The new layout pointer in pnfs_find_alloc_layout() may be NULL because of
out of memory. we must do some check work, otherwise pnfs_free_layout_hdr()
will go wrong because it can not deal with a NULL pointer.
Signed-off-by: NYanchuan Nian <ycnian@gmail.com>
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>

The DNS resolver's use of the sunrpc cache involves a 'ttl' number
(relative) rather that a timeout (absolute).  This confused me when
I wrote
  commit c5b29f88
     "sunrpc: use seconds since boot in expiry cache"

and I managed to break it.  The effect is that any TTL is interpreted
as 0, and nothing useful gets into the cache.

This patch removes the use of get_expiry() - which really expects an
expiry time - and uses get_uint() instead, treating the int correctly
as a ttl.

This fixes a regression that has been present since 2.6.37, causing
certain NFS accesses in certain environments to incorrectly fail.
Reported-by: NChuck Lever <chuck.lever@oracle.com>
Tested-by: NChuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: NNeilBrown <neilb@suse.de>
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>

If the state recovery machinery is triggered by the call to
nfs4_async_handle_error() then we can deadlock.
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@vger.kernel.org

If we do not release the sequence id in cases where we fail to get a
session slot, then we can deadlock if we hit a recovery scenario.
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@vger.kernel.org

Currently, we will schedule session recovery and then return to the
caller of nfs4_handle_exception.  This works for most cases, but causes
a hang on the following test case:

	Client				Server
	------				------
	Open file over NFS v4.1
	Write to file
					Expire client
	Try to lock file

The server will return NFS4ERR_BADSESSION, prompting the client to
schedule recovery.  However, the client will continue placing lock
attempts and the open recovery never seems to be scheduled.  The
simplest solution is to wait for session recovery to run before retrying
the lock.
Signed-off-by: NBryan Schumaker <bjschuma@netapp.com>
Signed-off-by: NTrond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@vger.kernel.org

Jack Lin reports that the error return from dup3() for the RLIMIT_NOFILE
case changed incorrectly after 3.6.

The culprit is commit f33ff992 ("take rlimit check to callers of
expand_files()") which when it moved the "return -EMFILE" out to the
caller, didn't notice that the dup3() had special code to turn the
EMFILE return into EBADF.

The replace_fd() helper that got added later then inherited the bug too.
Reported-by: NJack Lin <linliangjie@huawei.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
[ Noted more bugs, wrote proper changelog, fixed up typos - Linus ]
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull md fixes from NeilBrown:
 "Some fixes for md in 3.7
   - one recently introduced crash for dm-raid10 with discard
   - one bug in new functionality that has been around for a few
     releases.
   - minor bug in md's 'faulty' personality

  and UAPI disintegration for md."

* tag 'md-3.7-fixes' of git://neil.brown.name/md:
  MD RAID10: Fix oops when creating RAID10 arrays via dm-raid.c
  md/raid1: Fix assembling of arrays containing Replacements.
  md faulty: use disk_stack_limits()
  UAPI: (Scripted) Disintegrate include/linux/raid

Commit 2863b9eb didn't take into account the changes to add TRIM support to
RAID10 (commit 532a2a3f).  That is, when using dm-raid.c to create the
RAID10 arrays, there is no mddev->gendisk or mddev->queue.  The code added
to support TRIM simply assumes that mddev->queue is available without
checking.  The result is an oops any time dm-raid.c attempts to create a
RAID10 device.
Signed-off-by: NJonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NNeilBrown <neilb@suse.de>

setup_conf in raid1.c uses conf->raid_disks before assigning
a value.  It is used when including 'Replacement' devices.

The consequence is that assembling an array which contains a
replacement will misbehave and either not include the replacement, or
not include the device being replaced.

Though this doesn't lead directly to data corruption, it could lead to
reduced data safety.

So use mddev->raid_disks, which is initialised, instead.

Bug was introduced by commit c19d5798
      md/raid1: recognise replacements when assembling arrays.

in 3.3, so fix is suitable for 3.3.y thru 3.6.y.

Cc: stable@vger.kernel.org
Signed-off-by: NNeilBrown <neilb@suse.de>

Pull GPIO fixes from Linus Walleij:
 - Fix a potential bit wrap issue in the Timberdale driver
 - Fix up the buffer allocation size in the 74x164 driver
 - Set the value in direction_output() right in the mvebu driver
 - Return proper error codes for invalid GPIOs
 - Fix an off-mode bug for the OMAP
 - Don't initialize the mask_cach on the mvebu driver

* tag 'gpio-fixes-v3.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  GPIO: mvebu-gpio: Don't initialize the mask_cache
  gpio/omap: fix off-mode bug: clear debounce settings on free/reset
  gpiolib: Don't return -EPROBE_DEFER to sysfs, or for invalid gpios
  gpio: mvebu: correctly set the value in direction_output()
  gpio-74x164: Fix buffer allocation size
  gpio-timberdale: fix a potential wrapping issue

Pull ext4 bugfix from Ted Ts'o:
 "This fixes the root cause of the ext4 data corruption bug which raised
  a ruckus on LWN, Phoronix, and Slashdot.

  This bug only showed up when non-standard mount options
  (journal_async_commit and/or journal_checksum) were enabled, and when
  the file system was not cleanly unmounted, but the root cause was the
  inode bitmap modifications was not being properly journaled.

  This could potentially lead to minor file system corruptions (pass 5
  complaints with the inode allocation bitmap) after an unclean shutdown
  under the wrong/unlucky workloads, but it turned into major failure if
  the journal_checksum and/or jouaral_async_commit was enabled."

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix unjournaled inode bitmap modification

Pull block driver update from Jens Axboe:
 "Distilled down variant, the rest will pass over to 3.8.  I pulled it
  into the for-linus branch I had waiting for a pull request as well, in
  case you are wondering why there are new entries in here too.  This
  also got rid of two reverts and the ones of the mtip32xx patches that
  went in later in the 3.6 cycle, so the series looks a bit cleaner."

* 'for-linus' of git://git.kernel.dk/linux-block:
  loop: Make explicit loop device destruction lazy
  mtip32xx:Added appropriate timeout value for secure erase
  xen/blkback: Change xen_vbd's flush_support and discard_secure to have type unsigned int, rather than bool
  cciss: select CONFIG_CHECK_SIGNATURE
  cciss: remove unneeded memset()
  xen/blkback: use kmem_cache_zalloc instead of kmem_cache_alloc/memset
  pktcdvd: update MAINTAINERS
  floppy: remove dr, reuse drive on do_floppy_init
  floppy: use common function to check if floppies can be registered
  floppy: properly handle failure on add_disk loop
  floppy: do put_disk on current dr if blk_init_queue fails
  floppy: don't call alloc_ordered_workqueue inside the alloc_disk loop
  xen/blkback: Fix compile warning
  block: Add blk_rq_pos(rq) to sort rq when plushing
  drivers/block: remove CONFIG_EXPERIMENTAL
  block: remove CONFIG_EXPERIMENTAL
  vfs: fix: don't increase bio_slab_max if krealloc() fails
  blkcg: stop iteration early if root_rl is the only request list
  blkcg: Fix use-after-free of q->root_blkg and q->root_rl.blkg

Due to the SMP nature of some of the chips, which have per CPU
registers, the driver does not use the generic irq_gc_mask_set_bit() &
irq_gc_mask_clr_bit() functions, which only support a single register.
The driver has its own implementation of these functions, which can
pick the correct register depending on the CPU being used. The
functions do however use the gc->mask_cache value.

The call to irq_setup_generic_chip() was passing
IRQ_GC_INIT_MASK_CACHE, which caused the gc->mask_cache to be
initialized to the contents of some random register. This resulted in
unexpected interrupts been delivered from random GPIO lines.
Signed-off-by: NAndrew Lunn <andrew@lunn.ch>
Tested-by: NJamie Lentin <jm@lentin.co.uk>
Acked-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Tested-by: NMichael Walle <michael@walle.cc>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>

xfstests has always had random failures of tests due to loop devices
failing to be torn down and hence leaving filesytems that cannot be
unmounted. This causes test runs to immediately stop.

Over the past 6 or 7 years we've added hacks like explicit unmount
-d commands for loop mounts, losetup -d after unmount -d fails, etc,
but still the problems persist.  Recently, the frequency of loop
related failures increased again to the point that xfstests 259 will
reliably fail with a stray loop device that was not torn down.

That is despite the fact the test is above as simple as it gets -
loop 5 or 6 times running mkfs.xfs with different paramters:

        lofile=$(losetup -f)
        losetup $lofile "$testfile"
        "$MKFS_XFS_PROG" -b size=512 $lofile >/dev/null || echo "mkfs failed!"
        sync
        losetup -d $lofile

And losteup -d $lofile is failing with EBUSY on 1-3 of these loops
every time the test is run.

Turns out that blkid is running simultaneously with losetup -d, and
so it sees an elevated reference count and returns EBUSY.  But why
is blkid running? It's obvious, isn't it? udev has decided to try
and find out what is on the block device as a result of a creation
notification. And it is racing with mkfs, so might still be scanning
the device when mkfs finishes and we try to tear it down.

So, make losetup -d force autoremove behaviour. That is, when the
last reference goes away, tear down the device. xfstests wants it
*gone*, not causing random teardown failures when we know that all
the operations the tests have specifically run on the device have
completed and are no longer referencing the loop device.
Signed-off-by: NDave Chinner <dchinner@redhat.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

Added appropriate timeout value for secure erase based on identify device data
Signed-off-by: NAsai Thambi S P <asamymuthupa@micron.com>
Signed-off-by: NSelvan Mani <smani@micron.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

xen/blkback: Change xen_vbd's flush_support and discard_secure to have type unsigned int, rather than bool

Changing the type of bdev parameters to be unsigned int :1, rather than bool.
This is more consistent with the types of other features in the block drivers.
Signed-off-by: NOliver Chick <oliver.chick@citrix.com>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

The patch cciss-use-check_signature.patch in -mm tree introduced
a build error:

drivers/built-in.o: In function `CISS_signature_present':
drivers/block/cciss.c:4270: undefined reference to `check_signature'

Add missing CONFIG_CHECK_SIGNATURE to fix this issue.
Reported-by: NFengguang Wu <wfg@linux.intel.com>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Cc: Fengguang Wu <wfg@linux.intel.com>
Cc: Mike Miller <mike.miller@hp.com>
Cc: Jens Axboe <axboe@kernel.dk>
Acked-by: N"Stephen M. Cameron" <scameron@beardog.cce.hp.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

The memory return by kzalloc() or kmem_cache_zalloc() has already be set
to zero, so remove useless memset(0).

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: Mike Miller <mike.miller@hp.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

Using kmem_cache_zalloc() instead of kmem_cache_alloc() and memset().

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Peter is not going to maintain the driver any more. I have the
hardware.
Acked-by: NPeter Osterlund <petero2@telia.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

This is a small cleanup, that also may turn error handling of
unitialized disks more readable. We don't need a separate variable to
track allocated disks, remove dr and reuse drive variable instead.
Signed-off-by: NHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

The same checks to see if a drive can be or is registered are
repeated through the code, factor out the checks in a common function
and replace the repeated checks with it.
Signed-off-by: NHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

On floppy initialization, if something failed inside the loop we call
add_disk, there was no cleanup of previous iterations in the error
handling.

Cc: stable@vger.kernel.org
Signed-off-by: NHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

If blk_init_queue fails, we do not call put_disk on the current dr
(dr is decremented first in the error handling loop).

Cc: stable@vger.kernel.org
Reviewed-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

Since commit 070ad7e7 ("floppy: convert to delayed work and single-thread
wq"), we end up calling alloc_ordered_workqueue multiple times inside
the loop, which shouldn't be intended. Besides the leak, other side
effect in the current code is if blk_init_queue fails, we would end up
calling unregister_blkdev even if we didn't call yet register_blkdev.

Just moved the allocation of floppy_wq before the loop, and adjusted the
code accordingly.

Cc: stable@vger.kernel.org # 3.5+
Acked-by: NVivek Goyal <vgoyal@redhat.com>
Reviewed-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Signed-off-by: NJens Axboe <axboe@kernel.dk>

drivers/block/xen-blkback/xenbus.c:260:5: warning: symbol 'xenvbd_sysfs_addif' was not declared. Should it be static?
drivers/block/xen-blkback/xenbus.c:284:6: warning: symbol 'xenvbd_sysfs_delif' was not declared. Should it be static?
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Pull Ceph fixes form Sage Weil:
 "There are two fixes in the messenger code, one that can trigger a NULL
  dereference, and one that error in refcounting (extra put).  There is
  also a trivial fix that in the fs client code that is triggered by NFS
  reexport."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  ceph: fix dentry reference leak in encode_fh()
  libceph: avoid NULL kref_put when osd reset races with alloc_msg
  rbd: reset BACKOFF if unable to re-queue

Call to d_find_alias() needs a corresponding dput()

This fixes http://tracker.newdream.net/issues/3271Signed-off-by: NDavid Zafman <david.zafman@inktank.com>
Reviewed-by: NSage Weil <sage@inktank.com>

commit 119c0d44 changed
ext4_new_inode() such that the inode bitmap was being modified
outside a transaction, which could lead to corruption, and was
discovered when journal_checksum found a bad checksum in the
journal during log replay.

Nix ran into this when using the journal_async_commit mount
option, which enables journal checksumming.  The ensuing
journal replay failures due to the bad checksums led to
filesystem corruption reported as the now infamous
"Apparent serious progressive ext4 data corruption bug"

[ Changed by tytso to only call ext4_journal_get_write_access() only
  when we're fairly certain that we're going to allocate the inode. ]

I've tested this by mounting with journal_checksum and
running fsstress then dropping power; I've also tested by
hacking DM to create snapshots w/o first quiescing, which
allows me to test journal replay repeatedly w/o actually
power-cycling the box.  Without the patch I hit a journal
checksum error every time.  With this fix it survives
many iterations.
Reported-by: NNix <nix@esperi.org.uk>
Signed-off-by: NEric Sandeen <sandeen@redhat.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

Pull i2c subsystem fixes from Jean Delvare.

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  i2c-i801: Fix comment
  i2c-i801: Simplify dependency towards GPIOLIB
  i2c-stub: Move to drivers/i2c

Signed-off-by: NJean Delvare <khali@linux-fr.org>

Arbitrarily selecting GPIOLIB causes trouble on some architectures,
so don't do that. Instead, just make the optional multiplexing code
depend on CONFIG_I2C_MUX_GPIO instead of CONFIG_I2C_MUX for now. We
can revisit if the i2c-i801 driver ever supports other multiplexing
flavors.

Also make that optional code depend on DMI, as it won't do anything
without that.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Cc: Fengguang Wu <fengguang.wu@intel.com>

Move the i2c-stub driver to drivers/i2c, to match the Kconfig entry.
This is less confusing that way.

I also fixed all checkpatch warnings and errors.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Cc: Peter Huewe <peterhuewe@gmx.de>

Pull ktest confusion fix from Steven Rostedt:
 "With the v3.7-rc2 kernel, the network cards on my target boxes were
  not being brought up.

  I found that the modules for the network was not being installed.
  This was due to the config CONFIG_MODULES_USE_ELF_RELA that came
  before CONFIG_MODULES, and confused ktest in thinking that
  CONFIG_MODULES=y was not found.

  Ktest needs to test all configs and not just stop if something starts
  with CONFIG_MODULES."

* tag 'ktest-v3.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:
  ktest: Fix ktest confusion with CONFIG_MODULES_USE_ELF_RELA

Pull minor spi MXS fixes from Mark Brown:
 "These fixes are both pretty minor ones and are driver local."

* tag 'spi-mxs' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/misc:
  spi: mxs: Terminate DMA in case of DMA timeout
  spi: mxs: Assign message status after transfer finished

Pull arm-soc fixes from Arnd Bergmann:
 "Bug fixes for a number of ARM platforms, mostly OMAP, imx and at91.

  These come a little later than I had hoped but unfortunately we had a
  few of these patches cause regressions themselves and had to work out
  how to deal with those in the meantime."

* tag 'fixes-for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (38 commits)
  Revert "ARM i.MX25: Fix PWM per clock lookups"
  ARM: versatile: fix versatile_defconfig
  ARM: mvebu: update defconfig with 3.7 changes
  ARM: at91: fix at91x40 build
  ARM: socfpga: Fix socfpga compilation with early_printk() enabled
  ARM: SPEAr: Remove unused empty files
  MAINTAINERS: Add arm-soc tree entry
  ARM: dts: mxs: add the "clock-names" for gpmi-nand
  ARM: ux500: Correct SDI5 address and add some format changes
  ARM: ux500: Specify AMBA Primecell IDs for Nomadik I2C in DT
  ARM: ux500: Fix build error relating to IRQCHIP_SKIP_SET_WAKE
  ARM: at91: drop duplicated config SOC_AT91SAM9 entry
  ARM: at91/i2c: change id to let i2c-at91 work
  ARM: at91/i2c: change id to let i2c-gpio work
  ARM: at91/dts: at91sam9g20ek_common: Fix typos in buttons labels.
  ARM: at91: fix external interrupt specification in board code
  ARM: at91: fix external interrupts in non-DT case
  ARM: at91: at91sam9g10: fix SOC type detection
  ARM: at91/tc: fix typo in the DT document
  ARM: AM33XX: Fix configuration of dmtimer parent clock by dmtimer driverDate:Wed, 17 Oct 2012 13:55:55 -0500
  ...

Functions generic_file_splice_read and generic_file_splice_write access
the pagecache directly. For block devices these functions must be locked
so that block size is not changed while they are in progress.

This patch is an additional fix for commit b87570f5 ("Fix a crash
when block device is read and block size is changed at the same time")
that locked aio_read, aio_write and mmap against block size change.
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Use rcu_read_lock_sched / rcu_read_unlock_sched / synchronize_sched
instead of rcu_read_lock / rcu_read_unlock / synchronize_rcu.

This is an optimization. The RCU-protected region is very small, so
there will be no latency problems if we disable preempt in this region.

So we use rcu_read_lock_sched / rcu_read_unlock_sched that translates
to preempt_disable / preempt_disable. It is smaller (and supposedly
faster) than preemptible rcu_read_lock / rcu_read_unlock.
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch introduces new barrier pair light_mb() and heavy_mb() for
percpu rw semaphores.

This patch fixes a bug in percpu-rw-semaphores where a barrier was
missing in percpu_up_write.

This patch improves performance on the read path of
percpu-rw-semaphores: on non-x86 cpus, there was a smp_mb() in
percpu_up_read. This patch changes it to a compiler barrier and removes
the "#if defined(X86) ..." condition.

From: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>