0738b0db588b0b0a4e upstream.\n\ncommit 27a7b260f71439c40546b43588448faac01adb93\n md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.\n\nchanged 0.90 metadata handling to truncated size to 4TB as that is\nall that 0.90 can record.\nHowever for RAID0 and Linear, 0.90 doesn\u0027t need to record the size, so\nthis truncation is not needed and causes working arrays to become too small.\n\nSo avoid the truncation for RAID0 and Linear\n\nThis bug was introduced in 3.1 and is suitable for any stable kernels\nfrom then onwards.\nAs the offending commit was tagged for \u0027stable\u0027, any stable kernel\nthat it was applied to should also get this patch. That includes\nat least 2.6.32, 2.6.33 and 3.0. (Thanks to Ben Hutchings for\nproviding that list).\n\nSigned-off-by: Neil Brown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "fb060f3d95d29c385063151c8a09faa4d1a02f2f", "tree": "91806e31b0b68b68280a1ce738c41ae9679454b4", "parents": [ "cc9fdb9cdde35aafad3b11ce74e244f5da7ac3c0" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue Jul 31 10:05:34 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Wed Aug 15 08:10:08 2012 -0700" }, "message": "md/raid1: don\u0027t abort a resync on the first badblock.\n\ncommit b7219ccb33aa0df9949a60c68b5e9f712615e56f upstream.\n\nIf a resync of a RAID1 array with 2 devices finds a known bad block\none device it will neither read from, or write to, that device for\nthis block offset.\nSo there will be one read_target (The other device) and zero write\ntargets.\nThis condition causes md/raid1 to abort the resync assuming that it\nhas finished - without known bad blocks this would be true.\n\nWhen there are no write targets because of the presence of bad blocks\nwe should only skip over the area covered by the bad block.\nRAID10 already gets this right, raid1 doesn\u0027t. Or didn\u0027t.\n\nAs this can cause a \u0027sync\u0027 to abort early and appear to have succeeded\nit could lead to some data corruption, so it suitable for -stable.\n\nReported-by: Alexander Lyakas \u003calex.bolshoy@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e73b09d8f258df200adb6383c77c38c31f6f4baa", "tree": "5d67fdbc9e8636156681f69bf46d61a5ab6a1e45", "parents": [ "b4ce163953a4baab2341ba42386904a7199d11af" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Fri Jul 27 15:08:05 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:40 2012 -0700" }, "message": "dm thin: fix memory leak in process_prepared_mapping error paths\n\ncommit 905386f82d08f66726912f303f3e6605248c60a3 upstream.\n\nFix memory leak in process_prepared_mapping by always freeing\nthe dm_thin_new_mapping structs from the mapping_pool mempool on\nthe error paths.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b4ce163953a4baab2341ba42386904a7199d11af", "tree": "9ce488763642d813f454f09fb819f15bee700a90", "parents": [ "27cd8f51344dcf4799c7a092c1797402b833126a" ], "author": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Fri Jul 27 15:07:57 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Aug 09 08:31:40 2012 -0700" }, "message": "dm thin: reduce endio_hook pool size\n\ncommit 7768ed33ccdc02801c4483fc5682dc66ace14aea upstream.\n\nReduce the slab size used for the dm_thin_endio_hook mempool.\n\nAllocation has been seen to fail on machines with smaller amounts\nof memory due to fragmentation.\n\n lvm: page allocation failure. order:5, mode:0xd0\n device-mapper: table: 253:38: thin-pool: Error creating pool\u0027s endio_hook mempool\n\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5a4db9ee4f44658077a11c71d78a17573016fc0e", "tree": "d871a7d3fda912e1d892857c329c997af28ece5f", "parents": [ "91aafba4414743c24c6d06ccca75113e4abd13a8" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 20 14:25:07 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 29 08:04:21 2012 -0700" }, "message": "dm raid1: set discard_zeroes_data_unsupported\n\ncommit 7c8d3a42fe1c58a7e8fd3f6a013e7d7b474ff931 upstream.\n\nWe can\u0027t guarantee that REQ_DISCARD on dm-mirror zeroes the data even if\nthe underlying disks support zero on discard. So this patch sets\nti-\u003ediscard_zeroes_data_unsupported.\n\nFor example, if the mirror is in the process of resynchronizing, it may\nhappen that kcopyd reads a piece of data, then discard is sent on the\nsame area and then kcopyd writes the piece of data to another leg.\nConsequently, the data is not zeroed.\n\nThe flag was made available by commit 983c7db347db8ce2d8453fd1d89b7a4bb6920d56\n(dm crypt: always disable discard_zeroes_data).\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "91aafba4414743c24c6d06ccca75113e4abd13a8", "tree": "3417d1b51ff8d4a218ccf24485b7237d829073ac", "parents": [ "5b8bbc39d5678179f2fd4ee2e09005d8f277834c" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 20 14:25:03 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 29 08:04:21 2012 -0700" }, "message": "dm raid1: fix crash with mirror recovery and discard\n\ncommit 751f188dd5ab95b3f2b5f2f467c38aae5a2877eb upstream.\n\nThis patch fixes a crash when a discard request is sent during mirror\nrecovery.\n\nFirstly, some background. Generally, the following sequence happens during\nmirror synchronization:\n- function do_recovery is called\n- do_recovery calls dm_rh_recovery_prepare\n- dm_rh_recovery_prepare uses a semaphore to limit the number\n simultaneously recovered regions (by default the semaphore value is 1,\n so only one region at a time is recovered)\n- dm_rh_recovery_prepare calls __rh_recovery_prepare,\n __rh_recovery_prepare asks the log driver for the next region to\n recover. Then, it sets the region state to DM_RH_RECOVERING. If there\n are no pending I/Os on this region, the region is added to\n quiesced_regions list. If there are pending I/Os, the region is not\n added to any list. It is added to the quiesced_regions list later (by\n dm_rh_dec function) when all I/Os finish.\n- when the region is on quiesced_regions list, there are no I/Os in\n flight on this region. The region is popped from the list in\n dm_rh_recovery_start function. Then, a kcopyd job is started in the\n recover function.\n- when the kcopyd job finishes, recovery_complete is called. It calls\n dm_rh_recovery_end. dm_rh_recovery_end adds the region to\n recovered_regions or failed_recovered_regions list (depending on\n whether the copy operation was successful or not).\n\nThe above mechanism assumes that if the region is in DM_RH_RECOVERING\nstate, no new I/Os are started on this region. When I/O is started,\ndm_rh_inc_pending is called, which increases reg-\u003epending count. When\nI/O is finished, dm_rh_dec is called. It decreases reg-\u003epending count.\nIf the count is zero and the region was in DM_RH_RECOVERING state,\ndm_rh_dec adds it to the quiesced_regions list.\n\nConsequently, if we call dm_rh_inc_pending/dm_rh_dec while the region is\nin DM_RH_RECOVERING state, it could be added to quiesced_regions list\nmultiple times or it could be added to this list when kcopyd is copying\ndata (it is assumed that the region is not on any list while kcopyd does\nits jobs). This results in memory corruption and crash.\n\nThere already exist bypasses for REQ_FLUSH requests: REQ_FLUSH requests\ndo not belong to any region, so they are always added to the sync list\nin do_writes. dm_rh_inc_pending does not increase count for REQ_FLUSH\nrequests. In mirror_end_io, dm_rh_dec is never called for REQ_FLUSH\nrequests. These bypasses avoid the crash possibility described above.\n\nThese bypasses were improperly implemented for REQ_DISCARD when\nthe mirror target gained discard support in commit\n5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4 (dm raid1: support discard).\n\nIn do_writes, REQ_DISCARD requests is always added to the sync queue and\nimmediately dispatched (even if the region is in DM_RH_RECOVERING). However,\ndm_rh_inc and dm_rh_dec is called for REQ_DISCARD resusts. So it violates the\nrule that no I/Os are started on DM_RH_RECOVERING regions, and causes the list\ncorruption described above.\n\nThis patch changes it so that REQ_DISCARD requests follow the same path\nas REQ_FLUSH. This avoids the crash.\n\nReference: https://bugzilla.redhat.com/837607\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "5b8bbc39d5678179f2fd4ee2e09005d8f277834c", "tree": "184a8536462352210ce124ba0d8886b196ef2b41", "parents": [ "08603bdd6b0b65248921c8be05febe574dd78905" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 20 14:25:05 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 29 08:04:20 2012 -0700" }, "message": "dm thin: do not send discards to shared blocks\n\ncommit 650d2a06b4fe1cc1d218c20e256650f68bf0ca31 upstream.\n\nWhen process_discard receives a partial discard that doesn\u0027t cover a\nfull block, it sends this discard down to that block. Unfortunately, the\nblock can be shared and the discard would corrupt the other snapshots\nsharing this block.\n\nThis patch detects block sharing and ends the discard with success when\nsending it to the shared block.\n\nThe above change means that if the device supports discard it can\u0027t be\nguaranteed that a discard request zeroes data. Therefore, we set\nti-\u003ediscard_zeroes_data_unsupported.\n\nThin target discard support with this bug arrived in commit\n104655fd4dcebd50068ef30253a001da72e3a081 (dm thin: support discards).\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d8ae4bb4a1c12f9cfb373f215e624a9f1fca0767", "tree": "669ac900707bb663af164e972eeef30b519a79c4", "parents": [ "2ac8a0f58a8782ff8024404a579eee260e8b2010" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Jul 19 15:59:18 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 29 08:04:17 2012 -0700" }, "message": "md/raid1: close some possible races on write errors during resync\n\ncommit 58e94ae18478c08229626daece2fc108a4a23261 upstream.\n\ncommit 4367af556133723d0f443e14ca8170d9447317cb\n md/raid1: clear bad-block record when write succeeds.\n\nAdded a \u0027reschedule_retry\u0027 call possibility at the end of\nend_sync_write, but didn\u0027t add matching code at the end of\nsync_request_write. So if the writes complete very quickly, or\nscheduling makes it seem that way, then we can miss rescheduling\nthe request and the resync could hang.\n\nAlso commit 73d5c38a9536142e062c35997b044e89166e063b\n md: avoid races when stopping resync.\n\nFix a race condition in this same code in end_sync_write but didn\u0027t\nmake the change in sync_request_write.\n\nThis patch updates sync_request_write to fix both of those.\nPatch is suitable for 3.1 and later kernels.\n\nReported-by: Alexander Lyakas \u003calex.bolshoy@gmail.com\u003e\nOriginal-version-by: Alexander Lyakas \u003calex.bolshoy@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "2ac8a0f58a8782ff8024404a579eee260e8b2010", "tree": "b3712f056d64c6a4b1ce7b506fd96d2d59ba6896", "parents": [ "1c8f63c2758096c3b6425f4ecb274901151d6f17" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu Jul 19 15:59:18 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jul 29 08:04:17 2012 -0700" }, "message": "md: avoid crash when stopping md array races with closing other open fds.\n\ncommit a05b7ea03d72f36edb0cec05e8893803335c61a0 upstream.\n\nmd will refuse to stop an array if any other fd (or mounted fs) is\nusing it.\nWhen any fs is unmounted of when the last open fd is closed all\npending IO will be flushed (e.g. sync_blockdev call in __blkdev_put)\nso there will be no pending IO to worry about when the array is\nstopped.\n\nHowever in order to send the STOP_ARRAY ioctl to stop the array one\nmust first get and open fd on the block device.\nIf some fd is being used to write to the block device and it is closed\nafter mdadm open the block device, but before mdadm issues the\nSTOP_ARRAY ioctl, then there will be no last-close on the md device so\n__blkdev_put will not call sync_blockdev.\n\nIf this happens, then IO can still be in-flight while md tears down\nthe array and bad things can happen (use-after-free and subsequent\nhavoc).\n\nSo in the case where do_md_stop is being called from an open file\ndescriptor, call sync_block after taking the mutex to ensure there\nwill be no new openers.\n\nThis is needed when setting a read-write device to read-only too.\n\nReported-by: majianpeng \u003cmajianpeng@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "e301f7b1dbbb0af6dcb8ed10c800fa95bb34917a", "tree": "c583d4f8919432e04060582becd7af01f6d109d5", "parents": [ "a3a13c9974160030550ae28b3fa2c1ea8992b9c5" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Mon Jul 09 11:34:13 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Jul 19 08:58:55 2012 -0700" }, "message": "md/raid1: fix use-after-free bug in RAID1 data-check code.\n\ncommit 2d4f4f3384d4ef4f7c571448e803a1ce721113d5 upstream.\n\nThis bug has been present ever since data-check was introduce\nin 2.6.16. However it would only fire if a data-check were\ndone on a degraded array, which was only possible if the array\nhas 3 or more devices. This is certainly possible, but is quite\nuncommon.\n\nSince hot-replace was added in 3.3 it can happen more often as\nthe same condition can arise if not all possible replacements are\npresent.\n\nThe problem is that as soon as we submit the last read request, the\n\u0027r1_bio\u0027 structure could be freed at any time, so we really should\nstop looking at it. If the last device is being read from we will\nstop looking at it. However if the last device is not due to be read\nfrom, we will still check the bio pointer in the r1_bio, but the\nr1_bio might already be free.\n\nSo use the read_targets counter to make sure we stop looking for bios\nto submit as soon as we have submitted them all.\n\nThis fix is suitable for any -stable kernel since 2.6.16.\n\nReported-by: Arnold Schulz \u003carnysch@gmx.net\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "d3f940223c31cffd977864cdc13c69e89f03ce55", "tree": "09ba2e45102876e10f8bc9bb1f04a689193fbbc8", "parents": [ "0c4ad5cc8c01f62fe5211b5ce9563c27f795a4ab" ], "author": { "name": "majianpeng", "email": "majianpeng@gmail.com", "time": "Tue Jun 12 08:31:10 2012 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:43 2012 -0700" }, "message": "md/raid5: Do not add data_offset before call to is_badblock\n\ncommit 6c0544e255dd6582a9899572e120fb55d9f672a4 upstream.\n\nIn chunk_aligned_read() we are adding data_offset before calling\nis_badblock. But is_badblock also adds data_offset, so that is bad.\n\nSo move the addition of data_offset to after the call to\nis_badblock.\n\nThis bug was introduced by commit 31c176ecdf3563140e639\n md/raid5: avoid reading from known bad blocks.\nwhich first appeared in 3.0. So that patch is suitable for any\n-stable kernel from 3.0.y onwards. However it will need minor\nrevision for most of those (as the comment didn\u0027t appear until\nrecently).\n\nSigned-off-by: majianpeng \u003cmajianpeng@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\n[bwh: Backported to 3.2: ignored missing comment]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5bbbd747918d241b41f3220ff26323d7ed943c52", "tree": "b465bd87040429da89b324935074c8e3fc90a9d7", "parents": [ "c412589f74ab4f1e30bb25b685fe6d95f2befd4d" ], "author": { "name": "Shaohua Li", "email": "shli@kernel.org", "time": "Tue Jul 03 15:57:19 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:41 2012 -0700" }, "message": "raid5: delayed stripe fix\n\ncommit fab363b5ff502d1b39ddcfec04271f5858d9f26e upstream.\n\nThere isn\u0027t locking setting STRIPE_DELAYED and STRIPE_PREREAD_ACTIVE bits, but\nthe two bits have relationship. A delayed stripe can be moved to hold list only\nwhen preread active stripe count is below IO_THRESHOLD. If a stripe has both\nthe bits set, such stripe will be in delayed list and preread count not 0,\nwhich will make such stripe never leave delayed list.\n\nSigned-off-by: Shaohua Li \u003cshli@fusionio.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "6d442d8f7e1a6920aad3d3f3ea544f6f8e6898b8", "tree": "bd5a572130cb49bba9a456ccb7340e4b1534e5ee", "parents": [ "7723bfa90d8a1f75f41ade1a13b9b32c9255b15c" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Tue Jul 03 12:55:37 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:26 2012 -0700" }, "message": "dm persistent data: fix allocation failure in space map checker init\n\ncommit b0239faaf87c38bb419c9264bf20817438ddc3a9 upstream.\n\nIf CONFIG_DM_DEBUG_SPACE_MAPS is enabled and memory is fragmented and a\nsufficiently-large metadata device is used in a thin pool then the space\nmap checker will fail to allocate the memory it requires.\n\nSwitch from kmalloc to vmalloc to allow larger virtually contiguous\nallocations for the space map checker\u0027s internal count arrays.\n\nReported-by: Vivek Goyal \u003cvgoyal@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "7723bfa90d8a1f75f41ade1a13b9b32c9255b15c", "tree": "4e671f0460e5909c24e1c0e6c9a43ac079c086b1", "parents": [ "672c65731d62930439b91ff8a160830085d42a51" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Tue Jul 03 12:55:35 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:26 2012 -0700" }, "message": "dm persistent data: handle space map checker creation failure\n\ncommit 62662303e7f590fdfbb0070ab820a0ad4267c119 upstream.\n\nIf CONFIG_DM_DEBUG_SPACE_MAPS is enabled and dm_sm_checker_create()\nfails, dm_tm_create_internal() would still return success even though it\ncleaned up all resources it was supposed to have created. This will\nlead to a kernel crash:\n\ngeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC\n...\nRIP: 0010:[\u003cffffffff81593659\u003e] [\u003cffffffff81593659\u003e] dm_bufio_get_block_size+0x9/0x20\nCall Trace:\n [\u003cffffffff81599bae\u003e] dm_bm_block_size+0xe/0x10\n [\u003cffffffff8159b8b8\u003e] sm_ll_init+0x78/0xd0\n [\u003cffffffff8159c1a6\u003e] sm_ll_new_disk+0x16/0xa0\n [\u003cffffffff8159c98e\u003e] dm_sm_disk_create+0xfe/0x160\n [\u003cffffffff815abf6e\u003e] dm_pool_metadata_open+0x16e/0x6a0\n [\u003cffffffff815aa010\u003e] pool_ctr+0x3f0/0x900\n [\u003cffffffff8158d565\u003e] dm_table_add_target+0x195/0x450\n [\u003cffffffff815904c4\u003e] table_load+0xe4/0x330\n [\u003cffffffff815917ea\u003e] ctl_ioctl+0x15a/0x2c0\n [\u003cffffffff81591963\u003e] dm_ctl_ioctl+0x13/0x20\n [\u003cffffffff8116a4f8\u003e] do_vfs_ioctl+0x98/0x560\n [\u003cffffffff8116aa51\u003e] sys_ioctl+0x91/0xa0\n [\u003cffffffff81869f52\u003e] system_call_fastpath+0x16/0x1b\n\nFix the space map checker code to return an appropriate ERR_PTR and have\ndm_sm_disk_create() and dm_tm_create_internal() check for it with\nIS_ERR.\n\nReported-by: Vivek Goyal \u003cvgoyal@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "672c65731d62930439b91ff8a160830085d42a51", "tree": "ec07304750f68c74ffcdafbe9e82cfec24e657d1", "parents": [ "a712c8097b28c4c4f705db4102c0eed117806162" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Tue Jul 03 12:55:33 2012 +0100" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:26 2012 -0700" }, "message": "dm persistent data: fix shadow_info_leak on dm_tm_destroy\n\ncommit 25d7cd6faa7ae6ed2565617c3ee2500ccb8a9f7f upstream.\n\nCleanup the shadow table before destroying the transaction manager.\n\nReference: leak was identified with kmemleak when running\ntest_discard_random_sectors in the thinp-test-suite.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "8d9369807370331cebf3e237b95ecce068af80f1", "tree": "45d0c283ffd7f058e28a17d6b55e0a8a3d567502", "parents": [ "65c3f18b9032f7237fc74403ce3a92176eaebd8c" ], "author": { "name": "majianpeng", "email": "majianpeng@gmail.com", "time": "Tue Jul 03 12:11:54 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:25 2012 -0700" }, "message": "md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev\n\ncommit 1850753d2e6d9ca7856581ca5d3cf09521e6a5d7 upstream.\n\nIn ops_run_io(), the call to md_wait_for_blocked_rdev will decrement\nnr_pending so we lose the reference we hold on the rdev.\nSo atomic_inc it first to maintain the reference.\n\nThis bug was introduced by commit 73e92e51b7969ef5477d\n md/raid5. Don\u0027t write to known bad block on doubtful devices.\n\nwhich appeared in 3.0, so patch is suitable for stable kernels since\nthen.\n\nSigned-off-by: majianpeng \u003cmajianpeng@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "65c3f18b9032f7237fc74403ce3a92176eaebd8c", "tree": "2088abe208befd572ef07a2f41b5330f1d6a0dfb", "parents": [ "04e0f69d135f6cf10534282fc09cf3efd6973c5b" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue Jul 03 15:55:33 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:25 2012 -0700" }, "message": "md/raid10: fix failure when trying to repair a read error.\n\ncommit 055d3747dbf00ce85c6872ecca4d466638e80c22 upstream.\n\ncommit 58c54fcca3bac5bf9290cfed31c76e4c4bfbabaf\n md/raid10: handle further errors during fix_read_error better.\n\nin 3.1 added \"r10_sync_page_io\" which takes an IO size in sectors.\nBut we were passing the IO size in bytes!!!\nThis resulting in bio_add_page failing, and empty request being sent\ndown, and a consequent BUG_ON in scsi_lib.\n\n[fix missing space in error message at same time]\n\nThis fix is suitable for 3.1.y and later.\n\nReported-by: Christian Balzer \u003cchibi@gol.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "04e0f69d135f6cf10534282fc09cf3efd6973c5b", "tree": "a5d1d20670b6c24a78112446f51009aee13ed267", "parents": [ "10ff23ae117665e886fed089cb5a2e015cd8b7b4" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Tue Jul 03 10:37:30 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Jul 16 09:04:25 2012 -0700" }, "message": "md/raid10: Don\u0027t try to recovery unmatched (and unused) chunks.\n\ncommit fc448a18ae6219af9a73257b1fbcd009efab4a81 upstream.\n\nIf a RAID10 has an odd number of chunks - as might happen when there\nare an odd number of devices - the last chunk has no pair and so is\nnot mirrored. We don\u0027t store data there, but when recovering the last\ndevice in an array we retry to recover that last chunk from a\nnon-existent location. This results in an error, and the recovery\naborts.\n\nWhen we get to that last chunk we should just stop - there is nothing\nmore to do anyway.\n\nThis bug has been present since the introduction of RAID10, so the\npatch is appropriate for any -stable kernel.\n\nReported-by: Christian Balzer \u003cchibi@gol.com\u003e\nTested-by: Christian Balzer \u003cchibi@gol.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "584b886aee3aff5fe7eb21e30f779eb5cd1daa36", "tree": "61945a4b446196fd4e21cb0c5fe9d125d26fd1ea", "parents": [ "cf9ab4c62be7837c2f007cd51ab3604ca0620070" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu May 31 15:39:11 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Sun Jun 10 00:36:18 2012 +0900" }, "message": "md: raid1/raid10: fix problem with merge_bvec_fn\n\ncommit aba336bd1d46d6b0404b06f6915ed76150739057 upstream.\n\nThe new merge_bvec_fn which calls the corresponding function\nin subsidiary devices requires that mddev-\u003emerge_check_needed\nbe set if any child has a merge_bvec_fn.\n\nHowever were were only setting that when a device was hot-added,\nnot when a device was present from the start.\n\nThis bug was introduced in 3.4 so patch is suitable for 3.4.y\nkernels. However that are conflicts in raid10.c so a separate\npatch will be needed for 3.4.y.\n\nReported-by: Sebastian Riemer \u003csebastian.riemer@profitbricks.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "f132c6cf77251e011e1dad0ec88c0b1fda16d5aa", "tree": "f04b469a3547a19b7bdbe110adc571eb71c93328", "parents": [ "23016defd7db701a01dc49f972ad6b1bae9651c2", "3f6240f3e4e2608caf1a70d614ada658cbcbe7be" ], "author": { "name": "Steve Muckle", "email": "smuckle@codeaurora.org", "time": "Wed Jun 06 18:30:57 2012 -0700" }, "committer": { "name": "Steve Muckle", "email": "smuckle@codeaurora.org", "time": "Wed Jun 06 18:45:28 2012 -0700" }, "message": "Merge commit \u0027AU_LINUX_ANDROID_ICS.04.00.04.00.126\u0027 into msm-3.4\n\nAU_LINUX_ANDROID_ICS.04.00.04.00.126 from msm-3.0.\nFirst parent is from google/android-3.4.\n\n* commit \u0027AU_LINUX_ANDROID_ICS.04.00.04.00.126\u0027: (8712 commits)\n PRNG: Device tree entry for qrng device.\n vidc:1080p: Set video core timeout value for Thumbnail mode\n msm: sps: improve the debugging support in SPS driver\n board-8064 msm: Overlap secure and non secure video firmware heaps.\n msm: clock: Add handoff ops for 7x30 and copper XO clocks\n msm_fb: display: Wait for external vsync before DTV IOMMU unmap\n msm: Fix ciruclar dependency in debug UART settings\n msm: gdsc: Add GDSC regulator driver for msm-copper\n defconfig: Enable Mobicore Driver.\n mobicore: Add mobicore driver.\n mobicore: rename variable to lower case.\n mobicore: rename folder.\n mobicore: add makefiles\n mobicore: initial import of kernel driver\n ASoC: msm: Add SLIMBUS_2_RX CPU DAI\n board-8064-gpio: Update FUNC for EPM SPI CS\n msm_fb: display: Remove chicken bit config during video playback\n mmc: msm_sdcc: enable the sanitize capability\n msm-fb: display: lm2 writeback support on mpq platfroms\n msm_fb: display: Disable LVDS phy \u0026 pll during panel off\n ...\n\nSigned-off-by: Steve Muckle \u003csmuckle@codeaurora.org\u003e\n" }, { "commit": "51c75d344b36152159b19466964dab4ae1a19fcd", "tree": "8bb7efd135ee2ea268eb97d44f40dd869c6011e8", "parents": [ "ab9094fa038106675b40dbb5ee78b60255d6c436" ], "author": { "name": "Shaohua Li", "email": "shli@kernel.org", "time": "Mon May 21 09:26:59 2012 +1000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Fri Jun 01 15:18:19 2012 +0800" }, "message": "md: using GFP_NOIO to allocate bio for flush request\n\ncommit b5e1b8cee7ad58a15d2fa79bcd7946acb592602d upstream.\n\nA flush request is usually issued in transaction commit code path, so\nusing GFP_KERNEL to allocate memory for flush request bio falls into\nthe classic deadlock issue.\n\nThis is suitable for any -stable kernel to which it applies as it\navoids a possible deadlock.\n\nSigned-off-by: Shaohua Li \u003cshli@fusionio.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n" }, { "commit": "b1dab2f0409c478fd2d9e227c2c018524eca9603", "tree": "9d2b29b9209c6e0036da295b7704452aa7d35e72", "parents": [ "2f05af8b5943d5702ef555c91da93af99938be44", "f402693d06f32e746c6153e459c5fb064fa02741" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 18:22:45 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 18:22:45 2012 -0700" }, "message": "Merge tag \u0027dm-3.4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm\n\nPull a dm fix from Alasdair G Kergon:\n \"A fix to the thin provisioning userspace interface.\"\n\n* tag \u0027dm-3.4-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm:\n dm thin: fix table output when pool target disables discard passdown internally\n" }, { "commit": "f402693d06f32e746c6153e459c5fb064fa02741", "tree": "c4cfcf2702b3e5a1e94e3c3b923b52c413e4325a", "parents": [ "36be50515fe2aef61533b516fa2576a2c7fe7664" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Sat May 19 01:01:01 2012 +0100" }, "committer": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Sat May 19 01:01:01 2012 +0100" }, "message": "dm thin: fix table output when pool target disables discard passdown internally\n\nWhen the thin pool target clears the discard_passdown parameter\ninternally, it incorrectly changes the table line reported to userspace.\nThis breaks dumb string comparisons on these table lines in generic\nuserspace device-mapper library code and leads to tables being reloaded\nrepeatedly when nothing is actually meant to be changing.\n\nThis patch corrects this by no longer changing the table line when\ndiscard passdown was disabled.\n\nWe can still tell when discard passdown is overridden by looking for the\nmessage \"Discard unsupported by data device (sdX): Disabling discard passdown.\"\n\nThis automatic detection is also moved from the \u0027load\u0027 to the \u0027resume\u0027\nso that it is re-evaluated should the properties of underlying devices\nchange.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nAcked-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n" }, { "commit": "2f05af8b5943d5702ef555c91da93af99938be44", "tree": "dd5de3120fcfa21ac25e1ff96871b765d0104ed7", "parents": [ "8394edf3710b124793d46c51942a6392b7b569a0", "b0d634d5683f0b186b242ce6a4f3b041edb8b956" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 16:19:59 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri May 18 16:19:59 2012 -0700" }, "message": "Merge tag \u0027md-3.4-fixes\u0027 of git://neil.brown.name/md\n\nPull one more md bugfix from NeilBrown:\n \"Fix bug in recent fix to RAID10.\n\n Without this patch, recovery will crash\"\n\n* tag \u0027md-3.4-fixes\u0027 of git://neil.brown.name/md:\n md/raid10: fix transcription error in calc_sectors conversion.\n" }, { "commit": "b0d634d5683f0b186b242ce6a4f3b041edb8b956", "tree": "6443dc130dcd45c78ca2878938464c418ea89c41", "parents": [ "0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Sat May 19 09:01:13 2012 +1000" }, "committer": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Sat May 19 09:01:13 2012 +1000" }, "message": "md/raid10: fix transcription error in calc_sectors conversion.\n\nThe old code was\n\t\tsector_div(stride, fc);\nthe new code was\n\t\tsector_dir(size, conf-\u003enear_copies);\n\n\u0027size\u0027 is right (the stride various wasn\u0027t really needed), but\n\u0027fc\u0027 means \u0027far_copies\u0027, and that is an important difference.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e \n" }, { "commit": "36a1987cd891fa82d9981886c3abbbe82c428c0d", "tree": "26f2c1ebc2d0485de222f13ebf812456ee8a7cb8", "parents": [ "31ae98359d26ff89b745c4f8094093cbf6ccbdc6", "0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 17 09:44:35 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu May 17 09:44:35 2012 -0700" }, "message": "Merge tag \u0027md-3.4-fixes\u0027 of git://neil.brown.name/md\n\nPull two md fixes from NeilBrown:\n \"One fixes a bug in the new raid10 resize code so is relevant to 3.4\n only.\n\n The other fixes a bug in the use of md by dm-raid, so is relevant to\n any kernel with dm-raid support\"\n\n* tag \u0027md-3.4-fixes\u0027 of git://neil.brown.name/md:\n MD: Add del_timer_sync to mddev_suspend (fix nasty panic)\n md/raid10: set dev_sectors properly when resizing devices in array.\n" }, { "commit": "0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9", "tree": "3d0b8c398c1eda38bac6d3dd6ac1b22b518d26b4", "parents": [ "6508fdbf40a92fd7c19d32780ea33ce8e8362b93" ], "author": { "name": "Jonathan Brassow", "email": "jbrassow@redhat.com", "time": "Wed May 16 04:06:14 2012 -0500" }, "committer": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu May 17 10:38:24 2012 +1000" }, "message": "MD: Add del_timer_sync to mddev_suspend (fix nasty panic)\n\nUse del_timer_sync to remove timer before mddev_suspend finishes.\n\nWe don\u0027t want a timer going off after an mddev_suspend is called. This is\nespecially true with device-mapper, since it can call the destructor function\nimmediately following a suspend. This results in the removal (kfree) of the\nstructures upon which the timer depends - resulting in a very ugly panic.\nTherefore, we add a del_timer_sync to mddev_suspend to prevent this.\n\nCc: stable@vger.kernel.org\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\n" }, { "commit": "6508fdbf40a92fd7c19d32780ea33ce8e8362b93", "tree": "f51e0e36459eeb2f4e7d94f3ff15ffc5ab12de7c", "parents": [ "b16b1b6cd052acbacc0a15f934bca9b354534d48" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu May 17 10:08:45 2012 +1000" }, "committer": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Thu May 17 10:08:45 2012 +1000" }, "message": "md/raid10: set dev_sectors properly when resizing devices in array.\n\nraid10 stores dev_sectors in \u0027conf\u0027 separately from the one in\n\u0027mddev\u0027 because it can have a very significant effect on block\naddressing and so need to be updated carefully.\n\nHowever raid10_resize isn\u0027t updating it at all!\n\nTo update it correctly, we need to make sure it is a proper\nmultiple of the chunksize taking various details of the layout\nin to account.\nThis calculation is currently done in setup_conf. So split it\nout from there and call it from raid10_resize as well.\nThen set conf-\u003edev_sectors properly.\n\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\n" }, { "commit": "4a873f53995cd551587ee4aad1e6f189a330ff36", "tree": "a1caacf532d6a32861399720ae2883396f443954", "parents": [ "2eb429671a4b83ea34a1a722a4656bb14ce7c971", "062e55e3960062fc2fb62a7274b4c253003eba73" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 12 12:57:01 2012 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat May 12 12:57:01 2012 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David S. Miller:\n\n 1) Since we do RCU lookups on ipv4 FIB entries, we have to test if the\n entry is dead before returning it to our caller.\n\n 2) openvswitch locking and packet validation fixes from Ansis Atteka,\n Jesse Gross, and Pravin B Shelar.\n\n 3) Fix PM resume locking in IGB driver, from Benjamin Poirier.\n\n 4) Fix VLAN header handling in vhost-net and macvtap, from Basil Gor.\n\n 5) Revert a bogus network namespace isolation change that was causing\n regressions on S390 networking devices.\n\n 6) If bonding decides to process and handle a LACPDU frame, we\n shouldn\u0027t bump the rx_dropped counter. From Jiri Bohac.\n\n 7) Fix mis-calculation of available TX space in r8169 driver when doing\n TSO, which can lead to crashes and/or hung device. From Julien\n Ducourthial.\n\n 8) SCTP does not validate cached routes properly in all cases, from\n Nicolas Dichtel.\n\n 9) Link status interrupt needs to be handled in ks8851 driver, from\n Stephen Boyd.\n\n10) Use capable(), not cap_raised(), in connector/userns netlink code.\n From Eric W. Biederman via Andrew Morton.\n\n11) Fix pktgen OOPS on module unload, from Eric Dumazet.\n\n12) iwlwifi under-estimates SKB truesizes, also from Eric Dumazet.\n\n13) Cure division by zero in SFC driver, from Ben Hutchings.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)\n ks8851: Update link status during link change interrupt\n macvtap: restore vlan header on user read\n vhost-net: fix handle_rx buffer size\n bonding: don\u0027t increase rx_dropped after processing LACPDUs\n connector/userns: replace netlink uses of cap_raised() with capable()\n sctp: check cached dst before using it\n pktgen: fix crash at module unload\n Revert \"net: maintain namespace isolation between vlan and real device\"\n ehea: fix losing of NEQ events when one event occurred early\n igb: fix rtnl race in PM resume path\n ipv4: Do not use dead fib_info entries.\n r8169: fix unsigned int wraparound with TSO\n sfc: Fix division by zero when using one RX channel and no SR-IOV\n openvswitch: Validation of IPv6 set port action uses IPv4 header\n net: compare_ether_addr[_64bits]() has no ordering\n cdc_ether: Ignore bogus union descriptor for RNDIS devices\n bnx2x: bug fix when loading after SAN boot\n e1000: Silence sparse warnings by correcting type\n igb, ixgbe: netdev_tx_reset_queue incorrectly called from tx init path\n openvswitch: Release rtnl_lock if ovs_vport_cmd_build_info() failed.\n ...\n" }, { "commit": "510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8", "tree": "7d1a5c7b9c8bb19fef2d28e6ec84c5f0e400be61", "parents": [ "7cab8bf1601d38fd73a0a4ea40cc4892b26907cc" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Sat May 12 01:43:21 2012 +0100" }, "committer": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Sat May 12 01:43:21 2012 +0100" }, "message": "dm mpath: check if scsi_dh module already loaded before trying to load\n\nIf the requested scsi_dh module is already loaded then skip\nrequest_module().\n\nMultipath table loads can hang in an unnecessary __request_module.\n\nReported-by: Ben Marzinski \u003cbmarzins@redhat.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n" }, { "commit": "7cab8bf1601d38fd73a0a4ea40cc4892b26907cc", "tree": "541c6f0757a6a806e49dad866b1bca5cffd55c3e", "parents": [ "c3a0ce2eab76daf9516c817c3f227ea3f4549bd8" ], "author": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Sat May 12 01:43:19 2012 +0100" }, "committer": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Sat May 12 01:43:19 2012 +0100" }, "message": "dm thin: correct module description\n\nRemove duplicate copy of string \"device-mapper\" (DM_NAME) from\nMODULE_DESCRIPTION.\n\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n" }, { "commit": "c3a0ce2eab76daf9516c817c3f227ea3f4549bd8", "tree": "c2510a2e8a4a0f2c0eb66f736d1e1b70b53d0e27", "parents": [ "03aaae7cdc71bc306888440b1f569d463e917b6d" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Sat May 12 01:43:16 2012 +0100" }, "committer": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Sat May 12 01:43:16 2012 +0100" }, "message": "dm thin: fix unprotected use of prepared_discards list\n\nFix two places in commit 104655fd4dce (\"dm thin: support discards\") that\ndidn\u0027t use pool-\u003elock to protect against concurrent changes to the\nprepared_discards list.\n\nWithout this fix, thin_endio() can race with process_discard(), leading\nto concurrent list_add()s that result in the processes locking up with\nan error like the following:\n\nWARNING: at lib/list_debug.c:32 __list_add+0x8f/0xa0()\n...\nlist_add corruption. next-\u003eprev should be prev (ffff880323b96140), but was ffff8801d2c48440. (next\u003dffff8801d2c485c0).\n...\nPid: 17205, comm: kworker/u:1 Tainted: G W O 3.4.0-rc3.snitm+ #1\nCall Trace:\n [\u003cffffffff8103ca1f\u003e] warn_slowpath_common+0x7f/0xc0\n [\u003cffffffff8103cb16\u003e] warn_slowpath_fmt+0x46/0x50\n [\u003cffffffffa04f6ce6\u003e] ? bio_detain+0xc6/0x210 [dm_thin_pool]\n [\u003cffffffff8124ff3f\u003e] __list_add+0x8f/0xa0\n [\u003cffffffffa04f70d2\u003e] process_discard+0x2a2/0x2d0 [dm_thin_pool]\n [\u003cffffffffa04f6a78\u003e] ? remap_and_issue+0x38/0x50 [dm_thin_pool]\n [\u003cffffffffa04f7c3b\u003e] process_deferred_bios+0x7b/0x230 [dm_thin_pool]\n [\u003cffffffffa04f7df0\u003e] ? process_deferred_bios+0x230/0x230 [dm_thin_pool]\n [\u003cffffffffa04f7e42\u003e] do_worker+0x52/0x60 [dm_thin_pool]\n [\u003cffffffff81056fa9\u003e] process_one_work+0x129/0x450\n [\u003cffffffff81059b9c\u003e] worker_thread+0x17c/0x3c0\n [\u003cffffffff81059a20\u003e] ? manage_workers+0x120/0x120\n [\u003cffffffff8105eabe\u003e] kthread+0x9e/0xb0\n [\u003cffffffff814ceda4\u003e] kernel_thread_helper+0x4/0x10\n [\u003cffffffff8105ea20\u003e] ? kthread_freezable_should_stop+0x70/0x70\n [\u003cffffffff814ceda0\u003e] ? gs_change+0x13/0x13\n---[ end trace 7e0a523bc5e52692 ]---\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n" }, { "commit": "03aaae7cdc71bc306888440b1f569d463e917b6d", "tree": "0f26df484419ac7cfc73b0d13f94a4cf7b701781", "parents": [ "d48b97b403d23f6df0b990cee652bdf9a52337a3" ], "author": { "name": "Mike Snitzer", "email": "snitzer@redhat.com", "time": "Sat May 12 01:43:12 2012 +0100" }, "committer": { "name": "Alasdair G Kergon", "email": "agk@redhat.com", "time": "Sat May 12 01:43:12 2012 +0100" }, "message": "dm thin: reinstate missing mempool_free in cell_release_singleton\n\nFix a significant memory leak inadvertently introduced during\nsimplification of cell_release_singleton() in commit\n6f94a4c45a6f744383f9f695dde019998db3df55 (\"dm thin: fix stacked bi_next\nusage\").\n\nA cell\u0027s hlist_del() must be accompanied by a mempool_free().\nUse __cell_release() to do this, like before.\n\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Alasdair G Kergon \u003cagk@redhat.com\u003e\n" }, { "commit": "38bf1953987c1735f3c9140fca762949a8cae507", "tree": "5596d88145226774633d3a2853b6d7caaeffa4f1", "parents": [ "e0268868ba064980488fc8c194db3d8e9fb2959c" ], "author": { "name": "Eric W. Biederman", "email": "ebiederm@xmission.com", "time": "Fri May 04 11:34:03 2012 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu May 10 23:21:39 2012 -0400" }, "message": "connector/userns: replace netlink uses of cap_raised() with capable()\n\nIn 2009 Philip Reiser notied that a few users of netlink connector\ninterface needed a capability check and added the idiom\ncap_raised(nsp-\u003eeff_cap, CAP_SYS_ADMIN) to a few of them, on the premise\nthat netlink was asynchronous.\n\nIn 2011 Patrick McHardy noticed we were being silly because netlink is\nsynchronous and removed eff_cap from the netlink_skb_params and changed\nthe idiom to cap_raised(current_cap(), CAP_SYS_ADMIN).\n\nLooking at those spots with a fresh eye we should be calling\ncapable(CAP_SYS_ADMIN). The only reason I can see for not calling capable\nis that it once appeared we were not in the same task as the caller which\nwould have made calling capable() impossible.\n\nIn the initial user_namespace the only difference between between\ncap_raised(current_cap(), CAP_SYS_ADMIN) and capable(CAP_SYS_ADMIN) are a\nfew sanity checks and the fact that capable(CAP_SYS_ADMIN) sets\nPF_SUPERPRIV if we use the capability.\n\nSince we are going to be using root privilege setting PF_SUPERPRIV seems\nthe right thing to do.\n\nThe motivation for this that patch is that in a child user namespace\ncap_raised(current_cap(),...) tests your capabilities with respect to that\nchild user namespace not capabilities in the initial user namespace and\nthus will allow processes that should be unprivielged to use the kernel\nservices that are only protected with cap_raised(current_cap(),..).\n\nTo fix possible user_namespace issues and to just clean up the code\nreplace cap_raised(current_cap(), CAP_SYS_ADMIN) with\ncapable(CAP_SYS_ADMIN).\n\nSigned-off-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Patrick McHardy \u003ckaber@trash.net\u003e\nCc: Philipp Reisner \u003cphilipp.reisner@linbit.com\u003e\nAcked-by: Serge E. Hallyn \u003cserge.hallyn@canonical.com\u003e\nAcked-by: Andrew G. Morgan \u003cmorgan@kernel.org\u003e\nCc: Vasiliy Kulikov \u003csegoon@openwall.com\u003e\nCc: David Howells \u003cdhowells@redhat.com\u003e\nReviewed-by: James Morris \u003cjames.l.morris@oracle.com\u003e\nCc: David Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b16b1b6cd052acbacc0a15f934bca9b354534d48", "tree": "ba5b2e72e04a18a4bd83429f089d16637b9a6343", "parents": [ "69964ea4c7b68c9399f7977aa5b9aa6539a6a98a" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Fri May 04 17:03:18 2012 +1000" }, "committer": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Fri May 04 17:03:18 2012 +1000" }, "message": "md/bitmap: fix calculation of \u0027chunks\u0027 - missing shift.\n\ncommit 61a0d80c \"md/bitmap: discard CHUNK_BLOCK_SHIFT macro\"\nreplaced CHUNK_BLOCK_RATIO() by the same text that was\nreplacing CHUNK_BLOCK_SHIFT() - which is clearly wrong.\n\nThe result is that \u0027chunks\u0027 is often too small by 1,\nwhich can sometimes result in a crash (not sure how).\n\nSo use the correct replacement, and get rid of CHUNK_BLOCK_RATIO\nwhich is no longe used.\n\nReported-by: Karl Newman \u003csiliconfiend@gmail.com\u003e\nTested-by: Karl Newman \u003csiliconfiend@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\n" } ], "next": "30b8aa9172dfeaac6d77897c67ee9f9fc574cdbb" }