From 58a9ff14e04567c618bf9068bf2d0e1d0c960dca Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 8 Jun 2015 11:56:39 -0400 Subject: [PATCH] Linux v4.0.5 --- ...ix-ktime_divns-to-do-signed-division.patch | 125 -------- ...tomatically-enforce-module-signature.patch | 4 +- Add-secure_modules-call.patch | 4 +- ...q-option-to-disable-secure-boot-mode.patch | 2 +- ...pp-add-a-module-parameter-to-keep-fi.patch | 4 +- Kbuild-Add-an-option-to-enable-GCC-VTA.patch | 2 +- ..._rsdp-kernel-parameter-when-module-l.patch | 4 +- ...-Allocate-entire-range-in-zero-range.patch | 2 +- ...-the-possibility-that-m_list-or-s_li.patch | 54 ---- kernel.spec | 57 +--- ...-queued-TRIM-on-all-Samsung-800-seri.patch | 36 --- ...tore-to-sector-variable-in-raid0_mak.patch | 48 --- ..._mounts-when-applied-to-unmounted-mo.patch | 48 --- ...-t-remove-non-empty-opaque-directory.patch | 57 ---- pty-Fix-input-race-when-closing.patch | 284 ------------------ ...-blk_schedule_flush_plug-in-io_sched.patch | 102 ------- ...validate_disk-prevent-NULL-ptr-deref.patch | 4 +- sources | 2 +- ...e_handle-only-once-in-handle_to_path.patch | 39 --- 19 files changed, 19 insertions(+), 859 deletions(-) delete mode 100644 0001-ktime-Fix-ktime_divns-to-do-signed-division.patch delete mode 100644 fs_pin-Allow-for-the-possibility-that-m_list-or-s_li.patch delete mode 100644 libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch delete mode 100644 md-raid0-fix-restore-to-sector-variable-in-raid0_mak.patch delete mode 100644 mnt-Fail-collect_mounts-when-applied-to-unmounted-mo.patch delete mode 100644 ovl-don-t-remove-non-empty-opaque-directory.patch delete mode 100644 pty-Fix-input-race-when-closing.patch delete mode 100644 sched-always-use-blk_schedule_flush_plug-in-io_sched.patch delete mode 100644 vfs-read-file_handle-only-once-in-handle_to_path.patch diff --git a/0001-ktime-Fix-ktime_divns-to-do-signed-division.patch b/0001-ktime-Fix-ktime_divns-to-do-signed-division.patch deleted file mode 100644 index b679b60f9..000000000 --- a/0001-ktime-Fix-ktime_divns-to-do-signed-division.patch +++ /dev/null @@ -1,125 +0,0 @@ -From f7bcb70ebae0dcdb5a2d859b09e4465784d99029 Mon Sep 17 00:00:00 2001 -From: John Stultz -Date: Fri, 8 May 2015 13:47:23 -0700 -Subject: [PATCH] ktime: Fix ktime_divns to do signed division - -It was noted that the 32bit implementation of ktime_divns() -was doing unsigned division and didn't properly handle -negative values. - -And when a ktime helper was changed to utilize -ktime_divns, it caused a regression on some IR blasters. -See the following bugzilla for details: - https://bugzilla.redhat.com/show_bug.cgi?id=1200353 - -This patch fixes the problem in ktime_divns by checking -and preserving the sign bit, and then reapplying it if -appropriate after the division, it also changes the return -type to a s64 to make it more obvious this is expected. - -Nicolas also pointed out that negative dividers would -cause infinite loops on 32bit systems, negative dividers -is unlikely for users of this function, but out of caution -this patch adds checks for negative dividers for both -32-bit (BUG_ON) and 64-bit(WARN_ON) versions to make sure -no such use cases creep in. - -[ tglx: Hand an u64 to do_div() to avoid the compiler warning ] - -Fixes: 166afb64511e 'ktime: Sanitize ktime_to_us/ms conversion' -Reported-and-tested-by: Trevor Cordes -Signed-off-by: John Stultz -Acked-by: Nicolas Pitre -Cc: Ingo Molnar -Cc: Josh Boyer -Cc: One Thousand Gnomes -Cc: -Link: http://lkml.kernel.org/r/1431118043-23452-1-git-send-email-john.stultz@linaro.org -Signed-off-by: Thomas Gleixner ---- - include/linux/ktime.h | 27 +++++++++++++++++++++------ - kernel/time/hrtimer.c | 14 ++++++++------ - 2 files changed, 29 insertions(+), 12 deletions(-) - -diff --git a/include/linux/ktime.h b/include/linux/ktime.h -index 5fc3d10..2b6a204 100644 ---- a/include/linux/ktime.h -+++ b/include/linux/ktime.h -@@ -166,19 +166,34 @@ static inline bool ktime_before(const ktime_t cmp1, const ktime_t cmp2) - } - - #if BITS_PER_LONG < 64 --extern u64 __ktime_divns(const ktime_t kt, s64 div); --static inline u64 ktime_divns(const ktime_t kt, s64 div) -+extern s64 __ktime_divns(const ktime_t kt, s64 div); -+static inline s64 ktime_divns(const ktime_t kt, s64 div) - { -+ /* -+ * Negative divisors could cause an inf loop, -+ * so bug out here. -+ */ -+ BUG_ON(div < 0); - if (__builtin_constant_p(div) && !(div >> 32)) { -- u64 ns = kt.tv64; -- do_div(ns, div); -- return ns; -+ s64 ns = kt.tv64; -+ u64 tmp = ns < 0 ? -ns : ns; -+ -+ do_div(tmp, div); -+ return ns < 0 ? -tmp : tmp; - } else { - return __ktime_divns(kt, div); - } - } - #else /* BITS_PER_LONG < 64 */ --# define ktime_divns(kt, div) (u64)((kt).tv64 / (div)) -+static inline s64 ktime_divns(const ktime_t kt, s64 div) -+{ -+ /* -+ * 32-bit implementation cannot handle negative divisors, -+ * so catch them on 64bit as well. -+ */ -+ WARN_ON(div < 0); -+ return kt.tv64 / div; -+} - #endif - - static inline s64 ktime_to_us(const ktime_t kt) -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 76d4bd9..93ef7190 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -266,21 +266,23 @@ lock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags) - /* - * Divide a ktime value by a nanosecond value - */ --u64 __ktime_divns(const ktime_t kt, s64 div) -+s64 __ktime_divns(const ktime_t kt, s64 div) - { -- u64 dclc; - int sft = 0; -+ s64 dclc; -+ u64 tmp; - - dclc = ktime_to_ns(kt); -+ tmp = dclc < 0 ? -dclc : dclc; -+ - /* Make sure the divisor is less than 2^32: */ - while (div >> 32) { - sft++; - div >>= 1; - } -- dclc >>= sft; -- do_div(dclc, (unsigned long) div); -- -- return dclc; -+ tmp >>= sft; -+ do_div(tmp, (unsigned long) div); -+ return dclc < 0 ? -tmp : tmp; - } - EXPORT_SYMBOL_GPL(__ktime_divns); - #endif /* BITS_PER_LONG >= 64 */ --- -2.4.0 - diff --git a/Add-option-to-automatically-enforce-module-signature.patch b/Add-option-to-automatically-enforce-module-signature.patch index b3ce38ce5..4d375fa1d 100644 --- a/Add-option-to-automatically-enforce-module-signature.patch +++ b/Add-option-to-automatically-enforce-module-signature.patch @@ -163,10 +163,10 @@ index b033dab5c8bf..f526b6e02f59 100644 extern int modules_disabled; /* for sysctl */ diff --git a/kernel/module.c b/kernel/module.c -index 0372c3961016..55dacebb687b 100644 +index f3489ef9e409..3bb7c01b3c9f 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -3909,6 +3909,13 @@ void module_layout(struct module *mod, +@@ -3912,6 +3912,13 @@ void module_layout(struct module *mod, EXPORT_SYMBOL(module_layout); #endif diff --git a/Add-secure_modules-call.patch b/Add-secure_modules-call.patch index 6669c5376..63b825134 100644 --- a/Add-secure_modules-call.patch +++ b/Add-secure_modules-call.patch @@ -41,10 +41,10 @@ index b03485bcb82a..b033dab5c8bf 100644 #ifdef CONFIG_SYSFS diff --git a/kernel/module.c b/kernel/module.c -index ec53f594e9c9..0372c3961016 100644 +index 538794ce3cc7..f3489ef9e409 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -3908,3 +3908,13 @@ void module_layout(struct module *mod, +@@ -3911,3 +3911,13 @@ void module_layout(struct module *mod, } EXPORT_SYMBOL(module_layout); #endif diff --git a/Add-sysrq-option-to-disable-secure-boot-mode.patch b/Add-sysrq-option-to-disable-secure-boot-mode.patch index 7e23c8131..c759dd18b 100644 --- a/Add-sysrq-option-to-disable-secure-boot-mode.patch +++ b/Add-sysrq-option-to-disable-secure-boot-mode.patch @@ -228,7 +228,7 @@ index 4121345498e0..0ff3cef5df96 100644 return 0; diff --git a/kernel/module.c b/kernel/module.c -index 55dacebb687b..9d4deeb9268e 100644 +index 3bb7c01b3c9f..a43061731150 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -107,9 +107,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */ diff --git a/HID-logitech-hidpp-add-a-module-parameter-to-keep-fi.patch b/HID-logitech-hidpp-add-a-module-parameter-to-keep-fi.patch index ef6cb0c3e..b94926405 100644 --- a/HID-logitech-hidpp-add-a-module-parameter-to-keep-fi.patch +++ b/HID-logitech-hidpp-add-a-module-parameter-to-keep-fi.patch @@ -20,7 +20,7 @@ Signed-off-by: Jiri Kosina 1 file changed, 10 insertions(+) diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c -index e77658cd037c..8e9cb25f45cb 100644 +index 2caf5b2f3446..d8ecf20cc838 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -28,6 +28,11 @@ MODULE_LICENSE("GPL"); @@ -35,7 +35,7 @@ index e77658cd037c..8e9cb25f45cb 100644 #define REPORT_ID_HIDPP_SHORT 0x10 #define REPORT_ID_HIDPP_LONG 0x11 -@@ -1188,6 +1193,11 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) +@@ -1177,6 +1182,11 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) hidpp->quirks = id->driver_data; diff --git a/Kbuild-Add-an-option-to-enable-GCC-VTA.patch b/Kbuild-Add-an-option-to-enable-GCC-VTA.patch index 2e279ebe4..510a51fce 100644 --- a/Kbuild-Add-an-option-to-enable-GCC-VTA.patch +++ b/Kbuild-Add-an-option-to-enable-GCC-VTA.patch @@ -43,7 +43,7 @@ Signed-off-by: Josh Stone 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile -index 3d16bcc87585..8d2cb8495b41 100644 +index 1880cf77059b..f8fb68beeba5 100644 --- a/Makefile +++ b/Makefile @@ -706,7 +706,11 @@ KBUILD_CFLAGS += -fomit-frame-pointer diff --git a/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch b/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch index 99c75bb2b..7a83415cf 100644 --- a/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch +++ b/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch @@ -13,7 +13,7 @@ Signed-off-by: Josh Boyer 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index f9eeae871593..aa1dcf3d0216 100644 +index 5aa1f6e281d2..58ae459937a4 100644 --- a/drivers/acpi/osl.c +++ b/drivers/acpi/osl.c @@ -44,6 +44,7 @@ @@ -24,7 +24,7 @@ index f9eeae871593..aa1dcf3d0216 100644 #include #include -@@ -255,7 +256,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp); +@@ -252,7 +253,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp); acpi_physical_address __init acpi_os_get_root_pointer(void) { #ifdef CONFIG_KEXEC diff --git a/ext4-Allocate-entire-range-in-zero-range.patch b/ext4-Allocate-entire-range-in-zero-range.patch index de482fa3d..62cd890ca 100644 --- a/ext4-Allocate-entire-range-in-zero-range.patch +++ b/ext4-Allocate-entire-range-in-zero-range.patch @@ -22,7 +22,7 @@ Signed-off-by: Lukas Czerner 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 16f6365f65e7..30dee3c0e864 100644 +index ea4ee1732143..410841e364ef 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -4803,12 +4803,6 @@ static long ext4_zero_range(struct file *file, loff_t offset, diff --git a/fs_pin-Allow-for-the-possibility-that-m_list-or-s_li.patch b/fs_pin-Allow-for-the-possibility-that-m_list-or-s_li.patch deleted file mode 100644 index 61663f462..000000000 --- a/fs_pin-Allow-for-the-possibility-that-m_list-or-s_li.patch +++ /dev/null @@ -1,54 +0,0 @@ -From: "Eric W. Biederman" -Date: Thu, 2 Apr 2015 16:35:48 -0500 -Subject: [PATCH] fs_pin: Allow for the possibility that m_list or s_list go - unused. - -commit 820f9f147dcce2602eefd9b575bbbd9ea14f0953 upstream. - -This is needed to support lazily umounting locked mounts. Because the -entire unmounted subtree needs to stay together until there are no -users with references to any part of the subtree. - -To support this guarantee that the fs_pin m_list and s_list nodes -are initialized by initializing them in init_fs_pin allowing -for the possibility that pin_insert_group does not touch them. - -Further use hlist_del_init in pin_remove so that there is -a hlist_unhashed test before the list we attempt to update -the previous list item. - -Signed-off-by: "Eric W. Biederman" -Signed-off-by: Greg Kroah-Hartman ---- - fs/fs_pin.c | 4 ++-- - include/linux/fs_pin.h | 2 ++ - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/fs/fs_pin.c b/fs/fs_pin.c -index b06c98796afb..611b5408f6ec 100644 ---- a/fs/fs_pin.c -+++ b/fs/fs_pin.c -@@ -9,8 +9,8 @@ static DEFINE_SPINLOCK(pin_lock); - void pin_remove(struct fs_pin *pin) - { - spin_lock(&pin_lock); -- hlist_del(&pin->m_list); -- hlist_del(&pin->s_list); -+ hlist_del_init(&pin->m_list); -+ hlist_del_init(&pin->s_list); - spin_unlock(&pin_lock); - spin_lock_irq(&pin->wait.lock); - pin->done = 1; -diff --git a/include/linux/fs_pin.h b/include/linux/fs_pin.h -index 9dc4e0384bfb..3886b3bffd7f 100644 ---- a/include/linux/fs_pin.h -+++ b/include/linux/fs_pin.h -@@ -13,6 +13,8 @@ struct vfsmount; - static inline void init_fs_pin(struct fs_pin *p, void (*kill)(struct fs_pin *)) - { - init_waitqueue_head(&p->wait); -+ INIT_HLIST_NODE(&p->s_list); -+ INIT_HLIST_NODE(&p->m_list); - p->kill = kill; - } - diff --git a/kernel.spec b/kernel.spec index 706dba5fe..7d74a6955 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 202 +%global baserelease 200 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 4 +%define stable_update 5 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -625,9 +625,6 @@ Patch26171: acpi-video-Add-force-native-backlight-quirk-for-Leno.patch #CVE-2015-2150 rhbz 1196266 1200397 Patch26175: xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch -#rhbz 1208953 -Patch26178: pty-Fix-input-race-when-closing.patch - #rhbz 1210801 Patch26179: HID-logitech-hidpp-add-a-module-parameter-to-keep-fi.patch @@ -646,15 +643,9 @@ Patch26192: blk-loop-avoid-too-many-pending-per-work-IO.patch #rhbz 1206036 1215989 Patch26193: toshiba_acpi-Do-not-register-vendor-backlight-when-a.patch -#rhbz 1218662 -Patch26199: libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch - #rhbz 1219343 Patch26200: 0001-HID-usbhid-Add-HID_QUIRK_NOGET-for-Aten-DVI-KVM-swit.patch -#rhbz 1220915 -Patch26201: ovl-don-t-remove-non-empty-opaque-directory.patch - #rhbz 1220118 Patch26202: 0001-media-media-Fix-regression-in-some-more-dib0700-base.patch @@ -666,19 +657,6 @@ Patch26204: 0001-cx18-add-missing-caps-for-the-PCM-video-device.patch #rhbz 1218688 Patch26205: drm-i915-Fix-ilk-watermarks-calculation-when-primary.patch -#rhbz 1223332 -Patch26207: md-raid0-fix-restore-to-sector-variable-in-raid0_mak.patch - -#rhbz 1220519 -Patch26208: sched-always-use-blk_schedule_flush_plug-in-io_sched.patch - -#rhbz 1200353 -Patch26209: 0001-ktime-Fix-ktime_divns-to-do-signed-division.patch - -# Apply queued fixes for crasher reported by Alex Larsson -Patch26211: mnt-Fail-collect_mounts-when-applied-to-unmounted-mo.patch -Patch26212: fs_pin-Allow-for-the-possibility-that-m_list-or-s_li.patch - #rhbz 1217249 Patch26214: acpi_video-Add-enable_native_backlight-quirk-for-Mac.patch @@ -688,9 +666,6 @@ Patch26215: HID-lenovo-set-INPUT_PROP_POINTING_STICK.patch #rhbz 1218882 Patch26216: 0001-target-use-vfs_iter_read-write-in-fd_do_rw.patch -#CVE-2015-1420 rhbz 1187534 1227417 -Patch26217: vfs-read-file_handle-only-once-in-handle_to_path.patch - #rhbz 1188695 Patch26218: 0001-n_tty-Fix-auditing-support-for-cannonical-mode.patch @@ -1437,9 +1412,6 @@ ApplyPatch acpi-video-Add-force-native-backlight-quirk-for-Leno.patch #CVE-2015-2150 rhbz 1196266 1200397 ApplyPatch xen-pciback-Don-t-disable-PCI_COMMAND-on-PCI-device-.patch -#rhbz 1208953 -ApplyPatch pty-Fix-input-race-when-closing.patch - #rhbz 1210801 ApplyPatch HID-logitech-hidpp-add-a-module-parameter-to-keep-fi.patch @@ -1458,15 +1430,9 @@ ApplyPatch blk-loop-avoid-too-many-pending-per-work-IO.patch #rhbz 1206036 1215989 ApplyPatch toshiba_acpi-Do-not-register-vendor-backlight-when-a.patch -#rhbz 1218662 -ApplyPatch libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch - #rhbz 1219343 ApplyPatch 0001-HID-usbhid-Add-HID_QUIRK_NOGET-for-Aten-DVI-KVM-swit.patch -#rhbz 1220915 -ApplyPatch ovl-don-t-remove-non-empty-opaque-directory.patch - #rhbz 1220118 ApplyPatch 0001-media-media-Fix-regression-in-some-more-dib0700-base.patch @@ -1478,19 +1444,6 @@ ApplyPatch 0001-cx18-add-missing-caps-for-the-PCM-video-device.patch #rhbz 1218688 ApplyPatch drm-i915-Fix-ilk-watermarks-calculation-when-primary.patch -#rhbz 1223332 -ApplyPatch md-raid0-fix-restore-to-sector-variable-in-raid0_mak.patch - -#rhbz 1220519 -ApplyPatch sched-always-use-blk_schedule_flush_plug-in-io_sched.patch - -#rhbz 1200353 -ApplyPatch 0001-ktime-Fix-ktime_divns-to-do-signed-division.patch - -# Apply queued fixes for crasher reported by Alex Larsson -ApplyPatch mnt-Fail-collect_mounts-when-applied-to-unmounted-mo.patch -ApplyPatch fs_pin-Allow-for-the-possibility-that-m_list-or-s_li.patch - #rhbz 1217249 ApplyPatch acpi_video-Add-enable_native_backlight-quirk-for-Mac.patch @@ -1500,9 +1453,6 @@ ApplyPatch HID-lenovo-set-INPUT_PROP_POINTING_STICK.patch #rhbz 1218882 ApplyPatch 0001-target-use-vfs_iter_read-write-in-fd_do_rw.patch -#CVE-2015-1420 rhbz 1187534 1227417 -ApplyPatch vfs-read-file_handle-only-once-in-handle_to_path.patch - #rhbz 1188695 ApplyPatch 0001-n_tty-Fix-auditing-support-for-cannonical-mode.patch @@ -2380,6 +2330,9 @@ fi # ||----w | # || || %changelog +* Mon Jun 08 2015 Josh Boyer - 4.0.5-200 +- Linux v4.0.5 + * Thu Jun 04 2015 Josh Boyer - Backport commit to fix block spew (rhbz 1226621) - Add patch to fix SMT guests on POWER7 (rhbz 1227877) diff --git a/libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch b/libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch deleted file mode 100644 index 073aae74c..000000000 --- a/libata-Blacklist-queued-TRIM-on-all-Samsung-800-seri.patch +++ /dev/null @@ -1,36 +0,0 @@ -From: "Martin K. Petersen" -Date: Mon, 4 May 2015 12:20:29 -0400 -Subject: [PATCH] libata: Blacklist queued TRIM on all Samsung 800-series -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The queued TRIM problems appear to be generic to Samsung's firmware and -not tied to a particular model. A recent update to the 840 EVO firmware -introduced the same issue as we saw on 850 Pro. - -Blacklist queued TRIM on all 800-series drives while we work this issue -with Samsung. - -Reported-by: Günter Waller -Reported-by: Sven Köhler -Signed-off-by: Martin K. Petersen -Cc: stable@vger.kernel.org -Signed-off-by: Tejun Heo ---- - drivers/ata/libata-core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 23dac3babfe3..8cfe5eeac1e6 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4214,7 +4214,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, -- { "Samsung SSD 850 PRO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | -+ { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, - - /* diff --git a/md-raid0-fix-restore-to-sector-variable-in-raid0_mak.patch b/md-raid0-fix-restore-to-sector-variable-in-raid0_mak.patch deleted file mode 100644 index 772d098aa..000000000 --- a/md-raid0-fix-restore-to-sector-variable-in-raid0_mak.patch +++ /dev/null @@ -1,48 +0,0 @@ -From: Eric Work -Date: Tue, 19 May 2015 06:26:23 -0700 -Subject: [PATCH] md/raid0: fix restore to sector variable in - raid0_make_request - -md/raid0: fix restore to sector variable in raid0_make_request - -The variable "sector" in "raid0_make_request()" was improperly updated -by a call to "sector_div()" which modifies its first argument in place. -Commit 47d68979cc968535cb87f3e5f2e6a3533ea48fbd restored this variable -after the call for later re-use. Unfortunetly the restore was done after -the referenced variable "bio" was advanced. This lead to the original -value and the restored value being different. Here we move this line to -the proper place. - -One observed side effect of this bug was discarding a file though -unlinking would cause an unrelated file's contents to be discarded. - -Signed-off-by: NeilBrown -Fixes: 47d68979cc96 ("md/raid0: fix bug with chunksize not a power of 2.") -Cc: stable@vger.kernel.org (any that received above backport) -URL: https://bugzilla.kernel.org/show_bug.cgi?id=98501 ---- - drivers/md/raid0.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c -index 3b5d7f704aa3..903391ce9353 100644 ---- a/drivers/md/raid0.c -+++ b/drivers/md/raid0.c -@@ -517,6 +517,9 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio) - ? (sector & (chunk_sects-1)) - : sector_div(sector, chunk_sects)); - -+ /* Restore due to sector_div */ -+ sector = bio->bi_iter.bi_sector; -+ - if (sectors < bio_sectors(bio)) { - split = bio_split(bio, sectors, GFP_NOIO, fs_bio_set); - bio_chain(split, bio); -@@ -524,7 +527,6 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio) - split = bio; - } - -- sector = bio->bi_iter.bi_sector; - zone = find_zone(mddev->private, §or); - tmp_dev = map_sector(mddev, zone, sector, §or); - split->bi_bdev = tmp_dev->bdev; diff --git a/mnt-Fail-collect_mounts-when-applied-to-unmounted-mo.patch b/mnt-Fail-collect_mounts-when-applied-to-unmounted-mo.patch deleted file mode 100644 index 8faecac84..000000000 --- a/mnt-Fail-collect_mounts-when-applied-to-unmounted-mo.patch +++ /dev/null @@ -1,48 +0,0 @@ -From: "Eric W. Biederman" -Date: Wed, 7 Jan 2015 14:28:26 -0600 -Subject: [PATCH] mnt: Fail collect_mounts when applied to unmounted mounts - -commit cd4a40174b71acd021877341684d8bb1dc8ea4ae upstream. - -The only users of collect_mounts are in audit_tree.c - -In audit_trim_trees and audit_add_tree_rule the path passed into -collect_mounts is generated from kern_path passed an audit_tree -pathname which is guaranteed to be an absolute path. In those cases -collect_mounts is obviously intended to work on mounted paths and -if a race results in paths that are unmounted when collect_mounts -it is reasonable to fail early. - -The paths passed into audit_tag_tree don't have the absolute path -check. But are used to play with fsnotify and otherwise interact with -the audit_trees, so again operating only on mounted paths appears -reasonable. - -Avoid having to worry about what happens when we try and audit -unmounted filesystems by restricting collect_mounts to mounts -that appear in the mount tree. - -Signed-off-by: "Eric W. Biederman" -Signed-off-by: Greg Kroah-Hartman ---- - fs/namespace.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/fs/namespace.c b/fs/namespace.c -index 38ed1e1bed41..13b0f7bfc096 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -1709,8 +1709,11 @@ struct vfsmount *collect_mounts(struct path *path) - { - struct mount *tree; - namespace_lock(); -- tree = copy_tree(real_mount(path->mnt), path->dentry, -- CL_COPY_ALL | CL_PRIVATE); -+ if (!check_mnt(real_mount(path->mnt))) -+ tree = ERR_PTR(-EINVAL); -+ else -+ tree = copy_tree(real_mount(path->mnt), path->dentry, -+ CL_COPY_ALL | CL_PRIVATE); - namespace_unlock(); - if (IS_ERR(tree)) - return ERR_CAST(tree); diff --git a/ovl-don-t-remove-non-empty-opaque-directory.patch b/ovl-don-t-remove-non-empty-opaque-directory.patch deleted file mode 100644 index 1f29e1efc..000000000 --- a/ovl-don-t-remove-non-empty-opaque-directory.patch +++ /dev/null @@ -1,57 +0,0 @@ -From: Miklos Szeredi -Date: Thu, 14 May 2015 10:04:44 +0200 -Subject: [PATCH] ovl: don't remove non-empty opaque directory - -When removing an opaque directory we can't just call rmdir() to check for -emptiness, because the directory will need to be replaced with a whiteout. -The replacement is done with RENAME_EXCHANGE, which doesn't check -emptiness. - -Solution is just to check emptiness by reading the directory. In the -future we could add a new rename flag to check for emptiness even for -RENAME_EXCHANGE to optimize this case. - -Reported-by: Vincent Batts -Signed-off-by: Miklos Szeredi -Tested-by: Jordi Pujol Palomer -Fixes: 263b4a0fee43 ("ovl: dont replace opaque dir") -Cc: # v4.0+ ---- - fs/overlayfs/dir.c | 24 +++++++++++++++++++----- - 1 file changed, 19 insertions(+), 5 deletions(-) - -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index d139405d2bfa..2578a0c0677d 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -506,11 +506,25 @@ static int ovl_remove_and_whiteout(struct dentry *dentry, bool is_dir) - struct dentry *opaquedir = NULL; - int err; - -- if (is_dir && OVL_TYPE_MERGE_OR_LOWER(ovl_path_type(dentry))) { -- opaquedir = ovl_check_empty_and_clear(dentry); -- err = PTR_ERR(opaquedir); -- if (IS_ERR(opaquedir)) -- goto out; -+ if (is_dir) { -+ if (OVL_TYPE_MERGE_OR_LOWER(ovl_path_type(dentry))) { -+ opaquedir = ovl_check_empty_and_clear(dentry); -+ err = PTR_ERR(opaquedir); -+ if (IS_ERR(opaquedir)) -+ goto out; -+ } else { -+ LIST_HEAD(list); -+ -+ /* -+ * When removing an empty opaque directory, then it -+ * makes no sense to replace it with an exact replica of -+ * itself. But emptiness still needs to be checked. -+ */ -+ err = ovl_check_empty_dir(dentry, &list); -+ ovl_cache_free(&list); -+ if (err) -+ goto out; -+ } - } - - err = ovl_lock_rename_workdir(workdir, upperdir); diff --git a/pty-Fix-input-race-when-closing.patch b/pty-Fix-input-race-when-closing.patch deleted file mode 100644 index fa9bb9725..000000000 --- a/pty-Fix-input-race-when-closing.patch +++ /dev/null @@ -1,284 +0,0 @@ -From: Peter Hurley -Date: Mon, 13 Apr 2015 13:24:34 -0400 -Subject: [PATCH] pty: Fix input race when closing - -A read() from a pty master may mistakenly indicate EOF (errno == -EIO) -after the pty slave has closed, even though input data remains to be read. -For example, - - pty slave | input worker | pty master - | | - | | n_tty_read() -pty_write() | | input avail? no - add data | | sleep - schedule worker --->| | . - |---> flush_to_ldisc() | . -pty_close() | fill read buffer | . - wait for worker | wakeup reader --->| . - | read buffer full? |---> input avail ? yes - |<--- yes - exit worker | copy 4096 bytes to user - TTY_OTHER_CLOSED <---| |<--- kick worker - | | - - **** New read() before worker starts **** - - | | n_tty_read() - | | input avail? no - | | TTY_OTHER_CLOSED? yes - | | return -EIO - -Several conditions are required to trigger this race: -1. the ldisc read buffer must become full so the input worker exits -2. the read() count parameter must be >= 4096 so the ldisc read buffer - is empty -3. the subsequent read() occurs before the kicked worker has processed - more input - -However, the underlying cause of the race is that data is pipelined, while -tty state is not; ie., data already written by the pty slave end is not -yet visible to the pty master end, but state changes by the pty slave end -are visible to the pty master end immediately. - -Pipeline the TTY_OTHER_CLOSED state through input worker to the reader. -1. Introduce TTY_OTHER_DONE which is set by the input worker when - TTY_OTHER_CLOSED is set and either the input buffers are flushed or - input processing has completed. Readers/polls are woken when - TTY_OTHER_DONE is set. -2. Reader/poll checks TTY_OTHER_DONE instead of TTY_OTHER_CLOSED. -3. A new input worker is started from pty_close() after setting - TTY_OTHER_CLOSED, which ensures the TTY_OTHER_DONE state will be - set if the last input worker is already finished (or just about to - exit). - -Remove tty_flush_to_ldisc(); no in-tree callers. - -Fixes: 52bce7f8d4fc ("pty, n_tty: Simplify input processing on final close") -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96311 -BugLink: http://bugs.launchpad.net/bugs/1429756 -Cc: # 3.19+ -Reported-by: Andy Whitcroft -Reported-by: H.J. Lu -Signed-off-by: Peter Hurley ---- - Documentation/serial/tty.txt | 3 +++ - drivers/tty/n_hdlc.c | 4 ++-- - drivers/tty/n_tty.c | 22 ++++++++++++++++++---- - drivers/tty/pty.c | 5 +++-- - drivers/tty/tty_buffer.c | 41 +++++++++++++++++++++++++++-------------- - include/linux/tty.h | 2 +- - 6 files changed, 54 insertions(+), 23 deletions(-) - -diff --git a/Documentation/serial/tty.txt b/Documentation/serial/tty.txt -index 1e52d67d0abf..dbe6623fed1c 100644 ---- a/Documentation/serial/tty.txt -+++ b/Documentation/serial/tty.txt -@@ -198,6 +198,9 @@ TTY_IO_ERROR If set, causes all subsequent userspace read/write - - TTY_OTHER_CLOSED Device is a pty and the other side has closed. - -+TTY_OTHER_DONE Device is a pty and the other side has closed and -+ all pending input processing has been completed. -+ - TTY_NO_WRITE_SPLIT Prevent driver from splitting up writes into - smaller chunks. - -diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c -index 644ddb841d9f..bbc4ce66c2c1 100644 ---- a/drivers/tty/n_hdlc.c -+++ b/drivers/tty/n_hdlc.c -@@ -600,7 +600,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, - add_wait_queue(&tty->read_wait, &wait); - - for (;;) { -- if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) { -+ if (test_bit(TTY_OTHER_DONE, &tty->flags)) { - ret = -EIO; - break; - } -@@ -828,7 +828,7 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp, - /* set bits for operations that won't block */ - if (n_hdlc->rx_buf_list.head) - mask |= POLLIN | POLLRDNORM; /* readable */ -- if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) -+ if (test_bit(TTY_OTHER_DONE, &tty->flags)) - mask |= POLLHUP; - if (tty_hung_up_p(filp)) - mask |= POLLHUP; -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index cf6e0f2e1331..cc57a3a6b02b 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -1949,6 +1949,18 @@ static inline int input_available_p(struct tty_struct *tty, int poll) - return ldata->commit_head - ldata->read_tail >= amt; - } - -+static inline int check_other_done(struct tty_struct *tty) -+{ -+ int done = test_bit(TTY_OTHER_DONE, &tty->flags); -+ if (done) { -+ /* paired with cmpxchg() in check_other_closed(); ensures -+ * read buffer head index is not stale -+ */ -+ smp_mb__after_atomic(); -+ } -+ return done; -+} -+ - /** - * copy_from_read_buf - copy read data directly - * @tty: terminal device -@@ -2167,7 +2179,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, - struct n_tty_data *ldata = tty->disc_data; - unsigned char __user *b = buf; - DEFINE_WAIT_FUNC(wait, woken_wake_function); -- int c; -+ int c, done; - int minimum, time; - ssize_t retval = 0; - long timeout; -@@ -2235,8 +2247,10 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, - ((minimum - (b - buf)) >= 1)) - ldata->minimum_to_wake = (minimum - (b - buf)); - -+ done = check_other_done(tty); -+ - if (!input_available_p(tty, 0)) { -- if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) { -+ if (done) { - retval = -EIO; - break; - } -@@ -2443,12 +2457,12 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, - - poll_wait(file, &tty->read_wait, wait); - poll_wait(file, &tty->write_wait, wait); -+ if (check_other_done(tty)) -+ mask |= POLLHUP; - if (input_available_p(tty, 1)) - mask |= POLLIN | POLLRDNORM; - if (tty->packet && tty->link->ctrl_status) - mask |= POLLPRI | POLLIN | POLLRDNORM; -- if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) -- mask |= POLLHUP; - if (tty_hung_up_p(file)) - mask |= POLLHUP; - if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) { -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index e72ee629cead..4d5e8409769c 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -53,9 +53,8 @@ static void pty_close(struct tty_struct *tty, struct file *filp) - /* Review - krefs on tty_link ?? */ - if (!tty->link) - return; -- tty_flush_to_ldisc(tty->link); - set_bit(TTY_OTHER_CLOSED, &tty->link->flags); -- wake_up_interruptible(&tty->link->read_wait); -+ tty_flip_buffer_push(tty->link->port); - wake_up_interruptible(&tty->link->write_wait); - if (tty->driver->subtype == PTY_TYPE_MASTER) { - set_bit(TTY_OTHER_CLOSED, &tty->flags); -@@ -243,7 +242,9 @@ static int pty_open(struct tty_struct *tty, struct file *filp) - goto out; - - clear_bit(TTY_IO_ERROR, &tty->flags); -+ /* TTY_OTHER_CLOSED must be cleared before TTY_OTHER_DONE */ - clear_bit(TTY_OTHER_CLOSED, &tty->link->flags); -+ clear_bit(TTY_OTHER_DONE, &tty->link->flags); - set_bit(TTY_THROTTLED, &tty->flags); - return 0; - -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index 75661641f5fe..2f78b77f0f81 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -37,6 +37,28 @@ - - #define TTY_BUFFER_PAGE (((PAGE_SIZE - sizeof(struct tty_buffer)) / 2) & ~0xFF) - -+/* -+ * If all tty flip buffers have been processed by flush_to_ldisc() or -+ * dropped by tty_buffer_flush(), check if the linked pty has been closed. -+ * If so, wake the reader/poll to process -+ */ -+static inline void check_other_closed(struct tty_struct *tty) -+{ -+ unsigned long flags, old; -+ -+ /* transition from TTY_OTHER_CLOSED => TTY_OTHER_DONE must be atomic */ -+ for (flags = ACCESS_ONCE(tty->flags); -+ test_bit(TTY_OTHER_CLOSED, &flags); -+ ) { -+ old = flags; -+ __set_bit(TTY_OTHER_DONE, &flags); -+ flags = cmpxchg(&tty->flags, old, flags); -+ if (old == flags) { -+ wake_up_interruptible(&tty->read_wait); -+ break; -+ } -+ } -+} - - /** - * tty_buffer_lock_exclusive - gain exclusive access to buffer -@@ -229,6 +251,8 @@ void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld) - if (ld && ld->ops->flush_buffer) - ld->ops->flush_buffer(tty); - -+ check_other_closed(tty); -+ - atomic_dec(&buf->priority); - mutex_unlock(&buf->lock); - } -@@ -471,8 +495,10 @@ static void flush_to_ldisc(struct work_struct *work) - smp_rmb(); - count = head->commit - head->read; - if (!count) { -- if (next == NULL) -+ if (next == NULL) { -+ check_other_closed(tty); - break; -+ } - buf->head = next; - tty_buffer_free(port, head); - continue; -@@ -489,19 +515,6 @@ static void flush_to_ldisc(struct work_struct *work) - } - - /** -- * tty_flush_to_ldisc -- * @tty: tty to push -- * -- * Push the terminal flip buffers to the line discipline. -- * -- * Must not be called from IRQ context. -- */ --void tty_flush_to_ldisc(struct tty_struct *tty) --{ -- flush_work(&tty->port->buf.work); --} -- --/** - * tty_flip_buffer_push - terminal - * @port: tty port to push - * -diff --git a/include/linux/tty.h b/include/linux/tty.h -index 358a337af598..790752ac074a 100644 ---- a/include/linux/tty.h -+++ b/include/linux/tty.h -@@ -339,6 +339,7 @@ struct tty_file_private { - #define TTY_EXCLUSIVE 3 /* Exclusive open mode */ - #define TTY_DEBUG 4 /* Debugging */ - #define TTY_DO_WRITE_WAKEUP 5 /* Call write_wakeup after queuing new */ -+#define TTY_OTHER_DONE 6 /* Closed pty has completed input processing */ - #define TTY_LDISC_OPEN 11 /* Line discipline is open */ - #define TTY_PTY_LOCK 16 /* pty private */ - #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ -@@ -462,7 +463,6 @@ extern int tty_hung_up_p(struct file *filp); - extern void do_SAK(struct tty_struct *tty); - extern void __do_SAK(struct tty_struct *tty); - extern void no_tty(void); --extern void tty_flush_to_ldisc(struct tty_struct *tty); - extern void tty_buffer_free_all(struct tty_port *port); - extern void tty_buffer_flush(struct tty_struct *tty, struct tty_ldisc *ld); - extern void tty_buffer_init(struct tty_port *port); diff --git a/sched-always-use-blk_schedule_flush_plug-in-io_sched.patch b/sched-always-use-blk_schedule_flush_plug-in-io_sched.patch deleted file mode 100644 index 7943ef834..000000000 --- a/sched-always-use-blk_schedule_flush_plug-in-io_sched.patch +++ /dev/null @@ -1,102 +0,0 @@ -From: Shaohua Li -Date: Fri, 8 May 2015 10:51:29 -0700 -Subject: [PATCH] sched: always use blk_schedule_flush_plug in io_schedule_out - -block plug callback could sleep, so we introduce a parameter -'from_schedule' and corresponding drivers can use it to destinguish a -schedule plug flush or a plug finish. Unfortunately io_schedule_out -still uses blk_flush_plug(). This causes below output (Note, I added a -might_sleep() in raid1_unplug to make it trigger faster, but the whole -thing doesn't matter if I add might_sleep). In raid1/10, this can cause -deadlock. - -This patch makes io_schedule_out always uses blk_schedule_flush_plug. -This should only impact drivers (as far as I know, raid 1/10) which are -sensitive to the 'from_schedule' parameter. - -[ 370.817949] ------------[ cut here ]------------ -[ 370.817960] WARNING: CPU: 7 PID: 145 at ../kernel/sched/core.c:7306 __might_sleep+0x7f/0x90() -[ 370.817969] do not call blocking ops when !TASK_RUNNING; state=2 set at [] prepare_to_wait+0x2f/0x90 -[ 370.817971] Modules linked in: raid1 -[ 370.817976] CPU: 7 PID: 145 Comm: kworker/u16:9 Tainted: G W 4.0.0+ #361 -[ 370.817977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014 -[ 370.817983] Workqueue: writeback bdi_writeback_workfn (flush-9:1) -[ 370.817985] ffffffff81cd83be ffff8800ba8cb298 ffffffff819dd7af 0000000000000001 -[ 370.817988] ffff8800ba8cb2e8 ffff8800ba8cb2d8 ffffffff81051afc ffff8800ba8cb2c8 -[ 370.817990] ffffffffa00061a8 000000000000041e 0000000000000000 ffff8800ba8cba28 -[ 370.817993] Call Trace: -[ 370.817999] [] dump_stack+0x4f/0x7b -[ 370.818002] [] warn_slowpath_common+0x8c/0xd0 -[ 370.818004] [] warn_slowpath_fmt+0x46/0x50 -[ 370.818006] [] ? prepare_to_wait+0x2f/0x90 -[ 370.818008] [] ? prepare_to_wait+0x2f/0x90 -[ 370.818010] [] __might_sleep+0x7f/0x90 -[ 370.818014] [] raid1_unplug+0xd3/0x170 [raid1] -[ 370.818024] [] blk_flush_plug_list+0x8a/0x1e0 -[ 370.818028] [] ? bit_wait+0x50/0x50 -[ 370.818031] [] io_schedule_timeout+0x130/0x140 -[ 370.818033] [] bit_wait_io+0x36/0x50 -[ 370.818034] [] __wait_on_bit+0x65/0x90 -[ 370.818041] [] ? ext4_read_block_bitmap_nowait+0xbc/0x630 -[ 370.818043] [] ? bit_wait+0x50/0x50 -[ 370.818045] [] out_of_line_wait_on_bit+0x72/0x80 -[ 370.818047] [] ? autoremove_wake_function+0x40/0x40 -[ 370.818050] [] __wait_on_buffer+0x44/0x50 -[ 370.818053] [] ext4_wait_block_bitmap+0xe0/0xf0 -[ 370.818058] [] ext4_mb_init_cache+0x206/0x790 -[ 370.818062] [] ? lru_cache_add+0x1c/0x50 -[ 370.818064] [] ext4_mb_init_group+0x11e/0x200 -[ 370.818066] [] ext4_mb_load_buddy+0x341/0x360 -[ 370.818068] [] ext4_mb_find_by_goal+0x93/0x2f0 -[ 370.818070] [] ? ext4_mb_normalize_request+0x1e4/0x5b0 -[ 370.818072] [] ext4_mb_regular_allocator+0x67/0x460 -[ 370.818074] [] ? ext4_mb_normalize_request+0x1e4/0x5b0 -[ 370.818076] [] ext4_mb_new_blocks+0x4cb/0x620 -[ 370.818079] [] ext4_ext_map_blocks+0x4c6/0x14d0 -[ 370.818081] [] ? ext4_es_lookup_extent+0x4e/0x290 -[ 370.818085] [] ext4_map_blocks+0x14d/0x4f0 -[ 370.818088] [] ext4_writepages+0x76d/0xe50 -[ 370.818094] [] do_writepages+0x21/0x50 -[ 370.818097] [] __writeback_single_inode+0x60/0x490 -[ 370.818099] [] writeback_sb_inodes+0x2da/0x590 -[ 370.818103] [] ? trylock_super+0x1b/0x50 -[ 370.818105] [] ? trylock_super+0x1b/0x50 -[ 370.818107] [] __writeback_inodes_wb+0x9f/0xd0 -[ 370.818109] [] wb_writeback+0x34b/0x3c0 -[ 370.818111] [] bdi_writeback_workfn+0x23f/0x550 -[ 370.818116] [] process_one_work+0x1c8/0x570 -[ 370.818117] [] ? process_one_work+0x14b/0x570 -[ 370.818119] [] worker_thread+0x11b/0x470 -[ 370.818121] [] ? process_one_work+0x570/0x570 -[ 370.818124] [] kthread+0xf8/0x110 -[ 370.818126] [] ? kthread_create_on_node+0x210/0x210 -[ 370.818129] [] ret_from_fork+0x42/0x70 -[ 370.818131] [] ? kthread_create_on_node+0x210/0x210 -[ 370.818132] ---[ end trace 7b4deb71e68b6605 ]--- - -V2: don't change ->in_iowait - -Cc: NeilBrown -Signed-off-by: Shaohua Li -Reviewed-by: Jeff Moyer -Signed-off-by: Jens Axboe ---- - kernel/sched/core.c | 5 +---- - 1 file changed, 1 insertion(+), 4 deletions(-) - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 3d5f6f6d14c2..47045a5c7f46 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -4382,10 +4382,7 @@ long __sched io_schedule_timeout(long timeout) - long ret; - - current->in_iowait = 1; -- if (old_iowait) -- blk_schedule_flush_plug(current); -- else -- blk_flush_plug(current); -+ blk_schedule_flush_plug(current); - - delayacct_blkio_start(); - rq = raw_rq(); diff --git a/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch b/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch index 880d57380..1438d4e76 100644 --- a/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch +++ b/scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch @@ -9,10 +9,10 @@ Upstream-status: Fedora mustard (might be worth dropping...) 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 3290a3ed5b31..3c682f62925c 100644 +index a661d339adf7..d76e957e3ea4 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c -@@ -2750,13 +2750,18 @@ static int sd_try_extended_inquiry(struct scsi_device *sdp) +@@ -2741,13 +2741,18 @@ static int sd_try_extended_inquiry(struct scsi_device *sdp) static int sd_revalidate_disk(struct gendisk *disk) { struct scsi_disk *sdkp = scsi_disk(disk); diff --git a/sources b/sources index 47a88df1e..5556d288f 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ a86916bd12798220da9eb4a1eec3616d linux-4.0.tar.xz d125eecce68ab6fb5f1f23523c2c04b8 perf-man-4.0.tar.gz -30de8c55237264deee4d4fc60eee78fd patch-4.0.4.xz +d634b677385910495fd0c831c0cc5520 patch-4.0.5.xz diff --git a/vfs-read-file_handle-only-once-in-handle_to_path.patch b/vfs-read-file_handle-only-once-in-handle_to_path.patch deleted file mode 100644 index 0329d12ee..000000000 --- a/vfs-read-file_handle-only-once-in-handle_to_path.patch +++ /dev/null @@ -1,39 +0,0 @@ -From: Sasha Levin -Date: Wed, 28 Jan 2015 15:30:43 -0500 -Subject: [PATCH] vfs: read file_handle only once in handle_to_path - -We used to read file_handle twice. Once to get the amount of extra -bytes, and once to fetch the entire structure. - -This may be problematic since we do size verifications only after the -first read, so if the number of extra bytes changes in userspace between -the first and second calls, we'll have an incoherent view of -file_handle. - -Instead, read the constant size once, and copy that over to the final -structure without having to re-read it again. - -Signed-off-by: Sasha Levin -Cc: Al Viro -Cc: stable@vger.kernel.org -Signed-off-by: Linus Torvalds ---- - fs/fhandle.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/fs/fhandle.c b/fs/fhandle.c -index 999ff5c3cab0..d59712dfa3e7 100644 ---- a/fs/fhandle.c -+++ b/fs/fhandle.c -@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, - goto out_err; - } - /* copy the full handle */ -- if (copy_from_user(handle, ufh, -- sizeof(struct file_handle) + -+ *handle = f_handle; -+ if (copy_from_user(&handle->f_handle, -+ &ufh->f_handle, - f_handle.handle_bytes)) { - retval = -EFAULT; - goto out_handle;