From 57e2b74eb0777dc93bcf4a0a526ebfceae8992f0 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Oct 15 2014 15:45:34 +0000 Subject: Linux v3.17.1 - Revert Btrfs ro snapshot commit that causes filesystem corruption --- diff --git a/ARM-tegra-usb-no-reset.patch b/ARM-tegra-usb-no-reset.patch index 2f3dd68..3b6c906 100644 --- a/ARM-tegra-usb-no-reset.patch +++ b/ARM-tegra-usb-no-reset.patch @@ -9,10 +9,10 @@ Patch for disconnect issues with storage attached to a 1 file changed, 7 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index d481c99a20d7..6050143ce7ec 100644 +index dc849154f9de..88647f158ed2 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -5036,6 +5036,13 @@ static void hub_events(void) +@@ -5038,6 +5038,13 @@ static void hub_events(void) (u16) hub->change_bits[0], (u16) hub->event_bits[0]); diff --git a/Revert-Btrfs-race-free-update-of-commit-root-for-ro-.patch b/Revert-Btrfs-race-free-update-of-commit-root-for-ro-.patch new file mode 100644 index 0000000..90ebd2f --- /dev/null +++ b/Revert-Btrfs-race-free-update-of-commit-root-for-ro-.patch @@ -0,0 +1,105 @@ +From: Josh Boyer +Date: Wed, 15 Oct 2014 10:09:50 -0400 +Subject: [PATCH] Revert "Btrfs: race free update of commit root for ro + snapshots" + +This reverts commit 9c3b306e1c9e6be4be09e99a8fe2227d1005effc. +--- + fs/btrfs/inode.c | 36 ------------------------------------ + fs/btrfs/ioctl.c | 33 +++++++++++++++++++++++++++++++++ + 2 files changed, 33 insertions(+), 36 deletions(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 016c403bfe7e..46bd0303fadd 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5202,42 +5202,6 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry) + iput(inode); + inode = ERR_PTR(ret); + } +- /* +- * If orphan cleanup did remove any orphans, it means the tree +- * was modified and therefore the commit root is not the same as +- * the current root anymore. This is a problem, because send +- * uses the commit root and therefore can see inode items that +- * don't exist in the current root anymore, and for example make +- * calls to btrfs_iget, which will do tree lookups based on the +- * current root and not on the commit root. Those lookups will +- * fail, returning a -ESTALE error, and making send fail with +- * that error. So make sure a send does not see any orphans we +- * have just removed, and that it will see the same inodes +- * regardless of whether a transaction commit happened before +- * it started (meaning that the commit root will be the same as +- * the current root) or not. +- */ +- if (sub_root->node != sub_root->commit_root) { +- u64 sub_flags = btrfs_root_flags(&sub_root->root_item); +- +- if (sub_flags & BTRFS_ROOT_SUBVOL_RDONLY) { +- struct extent_buffer *eb; +- +- /* +- * Assert we can't have races between dentry +- * lookup called through the snapshot creation +- * ioctl and the VFS. +- */ +- ASSERT(mutex_is_locked(&dir->i_mutex)); +- +- down_write(&root->fs_info->commit_root_sem); +- eb = sub_root->commit_root; +- sub_root->commit_root = +- btrfs_root_node(sub_root); +- up_write(&root->fs_info->commit_root_sem); +- free_extent_buffer(eb); +- } +- } + } + + return inode; +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 8a8e29878c34..f99f15e5e8cd 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -711,6 +711,39 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, + if (ret) + goto fail; + ++ ret = btrfs_orphan_cleanup(pending_snapshot->snap); ++ if (ret) ++ goto fail; ++ ++ /* ++ * If orphan cleanup did remove any orphans, it means the tree was ++ * modified and therefore the commit root is not the same as the ++ * current root anymore. This is a problem, because send uses the ++ * commit root and therefore can see inode items that don't exist ++ * in the current root anymore, and for example make calls to ++ * btrfs_iget, which will do tree lookups based on the current root ++ * and not on the commit root. Those lookups will fail, returning a ++ * -ESTALE error, and making send fail with that error. So make sure ++ * a send does not see any orphans we have just removed, and that it ++ * will see the same inodes regardless of whether a transaction ++ * commit happened before it started (meaning that the commit root ++ * will be the same as the current root) or not. ++ */ ++ if (readonly && pending_snapshot->snap->node != ++ pending_snapshot->snap->commit_root) { ++ trans = btrfs_join_transaction(pending_snapshot->snap); ++ if (IS_ERR(trans) && PTR_ERR(trans) != -ENOENT) { ++ ret = PTR_ERR(trans); ++ goto fail; ++ } ++ if (!IS_ERR(trans)) { ++ ret = btrfs_commit_transaction(trans, ++ pending_snapshot->snap); ++ if (ret) ++ goto fail; ++ } ++ } ++ + inode = btrfs_lookup_dentry(dentry->d_parent->d_inode, dentry); + if (IS_ERR(inode)) { + ret = PTR_ERR(inode); +-- +1.9.3 + diff --git a/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch b/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch index 0f3a701..a733945 100644 --- a/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch +++ b/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch @@ -15,10 +15,10 @@ Signed-off-by: Josh Boyer 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 10d51c2f10d7..5b6ebe8b519e 100644 +index 1edd5fdc629d..17a82652ac03 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt -@@ -3596,7 +3596,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -3600,7 +3600,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. the allocated input device; If set to 0, video driver will only send out the event without touching backlight brightness level. diff --git a/USB-core-add-device-qualifier-quirk.patch b/USB-core-add-device-qualifier-quirk.patch index 7d05770..48a2c30 100644 --- a/USB-core-add-device-qualifier-quirk.patch +++ b/USB-core-add-device-qualifier-quirk.patch @@ -21,10 +21,10 @@ Signed-off-by: Greg Kroah-Hartman 2 files changed, 6 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 6050143ce7ec..9a6d2d6d9fe2 100644 +index 88647f158ed2..d3e4c73d56a2 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -4538,6 +4538,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1) +@@ -4540,6 +4540,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1) struct usb_qualifier_descriptor *qual; int status; @@ -35,17 +35,19 @@ index 6050143ce7ec..9a6d2d6d9fe2 100644 if (qual == NULL) return; diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h -index 55a17b188daa..ffe565c94743 100644 +index 32e0f5c04e72..a4abaeb3fb00 100644 --- a/include/linux/usb/quirks.h +++ b/include/linux/usb/quirks.h -@@ -41,4 +41,7 @@ +@@ -41,6 +41,9 @@ */ #define USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL 0x00000080 +/* device can't handle device_qualifier descriptor requests */ +#define USB_QUIRK_DEVICE_QUALIFIER 0x00000100 + - #endif /* __LINUX_USB_QUIRKS_H */ + /* device generates spurious wakeup, ignore remote wakeup capability */ + #define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200 + -- 1.9.3 diff --git a/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch b/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch index 8bad312..8329406 100644 --- a/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch +++ b/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch @@ -11,7 +11,7 @@ Signed-off-by: Adel Gadllah 1 file changed, 4 insertions(+) diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index cac60d9b091b..e71bad25294c 100644 +index 0999e0285e07..8ebe6254d013 100644 --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -98,6 +98,10 @@ static const struct usb_device_id usb_quirk_list[] = { diff --git a/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch b/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch index a344aba..f423789 100644 --- a/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch +++ b/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch @@ -27,7 +27,7 @@ Signed-off-by: Greg Kroah-Hartman 1 file changed, 4 insertions(+) diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index bae636e2a1a3..a342a783d496 100644 +index 814e712655e4..5ae883dc21f5 100644 --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -93,6 +93,10 @@ static const struct usb_device_id usb_quirk_list[] = { diff --git a/USB-quirks-enable-device-qualifier-quirk-for-another.patch b/USB-quirks-enable-device-qualifier-quirk-for-another.patch index febd6da..49f84d9 100644 --- a/USB-quirks-enable-device-qualifier-quirk-for-another.patch +++ b/USB-quirks-enable-device-qualifier-quirk-for-another.patch @@ -13,7 +13,7 @@ Signed-off-by: Adel Gadllah 1 file changed, 2 insertions(+) diff --git a/fs/namespace.c b/fs/namespace.c -index c8e3034ff4b2..fbba8b17330d 100644 +index 74647c2fe69c..550dbff08677 100644 --- a/fs/namespace.c +++ b/fs/namespace.c -@@ -1439,6 +1439,8 @@ static int do_umount(struct mount *mnt, int flags) +@@ -1356,6 +1356,8 @@ static int do_umount(struct mount *mnt, int flags) * Special case for "unmounting" root ... * we just try to remount it readonly. */ diff --git a/kernel.spec b/kernel.spec index ff6d275..c963d25 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 0 +%define stable_update 1 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -622,8 +622,6 @@ Patch26029: KEYS-Reinstate-EPERM-for-a-key-type-name-beginning-w.patch Patch26030: GFS2-Make-rename-not-save-dirent-location.patch -Patch26031: libata-Un-break-ATA-blacklist.patch - #CVE-2014-7970 rhbz 1151095 1151484 Patch26032: mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch @@ -640,6 +638,8 @@ Patch26041: HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch #CVE-2014-7975 rhbz 1151108 1152025 Patch26042: fs-Add-a-missing-permission-check-to-do_umount.patch +Patch26043: Revert-Btrfs-race-free-update-of-commit-root-for-ro-.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1375,8 +1375,6 @@ ApplyPatch KEYS-Reinstate-EPERM-for-a-key-type-name-beginning-w.patch ApplyPatch GFS2-Make-rename-not-save-dirent-location.patch -ApplyPatch libata-Un-break-ATA-blacklist.patch - #CVE-2014-7970 rhbz 1151095 1151484 ApplyPatch mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch @@ -1393,6 +1391,8 @@ ApplyPatch HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch #CVE-2014-7975 rhbz 1151108 1152025 ApplyPatch fs-Add-a-missing-permission-check-to-do_umount.patch +ApplyPatch Revert-Btrfs-race-free-update-of-commit-root-for-ro-.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2261,6 +2261,10 @@ fi # ||----w | # || || %changelog +* Wed Oct 15 2014 Josh Boyer - 3.17.1-300 +- Linux v3.17.1 +- Revert Btrfs ro snapshot commit that causes filesystem corruption + * Mon Oct 13 2014 Josh Boyer - CVE-2014-7975 fs: umount DoS (rhbz 1151108 1152025) diff --git a/libata-Un-break-ATA-blacklist.patch b/libata-Un-break-ATA-blacklist.patch deleted file mode 100644 index e8d70ba..0000000 --- a/libata-Un-break-ATA-blacklist.patch +++ /dev/null @@ -1,51 +0,0 @@ -From: George Spelvin -Date: Tue, 7 Oct 2014 07:26:38 -0400 -Subject: [PATCH] libata: Un-break ATA blacklist - -lib/glob.c provides a new glob_match() function, with arguments in -(pattern, string) order. It replaced a private function with arguments -in (string, pattern) order, but I didn't swap the call site... - -The result was the entire ATA blacklist was effectively disabled. - -The lesson for today is "I f***ed up *how* badly *how* many months ago?", -er, I mean "Nobody Tests RC Kernels On Legacy Hardware". - -This was not a subtle break, but it made it through an entire RC -cycle unreported, presumably because all the people doing testing -have full-featured hardware. - -(FWIW, the reason for the argument swap was because fnmatch() does it that -way, and for a while implementing a full fnmatch() was being considered.) - -Fixes: 428ac5fc056e0 (libata: Use glob_match from lib/glob.c) -Reported-by: Steven Honeyman -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=71371#c21 -Signed-off-by: George Spelvin -Cc: # 3.17 -Tested-by: Steven Honeyman -Signed-off-by: Tejun Heo ---- - drivers/ata/libata-core.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index f3e7b9f894cd..6f674906c64c 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4261,10 +4261,10 @@ static unsigned long ata_dev_blacklisted(const struct ata_device *dev) - ata_id_c_string(dev->id, model_rev, ATA_ID_FW_REV, sizeof(model_rev)); - - while (ad->model_num) { -- if (glob_match(model_num, ad->model_num)) { -+ if (glob_match(ad->model_num, model_num)) { - if (ad->model_rev == NULL) - return ad->horkage; -- if (glob_match(model_rev, ad->model_rev)) -+ if (glob_match(ad->model_rev, model_rev)) - return ad->horkage; - } - ad++; --- -1.9.3 -