{"push_id":1263191705,"size":175,"distinct_size":175,"ref":"refs/heads/3.14","head":"ae56c5f8df61371a3f90f6d4f7588667d3daba71","before":"864a130526acfeae209f955df26e38e788940f95","commits":[{"sha":"d72e7cf39d09298e9227ebd50e3c6a7aa802fc06","author":{"name":"Torsten Hilbrich","email":"f5d71f493be45e0412081d942fed5739d2121832@secunet.com"},"message":"fs/nilfs2: fix potential underflow in call to crc32_le\n\ncommit 63d2f95d63396059200c391ca87161897b99e74a upstream.\n\nThe value `bytes' comes from the filesystem which is about to be\nmounted.  We cannot trust that the value is always in the range we\nexpect it to be.\n\nCheck its value before using it to calculate the length for the crc32_le\ncall.  It value must be larger (or equal) sumoff + 4.\n\nThis fixes a kernel bug when accidentially mounting an image file which\nhad the nilfs2 magic value 0x3434 at the right offset 0x406 by chance.\nThe bytes 0x01 0x00 were stored at 0x408 and were interpreted as a\ns_bytes value of 1.  This caused an underflow when substracting sumoff +\n4 (20) in the call to crc32_le.\n\n  BUG: unable to handle kernel paging request at ffff88021e600000\n  IP:  crc32_le+0x36/0x100\n  ...\n  Call Trace:\n    nilfs_valid_sb.part.5+0x52/0x60 [nilfs2]\n    nilfs_load_super_block+0x142/0x300 [nilfs2]\n    init_nilfs+0x60/0x390 [nilfs2]\n    nilfs_mount+0x302/0x520 [nilfs2]\n    mount_fs+0x38/0x160\n    vfs_kern_mount+0x67/0x110\n    do_mount+0x269/0xe00\n    SyS_mount+0x9f/0x100\n    entry_SYSCALL_64_fastpath+0x16/0x71\n\nLink: http://lkml.kernel.org/r/1466778587-5184-2-git-send-email-konishi.ryusuke@lab.ntt.co.jp\nSigned-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>\nTested-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>\nSigned-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/d72e7cf39d09298e9227ebd50e3c6a7aa802fc06"},{"sha":"0fb6917509f4aa824f8e1c23bf9073fd6b622d9c","author":{"name":"Alexey Brodkin","email":"622a4dc4d126934e8a732fb98e268f020a2b4d1e@synopsys.com"},"message":"arc: unwind: warn only once if DW2_UNWIND is disabled\n\ncommit 9bd54517ee86cb164c734f72ea95aeba4804f10b upstream.\n\nIf CONFIG_ARC_DW2_UNWIND is disabled every time arc_unwind_core()\ngets called following message gets printed in debug console:\n----------------->8---------------\nCONFIG_ARC_DW2_UNWIND needs to be enabled\n----------------->8---------------\n\nThat message makes sense if user indeed wants to see a backtrace or\nget nice function call-graphs in perf but what if user disabled\nunwinder for the purpose? Why pollute his debug console?\n\nSo instead we'll warn user about possibly missing feature once and\nlet him decide if that was what he or she really wanted.\n\nSigned-off-by: Alexey Brodkin <abrodkin@synopsys.com>\nSigned-off-by: Vineet Gupta <vgupta@synopsys.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/0fb6917509f4aa824f8e1c23bf9073fd6b622d9c"},{"sha":"237f19893a451aff7f753f67ad91f463e09ce8a2","author":{"name":"Andrey Grodzovsky","email":"9f35aa43c317c36b57e2086a81f2ecebfd20a9c5@gmail.com"},"message":"xen/pciback: Fix conf_space read/write overlap check.\n\ncommit 02ef871ecac290919ea0c783d05da7eedeffc10e upstream.\n\nCurrent overlap check is evaluating to false a case where a filter\nfield is fully contained (proper subset) of a r/w request.  This\nchange applies classical overlap check instead to include all the\nscenarios.\n\nMore specifically, for (Hilscher GmbH CIFX 50E-DP(M/S)) device driver\nthe logic is such that the entire confspace is read and written in 4\nbyte chunks. In this case as an example, CACHE_LINE_SIZE,\nLATENCY_TIMER and PCI_BIST are arriving together in one call to\nxen_pcibk_config_write() with offset == 0xc and size == 4.  With the\nexsisting overlap check the LATENCY_TIMER field (offset == 0xd, length\n== 1) is fully contained in the write request and hence is excluded\nfrom write, which is incorrect.\n\nSigned-off-by: Andrey Grodzovsky <andrey2805@gmail.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nReviewed-by: Jan Beulich <JBeulich@suse.com>\nSigned-off-by: David Vrabel <david.vrabel@citrix.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/237f19893a451aff7f753f67ad91f463e09ce8a2"},{"sha":"a4eabc8c16004cc41f6a71c31cf7e349fa6efe50","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\n\ncommit cec8f96e49d9be372fdb0c3836dcf31ec71e457e upstream.\n\nThe stack object “tread” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/a4eabc8c16004cc41f6a71c31cf7e349fa6efe50"},{"sha":"414d03573fe4e942f07b1c3c8750227c6be0b061","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"ALSA: timer: Fix leak in events via snd_timer_user_ccallback\n\ncommit 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6 upstream.\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/414d03573fe4e942f07b1c3c8750227c6be0b061"},{"sha":"b40763254a772aaa1353237694eff230db004d7b","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt\n\ncommit e4ec8cc8039a7063e24204299b462bd1383184a5 upstream.\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/b40763254a772aaa1353237694eff230db004d7b"},{"sha":"e01e999a12214918ddf626bbd7fb97dad6471aaf","author":{"name":"Ping Cheng","email":"89f29106651295905902397ec5b057f4b40782f6@gmail.com"},"message":"Input: wacom_w8001 - w8001_MAX_LENGTH should be 13\n\ncommit 12afb34400eb2b301f06b2aa3535497d14faee59 upstream.\n\nSomehow the patch that added two-finger touch support forgot to update\nW8001_MAX_LENGTH from 11 to 13.\n\nSigned-off-by: Ping Cheng <pingc@wacom.com>\nReviewed-by: Peter Hutterer <peter.hutterer@who-t.net>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/e01e999a12214918ddf626bbd7fb97dad6471aaf"},{"sha":"92abf1880ae656872a4a30b41b909d1baacdebb3","author":{"name":"Cameron Gutman","email":"dae64e07afda5ec299f6c7de821d7927f9ed1853@gmail.com"},"message":"Input: xpad - validate USB endpoint count during probe\n\ncommit caca925fca4fb30c67be88cacbe908eec6721e43 upstream.\n\nThis prevents a malicious USB device from causing an oops.\n\nSigned-off-by: Cameron Gutman <aicommander@gmail.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/92abf1880ae656872a4a30b41b909d1baacdebb3"},{"sha":"2b7758f506b7af10910c4f9d12e4424821280734","author":{"name":"Tony Lindgren","email":"59db37dd0a1458e16c2dffa797f972d03fa29423@atomide.com"},"message":"pinctrl: single: Fix missing flush of posted write for a wakeirq\n\ncommit 0ac3c0a4025f41748a083bdd4970cb3ede802b15 upstream.\n\nWith many repeated suspend resume cycles, the pin specific wakeirq\nmay not always work on omaps. This is because the write to enable the\npin interrupt may not have reached the device over the interconnect\nbefore suspend happens.\n\nLet's fix the issue with a flush of posted write with a readback.\n\nReported-by: Nishanth Menon <nm@ti.com>\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/2b7758f506b7af10910c4f9d12e4424821280734"},{"sha":"9e7af3525df35cc5e5c83401dac78b2ad49ae13e","author":{"name":"Jeff Mahoney","email":"aaa0a0dd9330bfd9355df741c4f20144421bb087@suse.com"},"message":"Revert \"ecryptfs: forbid opening files without mmap handler\"\n\ncommit 78c4e172412de5d0456dc00d2b34050aa0b683b5 upstream.\n\nThis reverts commit 2f36db71009304b3f0b95afacd8eba1f9f046b87.\n\nIt fixed a local root exploit but also introduced a dependency on\nthe lower file system implementing an mmap operation just to open a file,\nwhich is a bit of a heavy hammer.  The right fix is to have mmap depend\non the existence of the mmap handler instead.\n\nSigned-off-by: Jeff Mahoney <jeffm@suse.com>\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/9e7af3525df35cc5e5c83401dac78b2ad49ae13e"},{"sha":"3fd142a860f165b176c9303882f1ee9479c267fb","author":{"name":"Jeff Mahoney","email":"aaa0a0dd9330bfd9355df741c4f20144421bb087@suse.com"},"message":"ecryptfs: don't allow mmap when the lower fs doesn't support it\n\ncommit f0fe970df3838c202ef6c07a4c2b36838ef0a88b upstream.\n\nThere are legitimate reasons to disallow mmap on certain files, notably\nin sysfs or procfs.  We shouldn't emulate mmap support on file systems\nthat don't offer support natively.\n\nCVE-2016-1583\n\nSigned-off-by: Jeff Mahoney <jeffm@suse.com>\n[tyhicks: clean up f_op check by using ecryptfs_file_to_lower()]\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/3fd142a860f165b176c9303882f1ee9479c267fb"},{"sha":"8ba2f5328c2c9859bbbf412e5804974483d66e9d","author":{"name":"Vineet Gupta","email":"a7e6bac69589bd9c485fe09b6cb3c1c86c8546ec@synopsys.com"},"message":"ARC: use ASL assembler mnemonic\n\ncommit a6416f57ce57fb390b6ee30b12c01c29032a26af upstream.\n\nARCompact and ARCv2 only have ASL, while binutils used to support LSL as\na alias mnemonic.\n\nNewer binutils (upstream) don't want to do that so replace it.\n\nSigned-off-by: Vineet Gupta <vgupta@synopsys.com>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/8ba2f5328c2c9859bbbf412e5804974483d66e9d"},{"sha":"e6fa962341c8d198dd59a0ff0e5b89deb87478d7","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"ext4: verify extent header depth\n\ncommit 7bc9491645118c9461bd21099c31755ff6783593 upstream.\n\nAlthough the extent tree depth of 5 should enough be for the worst\ncase of 2*32 extents of length 1, the extent tree code does not\ncurrently to merge nodes which are less than half-full with a sibling\nnode, or to shrink the tree depth if possible.  So it's possible, at\nleast in theory, for the tree depth to be greater than 5.  However,\neven in the worst case, a tree depth of 32 is highly unlikely, and if\nthe file system is maliciously corrupted, an insanely large eh_depth\ncan cause memory allocation failures that will trigger kernel warnings\n(here, eh_depth = 65280):\n\n    JBD2: ext4.exe wants too many credits credits:195849 rsv_credits:0 max:256\n    ------------[ cut here ]------------\n    WARNING: CPU: 0 PID: 50 at fs/jbd2/transaction.c:293 start_this_handle+0x569/0x580\n    CPU: 0 PID: 50 Comm: ext4.exe Not tainted 4.7.0-rc5+ #508\n    Stack:\n     604a8947 625badd8 0002fd09 00000000\n     60078643 00000000 62623910 601bf9bc\n     62623970 6002fc84 626239b0 900000125\n    Call Trace:\n     [<6001c2dc>] show_stack+0xdc/0x1a0\n     [<601bf9bc>] dump_stack+0x2a/0x2e\n     [<6002fc84>] __warn+0x114/0x140\n     [<6002fdff>] warn_slowpath_null+0x1f/0x30\n     [<60165829>] start_this_handle+0x569/0x580\n     [<60165d4e>] jbd2__journal_start+0x11e/0x220\n     [<60146690>] __ext4_journal_start_sb+0x60/0xa0\n     [<60120a81>] ext4_truncate+0x131/0x3a0\n     [<60123677>] ext4_setattr+0x757/0x840\n     [<600d5d0f>] notify_change+0x16f/0x2a0\n     [<600b2b16>] do_truncate+0x76/0xc0\n     [<600c3e56>] path_openat+0x806/0x1300\n     [<600c55c9>] do_filp_open+0x89/0xf0\n     [<600b4074>] do_sys_open+0x134/0x1e0\n     [<600b4140>] SyS_open+0x20/0x30\n     [<6001ea68>] handle_syscall+0x88/0x90\n     [<600295fd>] userspace+0x3fd/0x500\n     [<6001ac55>] fork_handler+0x85/0x90\n\n    ---[ end trace 08b0b88b6387a244 ]---\n\n[ Commit message modified and the extent tree depath check changed\nfrom 5 to 32 -- tytso ]\n\nCc: Darrick J. Wong <darrick.wong@oracle.com>\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/e6fa962341c8d198dd59a0ff0e5b89deb87478d7"},{"sha":"f6aabfad833531e1bbb6e095393e2de27f6e990a","author":{"name":"Ursula Braun","email":"bb80a5b71d7ccb33e0f48503af4b98b8a157f79b@linux.vnet.ibm.com"},"message":"qeth: delete napi struct when removing a qeth device\n\ncommit 7831b4ff0d926e0deeaabef9db8800ed069a2757 upstream.\n\nA qeth_card contains a napi_struct linked to the net_device during\ndevice probing. This struct must be deleted when removing the qeth\ndevice, otherwise Panic on oops can occur when qeth devices are\nrepeatedly removed and added.\n\nFixes: a1c3ed4c9ca (\"qeth: NAPI support for l2 and l3 discipline\")\nSigned-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nTested-by: Alexander Klein <ALKL@de.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/f6aabfad833531e1bbb6e095393e2de27f6e990a"},{"sha":"2ac56bef9b9bf169da254fc1a7d5f7dbf30adc3f","author":{"name":"Taras Kondratiuk","email":"eb145d331727929df47f6b5f95e256b7d6fbd80e@cisco.com"},"message":"mmc: block: fix packed command header endianness\n\ncommit f68381a70bb2b26c31b13fdaf67c778f92fd32b4 upstream.\n\nThe code that fills packed command header assumes that CPU runs in\nlittle-endian mode. Hence the header is malformed in big-endian mode\nand causes MMC data transfer errors:\n\n[  563.200828] mmcblk0: error -110 transferring data, sector 2048, nr 8, cmd response 0x900, card status 0xc40\n[  563.219647] mmcblk0: packed cmd failed, nr 2, sectors 16, failure index: -1\n\nConvert header data to LE.\n\nSigned-off-by: Taras Kondratiuk <takondra@cisco.com>\nFixes: ce39f9d17c14 (\"mmc: support packed write command for eMMC4.5 devices\")\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/2ac56bef9b9bf169da254fc1a7d5f7dbf30adc3f"},{"sha":"5c3a7aac3d8dc9baa708c7ce37df2dbae3098d1d","author":{"name":"Wolfgang Grandegger","email":"b196e2aa9de3f3a92e607e36370f5210bce32b40@grandegger.com"},"message":"can: at91_can: RX queue could get stuck at high bus load\n\ncommit 43200a4480cbbe660309621817f54cbb93907108 upstream.\n\nAt high bus load it could happen that \"at91_poll()\" enters with all RX\nmessage boxes filled up. If then at the end the \"quota\" is exceeded as\nwell, \"rx_next\" will not be reset to the first RX mailbox and hence the\ninterrupts remain disabled.\n\nSigned-off-by: Wolfgang Grandegger <wg@grandegger.com>\nTested-by: Amr Bekhit <amrbekhit@gmail.com>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/5c3a7aac3d8dc9baa708c7ce37df2dbae3098d1d"},{"sha":"6f8f768a3586b6fbd50e249e7fe4f964a6994685","author":{"name":"Oliver Hartkopp","email":"4a7aeae382a9ad981c684b504c17442f359c4ede@hartkopp.net"},"message":"can: fix handling of unmodifiable configuration options fix\n\ncommit bce271f255dae8335dc4d2ee2c4531e09cc67f5a upstream.\n\nWith upstream commit bb208f144cf3f59 (can: fix handling of unmodifiable\nconfiguration options) a new can_validate() function was introduced.\n\nWhen invoking 'ip link set can0 type can' without any configuration data\ncan_validate() tries to validate the content without taking into account that\nthere's totally no content. This patch adds a check for missing content.\n\nReported-by: ajneu <ajneu1@gmail.com>\nSigned-off-by: Oliver Hartkopp <socketcan@hartkopp.net>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/6f8f768a3586b6fbd50e249e7fe4f964a6994685"},{"sha":"aaf95b87cc9d2836a6103f4628d71186411033aa","author":{"name":"Oliver Hartkopp","email":"4a7aeae382a9ad981c684b504c17442f359c4ede@hartkopp.net"},"message":"can: fix oops caused by wrong rtnl dellink usage\n\ncommit 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 upstream.\n\nFor 'real' hardware CAN devices the netlink interface is used to set CAN\nspecific communication parameters. Real CAN hardware can not be created nor\nremoved with the ip tool ...\n\nThis patch adds a private dellink function for the CAN device driver interface\nthat does just nothing.\n\nIt's a follow up to commit 993e6f2fd (\"can: fix oops caused by wrong rtnl\nnewlink usage\") but for dellink.\n\nReported-by: ajneu <ajneu1@gmail.com>\nSigned-off-by: Oliver Hartkopp <socketcan@hartkopp.net>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/aaf95b87cc9d2836a6103f4628d71186411033aa"},{"sha":"a3e8780243019b958037cbb7c9f5903fbea9684b","author":{"name":"Brian King","email":"cf155b27024ff05df2a628d0587a84b619e7ad17@linux.vnet.ibm.com"},"message":"ipr: Clear interrupt on croc/crocodile when running with LSI\n\ncommit 54e430bbd490e18ab116afa4cd90dcc45787b3df upstream.\n\nIf we fall back to using LSI on the Croc or Crocodile chip we need to\nclear the interrupt so we don't hang the system.\n\nTested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nSigned-off-by: Brian King <brking@linux.vnet.ibm.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/a3e8780243019b958037cbb7c9f5903fbea9684b"},{"sha":"6b96b2d473701b45df3fea8dd9796b6ec39e6d54","author":{"name":"Ilya Dryomov","email":"ad0e6692b7885e8fd4eaec2423c74ce4fd4304dd@gmail.com"},"message":"libceph: apply new_state before new_up_client on incrementals\n\ncommit 930c532869774ebf8af9efe9484c597f896a7d46 upstream.\n\nCurrently, osd_weight and osd_state fields are updated in the encoding\norder.  This is wrong, because an incremental map may look like e.g.\n\n    new_up_client: { osd=6, addr=... } # set osd_state and addr\n    new_state: { osd=6, xorstate=EXISTS } # clear osd_state\n\nSuppose osd6's current osd_state is EXISTS (i.e. osd6 is down).  After\napplying new_up_client, osd_state is changed to EXISTS | UP.  Carrying\non with the new_state update, we flip EXISTS and leave osd6 in a weird\n\"!EXISTS but UP\" state.  A non-existent OSD is considered down by the\nmapping code\n\n2087    for (i = 0; i < pg->pg_temp.len; i++) {\n2088            if (ceph_osd_is_down(osdmap, pg->pg_temp.osds[i])) {\n2089                    if (ceph_can_shift_osds(pi))\n2090                            continue;\n2091\n2092                    temp->osds[temp->size++] = CRUSH_ITEM_NONE;\n\nand so requests get directed to the second OSD in the set instead of\nthe first, resulting in OSD-side errors like:\n\n[WRN] : client.4239 192.168.122.21:0/2444980242 misdirected client.4239.1:2827 pg 2.5df899f2 to osd.4 not [1,4,6] in e680/680\n\nand hung rbds on the client:\n\n[  493.566367] rbd: rbd0: write 400000 at 11cc00000 (0)\n[  493.566805] rbd: rbd0:   result -6 xferred 400000\n[  493.567011] blk_update_request: I/O error, dev rbd0, sector 9330688\n\nThe fix is to decouple application from the decoding and:\n- apply new_weight first\n- apply new_state before new_up_client\n- twiddle osd_state flags if marking in\n- clear out some of the state if osd is destroyed\n\nFixes: http://tracker.ceph.com/issues/14901\n\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nReviewed-by: Josh Durgin <jdurgin@redhat.com>\n[idryomov@gmail.com: backport to 3.10-3.14: strip primary-affinity]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/beagleboard/linux/commits/6b96b2d473701b45df3fea8dd9796b6ec39e6d54"}]}
{"actor":{"display_login":"RobertCNelson"}}