3.0 patches

7 files changed, 322 insertions, 0 deletions

diff --git a/queue-3.0/alsa-sound-core-pcm_compat.c-adjust-array-index.patch b/queue-3.0/alsa-sound-core-pcm_compat.c-adjust-array-index.patch
new file mode 100644
index 0000000000..e14d04fe7a
--- /dev/null
+++ b/queue-3.0/alsa-sound-core-pcm_compat.c-adjust-array-index.patch
@@ -0,0 +1,46 @@
+From ca9380fd68514c7bc952282c1b4fc70607e9fe43 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Thu, 28 Jul 2011 14:46:05 +0200
+Subject: ALSA: sound/core/pcm_compat.c: adjust array index
+
+From: Julia Lawall <julia@diku.dk>
+
+commit ca9380fd68514c7bc952282c1b4fc70607e9fe43 upstream.
+
+Convert array index from the loop bound to the loop index.
+
+A simplified version of the semantic patch that fixes this problem is as
+follows: (http://coccinelle.lip6.fr/)
+
+// <smpl>
+@@
+expression e1,e2,ar;
+@@
+
+for(e1 = 0; e1 < e2; e1++) { <...
+  ar[
+- e2
++ e1
+  ]
+  ...> }
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/pcm_compat.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -342,7 +342,7 @@ static int snd_pcm_ioctl_xfern_compat(st
+ 			kfree(bufs);
+ 			return -EFAULT;
+ 		}
+-		bufs[ch] = compat_ptr(ptr);
++		bufs[i] = compat_ptr(ptr);
+ 		bufptr++;
+ 	}
+ 	if (dir == SNDRV_PCM_STREAM_PLAYBACK)
diff --git a/queue-3.0/dm-fix-idr-leak-on-module-removal.patch b/queue-3.0/dm-fix-idr-leak-on-module-removal.patch
new file mode 100644
index 0000000000..53dc789f3a
--- /dev/null
+++ b/queue-3.0/dm-fix-idr-leak-on-module-removal.patch
@@ -0,0 +1,51 @@
+From d15b774c2920d55e3d58275c97fbe3adc3afde38 Mon Sep 17 00:00:00 2001
+From: Alasdair G Kergon <agk@redhat.com>
+Date: Tue, 2 Aug 2011 12:32:01 +0100
+Subject: dm: fix idr leak on module removal
+
+From: Alasdair G Kergon <agk@redhat.com>
+
+commit d15b774c2920d55e3d58275c97fbe3adc3afde38 upstream.
+
+Destroy _minor_idr when unloading the core dm module.  (Found by kmemleak.)
+
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -37,6 +37,8 @@ static const char *_name = DM_NAME;
+ static unsigned int major = 0;
+ static unsigned int _major = 0;
+ 
++static DEFINE_IDR(_minor_idr);
++
+ static DEFINE_SPINLOCK(_minor_lock);
+ /*
+  * For bio-based dm.
+@@ -313,6 +315,12 @@ static void __exit dm_exit(void)
+ 
+ 	while (i--)
+ 		_exits[i]();
++
++	/*
++	 * Should be empty by this point.
++	 */
++	idr_remove_all(&_minor_idr);
++	idr_destroy(&_minor_idr);
+ }
+ 
+ /*
+@@ -1705,8 +1713,6 @@ static int dm_any_congested(void *conges
+ /*-----------------------------------------------------------------
+  * An IDR is used to keep track of allocated minor numbers.
+  *---------------------------------------------------------------*/
+-static DEFINE_IDR(_minor_idr);
+-
+ static void free_minor(int minor)
+ {
+ 	spin_lock(&_minor_lock);
diff --git a/queue-3.0/dm-io-flush-cpu-cache-with-vmapped-io.patch b/queue-3.0/dm-io-flush-cpu-cache-with-vmapped-io.patch
new file mode 100644
index 0000000000..255a5aeffc
--- /dev/null
+++ b/queue-3.0/dm-io-flush-cpu-cache-with-vmapped-io.patch
@@ -0,0 +1,116 @@
+From bb91bc7bacb906c9f3a9b22744c53fa7564b51ba Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 2 Aug 2011 12:32:01 +0100
+Subject: dm io: flush cpu cache with vmapped io
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit bb91bc7bacb906c9f3a9b22744c53fa7564b51ba upstream.
+
+For normal kernel pages, CPU cache is synchronized by the dma layer.
+However, this is not done for pages allocated with vmalloc. If we do I/O
+to/from vmallocated pages, we must synchronize CPU cache explicitly.
+
+Prior to doing I/O on vmallocated page we must call
+flush_kernel_vmap_range to flush dirty cache on the virtual address.
+After finished read we must call invalidate_kernel_vmap_range to
+invalidate cache on the virtual address, so that accesses to the virtual
+address return newly read data and not stale data from CPU cache.
+
+This patch fixes metadata corruption on dm-snapshots on PA-RISC and
+possibly other architectures with caches indexed by virtual address.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-io.c |   29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -38,6 +38,8 @@ struct io {
+ 	struct dm_io_client *client;
+ 	io_notify_fn callback;
+ 	void *context;
++	void *vma_invalidate_address;
++	unsigned long vma_invalidate_size;
+ } __attribute__((aligned(DM_IO_MAX_REGIONS)));
+ 
+ static struct kmem_cache *_dm_io_cache;
+@@ -116,6 +118,10 @@ static void dec_count(struct io *io, uns
+ 		set_bit(region, &io->error_bits);
+ 
+ 	if (atomic_dec_and_test(&io->count)) {
++		if (io->vma_invalidate_size)
++			invalidate_kernel_vmap_range(io->vma_invalidate_address,
++						     io->vma_invalidate_size);
++
+ 		if (io->sleeper)
+ 			wake_up_process(io->sleeper);
+ 
+@@ -159,6 +165,9 @@ struct dpages {
+ 
+ 	unsigned context_u;
+ 	void *context_ptr;
++
++	void *vma_invalidate_address;
++	unsigned long vma_invalidate_size;
+ };
+ 
+ /*
+@@ -377,6 +386,9 @@ static int sync_io(struct dm_io_client *
+ 	io->sleeper = current;
+ 	io->client = client;
+ 
++	io->vma_invalidate_address = dp->vma_invalidate_address;
++	io->vma_invalidate_size = dp->vma_invalidate_size;
++
+ 	dispatch_io(rw, num_regions, where, dp, io, 1);
+ 
+ 	while (1) {
+@@ -415,13 +427,21 @@ static int async_io(struct dm_io_client
+ 	io->callback = fn;
+ 	io->context = context;
+ 
++	io->vma_invalidate_address = dp->vma_invalidate_address;
++	io->vma_invalidate_size = dp->vma_invalidate_size;
++
+ 	dispatch_io(rw, num_regions, where, dp, io, 0);
+ 	return 0;
+ }
+ 
+-static int dp_init(struct dm_io_request *io_req, struct dpages *dp)
++static int dp_init(struct dm_io_request *io_req, struct dpages *dp,
++		   unsigned long size)
+ {
+ 	/* Set up dpages based on memory type */
++
++	dp->vma_invalidate_address = NULL;
++	dp->vma_invalidate_size = 0;
++
+ 	switch (io_req->mem.type) {
+ 	case DM_IO_PAGE_LIST:
+ 		list_dp_init(dp, io_req->mem.ptr.pl, io_req->mem.offset);
+@@ -432,6 +452,11 @@ static int dp_init(struct dm_io_request
+ 		break;
+ 
+ 	case DM_IO_VMA:
++		flush_kernel_vmap_range(io_req->mem.ptr.vma, size);
++		if ((io_req->bi_rw & RW_MASK) == READ) {
++			dp->vma_invalidate_address = io_req->mem.ptr.vma;
++			dp->vma_invalidate_size = size;
++		}
+ 		vm_dp_init(dp, io_req->mem.ptr.vma);
+ 		break;
+ 
+@@ -460,7 +485,7 @@ int dm_io(struct dm_io_request *io_req,
+ 	int r;
+ 	struct dpages dp;
+ 
+-	r = dp_init(io_req, &dp);
++	r = dp_init(io_req, &dp, (unsigned long)where->count << SECTOR_SHIFT);
+ 	if (r)
+ 		return r;
+ 
diff --git a/queue-3.0/dm-mpath-fix-potential-null-pointer-in-feature-arg.patch b/queue-3.0/dm-mpath-fix-potential-null-pointer-in-feature-arg.patch
new file mode 100644
index 0000000000..68575d1a33
--- /dev/null
+++ b/queue-3.0/dm-mpath-fix-potential-null-pointer-in-feature-arg.patch
@@ -0,0 +1,34 @@
+From 286f367dad40beb3234a18c17391d03ba939a7f3 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Tue, 2 Aug 2011 12:32:00 +0100
+Subject: dm mpath: fix potential NULL pointer in feature arg processing
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 286f367dad40beb3234a18c17391d03ba939a7f3 upstream.
+
+Avoid dereferencing a NULL pointer if the number of feature arguments
+supplied is fewer than indicated.
+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -807,6 +807,11 @@ static int parse_features(struct arg_set
+ 	if (!argc)
+ 		return 0;
+ 
++	if (argc > as->argc) {
++		ti->error = "not enough arguments for features";
++		return -EINVAL;
++	}
++
+ 	do {
+ 		param_name = shift(as);
+ 		argc--;
diff --git a/queue-3.0/dm-snapshot-flush-disk-cache-when-merging.patch b/queue-3.0/dm-snapshot-flush-disk-cache-when-merging.patch
new file mode 100644
index 0000000000..0590ac8a05
--- /dev/null
+++ b/queue-3.0/dm-snapshot-flush-disk-cache-when-merging.patch
@@ -0,0 +1,35 @@
+From 762a80d9fc9f690a3a35983f3b4619a220650808 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 2 Aug 2011 12:32:00 +0100
+Subject: dm snapshot: flush disk cache when merging
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 762a80d9fc9f690a3a35983f3b4619a220650808 upstream.
+
+This patch makes dm-snapshot flush disk cache when writing metadata for
+merging snapshot.
+
+Without cache flushing the disk may reorder metadata write and other
+data writes and there is a possibility of data corruption in case of
+power fault.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap-persistent.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -753,7 +753,7 @@ static int persistent_commit_merge(struc
+ 	for (i = 0; i < nr_merged; i++)
+ 		clear_exception(ps, ps->current_committed - 1 - i);
+ 
+-	r = area_io(ps, WRITE);
++	r = area_io(ps, WRITE_FLUSH_FUA);
+ 	if (r < 0)
+ 		return r;
+ 
diff --git a/queue-3.0/series b/queue-3.0/series
index c404118473..04f9bc6b22 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -94,3 +94,9 @@ apparmor-fix-masking-of-capabilities-in-complain-mode.patch
 oom-task-mm-null-doesn-t-mean-the-memory-was-freed.patch
 rt2x00-add-device-id-for-rt539f-device.patch
 gfs2-fix-mount-hang-caused-by-certain-access-pattern-to-sysfs-files.patch
+watchdog-shwdt-fix-usage-of-mod_timer.patch
+alsa-sound-core-pcm_compat.c-adjust-array-index.patch
+dm-io-flush-cpu-cache-with-vmapped-io.patch
+dm-snapshot-flush-disk-cache-when-merging.patch
+dm-mpath-fix-potential-null-pointer-in-feature-arg.patch
+dm-fix-idr-leak-on-module-removal.patch
diff --git a/queue-3.0/watchdog-shwdt-fix-usage-of-mod_timer.patch b/queue-3.0/watchdog-shwdt-fix-usage-of-mod_timer.patch
new file mode 100644
index 0000000000..a35a45efbd
--- /dev/null
+++ b/queue-3.0/watchdog-shwdt-fix-usage-of-mod_timer.patch
@@ -0,0 +1,34 @@
+From bea1906620ce72b63f83735c4cc2642b25ec54ae Mon Sep 17 00:00:00 2001
+From: David Engraf <david.engraf@sysgo.com>
+Date: Wed, 20 Jul 2011 15:03:39 +0200
+Subject: watchdog: shwdt: fix usage of mod_timer
+
+From: David Engraf <david.engraf@sysgo.com>
+
+commit bea1906620ce72b63f83735c4cc2642b25ec54ae upstream.
+
+Fix the usage of mod_timer() and make the driver usable. mod_timer() must
+be called with an absolute timeout in jiffies. The old implementation
+used a relative timeout thus the hardware watchdog was never triggered.
+
+Signed-off-by: David Engraf <david.engraf@sysgo.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Wim Van sebroeck <wim@iguana.be>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/shwdt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/shwdt.c
++++ b/drivers/watchdog/shwdt.c
+@@ -64,7 +64,7 @@
+  * misses its deadline, the kernel timer will allow the WDT to overflow.
+  */
+ static int clock_division_ratio = WTCSR_CKS_4096;
+-#define next_ping_period(cks)	msecs_to_jiffies(cks - 4)
++#define next_ping_period(cks)	(jiffies + msecs_to_jiffies(cks - 4))
+ 
+ static const struct watchdog_info sh_wdt_info;
+ static struct platform_device *sh_wdt_dev;