commit 3820288942d1c1524c3ee85cbf503fee1533cfc3
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon Nov 5 09:57:06 2012 +0100
Linux 3.6.6
commit 8c1118a286324e4c16352b317f4531e82ede021a
Author: Ben Skeggs <bskeggs@redhat.com>
Date: Thu Nov 1 16:16:32 2012 +1000
drm/nouveau: headless mode by default if pci class != vga display
This is to prevent nouveau from taking over the console on headless boards
such as Tesla.
Backport of upstream commit: e412e95a268fa8544858ebfe066826b290430d51
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 83dc21544384ae8db01cc1c1a159ae6594444534
Author: Ben Skeggs <bskeggs@redhat.com>
Date: Thu Nov 1 16:16:31 2012 +1000
drm/nouveau: fix suspend/resume when in headless mode
Backport of fixes from upstream commit:
9430738d80223a1cd791a2baa74fa170d3df1262
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 783250d700a2ab8d12040dec188b291328e13225
Author: Ben Skeggs <bskeggs@redhat.com>
Date: Mon Oct 29 09:03:07 2012 +1000
drm/nouveau: silence modesetting spam on pre-gf8 chipsets
commit cee59f15a60cc6269a25e3f6fbf1a577d6ab8115 upstream.
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b2c70f388db2633fdbfe14f28d2133dd580fbb33
Author: Jiri Slaby <jslaby@suse.cz>
Date: Fri Oct 19 13:28:46 2012 +0200
HID: microsoft: fix invalid rdesc for 3k kbd
commit 3ccc60f9d8c39180c205dba1a020735bda1b2491 upstream.
Microsoft Digital Media Keyboard 3000 has two interfaces, and the
second one has a report descriptor with a bug. The second collection
says:
05 01 -- global; usage page -- 01 -- Generic Desktop Controls
09 80 -- local; usage -- 80 -- System Control
a1 01 -- main; collection -- 01 -- application
85 03 -- global; report ID -- 03
19 00 -- local; Usage Minimum -- 00
29 ff -- local; Usage Maximum -- ff
15 00 -- global; Logical Minimum -- 0
26 ff 00 -- global; Logical Maximum -- ff
81 00 -- main; input
c0 -- main; End Collection
I.e. it makes us think that there are all kinds of usages of system
control. That the keyboard is a not only a keyboard, but also a
joystick, mouse, gamepad, keypad, etc. The same as for the Wireless
Desktop Receiver, this should be Physical Min/Max. So fix that
appropriately.
References: https://bugzilla.novell.com/show_bug.cgi?id=776834
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2ec0fe7bd41bd500e58702291edc5f7285ada81e
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date: Fri Oct 26 15:35:45 2012 -0700
target: Fix double-free of se_cmd in target_complete_tmr_failure
commit e13d5fef88c40b87c8430f8274c3a9ca32ef90bc upstream.
Fabric drivers currently expect to internally release se_cmd in the event
of a TMR failure during target_submit_tmr(), which means the immediate call
to transport_generic_free_cmd() after TFO->queue_tm_rsp() from within
target_complete_tmr_failure() workqueue context is wrong.
This is done as some fabrics expect TMR operations to be acknowledged
before releasing the descriptor, so the assumption that core is releasing
se_cmd associated TMR memory is incorrect. This fixes a OOPs where
transport_generic_free_cmd() was being called more than once.
This bug was originally observed with tcm_qla2xxx fabric ports.
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Roland Dreier <roland@purestorage.com>
Cc: Andy Grover <agrover@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c7b3b9dff21b8beb7f3f49719b58495d4f744379
Author: Bernhard Kohl <bernhard.kohl@nsn.com>
Date: Wed Oct 24 15:53:58 2012 +0200
target: reintroduce some obsolete SCSI-2 commands
commit 1a1ff38c4cebf23be8bf0009a76b082a13bd25cb upstream.
With kernel 3.6 some obsolete SCSI-2 commands including SEEK_10 have
have been removed by commit 1fd032ee10d2816c947f5d5b9abda95e728f0a8f
"target: move code for CDB emulation".
There are still clients out there which use these old SCSI-2 commands.
This mainly happens when running VMs with legacy guest systems,
connected via SCSI command pass-through to iSCSI targets. Make them
happy and return status GOOD.
Many real SCSI disks or external iSCSI storage devices still support
these old commands. So let's make LIO backward compatible as well.
This patch adds support for the previously removed SEEK_10 and
additionally the SEEK_6 and REZERO_UNIT commands.
Signed-off-by: Bernhard Kohl <bernhard.kohl@nsn.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aa927fcb2d23c7f0b1e350335eb822f5179c49a9
Author: Roland Dreier <roland@purestorage.com>
Date: Thu Oct 11 13:41:32 2012 -0700
qla2xxx: Update target lookup session tables when a target session changes
commit c8292d1da53fa60c7516ab03a9d83f7ea266d335 upstream.
It is possible for the target code to change the loop_id or s_id of a
target session in reaction to an FC fabric change. However, the
session structures are stored in tables that are indexed by these two
keys, and if we just change the session structure but leave the
pointers to it in the old places in the table, havoc can ensue. For
example, a new session might come along that should go in the old slot
in the table and overwrite the old session pointer.
To handle this, add a new tgt_ops->update_sess() method that also
updates the "by loop_id" and "by s_id" lookup tables when a session
changes, so that the keys where a session pointer is stored in these
tables always matches the keys in the session structure itself.
(nab: Drop unnecessary double inversion with FCF_CONF_COMP_SUPPORTED
usage)
Signed-off-by: Roland Dreier <roland@purestorage.com>
Cc: Chad Dupuis <chad.dupuis@qlogic.com>
Cc: Arun Easi <arun.easi@qlogic.com>
Cc: Saurav Kashyap <saurav.kashyap@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 16d6c35cfbed79472c8e2ae2df5b4935c2ac588b
Author: Paul Bolle <pebolle@tiscali.nl>
Date: Tue Oct 30 10:38:06 2012 +0100
USB: io_edgeport: remove unused variable
The stable commit 12ddc74e8e25107eda81aceb74e3311c1480b381
("USB: io_edgeport: fix port-data memory leak") left one variable
unused:
drivers/usb/serial/io_edgeport.c: In function 'edge_release':
drivers/usb/serial/io_edgeport.c:3155:6: warning: unused variable 'i' [-Wunused-variable]
Remove this unused variable.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 7b746b16909444af2d207b010b89885591ea54d0
Author: Johan Hovold <jhovold@gmail.com>
Date: Wed Oct 31 20:48:54 2012 +0100
USB: iuu_phoenix: fix backported patches
Fix two memory leaks involving dbgbuf that were introduced in port-probe
error paths when backporting the following port-data fixes from v3.7
(which doesn't have dbgbuf):
0978c94 USB: iuu_phoenix: fix sysfs-attribute creation
5363655 USB: iuu_phoenix: fix port-data memory leak
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0813e85449a343a214462346f146f7b0f6a2053d
Author: Johan Hovold <jhovold@gmail.com>
Date: Wed Oct 31 20:52:42 2012 +0100
USB: mos7840: fix port-data memory leak
commit 80c00750f0c9867a65b30a17880939b6bc660a77 upstream.
Fix port-data memory leak by moving port data allocation and
deallocation to port_probe and port_remove.
Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no
driver is bound) the port private data is no longer freed at release as
it is no longer accessible.
Note that the indentation was kept intact using a do-while(0) in order
to facilitate review. A follow-up patch will remove it.
Compile-only tested.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b7639e25716afc0211bcc14006a4af4e9e9bc2b9
Author: Alex Elder <elder@inktank.com>
Date: Tue Oct 2 10:25:51 2012 -0500
ceph: avoid 32-bit page index overflow
commit 6285bc231277419255f3498d3eb5ddc9f8e7fe79 upstream.
A pgoff_t is defined (by default) to have type (unsigned long). On
architectures such as i686 that's a 32-bit type. The ceph address
space code was attempting to produce 64 bit offsets by shifting a
page's index by PAGE_CACHE_SHIFT, but the result was not what was
desired because the shift occurred before the result got promoted
to 64 bits.
Fix this by converting all uses of page->index used in this way to
use the page_offset() macro, which ensures the 64-bit result has the
intended value.
This fixes http://tracker.newdream.net/issues/3112
Reported-by: Mohamed Pakkeer <pakkeer.mohideen@realimage.com>
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 343c7f0dcb36f71bc4edfc602eb8c20faf88fa65
Author: Sage Weil <sage@inktank.com>
Date: Mon Sep 24 20:59:48 2012 -0700
libceph: check for invalid mapping
commit d63b77f4c552cc3a20506871046ab0fcbc332609 upstream.
If we encounter an invalid (e.g., zeroed) mapping, return an error
and avoid a divide by zero.
Signed-off-by: Sage Weil <sage@inktank.com>
Reviewed-by: Alex Elder <elder@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1ad6768c537d57fec3dcb249cd384332cfacfe24
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date: Thu Sep 20 17:42:25 2012 +0800
ceph: Fix oops when handling mdsmap that decreases max_mds
commit 3e8f43a089f06279c5f76a9ccd42578eebf7bfa5 upstream.
When i >= newmap->m_max_mds, ceph_mdsmap_get_addr(newmap, i) return
NULL. Passing NULL to memcmp() triggers oops.
Signed-off-by: Yan, Zheng <zheng.z.yan@intel.com>
Signed-off-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit aeb469d6f6b311f531df80d25a82b297cffc4569
Author: David Zafman <david.zafman@inktank.com>
Date: Thu Oct 18 14:01:43 2012 -0700
ceph: fix dentry reference leak in encode_fh()
commit 52eb5a900a9863a8b77a895f770e5d825c8e02c6 upstream.
Call to d_find_alias() needs a corresponding dput()
This fixes http://tracker.newdream.net/issues/3271
Signed-off-by: David Zafman <david.zafman@inktank.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit b6f8fbbad7bf2511aea493b0dc7be92e3b5c5a8d
Author: Sage Weil <sage@inktank.com>
Date: Wed Oct 24 16:12:58 2012 -0700
libceph: avoid NULL kref_put when osd reset races with alloc_msg
commit 9bd952615a42d7e2ce3fa2c632e808e804637a1a upstream.
The ceph_on_in_msg_alloc() method drops con->mutex while it allocates a
message. If that races with a timeout that resends a zillion messages and
resets the connection, and the ->alloc_msg() method returns a NULL message,
it will call ceph_msg_put(NULL) and BUG.
Fix by only calling put if msg is non-NULL.
Fixes http://tracker.newdream.net/issues/3142
Signed-off-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit a407c28651969f9e34fd51ea0415886b70e5c991
Author: Alex Elder <elder@inktank.com>
Date: Mon Oct 8 20:37:30 2012 -0700
rbd: reset BACKOFF if unable to re-queue
commit 588377d6199034c36d335e7df5818b731fea072c upstream.
If ceph_fault() is unable to queue work after a delay, it sets the
BACKOFF connection flag so con_work() will attempt to do so.
In con_work(), when BACKOFF is set, if queue_delayed_work() doesn't
result in newly-queued work, it simply ignores this condition and
proceeds as if no backoff delay were desired. There are two
problems with this--one of which is a bug.
The first problem is simply that the intended behavior is to back
off, and if we aren't able queue the work item to run after a delay
we're not doing that.
The only reason queue_delayed_work() won't queue work is if the
provided work item is already queued. In the messenger, this
means that con_work() is already scheduled to be run again. So
if we simply set the BACKOFF flag again when this occurs, we know
the next con_work() call will again attempt to hold off activity
on the connection until after the delay.
The second problem--the bug--is a leak of a reference count. If
queue_delayed_work() returns 0 in con_work(), con->ops->put() drops
the connection reference held on entry to con_work(). However,
processing is (was) allowed to continue, and at the end of the
function a second con->ops->put() is called.
This patch fixes both problems.
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Sage Weil <sage@inktank.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6d59ab3707595e1a7b2e6051ff3f5f0dabd0ad06
Author: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Date: Mon Aug 27 20:56:54 2012 -0300
floppy: properly handle failure on add_disk loop
commit d60e7ec18c3fb2cbf90969ccd42889eb2d03aef9 upstream.
On floppy initialization, if something failed inside the loop we call
add_disk, there was no cleanup of previous iterations in the error
handling.
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit d4eaaf6e3cf75c8394a36b6de67a1771da5ed2ee
Author: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Date: Mon Aug 27 20:56:52 2012 -0300
floppy: do put_disk on current dr if blk_init_queue fails
commit 238ab78469c6ab7845b43d5061cd3c92331b2452 upstream.
If blk_init_queue fails, we do not call put_disk on the current dr
(dr is decremented first in the error handling loop).
Reviewed-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 0de4380ecfc63f6f3940b9ec03c36c78f008ac12
Author: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Date: Mon Aug 27 20:56:51 2012 -0300
floppy: don't call alloc_ordered_workqueue inside the alloc_disk loop
commit b54e1f88897bcacc2cd359f48ea3b39eaf55f084 upstream.
Since commit 070ad7e ("floppy: convert to delayed work and single-thread
wq"), we end up calling alloc_ordered_workqueue multiple times inside
the loop, which shouldn't be intended. Besides the leak, other side
effect in the current code is if blk_init_queue fails, we would end up
calling unregister_blkdev even if we didn't call yet register_blkdev.
Just moved the allocation of floppy_wq before the loop, and adjusted the
code accordingly.
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Reviewed-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 636b755668eefd3537af58e7843ef8389c4d03b6
Author: NeilBrown <neilb@suse.de>
Date: Wed Oct 31 11:42:03 2012 +1100
md/raid1: Fix assembling of arrays containing Replacements.
commit 02b898f2f04e418094f0093a3ad0b415bcdbe8eb upstream.
setup_conf in raid1.c uses conf->raid_disks before assigning
a value. It is used when including 'Replacement' devices.
The consequence is that assembling an array which contains a
replacement will misbehave and either not include the replacement, or
not include the device being replaced.
Though this doesn't lead directly to data corruption, it could lead to
reduced data safety.
So use mddev->raid_disks, which is initialised, instead.
Bug was introduced by commit c19d57980b38a5bb613a898937a1cf85f422fb9b
md/raid1: recognise replacements when assembling arrays.
in 3.3, so fix is suitable for 3.3.y thru 3.6.y.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 4b4717878e2e70626855d5a6b4639a8e37599acc
Author: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu Oct 25 14:03:03 2012 +0300
gpiolib: Don't return -EPROBE_DEFER to sysfs, or for invalid gpios
commit ad2fab36d7922401c4576fb7ea9b21a47a29a17f upstream.
gpios requested with invalid numbers, or gpios requested from userspace via sysfs
should not try to be deferred on failure.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 11d65f48c02dae54020c407d1cf3f2dfd44e88c0
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu Oct 11 09:56:35 2012 +0300
gpio-timberdale: fix a potential wrapping issue
commit d79550a7bc35c16476ebdc27c78378d8093390ec upstream.
->last_ier is an unsigned long but the high bits can't be used int the
original code because the shift wraps.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit edf5181e0804d4d484b11b4d4e8150a80a39908b
Author: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Date: Wed Oct 17 17:45:36 2012 +0900
blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg
commit 65635cbc37e011e71b208257a25e7c1078cd039b upstream.
blk_put_rl() does not call blkg_put() for q->root_rl because we
don't take request list reference on q->root_blkg.
However, if root_blkg is once attached then detached (freed),
blk_put_rl() is confused by the bogus pointer in q->root_blkg.
For example, with !CONFIG_BLK_DEV_THROTTLING &&
CONFIG_CFQ_GROUP_IOSCHED,
switching IO scheduler from cfq to deadline will cause system stall
after the following warning with 3.6:
> WARNING: at /work/build/linux/block/blk-cgroup.h:250
> blk_put_rl+0x4d/0x95()
> Modules linked in: bridge stp llc sunrpc acpi_cpufreq freq_table mperf
> ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4
> Pid: 0, comm: swapper/0 Not tainted 3.6.0 #1
> Call Trace:
> <IRQ> [<ffffffff810453bd>] warn_slowpath_common+0x85/0x9d
> [<ffffffff810453ef>] warn_slowpath_null+0x1a/0x1c
> [<ffffffff811d5f8d>] blk_put_rl+0x4d/0x95
> [<ffffffff811d614a>] __blk_put_request+0xc3/0xcb
> [<ffffffff811d71a3>] blk_finish_request+0x232/0x23f
> [<ffffffff811d76c3>] ? blk_end_bidi_request+0x34/0x5d
> [<ffffffff811d76d1>] blk_end_bidi_request+0x42/0x5d
> [<ffffffff811d7728>] blk_end_request+0x10/0x12
> [<ffffffff812cdf16>] scsi_io_completion+0x207/0x4d5
> [<ffffffff812c6fcf>] scsi_finish_command+0xfa/0x103
> [<ffffffff812ce2f8>] scsi_softirq_done+0xff/0x108
> [<ffffffff811dcea5>] blk_done_softirq+0x8d/0xa1
> [<ffffffff810915d5>] ?
> generic_smp_call_function_single_interrupt+0x9f/0xd7
> [<ffffffff8104cf5b>] __do_softirq+0x102/0x213
> [<ffffffff8108a5ec>] ? lock_release_holdtime+0xb6/0xbb
> [<ffffffff8104d2b4>] ? raise_softirq_irqoff+0x9/0x3d
> [<ffffffff81424dfc>] call_softirq+0x1c/0x30
> [<ffffffff81011beb>] do_softirq+0x4b/0xa3
> [<ffffffff8104cdb0>] irq_exit+0x53/0xd5
> [<ffffffff8102d865>] smp_call_function_single_interrupt+0x34/0x36
> [<ffffffff8142486f>] call_function_single_interrupt+0x6f/0x80
> <EOI> [<ffffffff8101800b>] ? mwait_idle+0x94/0xcd
> [<ffffffff81018002>] ? mwait_idle+0x8b/0xcd
> [<ffffffff81017811>] cpu_idle+0xbb/0x114
> [<ffffffff81401fbd>] rest_init+0xc1/0xc8
> [<ffffffff81401efc>] ? csum_partial_copy_generic+0x16c/0x16c
> [<ffffffff81cdbd3d>] start_kernel+0x3d4/0x3e1
> [<ffffffff81cdb79e>] ? kernel_init+0x1f7/0x1f7
> [<ffffffff81cdb2dd>] x86_64_start_reservations+0xb8/0xbd
> [<ffffffff81cdb3e3>] x86_64_start_kernel+0x101/0x110
This patch clears q->root_blkg and q->root_rl.blkg when root blkg
is destroyed.
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Acked-by: Vivek Goyal <vgoyal@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit dab43b73a7c7317f941c1314e9a77374ba8999ee
Author: Eric Sandeen <sandeen@redhat.com>
Date: Sun Oct 28 22:24:57 2012 -0400
ext4: fix unjournaled inode bitmap modification
commit ffb5387e85d528fb6d0d924abfa3fbf0fc484071 upstream.
commit 119c0d4460b001e44b41dcf73dc6ee794b98bd31 changed
ext4_new_inode() such that the inode bitmap was being modified
outside a transaction, which could lead to corruption, and was
discovered when journal_checksum found a bad checksum in the
journal during log replay.
Nix ran into this when using the journal_async_commit mount
option, which enables journal checksumming. The ensuing
journal replay failures due to the bad checksums led to
filesystem corruption reported as the now infamous
"Apparent serious progressive ext4 data corruption bug"
[ Changed by tytso to only call ext4_journal_get_write_access() only
when we're fairly certain that we're going to allocate the inode. ]
I've tested this by mounting with journal_checksum and
running fsstress then dropping power; I've also tested by
hacking DM to create snapshots w/o first quiescing, which
allows me to test journal replay repeatedly w/o actually
power-cycling the box. Without the patch I hit a journal
checksum error every time. With this fix it survives
many iterations.
Reported-by: Nix <nix@esperi.org.uk>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>