linux-toradex.git/fs, branch v2.6.29.2

hugetlbfs: return negative error code for bad mount option

2009-04-27T17:37:05+00:00

upstream commit: c12ddba09394c60e1120e6997794fa6ed52da884

This fixes the following BUG:

  # mount -o size=MM -t hugetlbfs none /huge
  hugetlbfs: Bad value 'MM' for mount option 'size=MM'
  ------------[ cut here ]------------
  kernel BUG at fs/super.c:996!

Due to

	BUG_ON(!mnt->mnt_sb);

in vfs_kern_mount().

Also, remove unused #include 

Cc: William Irwin 
Cc: 
Signed-off-by: Akinobu Mita 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright

NFS: Fix the XDR iovec calculation in nfs3_xdr_setaclargs

2009-04-27T17:37:05+00:00

upstream commit: 8340437210390676f687633a80e3748c40885dc8

Commit ae46141ff08f1965b17c531b571953c39ce8b9e2 (NFSv3: Fix posix ACL code)
introduces a bug in the calculation of the XDR header iovec. In the case
where we are inlining the acls, we need to adjust the length of the iovec
req->rq_svec, in addition to adjusting the total buffer length.

Tested-by: Leonardo Chiquitto 
Tested-by: Suresh Jayaraman 
Signed-off-by: Trond Myklebust 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright

splice: fix deadlock in splicing to file

2009-04-27T17:36:58+00:00

upstream commit: 7bfac9ecf0585962fe13584f5cf526d8c8e76f17

There's a possible deadlock in generic_file_splice_write(),
splice_from_pipe() and ocfs2_file_splice_write():

 - task A calls generic_file_splice_write()
 - this calls inode_double_lock(), which locks i_mutex on both
   pipe->inode and target inode
 - ordering depends on inode pointers, can happen that pipe->inode is
   locked first
 - __splice_from_pipe() needs more data, calls pipe_wait()
 - this releases lock on pipe->inode, goes to interruptible sleep
 - task B calls generic_file_splice_write(), similarly to the first
 - this locks pipe->inode, then tries to lock inode, but that is
   already held by task A
 - task A is interrupted, it tries to lock pipe->inode, but fails, as
   it is already held by task B
 - ABBA deadlock

Fix this by explicitly ordering locks: the outer lock must be on
target inode and the inner lock (which is later unlocked and relocked)
must be on pipe->inode.  This is OK, pipe inodes and target inodes
form two nonoverlapping sets, generic_file_splice_write() and friends
are not called with a target which is a pipe.

Signed-off-by: Miklos Szeredi 
Acked-by: Mark Fasheh 
Acked-by: Jens Axboe 
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright

vfs: skip I_CLEAR state inodes

2009-04-27T17:36:55+00:00

upstream commit: b6fac63cc1f52ec27f29fe6c6c8494a2ffac33fd

clear_inode() will switch inode state from I_FREEING to I_CLEAR, and do so
_outside_ of inode_lock.  So any I_FREEING testing is incomplete without a
coupled testing of I_CLEAR.

So add I_CLEAR tests to drop_pagecache_sb(), generic_sync_sb_inodes() and
add_dquot_ref().

Masayoshi MIZUMA discovered the bug in drop_pagecache_sb() and Jan Kara
reminds fixing the other two cases.

Masayoshi MIZUMA has a nice panic flow:

=====================================================================
            [process A]               |        [process B]
 |                                    |
 |    prune_icache()                  | drop_pagecache()
 |      spin_lock(&inode_lock)        |   drop_pagecache_sb()
 |      inode->i_state |= I_FREEING;  |       |
 |      spin_unlock(&inode_lock)      |       V
 |          |                         |     spin_lock(&inode_lock)
 |          V                         |         |
 |      dispose_list()                |         |
 |        list_del()                  |         |
 |        clear_inode()               |         |
 |          inode->i_state = I_CLEAR  |         |
 |            |                       |         V
 |            |                       |      if (inode->i_state & (I_FREEING|I_WILL_FREE))
 |            |                       |              continue;           <==== NOT MATCH
 |            |                       |
 |            |                       | (DANGER from here on! Accessing disposing inode!)
 |            |                       |
 |            |                       |      __iget()
 |            |                       |        list_move() <===== PANIC on poisoned list !!
 V            V                       |
(time)
=====================================================================

Reported-by: Masayoshi MIZUMA 
Reviewed-by: Jan Kara 
Signed-off-by: Wu Fengguang 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
[chrisw: backport to 2.6.29]
Signed-off-by: Chris Wright

ext4: fix locking typo in mballoc which could cause soft lockup hangs

2009-04-27T17:36:52+00:00

upstream commit: e7c9e3e99adf6c49c5d593a51375916acc039d1e

Smatch (http://repo.or.cz/w/smatch.git/) complains about the locking in
ext4_mb_add_n_trim() from fs/ext4/mballoc.c

  4438          list_for_each_entry_rcu(tmp_pa, &lg->lg_prealloc_list[order],
  4439                                                  pa_inode_list) {
  4440                  spin_lock(&tmp_pa->pa_lock);
  4441                  if (tmp_pa->pa_deleted) {
  4442                          spin_unlock(&pa->pa_lock);
  4443                          continue;
  4444                  }

Brown paper bag time...

Reported-by: Dan Carpenter 
Reviewed-by: Eric Sandeen 
Reviewed-by: Aneesh Kumar K.V 
Signed-off-by: "Theodore Ts'o" 
Cc: stable@kernel.org
Signed-off-by: Chris Wright

ext4: fix typo which causes a memory leak on error path

2009-04-27T17:36:51+00:00

upstream commit: a7b19448ddbdc34b2b8fedc048ba154ca798667b

This was found by smatch (http://repo.or.cz/w/smatch.git/)

Signed-off-by: Dan Carpenter 
Signed-off-by: "Theodore Ts'o" 
Cc: stable@kernel.org
Signed-off-by: Chris Wright

fuse: fix fuse_file_lseek returning with lock held

2009-04-02T20:55:18+00:00

upstream commit: 5291658d87ac1ae60418e79e7b6bad7d5f595e0c

This bug was found with smatch (http://repo.or.cz/w/smatch.git/).  If
we return directly the inode->i_mutex lock doesn't get released.

Signed-off-by: Dan Carpenter 
Signed-off-by: Miklos Szeredi 
CC: stable@kernel.org
Signed-off-by: Chris Wright

CIFS: Fix memory overwrite when saving nativeFileSystem field during mount

2009-04-02T20:55:17+00:00

upstream commit: b363b3304bcf68c4541683b2eff70b29f0446a5b

CIFS can allocate a few bytes to little for the nativeFileSystem field
during tree connect response processing during mount.  This can result
in a "Redzone overwritten" message to be logged.

Signed-off-by: Sridhar Vinay 
Acked-by: Shirish Pargaonkar 
CC: Stable 
Signed-off-by: Steve French 
[chrisw: minor backport to CHANGES file]
Signed-off-by: Chris Wright

cifs: fix buffer format byte on NT Rename/hardlink

2009-04-02T20:55:16+00:00

upstream commit: fcc7c09d94be7b75c9ea2beb22d0fae191c6b4b9

Discovered at Connnectathon 2009...

The buffer format byte and the pad are transposed in NT_RENAME calls
(which are used to set hardlinks). Most servers seem to ignore this
fact, but NetApp filers throw back an error due to this problem. This
patch fixes it.

CC: Stable 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Chris Wright

Update my email address

2009-03-22T18:28:37+00:00

Update all previous incarnations of my email address to the correct one.

Signed-off-by: Gertjan van Wingerde 
Signed-off-by: Linus Torvalds