{"push_id":1143878849,"size":42,"distinct_size":42,"ref":"refs/heads/master","head":"b2d5ad822322cfb5dd33e90484ed7df4ee6e68ee","before":"8c52b6dcdd1994ad0d2672e43c8d975d5c8195c3","commits":[{"sha":"9f9cd7ee2c05881f151e5ee4889e667a031dd8d9","author":{"name":"Aaron Lu","email":"99cc2c1b1cb63374cbfa049d0eeb7e951b7db2ae@intel.com"},"message":"ACPI / Thermal / video: fix max_level incorrect value\n\ncommit 059500940def (ACPI/video: export acpi_video_get_levels)\nmistakenly dropped the correct value of max_level and that caused the\nset_level function following failed and the acpi_video backlight interface\ndidn't get created. Fix this by passing back the correct max_level value.\n\nWhile at it, also fix the param used in acpi_video_device_lcd_query_levels\nwhere acpi_handle is expected but acpi_video_device is passed.\n\nFixes: 059500940def (ACPI/video: export acpi_video_get_levels)\nReported-and-tested-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>\nSigned-off-by: Aaron Lu <aaron.lu@intel.com>\nAcked-by: Zhang Rui <rui.zhang@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/9f9cd7ee2c05881f151e5ee4889e667a031dd8d9"},{"sha":"ce7791ffee1e1ee9f97193b817c7dd1fa6746aad","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race between readahead and device replace/removal\n\nThe list of devices is protected by the device_list_mutex and the device\nreplace code, in its finishing phase correctly takes that mutex before\nremoving the source device from that list. However the readahead code was\niterating that list without acquiring the respective mutex leading to\ncrashes later on due to invalid memory accesses:\n\n[125671.831036] general protection fault: 0000 [#1] PREEMPT SMP\n[125671.832129] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq acpi_cpufreq tpm_tis tpm ppdev evdev parport_pc psmouse sg parport\nprocessor ser\n[125671.834973] CPU: 10 PID: 19603 Comm: kworker/u32:19 Tainted: G        W       4.6.0-rc7-btrfs-next-29+ #1\n[125671.834973] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014\n[125671.834973] Workqueue: btrfs-readahead btrfs_readahead_helper [btrfs]\n[125671.834973] task: ffff8801ac520540 ti: ffff8801ac918000 task.ti: ffff8801ac918000\n[125671.834973] RIP: 0010:[<ffffffff81270479>]  [<ffffffff81270479>] __radix_tree_lookup+0x6a/0x105\n[125671.834973] RSP: 0018:ffff8801ac91bc28  EFLAGS: 00010206\n[125671.834973] RAX: 0000000000000000 RBX: 6b6b6b6b6b6b6b6a RCX: 0000000000000000\n[125671.834973] RDX: 0000000000000000 RSI: 00000000000c1bff RDI: ffff88002ebd62a8\n[125671.834973] RBP: ffff8801ac91bc70 R08: 0000000000000001 R09: 0000000000000000\n[125671.834973] R10: ffff8801ac91bc70 R11: 0000000000000000 R12: ffff88002ebd62a8\n[125671.834973] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000000c1bff\n[125671.834973] FS:  0000000000000000(0000) GS:ffff88023fd40000(0000) knlGS:0000000000000000\n[125671.834973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[125671.834973] CR2: 000000000073cae4 CR3: 00000000b7723000 CR4: 00000000000006e0\n[125671.834973] Stack:\n[125671.834973]  0000000000000000 ffff8801422d5600 ffff8802286bbc00 0000000000000000\n[125671.834973]  0000000000000001 ffff8802286bbc00 00000000000c1bff 0000000000000000\n[125671.834973]  ffff88002e639eb8 ffff8801ac91bc80 ffffffff81270541 ffff8801ac91bcb0\n[125671.834973] Call Trace:\n[125671.834973]  [<ffffffff81270541>] radix_tree_lookup+0xd/0xf\n[125671.834973]  [<ffffffffa04ae6a6>] reada_peer_zones_set_lock+0x3e/0x60 [btrfs]\n[125671.834973]  [<ffffffffa04ae8b9>] reada_pick_zone+0x29/0x103 [btrfs]\n[125671.834973]  [<ffffffffa04af42f>] reada_start_machine_worker+0x129/0x2d3 [btrfs]\n[125671.834973]  [<ffffffffa04880be>] btrfs_scrubparity_helper+0x185/0x3aa [btrfs]\n[125671.834973]  [<ffffffffa0488341>] btrfs_readahead_helper+0xe/0x10 [btrfs]\n[125671.834973]  [<ffffffff81069691>] process_one_work+0x271/0x4e9\n[125671.834973]  [<ffffffff81069dda>] worker_thread+0x1eb/0x2c9\n[125671.834973]  [<ffffffff81069bef>] ? rescuer_thread+0x2b3/0x2b3\n[125671.834973]  [<ffffffff8106f403>] kthread+0xd4/0xdc\n[125671.834973]  [<ffffffff8149e242>] ret_from_fork+0x22/0x40\n[125671.834973]  [<ffffffff8106f32f>] ? kthread_stop+0x286/0x286\n\nSo fix this by taking the device_list_mutex in the readahead code. We\ncan't use here the lighter approach of using a rcu_read_lock() and\nrcu_read_unlock() pair together with a list_for_each_entry_rcu() call\nbecause we end up doing calls to sleeping functions (kzalloc()) in the\nrespective code path.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/ce7791ffee1e1ee9f97193b817c7dd1fa6746aad"},{"sha":"57ba4cb85bffc0c7c6567c89d23713721fea9655","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race between device replace and block group removal\n\nWhen it's finishing, the device replace code iterates all extent maps\nrepresenting block group and for each one that has a stripe that refers\nto the source device, it replaces its device with the target device.\nHowever when it replaces the source device with the target device it,\nthe target device still has an ID of 0ULL (BTRFS_DEV_REPLACE_DEVID),\nonly after its ID is changed to match the one from the source device.\nThis leads to races with the chunk removal code that can temporarly see\na device with an ID of 0ULL and then attempt to use that ID to remove\nitems from the device tree and fail, causing a transaction abort:\n\n[ 9238.594364] BTRFS info (device sdf): dev_replace from /dev/sdf (devid 3) to /dev/sde finished\n[ 9238.594377] ------------[ cut here ]------------\n[ 9238.594402] WARNING: CPU: 14 PID: 21566 at fs/btrfs/volumes.c:2771 btrfs_remove_chunk+0x2e5/0x793 [btrfs]\n[ 9238.594403] BTRFS: Transaction aborted (error 1)\n[ 9238.594416] Modules linked in: btrfs crc32c_generic acpi_cpufreq xor tpm_tis tpm raid6_pq ppdev parport_pc processor psmouse parport i2c_piix4 evdev sg i2c_core se\nrio_raw pcspkr button loop autofs4 ext4 crc16 jbd2 mbcache sr_mod cdrom sd_mod ata_generic virtio_scsi ata_piix virtio_pci libata virtio_ring virtio e1000 scsi_mod fl\noppy [last unloaded: btrfs]\n[ 9238.594418] CPU: 14 PID: 21566 Comm: btrfs-cleaner Not tainted 4.6.0-rc7-btrfs-next-29+ #1\n[ 9238.594419] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014\n[ 9238.594421]  0000000000000000 ffff88017f1dbc60 ffffffff8126b42c ffff88017f1dbcb0\n[ 9238.594422]  0000000000000000 ffff88017f1dbca0 ffffffff81052b14 00000ad37f1dbd18\n[ 9238.594423]  0000000000000001 ffff88018068a558 ffff88005c4b9c00 ffff880233f60db0\n[ 9238.594424] Call Trace:\n[ 9238.594428]  [<ffffffff8126b42c>] dump_stack+0x67/0x90\n[ 9238.594430]  [<ffffffff81052b14>] __warn+0xc2/0xdd\n[ 9238.594432]  [<ffffffff81052b7a>] warn_slowpath_fmt+0x4b/0x53\n[ 9238.594434]  [<ffffffff8116c311>] ? kmem_cache_free+0x128/0x188\n[ 9238.594450]  [<ffffffffa04d43f5>] btrfs_remove_chunk+0x2e5/0x793 [btrfs]\n[ 9238.594452]  [<ffffffff8108e456>] ? arch_local_irq_save+0x9/0xc\n[ 9238.594464]  [<ffffffffa04a26fa>] btrfs_delete_unused_bgs+0x317/0x382 [btrfs]\n[ 9238.594476]  [<ffffffffa04a961d>] cleaner_kthread+0x1ad/0x1c7 [btrfs]\n[ 9238.594489]  [<ffffffffa04a9470>] ? btree_invalidatepage+0x8e/0x8e [btrfs]\n[ 9238.594490]  [<ffffffff8106f403>] kthread+0xd4/0xdc\n[ 9238.594494]  [<ffffffff8149e242>] ret_from_fork+0x22/0x40\n[ 9238.594495]  [<ffffffff8106f32f>] ? kthread_stop+0x286/0x286\n[ 9238.594496] ---[ end trace 183efbe50275f059 ]---\n\nThe sequence of steps leading to this is like the following:\n\n              CPU 1                                           CPU 2\n\n btrfs_dev_replace_finishing()\n\n   at this point\n   dev_replace->tgtdev->devid ==\n   BTRFS_DEV_REPLACE_DEVID (0ULL)\n\n   ...\n\n   btrfs_start_transaction()\n   btrfs_commit_transaction()\n\n                                                     btrfs_delete_unused_bgs()\n                                                       btrfs_remove_chunk()\n\n                                                         looks up for the extent map\n                                                         corresponding to the chunk\n\n                                                         lock_chunks() (chunk_mutex)\n                                                         check_system_chunk()\n                                                         unlock_chunks() (chunk_mutex)\n\n   locks fs_info->chunk_mutex\n\n   btrfs_dev_replace_update_device_in_mapping_tree()\n     --> iterates fs_info->mapping_tree and\n         replaces the device in every extent\n         map's map->stripes[] with\n         dev_replace->tgtdev, which still has\n         an id of 0ULL (BTRFS_DEV_REPLACE_DEVID)\n\n                                                         iterates over all stripes from\n                                                         the extent map\n\n                                                           --> calls btrfs_free_dev_extent()\n                                                               passing it the target device\n                                                               that still has an ID of 0ULL\n\n                                                           --> btrfs_free_dev_extent() fails\n                                                             --> aborts current transaction\n\n   finishes setting up the target device,\n   namely it sets tgtdev->devid to the value\n   of srcdev->devid (which is necessarily > 0)\n\n   frees the srcdev\n\n   unlocks fs_info->chunk_mutex\n\nSo fix this by taking the device list mutex while processing the stripes\nfor the chunk's extent map. This is similar to the race between device\nreplace and block group creation that was fixed by commit 50460e37186a\n(\"Btrfs: fix race when finishing dev replace leading to transaction abort\").\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/57ba4cb85bffc0c7c6567c89d23713721fea9655"},{"sha":"f0e9b7d6401959816599191d1d9db90b6fd750db","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race setting block group readonly during device replace\n\nWhen we do a device replace, for each device extent we find from the\nsource device, we set the corresponding block group to readonly mode to\nprevent writes into it from happening while we are copying the device\nextent from the source to the target device. However just before we set\nthe block group to readonly mode some concurrent task might have already\nallocated an extent from it or decided it could perform a nocow write\ninto one of its extents, which can make the device replace process to\nmiss copying an extent since it uses the extent tree's commit root to\nsearch for extents and only once it finishes searching for all extents\nbelonging to the block group it does set the left cursor to the logical\nend address of the block group - this is a problem if the respective\nordered extents finish while we are searching for extents using the\nextent tree's commit root and no transaction commit happens while we\nare iterating the tree, since it's the delayed references created by the\nordered extents (when they complete) that insert the extent items into\nthe extent tree (using the non-commit root of course).\nExample:\n\n          CPU 1                                            CPU 2\n\n btrfs_dev_replace_start()\n   btrfs_scrub_dev()\n     scrub_enumerate_chunks()\n       --> finds device extent belonging\n           to block group X\n\n                               <transaction N starts>\n\n                                                      starts buffered write\n                                                      against some inode\n\n                                                      writepages is run against\n                                                      that inode forcing dellaloc\n                                                      to run\n\n                                                      btrfs_writepages()\n                                                        extent_writepages()\n                                                          extent_write_cache_pages()\n                                                            __extent_writepage()\n                                                              writepage_delalloc()\n                                                                run_delalloc_range()\n                                                                  cow_file_range()\n                                                                    btrfs_reserve_extent()\n                                                                      --> allocates an extent\n                                                                          from block group X\n                                                                          (which is not yet\n                                                                           in RO mode)\n                                                                    btrfs_add_ordered_extent()\n                                                                      --> creates ordered extent Y\n                                                        flush_epd_write_bio()\n                                                          --> bio against the extent from\n                                                              block group X is submitted\n\n       btrfs_inc_block_group_ro(bg X)\n         --> sets block group X to readonly\n\n       scrub_chunk(bg X)\n         scrub_stripe(device extent from srcdev)\n           --> keeps searching for extent items\n               belonging to the block group using\n               the extent tree's commit root\n           --> it never blocks due to\n               fs_info->scrub_pause_req as no\n               one tries to commit transaction N\n           --> copies all extents found from the\n               source device into the target device\n           --> finishes search loop\n\n                                                        bio completes\n\n                                                        ordered extent Y completes\n                                                        and creates delayed data\n                                                        reference which will add an\n                                                        extent item to the extent\n                                                        tree when run (typically\n                                                        at transaction commit time)\n\n                                                          --> so the task doing the\n                                                              scrub/device replace\n                                                              at CPU 1 misses this\n                                                              and does not copy this\n                                                              extent into the new/target\n                                                              device\n\n       btrfs_dec_block_group_ro(bg X)\n         --> turns block group X back to RW mode\n\n       dev_replace->cursor_left is set to the\n       logical end offset of block group X\n\nSo fix this by waiting for all cow and nocow writes after setting a block\ngroup to readonly mode.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/f0e9b7d6401959816599191d1d9db90b6fd750db"},{"sha":"81e87a736c5581e83f52dc054b368993ec7f16d7","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix unprotected assignment of the left cursor for device replace\n\nWe were assigning new values to fields of the device replace object\nwithout holding the respective lock after processing each device extent.\nThis is important for the left cursor field which can be accessed by a\nconcurrent task running __btrfs_map_block (which, correctly, takes the\ndevice replace lock).\nSo change these fields while holding the device replace lock.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/81e87a736c5581e83f52dc054b368993ec7f16d7"},{"sha":"1a1a8b732c7e958e6eba0680439e814efde2362d","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race setting block group back to RW mode during device replace\n\nAfter it finishes processing a device extent, the device replace code sets\nback the block group to RW mode and then after that it sets the left cursor\nto match the logical end address of the block group, so that future writes\ninto extents belonging to the block group go both the source (old) and\ntarget (new) devices. However from the moment we turn the block group\nback to RW mode we have a short time window, that lasts until we update\nthe left cursor's value, where extents can be allocated from the block\ngroup and written to, in which case they will not be copied/written to\nthe target (new) device. Fix this by updating the left cursor's value\nbefore turning the block group back to RW mode.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/1a1a8b732c7e958e6eba0680439e814efde2362d"},{"sha":"22ab04e814f4fe2ce72a13d291491f98ef6ac757","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race between device replace and chunk allocation\n\nWhile iterating and copying extents from the source device, the device\nreplace code keeps adjusting a left cursor that is used to make sure that\nonce we finish processing a device extent, any future writes to extents\nfrom the corresponding block group will get into both the source and\ntarget devices. This left cursor is also used for resuming the device\nreplace operation at mount time.\n\nHowever using this left cursor to decide whether writes go into both\ndevices or only the source device is not enough to guarantee we don't\nmiss copying extents into the target device. There are two cases where\nthe current approach fails. The first one is related to when there are\nholes in the device and they get allocated for new block groups while\nthe device replace operation is iterating the device extents (more on\nthis explained below). The second one is that when that loop over the\ndevice extents finishes, we start dellaloc, wait for all ordered extents\nand then commit the current transaction, we might have got new block\ngroups allocated that are now using a device extent that has an offset\ngreater then or equals to the value of the left cursor, in which case\nwrites to extents belonging to these new block groups will get issued\nonly to the source device.\n\nFor the first case where the current approach of using a left cursor\nfails, consider the source device currently has the following layout:\n\n  [ extent bg A ] [ hole, unallocated space ] [extent bg B ]\n  3Gb             4Gb                         5Gb\n\nWhile we are iterating the device extents from the source device using\nthe commit root of the device tree, the following happens:\n\n        CPU 1                                            CPU 2\n\n                      <we are at transaction N>\n\n  scrub_enumerate_chunks()\n    --> searches the device tree for\n        extents belonging to the source\n        device using the device tree's\n        commit root\n    --> 1st iteration finds extent belonging to\n        block group A\n\n        --> sets block group A to RO mode\n            (btrfs_inc_block_group_ro)\n\n        --> sets cursor left to found_key.offset\n            which is 3Gb\n\n        --> scrub_chunk() starts\n            copies all allocated extents from\n            block group's A stripe at source\n            device into target device\n\n                                                           btrfs_alloc_chunk()\n                                                             --> allocates device extent\n                                                                 in the range [4Gb, 5Gb[\n                                                                 from the source device for\n                                                                 a new block group C\n\n                                                           extent allocated from block\n                                                           group C for a direct IO,\n                                                           buffered write or btree node/leaf\n\n                                                           extent is written to, perhaps\n                                                           in response to a writepages()\n                                                           call from the VM or directly\n                                                           through direct IO\n\n                                                           the write is made only against\n                                                           the source device and not against\n                                                           the target device because the\n                                                           extent's offset is in the interval\n                                                           [4Gb, 5Gb[ which is larger then\n                                                           the value of cursor_left (3Gb)\n\n        --> scrub_chunks() finishes\n\n        --> updates left cursor from 3Gb to\n            4Gb\n\n        --> btrfs_dec_block_group_ro() sets\n            block group A back to RW mode\n\n                             <we are still at transaction N>\n\n    --> 2nd iteration finds extent belonging to\n        block group B - it did not find the new\n        extent in the range [4Gb, 5Gb[ for block\n        group C because we are using the device\n        tree's commit root or even because the\n        block group's items are not all yet\n        inserted in the respective btrees, that is,\n        the block group is still attached to some\n        transaction handle's new_bgs list and\n        btrfs_create_pending_block_groups() was\n        not called yet against that transaction\n        handle, so the device extent items were\n        not yet inserted into the devices tree\n\n                             <we are still at transaction N>\n\n        --> so we end not copying anything from the newly\n            allocated device extent from the source device\n            to the target device\n\nSo fix this by making __btrfs_map_block() always redirect writes to the\ntarget device as well, independently of the left cursor's value. With\nthis change the left cursor is now used only for the purpose of tracking\nprogress and allow a mount operation to resume a device replace.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/22ab04e814f4fe2ce72a13d291491f98ef6ac757"},{"sha":"6cacd115a8aafdc3f0f47c30af9d3a55a18074db","author":{"name":"Srinivas Pandruvada","email":"bafa8fbaf973e74aae734803a1f0d8e07d0d0888@linux.intel.com"},"message":"cpufreq: intel_pstate: Downgrade print level for _PPC\n\nDowngrade pr_info to pr_debug for the \"_PPC limits will be enforced\"\nmessage.\n\nIn server systems with many cores this message is annoying.\n\nSigned-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>\n[ rjw: Changelog ]\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/6cacd115a8aafdc3f0f47c30af9d3a55a18074db"},{"sha":"b7ec35b304b64af2830027350cc99d31e6e537c2","author":{"name":"Ilya Dryomov","email":"ad0e6692b7885e8fd4eaec2423c74ce4fd4304dd@gmail.com"},"message":"libceph: change ceph_osdmap_flag() to take osdc\n\nFor the benefit of every single caller, take osdc instead of map.\nAlso, now that osdc->osdmap can't ever be NULL, drop the check.\n\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/b7ec35b304b64af2830027350cc99d31e6e537c2"},{"sha":"dc045a9168c83b2dc590930a0565e066346de382","author":{"name":"Ilya Dryomov","email":"ad0e6692b7885e8fd4eaec2423c74ce4fd4304dd@gmail.com"},"message":"libceph: put request only if it's done in handle_reply()\n\nhandle_reply() may be called twice on the same request: on ack and then\non commit.  This occurs on btrfs-formatted OSDs or if cephfs sync write\npath is triggered - CEPH_OSD_FLAG_ACK | CEPH_OSD_FLAG_ONDISK.\n\nhandle_reply() handles this with the help of done_request().\n\nFixes: 5aea3dcd5021 (\"libceph: a major OSD client update\")\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/dc045a9168c83b2dc590930a0565e066346de382"},{"sha":"4a3262b17c96b6ff332134c9e57f193a20226eb2","author":{"name":"Ilya Dryomov","email":"ad0e6692b7885e8fd4eaec2423c74ce4fd4304dd@gmail.com"},"message":"libceph: use %s instead of %pE in dout()s\n\nCommit d30291b985d1 (\"libceph: variable-sized ceph_object_id\") changed\ndout()s in what is now encode_request() and ceph_object_locator_to_pg()\nto use %pE, mostly to document that, although all rbd and cephfs object\nnames are NULL-terminated strings, ceph_object_id will handle any RADOS\nobject name, including the one containing NULs, just fine.\n\nHowever, it turns out that vbin_printf() can't handle anything but ints\nand %s - all %p suffixes are ignored.  The buffer %p** points to isn't\nrecorded, resulting in trash in the messages if the buffer had been\nreused by the time bstr_printf() got to it.\n\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/4a3262b17c96b6ff332134c9e57f193a20226eb2"},{"sha":"2999241daa8d77947f108dfbde35c268cd7bd709","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race between device replace and discard\n\nWhile we are finishing a device replace operation, we can make a discard\noperation (fs mounted with -o discard) do an invalid memory access like\nthe one reported by the following trace:\n\n[ 3206.384654] general protection fault: 0000 [#1] PREEMPT SMP\n[ 3206.387520] Modules linked in: dm_mod btrfs crc32c_generic xor raid6_pq acpi_cpufreq tpm_tis psmouse tpm ppdev sg parport_pc evdev i2c_piix4 parport\nprocessor serio_raw i2c_core pcspkr button loop autofs4 ext4 crc16 jbd2 mbcache sr_mod cdrom ata_generic sd_mod virtio_scsi ata_piix libata virtio_pci\nvirtio_ring scsi_mod e1000 virtio floppy [last unloaded: btrfs]\n[ 3206.388595] CPU: 14 PID: 29194 Comm: fsstress Not tainted 4.6.0-rc7-btrfs-next-29+ #1\n[ 3206.388595] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014\n[ 3206.388595] task: ffff88017ace0100 ti: ffff880171b98000 task.ti: ffff880171b98000\n[ 3206.388595] RIP: 0010:[<ffffffff8124d233>]  [<ffffffff8124d233>] blkdev_issue_discard+0x5c/0x2a7\n[ 3206.388595] RSP: 0018:ffff880171b9bb80  EFLAGS: 00010246\n[ 3206.388595] RAX: ffff880171b9bc28 RBX: 000000000090d000 RCX: 0000000000000000\n[ 3206.388595] RDX: ffffffff82fa1b48 RSI: ffffffff8179f46c RDI: ffffffff82fa1b48\n[ 3206.388595] RBP: ffff880171b9bcc0 R08: 0000000000000000 R09: 0000000000000001\n[ 3206.388595] R10: ffff880171b9bce0 R11: 000000000090f000 R12: ffff880171b9bbe8\n[ 3206.388595] R13: 0000000000000010 R14: 0000000000004868 R15: 6b6b6b6b6b6b6b6b\n[ 3206.388595] FS:  00007f6182e4e700(0000) GS:ffff88023fdc0000(0000) knlGS:0000000000000000\n[ 3206.388595] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 3206.388595] CR2: 00007f617c2bbb18 CR3: 000000017ad9c000 CR4: 00000000000006e0\n[ 3206.388595] Stack:\n[ 3206.388595]  0000000000004878 0000000000000000 0000000002400040 0000000000000000\n[ 3206.388595]  0000000000000000 ffff880171b9bbe8 ffff880171b9bbb0 ffff880171b9bbb0\n[ 3206.388595]  ffff880171b9bbc0 ffff880171b9bbc0 ffff880171b9bbd0 ffff880171b9bbd0\n[ 3206.388595] Call Trace:\n[ 3206.388595]  [<ffffffffa042899e>] btrfs_issue_discard+0x12f/0x143 [btrfs]\n[ 3206.388595]  [<ffffffffa042899e>] ? btrfs_issue_discard+0x12f/0x143 [btrfs]\n[ 3206.388595]  [<ffffffffa042e862>] btrfs_discard_extent+0x87/0xde [btrfs]\n[ 3206.388595]  [<ffffffffa04303b5>] btrfs_finish_extent_commit+0xb2/0x1df [btrfs]\n[ 3206.388595]  [<ffffffff8149c246>] ? __mutex_unlock_slowpath+0x150/0x15b\n[ 3206.388595]  [<ffffffffa04464c4>] btrfs_commit_transaction+0x7fc/0x980 [btrfs]\n[ 3206.388595]  [<ffffffff8149c246>] ? __mutex_unlock_slowpath+0x150/0x15b\n[ 3206.388595]  [<ffffffffa0459af6>] btrfs_sync_file+0x38f/0x428 [btrfs]\n[ 3206.388595]  [<ffffffff811a8292>] vfs_fsync_range+0x8c/0x9e\n[ 3206.388595]  [<ffffffff811a82c0>] vfs_fsync+0x1c/0x1e\n[ 3206.388595]  [<ffffffff811a8417>] do_fsync+0x31/0x4a\n[ 3206.388595]  [<ffffffff811a8637>] SyS_fsync+0x10/0x14\n[ 3206.388595]  [<ffffffff8149e025>] entry_SYSCALL_64_fastpath+0x18/0xa8\n[ 3206.388595]  [<ffffffff81100c6b>] ? time_hardirqs_off+0x9/0x14\n[ 3206.388595]  [<ffffffff8108e87d>] ? trace_hardirqs_off_caller+0x1f/0xaa\n\nThis happens because when we call btrfs_map_block() from\nbtrfs_discard_extent() to get a btrfs_bio structure, the device replace\noperation has not finished yet, but before we use the device of one of the\nstripes from the returned btrfs_bio structure, the device object is freed.\n\nThis is illustrated by the following diagram.\n\n            CPU 1                                                  CPU 2\n\n btrfs_dev_replace_start()\n\n (...)\n\n btrfs_dev_replace_finishing()\n\n   btrfs_start_transaction()\n   btrfs_commit_transaction()\n\n   (...)\n\n                                                            btrfs_sync_file()\n                                                              btrfs_start_transaction()\n\n                                                              (...)\n\n                                                              btrfs_commit_transaction()\n                                                                btrfs_finish_extent_commit()\n                                                                  btrfs_discard_extent()\n                                                                    btrfs_map_block()\n                                                                      --> returns a struct btrfs_bio\n                                                                          with a stripe that has a\n                                                                          device field pointing to\n                                                                          source device of the replace\n                                                                          operation (the device that\n                                                                          is being replaced)\n\n   mutex_lock(&uuid_mutex)\n   mutex_lock(&fs_info->fs_devices->device_list_mutex)\n   mutex_lock(&fs_info->chunk_mutex)\n\n   btrfs_dev_replace_update_device_in_mapping_tree()\n     --> iterates the mapping tree and for each\n         extent map that has a stripe pointing to\n         the source device, it updates the stripe\n         to point to the target device instead\n\n   btrfs_rm_dev_replace_blocked()\n     --> waits for fs_info->bio_counter to go down to 0\n\n   btrfs_rm_dev_replace_remove_srcdev()\n     --> removes source device from the list of devices\n\n   mutex_unlock(&fs_info->chunk_mutex)\n   mutex_unlock(&fs_info->fs_devices->device_list_mutex)\n   mutex_unlock(&uuid_mutex)\n\n   btrfs_rm_dev_replace_free_srcdev()\n     --> frees the source device\n\n                                                                    --> iterates over all stripes\n                                                                        of the returned struct\n                                                                        btrfs_bio\n                                                                    --> for each stripe it\n                                                                        dereferences its device\n                                                                        pointer\n                                                                        --> it ends up finding a\n                                                                            pointer to the device\n                                                                            used as the source\n                                                                            device for the replace\n                                                                            operation and that was\n                                                                            already freed\n\nSo fix this by surrounding the call to btrfs_map_block(), and the code\nthat uses the returned struct btrfs_bio, with calls to\nbtrfs_bio_counter_inc_blocked() and btrfs_bio_counter_dec(), so that\nthe finishing phase of the device replace operation blocks until the\nthe bio counter decreases to zero before it frees the source device.\nThis is the same approach we do at btrfs_map_bio() for example.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/2999241daa8d77947f108dfbde35c268cd7bd709"},{"sha":"b5de8d0df80fa87f1f97fbcc4bbc8cad0a018802","author":{"name":"Filipe Manana","email":"396addc00218539530419b15da697a581cb02fca@suse.com"},"message":"Btrfs: fix race between device replace and read repair\n\nWhile we are finishing a device replace operation we can have a concurrent\ntask trying to do a read repair operation, in which case it will call\nbtrfs_map_block() to get a struct btrfs_bio which can have a stripe that\npoints to the source device of the device replace operation. This allows\nfor the read repair task to dereference the stripe's device pointer after\nthe device replace operation has freed the source device, resulting in\nan invalid memory access. This is similar to the problem solved by my\nprevious patch in the same series and named \"Btrfs: fix race between\ndevice replace and discard\".\n\nSo fix this by surrounding the call to btrfs_map_block() and the code\nthat uses the returned struct btrfs_bio with calls to\nbtrfs_bio_counter_inc_blocked() and btrfs_bio_counter_dec(), giving the\nproper serialization with the finishing phase of the device replace\noperation.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/b5de8d0df80fa87f1f97fbcc4bbc8cad0a018802"},{"sha":"d2138455286f9db8fbff9b50b53b51766f6c1f92","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"FS-Cache: wake write waiter after invalidating writes\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>\nAcked-by: David Howells <dhowells@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/d2138455286f9db8fbff9b50b53b51766f6c1f92"},{"sha":"480ce08a70e4179f34808a3bdbfe6627f624cf54","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"FS-Cache: make check_consistency callback return int\n\n__fscache_check_consistency() calls check_consistency() callback\nand return the callback's return value. But the return type of\ncheck_consistency() is bool. So __fscache_check_consistency()\nreturn 1 if the cache is inconsistent. This is inconsistent with\nthe document.\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>\nAcked-by: David Howells <dhowells@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/480ce08a70e4179f34808a3bdbfe6627f624cf54"},{"sha":"368e35857dfab264f512d040c4486c9b13297988","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"ceph: call __fscache_uncache_page() if readpages fails\n\nIf readpages fails, fscache needs to cleanup its internal state.\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/368e35857dfab264f512d040c4486c9b13297988"},{"sha":"1464975816c79a7cd28dc314384f060a122a9d55","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"ceph: avoid unnecessary fscache invalidation/revlidation\n\nceph_fill_file_size() has already called ceph_fscache_invalidate()\nif it return true.\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/1464975816c79a7cd28dc314384f060a122a9d55"},{"sha":"46b59b2be05a71d80d76883d2f495f182d768f47","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"ceph: disable fscache when inode is opened for write\n\nAll other filesystems do not add dirty pages to fscache. They all\ndisable fscache when inode is opened for write. Only ceph adds\ndirty pages to fscache, but the code is buggy.\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/46b59b2be05a71d80d76883d2f495f182d768f47"},{"sha":"f7f7e7a0635dedd5064fba255cb3facfa87b06d6","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"ceph: improve fscache revalidation\n\nThere are several issues in fscache revalidation code.\n- In ceph_revalidate_work(), fscache_invalidate() is called when\n  fscache_check_consistency() return 0. This is complete wrong\n  because 0 means cache is valid.\n- Handle_cap_grant() calls ceph_queue_revalidate() if client\n  already has CAP_FILE_CACHE. This code is confusing. Client\n  should revalidate the cache each time it got CAP_FILE_CACHE\n  anew.\n- In Handle_cap_grant(), fscache_invalidate() is called if MDS\n  revokes CAP_FILE_CACHE. This is inconsistency with the case\n  that inode get evicted. In the later case, the cache is not\n  discarded. Client may use the cache when inode is reloaded.\n\nThis patch moves the fscache revalidation into ceph_get_caps().\nClient revalidates the cache after it gets CAP_FILE_CACHE.\ni_rdcache_gen should keep constance while CAP_FILE_CACHE is\nused. If i_fscache_gen is not equal to i_rdcache_gen, client\nneeds to check cache's consistency.\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/f7f7e7a0635dedd5064fba255cb3facfa87b06d6"},{"sha":"f6973c09490c919398fc87d9c6bec9c0b670c4c4","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"ceph: use i_version to check validity of fscache\n\nSigned-off-by: Yan, Zheng <zyan@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Noltari/linux/commits/f6973c09490c919398fc87d9c6bec9c0b670c4c4"}]}
{"actor":{"display_login":"Noltari"}}