Files
kernel_google_wahoo/fs/buffer.c
Robin Peng 62b159444e Merge upstream-linux-4.4.y (4.4.196) into android-msm-wahoo-4.4-qt-lts
Linux 4.4.196
    NFC: fix attrs checks in netlink interface
  * smack: use GFP_NOFS while holding inode_smack::smk_lock
      security/smack/smack_access.c
      security/smack/smack_lsm.c
  * Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set
      security/smack/smack_lsm.c
    sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
    net/rds: Fix error handling in rds_ib_add_one()
    xen-netfront: do not use ~0U as error return value for xennet_fill_frags()
    sch_dsmark: fix potential NULL deref in dsmark_init()
    nfc: fix memory leak in llcp_sock_bind()
    net: qlogic: Fix memory leak in ql_alloc_large_buffers
  * net: ipv4: avoid mixed n_redirects and rate_tokens usage
      net/ipv4/route.c
  * ipv6: drop incoming packets having a v4mapped source address
      net/ipv6/ip6_input.c
    hso: fix NULL-deref on tty open
  * ANDROID: binder: synchronize_rcu() when using POLLFREE.
      drivers/android/binder.c
  * ANDROID: binder: remove waitqueue when thread exits.
      drivers/android/binder.c
  * kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K
      lib/Kconfig.debug
    ocfs2: wait for recovering done after direct unlock request
    hypfs: Fix error number left in struct pointer member
  * fat: work around race with userspace's read via blockdev while mounting
      fs/fat/dir.c
      fs/fat/fatent.c
  * security: smack: Fix possible null-pointer dereferences in smack_socket_sock_rcv_skb()
      security/smack/smack_lsm.c
  * HID: apple: Fix stuck function keys when using FN
      drivers/hid/hid-apple.c
    ARM: 8898/1: mm: Don't treat faults reported from cache maintenance as writes
    mfd: intel-lpss: Remove D3cold delay
  * scsi: core: Reduce memory required for SCSI logging
      drivers/scsi/scsi_logging.c
      include/scsi/scsi_dbg.h
    powerpc/pseries: correctly track irq state in default idle
    powerpc/64s/exception: machine check use correct cfar for late handler
    vfio_pci: Restore original state on release
    pinctrl: tegra: Fix write barrier placement in pmx_writel
    powerpc/pseries/mobility: use cond_resched when updating device tree
    powerpc/futex: Fix warning: 'oldval' may be used uninitialized in this function
    powerpc/rtas: use device model APIs and serialization during LPM
    clk: sirf: Don't reference clk_init_data after registration
    clk: qoriq: Fix -Wunused-const-variable
    ipmi_si: Only schedule continuously in the thread in maintenance mode
    gpu: drm: radeon: Fix a possible null-pointer dereference in radeon_connector_set_property()
    video: ssd1307fb: Start page range at page_offset
Linux 4.4.195
    Btrfs: fix race setting up and completing qgroup rescan workers
    btrfs: Relinquish CPUs in btrfs_compare_trees
    Btrfs: fix use-after-free when using the tree modification log
  * ovl: filter of trusted xattr results in audit
      fs/overlayfs/inode.c
    CIFS: Fix oplock handling for SMB 2.1+ protocols
    i2c: riic: Clear NACK in tend isr
  * hwrng: core - don't wait on add_early_randomness()
      drivers/char/hw_random/core.c
  * quota: fix wrong condition in is_quota_modification()
      include/linux/quotaops.h
  * ext4: fix punch hole for inline_data file systems
      fs/ext4/inode.c
  * /dev/mem: Bail out upon SIGKILL.
      drivers/char/mem.c
  * cfg80211: Purge frame registrations on iftype change
      net/wireless/util.c
    md/raid6: Set R5_ReadError when there is read failure on parity disk
  * alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP
      kernel/time/alarmtimer.c
    ARM: zynq: Use memcpy_toio instead of memcpy on smp bring-up
    ASoC: Intel: Fix use of potentially uninitialized variable
    media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table
    KVM: x86: Manually calculate reserved bits when loading PDPTRS
    KVM: x86: set ctxt->have_exception in x86_decode_insn()
    KVM: x86: always stop emulation on page fault
    parisc: Disable HP HSC-PCI Cards to prevent kernel crash
  * fuse: fix missing unlock_page in fuse_writepage()
      fs/fuse/file.c
  * printk: Do not lose last line in kmsg buffer dump
      kernel/printk/printk.c
    ALSA: firewire-tascam: check intermediate state of clock status and retry
    ALSA: firewire-tascam: handle error code when getting current source of clock
    media: omap3isp: Set device on omap3isp subdevs
    btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type
    ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93
    media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
    libertas: Add missing sentinel at end of if_usb.c fw_table
    mmc: sdhci: Fix incorrect switch to HS mode
    ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set
  * kprobes: Prohibit probing on BUG() and WARN() address
      include/linux/bug.h
    dmaengine: ti: edma: Do not reset reserved paRAM slots
    md/raid1: fail run raid1 array when active disk less than one
    hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap'
    ACPI: custom_method: fix memory leaks
    libtraceevent: Change users plugin directory
    ACPI / CPPC: do not require the _PSD method
    media: ov9650: add a sanity check
    media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate()
    media: cpia2_usb: fix memory leaks
    media: saa7146: add cleanup in hexium_attach()
    media: hdpvr: add terminating 0 at end of string
    media: radio/si470x: kill urb on error
    net: lpc-enet: fix printk format strings
    media: omap3isp: Don't set streaming state on random subdevs
    dmaengine: iop-adma: use correct printk format strings
    media: gspca: zero usb_buf on error
    efi: cper: print AER info of PCIe fatal error
  * md: don't set In_sync if array is frozen
      drivers/md/md.c
  * md: don't call spare_active in md_reap_sync_thread if all member devices can't work
      drivers/md/md.c
    ia64:unwind: fix double free for mod->arch.init_unw_table
  * ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid
      sound/usb/pcm.c
  * base: soc: Export soc_device_register/unregister APIs
      drivers/base/soc.c
    media: iguanair: add sanity checks
    ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls()
    ALSA: hda - Show the fatal CORB/RIRB error more clearly
    x86/apic: Soft disable APIC before initializing it
    x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI fails
  * sched/core: Fix CPU controller for !RT_GROUP_SCHED
      kernel/sched/core.c
  * sched/fair: Fix imbalance due to CPU affinity
      kernel/sched/fair.c
    media: hdpvr: Add device num check and handling
    media: dib0700: fix link error for dibx000_i2c_set_speed
    leds: leds-lp5562 allow firmware files up to the maximum length
    dmaengine: bcm2835: Print error in case setting DMA mask fails
    ASoC: sgtl5000: Fix charge pump source assignment
    ALSA: hda: Flush interrupts on disabling
    nfc: enforce CAP_NET_RAW for raw sockets
    ieee802154: enforce CAP_NET_RAW for raw sockets
    ax25: enforce CAP_NET_RAW for raw sockets
    appletalk: enforce CAP_NET_RAW for raw sockets
    mISDN: enforce CAP_NET_RAW for raw sockets
  * usbnet: sanity checking of packet sizes and device mtu
      drivers/net/usb/usbnet.c
  * usbnet: ignore endpoints with invalid wMaxPacketSize
      drivers/net/usb/usbnet.c
    skge: fix checksum byte order
    sch_netem: fix a divide by zero in tabledist()
    openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC
    net/phy: fix DP83865 10 Mbps HDX loopback disable function
  * cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
      drivers/net/usb/cdc_ncm.c
    arcnet: provide a buffer big enough to actually receive packets
    Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
    drm: Flush output polling on shutdown
    f2fs: fix to do sanity check on segment bitmap of LFS curseg
    Revert "f2fs: avoid out-of-range memory access"
    f2fs: check all the data segments against all node ones
  * irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
      drivers/irqchip/irq-gic-v3-its.c
    locking/lockdep: Add debug_locks check in __lock_downgrade()
    mac80211: handle deauthentication/disassociation from TDLS peer
    mac80211: Print text for disassociation reason
    ALSA: hda - Add laptop imic fixup for ASUS M9V laptop
    ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt()
    net: rds: Fix NULL ptr use in rds_tcp_kill_sock
    crypto: talitos - fix missing break in switch statement
    mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
  * HID: hidraw: Fix invalid read in hidraw_ioctl
      drivers/hid/hidraw.c
  * HID: logitech: Fix general protection fault caused by Logitech driver
      drivers/hid/hid-lg.c
      drivers/hid/hid-lg4ff.c
  * HID: lg: make transfer buffers DMA capable
      drivers/hid/hid-lg.c
    HID: prodikeys: Fix general protection fault during probe
  * Revert "Bluetooth: validate BLE connection interval updates"
      net/bluetooth/hci_event.c
      net/bluetooth/l2cap_core.c
Linux 4.4.194
  * net_sched: let qdisc_put() accept NULL pointer
      net/sched/sch_generic.c
    ARC: export "abort" for modules
    media: technisat-usb2: break out of loop at end of buffer
    floppy: fix usercopy direction
  * keys: Fix missing null pointer check in request_key_auth_describe()
      security/keys/request_key_auth.c
    dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
    net: seeq: Fix the function used to release some memory in an error handling path
    tools/power turbostat: fix buffer overrun
    sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
    cifs: Use kzfree() to zero out the password
    cifs: set domainName when a domain-key is used in multiuser
    NFSv2: Fix write regression
    NFSv2: Fix eof handling
  * netfilter: nf_conntrack_ftp: Fix debug output
      net/netfilter/nf_conntrack_ftp.c
    x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
  * r8152: Set memory to all 0xFFs on failed reg reads
      drivers/net/usb/r8152.c
    ARM: 8874/1: mm: only adjust sections of valid mm structures
  * Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
      drivers/atm/Kconfig
    NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
    NFSv4: Fix return values for nfs4_file_open()
    s390/bpf: use 32-bit index for tail calls
    ARM: OMAP2+: Fix omap4 errata warning on other SoCs
    s390/bpf: fix lcgr instruction encoding
    mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
    tty/serial: atmel: reschedule TX after RX was started
    serial: sprd: correct the wrong sequence of arguments
    KVM: coalesced_mmio: add bounds checking
    xen-netfront: do not assume sk_buff_head list is empty in error handling
    x86/boot: Add missing bootparam that breaks boot on some platforms
    media: tm6000: double free if usb disconnect while streaming
  * USB: usbcore: Fix slab-out-of-bounds bug during device reset
      drivers/usb/core/config.c
    ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
    MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
    x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
    crypto: talitos - check data blocksize in ablkcipher.
    crypto: talitos - check AES key size
  * driver core: Fix use-after-free and double free on glue directory
      drivers/base/core.c
    clk: rockchip: Don't yell about bad mmc phases when getting
    MIPS: VDSO: Use same -m%-float cflag as the kernel proper
    MIPS: VDSO: Prevent use of smp_processor_id()
    KVM: nVMX: handle page fault in vmread
    KVM: x86: work around leak of uninitialized stack contents
    KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
  * genirq: Prevent NULL pointer dereference in resend_irqs()
      kernel/irq/resend.c
    Btrfs: fix assertion failure during fsync and use of stale transaction
    Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
  * tun: fix use-after-free when register netdev failed
      drivers/net/tun.c
    tipc: add NULL pointer check before calling kfree_rcu
  * tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
      net/ipv4/tcp_input.c
    sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
    sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
    sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
  * net: Fix null de-reference of device refcount
      net/core/dev.c
    isdn/capi: check message length in capi_write()
  * ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
      net/ipv6/ping.c
  * cdc_ether: fix rndis support for Mediatek based smartphones
      drivers/net/usb/cdc_ether.c
  * bridge/mdb: remove wrong use of NLM_F_MULTI
      net/bridge/br_mdb.c
Linux 4.4.193
    vhost: make sure log_num < in_num
  * af_packet: tone down the Tx-ring unsupported spew.
      net/packet/af_packet.c
    x86, boot: Remove multiple copy of static function sanitize_boot_params()
    clk: s2mps11: Add used attribute to s2mps11_dt_match
    scripts/decode_stacktrace: match basepath using shell prefix operator, not regex
    vhost/test: fix build for vhost test
  * xfrm: clean up xfrm protocol checks
      include/net/xfrm.h
      net/key/af_key.c
      net/xfrm/xfrm_state.c
      net/xfrm/xfrm_user.c
    ALSA: hda/realtek - Fix overridden device-specific initialization
    ALSA: hda - Fix potential endless loop at applying quirks
Linux 4.4.192
    net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
    net: fix skb use after free in netpoll
    Revert "x86/apic: Include the LDR when clearing out APIC registers"
    spi: bcm2835aux: fix corruptions for longer spi transfers
    spi: bcm2835aux: remove dangerous uncontrolled read of fifo
    spi: bcm2835aux: unifying code between polling and interrupt driven code
    spi: bcm2835aux: ensure interrupts are enabled for shared handler
    libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
    KVM: arm/arm64: Only skip MMIO insn once
    ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
    IB/mlx4: Fix memory leaks
    Tools: hv: kvp: eliminate 'may be used uninitialized' warning
    ravb: Fix use-after-free ravb_tstamp_skb
    wimax/i2400m: fix a memory leak bug
    net: kalmia: fix memory leaks
    cx82310_eth: fix a memory leak bug
    net: myri10ge: fix memory leaks
    cxgb4: fix a memory leak bug
  * gpio: Fix build error of function redefinition
      include/linux/gpio.h
    ibmveth: Convert multicast list size for little-endian system
    Bluetooth: btqca: Add a short delay before downloading the NVM
    net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
    net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
Linux 4.4.191
    x86/ptrace: fix up botched merge of spectrev1 fix
    mac80211: fix possible sta leak
  * Revert "cfg80211: fix processing world regdomain when non modular"
      net/wireless/reg.c
    VMCI: Release resource if the work is already queued
    stm class: Fix a double free of stm_source_device
    mmc: core: Fix init of SD cards reporting an invalid VDD range
    mmc: sdhci-of-at91: add quirk for broken HS200
    uprobes/x86: Fix detection of 32-bit user mode
    ptrace,x86: Make user_64bit_mode() available to 32-bit builds
    USB: storage: ums-realtek: Whitelist auto-delink support
    USB: storage: ums-realtek: Update module parameter description for auto_delink_en
    usb: host: ohci: fix a race condition between shutdown and irq
    USB: cdc-wdm: fix race between write and disconnect due to flag abuse
  * usb-storage: Add new JMS567 revision to unusual_devs
      drivers/usb/storage/unusual_devs.h
    x86/apic: Include the LDR when clearing out APIC registers
    x86/apic: Do not initialize LDR and DFR for bigsmp
    KVM: x86: Don't update RIP or do single-step on faulting emulation
    ALSA: seq: Fix potential concurrent access to the deleted pool
  * tcp: make sure EPOLLOUT wont be missed
      net/core/stream.c
  * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
      sound/usb/mixer.c
  * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
      sound/usb/mixer.c
  * tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
      include/net/tcp.h
    watchdog: bcm2835_wdt: Fix module autoload
    tools: hv: fix KVP and VSS daemons exit code
    usb: host: fotg2: restart hcd after port reset
  * usb: gadget: composite: Clear "suspended" on reset/disconnect
      drivers/usb/gadget/composite.c
    dmaengine: ste_dma40: fix unneeded variable warning
  * scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm()
      drivers/scsi/ufs/ufshcd.c
    x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
    x86/pm: Introduce quirk framework to save/restore extra MSR registers around suspend/resume
    Revert "perf test 6: Fix missing kvm module load for s390"
  * netfilter: conntrack: Use consistent ct id hash calculation
      net/netfilter/nf_conntrack_core.c
  * netfilter: ctnetlink: don't use conntrack/expect object addresses as id
      include/net/netfilter/nf_conntrack.h
      net/netfilter/nf_conntrack_core.c
      net/netfilter/nf_conntrack_netlink.c
  * inet: switch IP ID generator to siphash
      include/linux/siphash.h
      include/net/netns/ipv4.h
      net/ipv4/route.c
      net/ipv6/output_core.c
  * siphash: implement HalfSipHash1-3 for hash tables
      include/linux/siphash.h
      lib/siphash.c
  * siphash: add cryptographically secure PRF
      include/linux/siphash.h
      lib/Kconfig.debug
      lib/Makefile
      lib/siphash.c
    vhost: scsi: add weight support
    vhost_net: fix possible infinite loop
    vhost: introduce vhost_exceeds_weight()
    vhost_net: introduce vhost_exceeds_weight()
    vhost_net: use packet weight for rx handler, too
    vhost-net: set packet weight of tx polling to 2 * vq size
    net: arc_emac: fix koops caused by sk_buff free
    GFS2: don't set rgrp gl_object until it's inserted into rgrp tree
  * cgroup: Disable IRQs while holding css_set_lock
      kernel/cgroup.c
  * dm table: fix invalid memory accesses with too high sector number
      drivers/md/dm-table.c
    dm space map metadata: fix missing store of apply_bops() return value
    dm btree: fix order of block initialization in btree_split_beneath
    x86/boot: Fix boot regression caused by bootparam sanitizing
    x86/boot: Save fields explicitly, zero out everything else
    x86/apic: Handle missing global clockevent gracefully
    x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
    userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
  * Revert "dm bufio: fix deadlock with loop device"
      drivers/md/dm-bufio.c
  * HID: wacom: correct misreported EKR ring values
      drivers/hid/wacom_wac.c
    selftests: kvm: Adding config fragments
    libata: add SG safety checks in SFF pio transfers
    net: hisilicon: Fix dma_map_single failed on arm64
    net: hisilicon: fix hip04-xmit never return TX_BUSY
    net: hisilicon: make hip04_tx_reclaim non-reentrant
    net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
    NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
    can: peak_usb: force the string buffer NULL-terminated
    can: sja1000: force the string buffer NULL-terminated
    perf bench numa: Fix cpu0 binding
    isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
    isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
    net: usb: qmi_wwan: Add the BroadMobi BM818 card
    ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
    st_nci_hci_connectivity_event_received: null check the allocation
    st21nfca_connectivity_event_received: null check the allocation
    can: dev: call netif_carrier_off() in register_candev()
  * bonding: Force slave speed check after link state recovery for 802.3ad
      drivers/net/bonding/bond_main.c
  * netfilter: ebtables: fix a memory leak bug in compat
      net/bridge/netfilter/ebtables.c
    MIPS: kernel: only use i8253 clocksource with periodic clockevent
  * HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
      drivers/hid/hid-tmff.c
Linux 4.4.190
  * bonding: Add vlan tx offload to hw_enc_features
      drivers/net/bonding/bond_main.c
    sctp: fix the transport error_count check
    net/mlx5e: Only support tx/rx pause setting for port owner
    xen/netback: Reset nr_frags before freeing skb
  * net/packet: fix race in tpacket_snd()
      net/packet/af_packet.c
    x86/boot: Disable the address-of-packed-member compiler warning
    iommu/amd: Move iommu_init_pci() to .init section
    x86/vdso: Remove direct HPET access through the vDSO
    IB/mlx5: Make coding style more consistent
    RDMA: Directly cast the sockaddr union to sockaddr
    scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
  * asm-generic: default BUG_ON(x) to if(x)BUG()
      include/asm-generic/bug.h
    Input: psmouse - fix build error of multiple definition
  * arm64: compat: Allow single-byte watchpoints on all addresses
      arch/arm64/kernel/hw_breakpoint.c
  * include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
      include/linux/module.h
  * Backport minimal compiler_attributes.h to support GCC 9
      include/linux/compiler.h
    USB: serial: option: Add Motorola modem UARTs
    USB: serial: option: add the BroadMobi BM818 card
    USB: serial: option: Add support for ZTE MF871A
    USB: serial: option: add D-Link DWM-222 device ID
    usb: cdc-acm: make sure a refcount is taken early enough
  * USB: core: Fix races in character device registration and deregistraion
      drivers/usb/core/file.c
    staging: comedi: dt3000: Fix rounding up of timer divisor
    staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
  * asm-generic: fix -Wtype-limits compiler warnings
      include/asm-generic/getorder.h
    ocfs2: remove set but not used variable 'last_hash'
    IB/core: Add mitigation for Spectre V1
  * kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
      scripts/Makefile.modpost
    ata: libahci: do not complain in case of deferred probe
    scsi: hpsa: correct scsi command status issue after reset
    libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    perf header: Fix use of unitialized value warning
    perf header: Fix divide by zero error if f_header.attr_size==0
    irqchip/irq-imx-gpcv2: Forward irq type to parent
    xen/pciback: remove set but not used variable 'old_state'
    net: usb: pegasus: fix improper read if get_registers() fail
    Input: iforce - add sanity checks
    Input: kbtab - sanity check for endpoint type
    HID: hiddev: do cleanup in failure of opening a device
    HID: hiddev: avoid opening a disconnected device
    HID: holtek: test for sanity of intfdata
    ALSA: hda - Fix a memory leak bug
    mm/memcontrol.c: fix use after free in mem_cgroup_iter()
  * USB: gadget: f_midi: fixing a possible double-free in f_midi
      drivers/usb/gadget/function/f_midi.c
      drivers/usb/gadget/u_f.h
  * usb: gadget: f_midi: fail if set_alt fails to allocate requests
      drivers/usb/gadget/function/f_midi.c
    sh: kernel: hw_breakpoint: Fix missing break in switch statement
    scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
    mwifiex: fix 802.11n/WPA detection
    smb3: send CAP_DFS capability during session setup
    SMB3: Fix deadlock in validate negotiate hits reconnect
    mac80211: don't WARN on short WMM parameters from AP
    ALSA: firewire: fix a memory leak bug
    hwmon: (nct7802) Fix wrong detection of in4 presence
    can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
    can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
  * perf/core: Fix creating kernel counters for PMUs that override event->cpu
      kernel/events/core.c
  * tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
      drivers/tty/tty_ldsem.c
    scsi: ibmvfc: fix WARN_ON during event pool release
    scsi: megaraid_sas: fix panic on loading firmware crashdump
    ARM: davinci: fix sleep.S build error on ARMv4
    perf probe: Avoid calling freeing routine multiple times for same pointer
  * ALSA: compress: Be more restrictive about when a drain is allowed
      sound/core/compress_offload.c
  * ALSA: compress: Prevent bypasses of set_params
      sound/core/compress_offload.c
  * ALSA: compress: Fix regression on compressed capture streams
      include/sound/compress_driver.h
      sound/core/compress_offload.c
    s390/qdio: add sanity checks to the fast-requeue path
    cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
    mac80211: don't warn about CW params when not using them
  * iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
      drivers/firmware/Kconfig
  * netfilter: nfnetlink: avoid deadlock due to synchronous request_module
      net/netfilter/nfnetlink.c
    can: peak_usb: fix potential double kfree_skb()
    usb: yurex: Fix use-after-free in yurex_delete
    perf db-export: Fix thread__exec_comm()
  * mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
      mm/vmalloc.c
    x86/mm: Sync also unmappings in vmalloc_sync_all()
    x86/mm: Check for pfn instead of page in vmalloc_sync_one()
  * sound: fix a memory leak bug
      sound/sound_core.c
    usb: iowarrior: fix deadlock on disconnect
Linux 4.4.189
    x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS
    x86/entry/64: Use JMP instead of JMPQ
    x86/speculation: Enable Spectre v1 swapgs mitigations
    x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations
    x86/entry/64: Fix context tracking state warning when load_gs_index fails
    x86: cpufeatures: Sort feature word 7
    spi: bcm2835: Fix 3-wire mode if DMA is enabled
  * block: blk_init_allocated_queue() set q->fq as NULL in the fail case
      block/blk-core.c
  * compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
      drivers/net/ppp/pppoe.c
      drivers/net/ppp/pppox.c
      fs/compat_ioctl.c
      include/linux/if_pppox.h
      net/l2tp/l2tp_ppp.c
    bnx2x: Disable multi-cos feature.
    net/mlx5: Use reversed order when unregister devices
    net: sched: Fix a possible null-pointer dereference in dequeue_func()
    tipc: compat: allow tipc commands without arguments
  * net: fix ifindex collision during namespace removal
      net/core/dev.c
    net: bridge: delete local fdb on device init failure
    atm: iphase: Fix Spectre v1 vulnerability
  * tcp: be more careful in tcp_fragment()
      include/net/tcp.h
      net/ipv4/tcp_output.c
  * HID: Add quirk for HP X1200 PIXART OEM mouse
      drivers/hid/hid-ids.h
      drivers/hid/usbhid/hid-quirks.c
    netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter
  * arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
      arch/arm64/include/asm/cpufeature.h
      arch/arm64/kernel/cpufeature.c
  * arm64: cpufeature: Fix CTR_EL0 field definitions
      arch/arm64/kernel/cpufeature.c
Linux 4.4.188
    xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
    s390/dasd: fix endless loop after read unit address configuration
  * selinux: fix memory leak in policydb_init()
      security/selinux/ss/policydb.c
    x86/kvm: Don't call kvm_spurious_fault() from .fixup
    ipc/mqueue.c: only perform resource calculation if user valid
    uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers
    coda: fix build using bare-metal toolchain
    coda: add error handling for fget
  * mm/cma.c: fail if fixed declaration can't be honored
      mm/cma.c
    x86: math-emu: Hide clang warnings for 16-bit overflow
    x86/apic: Silence -Wtype-limits compiler warnings
    be2net: Signal that the device cannot transmit during reconfiguration
  * ACPI: fix false-positive -Wuninitialized warning
      include/linux/acpi.h
    scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
    ceph: fix improper use of smp_mb__before_atomic()
    btrfs: fix minimum number of chunk errors for DUP
    fs/adfs: super: fix use-after-free bug
    dmaengine: rcar-dmac: Reject zero-length slave DMA requests
    MIPS: lantiq: Fix bitfield masking
  * kernel/module.c: Only return -EEXIST for modules that have finished loading
      kernel/module.c
    ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend
    ARM: riscpc: fix DMA
Linux 4.4.187
    ceph: hold i_ceph_lock when removing caps for freeing inode
    drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
  * sched/fair: Don't free p->numa_faults with concurrent readers
      fs/exec.c
      include/linux/sched.h
      kernel/fork.c
      kernel/sched/fair.c
    Bluetooth: hci_uart: check for missing tty operations
    media: radio-raremono: change devm_k*alloc to k*alloc
    media: cpia2_usb: first wake up, then free in disconnect
    ISDN: hfcsusb: checking idx of ep configuration
  * tcp: reset sk_send_head in tcp_write_queue_purge
      include/net/tcp.h
    ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
  * mm, vmstat: make quiet_vmstat lighter
      mm/vmstat.c
  * vmstat: Remove BUG_ON from vmstat_update
      mm/vmstat.c
  * access: avoid the RCU grace period for the temporary subjective credentials
      fs/open.c
      include/linux/cred.h
      kernel/cred.c
    powerpc/tm: Fix oops on sigreturn on systems without TM
    ALSA: hda - Add a conexant codec entry to let mute led work
    ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1
    hpet: Fix division by zero in hpet_time_div()
    x86/speculation/mds: Apply more accurate check on hypervisor platform
    x86/sysfb_efi: Add quirks for some devices with swapped width and height
  * usb: pci-quirks: Correct AMD PLL quirk detection
      drivers/usb/host/pci-quirks.c
    usb: wusbcore: fix unbalanced get/put cluster_id
    locking/lockdep: Hide unused 'class' variable
    locking/lockdep: Fix lock used or unused stats error
    mm/mmu_notifier: use hlist_add_head_rcu()
    9p: pass the correct prototype to read_cache_page
    mm/kmemleak.c: fix check for softirq context
    sh: prevent warnings when using iounmap
    powerpc/eeh: Handle hugepages in ioremap space
    mailbox: handle failed named mailbox channel request
    f2fs: avoid out-of-range memory access
    perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning
  * kallsyms: exclude kasan local symbols on s390
      scripts/kallsyms.c
    serial: sh-sci: Fix TX DMA buffer flushing and workqueue races
    powerpc/4xx/uic: clear pending interrupt after irq type/pol change
    um: Silence lockdep complaint about mmap_sem
    mfd: arizona: Fix undefined behavior
  * mfd: core: Set fwnode for created devices
      drivers/mfd/mfd-core.c
    recordmcount: Fix spurious mcount entries on powerpc
    iio: iio-utils: Fix possible incorrect mask calculation
  * PCI: sysfs: Ignore lockdep for remove attribute
      drivers/pci/pci-sysfs.c
    powerpc/pci/of: Fix OF flags parsing for 64bit BARs
  * usb: gadget: Zero ffs_io_data
      drivers/usb/gadget/function/f_fs.c
    phy: renesas: rcar-gen2: Fix memory leak at error paths
    drm/virtio: Add memory barriers for capset cache.
  * tty: serial: msm_serial: avoid system lockup condition
      drivers/tty/serial/msm_serial.c
    tty/serial: digicolor: Fix digicolor-usart already registered warning
    memstick: Fix error cleanup path of memstick_init
    tty: serial: cpm_uart - fix init when SMC is relocated
    pinctrl: rockchip: fix leaked of_node references
    tty: max310x: Fix invalid baudrate divisors calculator
  * usb: core: hub: Disable hub-initiated U1/U2
      drivers/usb/core/hub.c
    drm/panel: simple: Fix panel_simple_dsi_probe
    nfsd: Fix overflow causing non-working mounts on 1 TB machines
    nfsd: fix performance-limiting session calculation
    nfsd: give out fewer session slots as limit approaches
    nfsd: increase DRC cache limit
    NFSv4: Fix open create exclusive when the server reboots
  * elevator: fix truncation of icq_cache_name
      include/linux/elevator.h
  * net: bridge: stp: don't cache eth dest pointer before skb pull
      net/bridge/br_stp_bpdu.c
  * net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
      net/bridge/br_multicast.c
  * net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
      net/bridge/br_multicast.c
  * bonding: validate ip header before check IPPROTO_IGMP
      drivers/net/bonding/bond_main.c
  * tcp: Reset bytes_acked and bytes_received when disconnecting
      net/ipv4/tcp.c
    netrom: hold sock when setting skb->destructor
    netrom: fix a memory leak in nr_rx_frame()
    sky2: Disable MSI on ASUS P6T
    nfc: fix potential illegal memory access
  * net: neigh: fix multiple neigh timer scheduling
      net/core/neighbour.c
    net: bcmgenet: use promisc for unsupported filters
  * ipv4: don't set IPv6 only flags to IPv4 addresses
      net/ipv4/devinet.c
    caif-hsi: fix possible deadlock in cfhsi_exit_module()
    bnx2x: Prevent load reordering in tx completion processing
  * dm bufio: fix deadlock with loop device
      drivers/md/dm-bufio.c
  * usb: Handle USB3 remote wakeup for LPM enabled devices correctly
      drivers/usb/core/hub.c
  * Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
      net/bluetooth/smp.c
    intel_th: msu: Fix single mode with disabled IOMMU
    eCryptfs: fix a couple type promotion bugs
    powerpc/watchpoint: Restore NV GPRs while returning from exception
    powerpc/32s: fix suspend/resume when IBATs 4-7 are used
    parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
    gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
    coda: pass the host file in vma->vm_file on mmap
    floppy: fix out-of-bounds read in copy_buffer
    floppy: fix invalid pointer dereference in drive_name
    floppy: fix out-of-bounds read in next_valid_format
    floppy: fix div-by-zero in setup_format_params
  * take floppy compat ioctls to sodding floppy.c
      block/compat_ioctl.c
  * PCI: Do not poll for PME if the device is in D3cold
      drivers/pci/pci.c
    9p/virtio: Add cleanup path in p9_virtio_init
    padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
    drm/nouveau/i2c: Enable i2c pads & busses during preinit
    KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
    media: coda: Remove unbalanced and unneeded mutex unlock
  * media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
      drivers/media/v4l2-core/v4l2-ctrls.c
    ALSA: seq: Break too long mutex context in the write loop
  * lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
      lib/scatterlist.c
    NFSv4: Handle the special Linux file open access mode
  * tracing/snapshot: Resize spare buffer if size changed
      kernel/trace/trace.c
    regulator: s2mps11: Fix buck7 and buck8 wrong voltages
    Input: gtco - bounds check collection indent level
  * crypto: arm64/sha2-ce - correct digest for empty data in finup
      arch/arm64/crypto/sha2-ce-glue.c
  * crypto: arm64/sha1-ce - correct digest for empty data in finup
      arch/arm64/crypto/sha1-ce-glue.c
  * crypto: ghash - fix unaligned memory access in ghash_setkey()
      crypto/ghash-generic.c
  * Bluetooth: validate BLE connection interval updates
      net/bluetooth/hci_event.c
      net/bluetooth/l2cap_core.c
  * Bluetooth: Check state in l2cap_disconnect_rsp
      net/bluetooth/l2cap_core.c
    Bluetooth: 6lowpan: search for destination address in all peers
    Bluetooth: hci_bcsp: Fix memory leak in rx_skb
    bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
  * EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
      drivers/edac/edac_mc_sysfs.c
      drivers/edac/edac_module.h
    ixgbe: Check DDM existence in transceiver before access
  * rslib: Fix handling of of caller provided syndrome
      lib/reed_solomon/decode_rs.c
  * rslib: Fix decoding of shortened codes
      lib/reed_solomon/decode_rs.c
    ath10k: fix PCIE device wake up failed
    mt7601u: fix possible memory leak when the device is disconnected
    x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
    mt7601u: do not schedule rx_tasklet when the device has been disconnected
    media: coda: increment sequence offset for the last returned frame
    media: coda: fix mpeg2 sequence number handling
  * acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
      arch/arm64/kernel/acpi.c
  * timer_list: Guard procfs specific code
      kernel/time/timer_list.c
  * ntp: Limit TAI-UTC offset
      kernel/time/ntp.c
  * media: i2c: fix warning same module names
      drivers/media/i2c/Makefile
  * EDAC/sysfs: Fix memory leak when creating a csrow object
      drivers/edac/edac_mc_sysfs.c
    vhost_net: disable zerocopy by default
    perf evsel: Make perf_evsel__name() accept a NULL argument
  * xfrm: fix sa selector validation
      net/xfrm/xfrm_user.c
  * rcu: Force inlining of rcu_read_lock()
      include/linux/rcupdate.h
  * bpf: silence warning messages in core
      kernel/bpf/Makefile
  * regmap: fix bulk writes on paged registers
      drivers/base/regmap/regmap.c
    gpio: omap: ensure irq is enabled before wakeup
    gpio: omap: fix lack of irqstatus_raw0 for OMAP4
    perf test 6: Fix missing kvm module load for s390
    s390/qdio: handle PENDING state for QEBSM devices
    net: axienet: Fix race condition causing TX hang
    net: fec: Do not use netdev messages too early
    cpupower : frequency-set -r option misses the last cpu in related cpu list
    media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
    locking/lockdep: Fix merging of hlocks with non-zero references
    tua6100: Avoid build warnings.
  * net: phy: Check against net_device being NULL
      drivers/net/phy/phy_device.c
    media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
  * xfrm: Fix xfrm sel prefix length validation
      net/xfrm/xfrm_user.c
  * af_key: fix leaks in key_pol_get_resp and dump_sp.
      net/key/af_key.c
    signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
    net: stmmac: dwmac1000: Clear unused address entries
    media: vpss: fix a potential NULL pointer dereference
    media: marvell-ccic: fix DMA s/g desc number calculation
    crypto: talitos - fix skcipher failure due to wrong output IV
    media: dvb: usb: fix use after free in dvb_usb_device_exit
    batman-adv: fix for leaked TVLV handler.
    ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
    ath6kl: add some bounds checking
    ath9k: Check for errors when reading SREV register
    ath10k: Do not send probe response template for mesh
    dmaengine: imx-sdma: fix use-after-free on probe error path
    MIPS: fix build on non-linux hosts
    MIPS: ath79: fix ar933x uart parity mode
Linux 4.4.186
    KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock
    s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
    s390/qdio: (re-)initialize tiqdio list entries
    s390: fix stfle zero padding
    ARC: hide unused function unw_hdr_alloc
    kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR
    dm verity: use message limit for data block corruption message
    sis900: fix TX completion
  * ppp: mppe: Add softdep to arc4
      drivers/net/ppp/ppp_mppe.c
    be2net: fix link failure after ethtool offline test
    ARM: omap2: remove incorrect __init annotation
  * perf/core: Fix perf_sample_regs_user() mm check
      kernel/events/core.c
    e1000e: start network tx queue only when link is up
    MIPS: Remove superfluous check for __linux__
    VMCI: Fix integer overflow in VMCI handle arrays
    carl9170: fix misuse of device driver API
    staging: comedi: amplc_pci230: fix null pointer deref on interrupt
    staging: comedi: dt282x: fix a null pointer deref on interrupt
    usb: renesas_usbhs: add a workaround for a race condition of workqueue
  * usb: gadget: ether: Fix race between gether_disconnect and rx_submit
      drivers/usb/gadget/function/u_ether.c
    USB: serial: option: add support for GosunCn ME3630 RNDIS mode
    USB: serial: ftdi_sio: add ID for isodebug v1
    mwifiex: Don't abort on small, spec-compliant vendor IEs
  * fscrypt: don't set policy for a dead directory
      fs/ext4/crypto_policy.c
    mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
    mwifiex: Abort at too short BSS descriptor element
    x86/tls: Fix possible spectre-v1 in do_get_thread_area()
    x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
    udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
    bnx2x: Check if transceiver implements DDM before access
  * md: fix for divide error in status_resync
      drivers/md/md.c
    ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
    ARM: davinci: da850-evm: call regulator_has_full_constraints()
    Input: imx_keypad - make sure keyboard can always wake up system
  * can: mcp251x: add support for mcp25625
      drivers/net/can/spi/Kconfig
    dt-bindings: can: mcp251x: add mcp25625 support
    mwifiex: Fix possible buffer overflows at parsing bss descriptor
    mac80211: mesh: fix RCU warning
    samples, bpf: fix to change the buffer size for read()
    Input: elantech - enable middle button support on 2 ThinkPads
Linux 4.4.185
    dmaengine: imx-sdma: remove BD_INTR for channel0
    KVM: x86: degrade WARN to pr_warn_ratelimited
  * arm64, vdso: Define vdso_{start,end} as array
      arch/arm64/kernel/vdso.c
    ARC: handle gcc generated __builtin_trap for older compiler
    tty: rocket: fix incorrect forward declaration of 'rp_init()'
    btrfs: Ensure replaced device doesn't have pending chunk allocation
  * lib/mpi: Fix karactx leak in mpi_powm
      lib/mpi/mpi-pow.c
  * ALSA: usb-audio: fix sign unintended sign extension on left shifts
      sound/usb/mixer_quirks.c
    ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
    ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
    crypto: user - prevent operating on larval algorithms
  * ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
      kernel/ptrace.c
    MIPS: Workaround GCC __builtin_unreachable reordering bug
  * bug.h: work around GCC PR82365 in BUG()
      include/asm-generic/bug.h
      include/linux/compiler-gcc.h
      include/linux/compiler.h
  * swiotlb: Make linux/swiotlb.h standalone includible
      include/linux/swiotlb.h
    mfd: omap-usb-tll: Fix register offsets
    MIPS: math-emu: do not use bools for arithmetic
    ARC: fix build warning in elf.h
    ARC: Assume multiplier is always present
    scsi: hpsa: correct ioaccel2 chaining
    usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
    usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
    ASoC: max98090: remove 24-bit format support if RJ is 0
    spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
    ASoC : cs4265 : readable register too low
    um: Compile with modern headers
  * Bluetooth: Fix faulty expression for minimum encryption key size check
      net/bluetooth/l2cap_core.c
  * net: check before dereferencing netdev_ops during busy poll
      include/net/busy_poll.h
  * bonding: Always enable vlan tx offload
      drivers/net/bonding/bond_main.c
  * ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
      net/ipv4/raw.c
    team: Always enable vlan tx offload
    tipc: check msg->req data len in tipc_nl_compat_bearer_disable
    tipc: change to use register_pernet_device
    sctp: change to hold sk after auth shkey is created successfully
  * cpu/speculation: Warn on unsupported mitigations= parameter
      kernel/cpu.c
    x86/speculation: Allow guests to use SSBD even if host does not
  * ovl: modify ovl_permission() to do checks on two inodes
      fs/overlayfs/inode.c
    KVM: X86: Fix scan ioapic use-before-initialization
    net/9p: include trans_common.h to fix missing prototype warning.
    9p: p9dirent_read: check network-provided name length
    9p/rdma: remove useless check in cm_event_handler
    9p: acl: fix uninitialized iattr access
    9p/rdma: do not disconnect on down_interruptible EAGAIN
    perf help: Remove needless use of strncpy()
    perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
    mac80211: drop robust management frames from unknown TA
  * cfg80211: fix memory leak of wiphy device name
      net/wireless/core.c
    SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write
  * Bluetooth: Fix regression with minimum encryption key size alignment
      net/bluetooth/hci_conn.c
      net/bluetooth/l2cap_core.c
  * Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
      include/net/bluetooth/hci_core.h
      net/bluetooth/hci_conn.c
    ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
    can: purge socket error queue on sock destruct
    can: flexcan: fix timeout when set small bitrate
    btrfs: start readahead also in seed devices
    Btrfs: fix race between readahead and device replace/removal
    hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
    s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
  * scsi: ufs: Check that space was properly alloced in copy_query_response
      drivers/scsi/ufs/ufshcd.c
    scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
    sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
    net: hns: Fix loopback test failed at copper ports
    MIPS: uprobes: remove set but not used variable 'epc'
    IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
    parisc: Fix compiler warnings in float emulation code
    parport: Fix mem leak in parport_register_dev_model
    apparmor: enforce nullbyte at end of tag string
  * Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
      drivers/input/misc/uinput.c
    usb: chipidea: udc: workaround for endpoint conflict issue
  * gcc-9: silence 'address-of-packed-member' warning
      Makefile
  * tracing: Silence GCC 9 array bounds warning
      kernel/trace/trace.c
      kernel/trace/trace.h
    scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
    mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
    fs/binfmt_flat.c: make load_flat_shared_library() work
Linux 4.4.184
  * tcp: refine memory limit test in tcp_fragment()
      net/ipv4/tcp_output.c
Linux 4.4.183
  * Abort file_remove_privs() for non-reg. files
      fs/inode.c
  * coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
      drivers/android/binder.c
      fs/proc/task_mmu.c
      include/linux/mm.h
      mm/mmap.c
    Revert "crypto: crypto4xx - properly set IV after de- and encrypt"
    scsi: libsas: delete sas port if expander discover failed
    scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route()
    net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs
    KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list
    ia64: fix build errors by exporting paddr_to_nid()
  * configfs: Fix use-after-free when accessing sd->s_dentry
      fs/configfs/dir.c
  * i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
      drivers/i2c/i2c-dev.c
    net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE()
  * gpio: fix gpio-adp5588 build errors
      drivers/gpio/Kconfig
  * perf/ring_buffer: Add ordering to rb->nest increment
      kernel/events/ring_buffer.c
  * perf/ring_buffer: Fix exposing a temporarily decreased data_head
      kernel/events/ring_buffer.c
    x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor
    mISDN: make sure device name is NUL terminated
    sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg
  * neigh: fix use-after-free read in pneigh_get_next
      net/core/neighbour.c
    lapb: fixed leak of control-blocks.
  * ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero
      net/ipv6/ip6_flowlabel.c
    be2net: Fix number of Rx queues used for flow hashing
    ax25: fix inconsistent lock state in ax25_destroy_timer
    USB: serial: option: add Telit 0x1260 and 0x1261 compositions
    USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
    USB: serial: pl2303: add Allied Telesis VT-Kit3
  * USB: usb-storage: Add new ID to ums-realtek
      drivers/usb/storage/unusual_realtek.h
  * USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
      drivers/usb/core/quirks.c
    drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
    drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
    KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
    KVM: x86/pmu: do not mask the value that is written to fixed PMUs
    usbnet: ipheth: fix racing condition
    scsi: bnx2fc: fix incorrect cast to u64 on shift operation
    scsi: lpfc: add check for loss of ndlp when sending RRQ
    Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
    ASoC: cs42xx8: Add regcache mask dirty
  * cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
      include/linux/cgroup.h
    bcache: fix stack corruption by PRECEDING_KEY()
    i2c: acorn: fix i2c warning
  * ptrace: restore smp_rmb() in __ptrace_may_access()
      kernel/cred.c
      kernel/ptrace.c
  * signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
      kernel/ptrace.c
    fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
  * mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
      mm/list_lru.c
    libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
    ALSA: seq: Cover unsubscribe_port() in list_mutex
  * Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
      include/net/bluetooth/hci_core.h
      net/bluetooth/hci_conn.c
  * futex: Fix futex lock the wrong page
      kernel/futex.c
    ARM: exynos: Fix undefined instruction during Exynos5422 resume
  * pwm: Fix deadlock warning when removing PWM device
      drivers/pwm/core.c
      drivers/pwm/sysfs.c
      include/linux/pwm.h
    ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
    pwm: tiehrpwm: Update shadow register for disabling PWMs
    dmaengine: idma64: Use actual device for DMA transfers
    gpio: gpio-omap: add check for off wake capable gpios
    PCI: xilinx: Check for __get_free_pages() failure
    video: imsttfb: fix potential NULL pointer dereferences
    video: hgafb: fix potential NULL pointer dereference
    PCI: rcar: Fix a potential NULL pointer dereference
    PCI: rpadlpar: Fix leaked device_node references in add/remove paths
    ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
    ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
    ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
    clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
    soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
    platform/chrome: cros_ec_proto: check for NULL transfer function
    x86/PCI: Fix PCI IRQ routing table memory leak
    nfsd: allow fh_want_write to be called twice
  * fuse: retrieve: cap requested size to negotiated max_write
      fs/fuse/dev.c
    nvmem: core: fix read buffer in place
    ALSA: hda - Register irq handler after the chip initialization
    iommu/vt-d: Set intel_iommu_gfx_mapped correctly
    f2fs: fix to do sanity check on valid block count of segment
    f2fs: fix to avoid panic in do_recover_data()
  * ntp: Allow TAI-UTC offset to be set to zero
      kernel/time/ntp.c
    drm/bridge: adv7511: Fix low refresh rate selection
    perf/x86/intel: Allow PEBS multi-entry in watermark mode
    mfd: twl6040: Fix device init errors for ACCCTL register
    mfd: intel-lpss: Set the device in reset state when init
  * kernel/sys.c: prctl: fix false positive in validate_prctl_map()
      kernel/sys.c
  * mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
      mm/cma_debug.c
  * mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
      mm/cma.c
    hugetlbfs: on restore reserve error path retain subpool reservation
    ipc: prevent lockup on alloc_msg and free_msg
  * sysctl: return -EINVAL if val violates minmax
      kernel/sysctl.c
  * fs/fat/file.c: issue flush after the writeback of FAT
      fs/fat/file.c
Linux 4.4.182
  * tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
      net/ipv4/tcp_timer.c
  * tcp: add tcp_min_snd_mss sysctl
      include/net/netns/ipv4.h
      net/ipv4/sysctl_net_ipv4.c
      net/ipv4/tcp_ipv4.c
      net/ipv4/tcp_output.c
  * tcp: tcp_fragment() should apply sane memory limits
      include/uapi/linux/snmp.h
      net/ipv4/proc.c
      net/ipv4/tcp_output.c
  * tcp: limit payload size of sacked skbs
      include/linux/tcp.h
      include/net/tcp.h
      net/ipv4/tcp.c
      net/ipv4/tcp_input.c
      net/ipv4/tcp_output.c
Linux 4.4.181
  * ethtool: check the return value of get_regs_len
      net/core/ethtool.c
  * ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
      include/net/arp.h
  * fuse: Add FOPEN_STREAM to use stream_open()
      fs/fuse/file.c
      include/uapi/linux/fuse.h
  * fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
      fs/open.c
      fs/read_write.c
      include/linux/fs.h
    drm/gma500/cdv: Check vbt config bits when detecting lvds panels
    genwqe: Prevent an integer overflow in the ioctl
    MIPS: pistachio: Build uImage.gz by default
  * fuse: fallocate: fix return with locked inode
      fs/fuse/file.c
    parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
  * rcu: locking and unlocking need to always be at least barriers
      include/linux/rcupdate.h
    pktgen: do not sleep with the thread lock held.
    net: rds: fix memory leak in rds_ib_flush_mr_pool
    net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
  * neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
      net/core/neighbour.c
  * ethtool: fix potential userspace buffer overflow
      net/core/ethtool.c
    media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
  * usb: gadget: fix request length error for isoc transfer
      include/linux/usb/gadget.h
  * net: cdc_ncm: GetNtbFormat endian fix
      drivers/net/usb/cdc_ncm.c
    Revert "x86/build: Move _etext to actual end of .text"
  * userfaultfd: don't pin the user memory in userfaultfd_file_create()
      include/linux/sched.h
    brcmfmac: add subtype check for event handling in data path
    brcmfmac: add length checks in scheduled scan result handler
    brcmfmac: fix incorrect event channel deduction
    brcmfmac: revise handling events in receive path
    brcmfmac: screening firmware event packet
    brcmfmac: Add length checks on firmware events
    bnx2x: disable GSO where gso_size is too big for hardware
  * net: create skb_gso_validate_mac_len()
      include/linux/skbuff.h
  * binder: replace "%p" with "%pK"
      drivers/android/binder.c
  * binder: Replace "%p" with "%pK" for stable
      drivers/android/binder.c
    CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM
  * kernel/signal.c: trace_signal_deliver when signal_group_exit
      kernel/signal.c
  * memcg: make it work on sparse non-0-node systems
      include/linux/list_lru.h
      mm/list_lru.c
    tty: max310x: Fix external crystal register setup
  * tty: serial: msm_serial: Fix XON/XOFF
      drivers/tty/serial/msm_serial.c
    drm/nouveau/i2c: Disable i2c bus access after ->fini()
    ALSA: hda/realtek - Set default power save node to 0
    Btrfs: fix race updating log root item during fsync
    scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)
    scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove
    media: smsusb: better handle optional alignment
    media: usb: siano: Fix false-positive "uninitialized variable" warning
    media: usb: siano: Fix general protection fault in smsusb
    USB: rio500: fix memory leak in close after disconnect
    USB: rio500: refuse more than one device at a time
  * USB: Add LPM quirk for Surface Dock GigE adapter
      drivers/usb/core/quirks.c
    USB: sisusbvga: fix oops in error path of sisusb_probe
  * USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
      drivers/usb/core/config.c
  * usb: xhci: avoid null pointer deref when bos field is NULL
      drivers/usb/host/xhci.c
  * xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
      drivers/usb/host/xhci.c
  * include/linux/bitops.h: sanitize rotate primitives
      include/linux/bitops.h
    sparc64: Fix regression in non-hypervisor TLB flush xcall
    tipc: fix modprobe tipc failed after switch order of device registration -v2
    Revert "tipc: fix modprobe tipc failed after switch order of device registration"
    xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
    crypto: vmx - ghash: do nosimd fallback manually
    net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
    bnxt_en: Fix aggregation buffer leak under OOM condition.
    tipc: Avoid copying bytes beyond the supplied data
  * usbnet: fix kernel crash after disconnect
      drivers/net/usb/usbnet.c
    net: stmmac: fix reset gpio free missing
  * net-gro: fix use-after-free read in napi_gro_frags()
      net/core/dev.c
  * llc: fix skb leak in llc_build_and_send_ui_pkt()
      net/llc/llc_output.c
  * ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
      net/ipv6/raw.c
    ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
  * spi: Fix zero length xfer bug
      drivers/spi/spi.c
    spi: rspi: Fix sequencer reset during initialization
    spi : spi-topcliff-pch: Fix to handle empty DMA buffers
    scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
    media: saa7146: avoid high stack usage with clang
    media: go7007: avoid clang frame overflow warning with KASAN
    media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
    scsi: qla4xxx: avoid freeing unallocated dma memory
  * usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
      drivers/usb/core/hcd.c
    rcutorture: Fix cleanup path for invalid torture_type strings
    tty: ipwireless: fix missing checks for ioremap
    virtio_console: initialize vtermno value for ports
    media: wl128x: prevent two potential buffer overflows
    spi: tegra114: reset controller on probe
    cxgb3/l2t: Fix undefined behaviour
    ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
    ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
  * HID: core: move Usage Page concatenation to Main item
      drivers/hid/hid-core.c
      include/linux/hid.h
  * chardev: add additional check for minor range overlap
      fs/char_dev.c
    x86/ia32: Fix ia32_restore_sigcontext() AC leak
  * arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
      arch/arm64/kernel/cpu_ops.c
  * scsi: ufs: Avoid configuring regulator with undefined voltage range
      drivers/scsi/ufs/ufshcd.c
  * scsi: ufs: Fix regulator load and icc-level configuration
      drivers/scsi/ufs/ufshcd.c
    brcmfmac: fix race during disconnect when USB completion is in progress
    brcmfmac: convert dev_init_lock mutex to completion
    b43: shut up clang -Wuninitialized variable warning
    brcmfmac: fix missing checks for kmemdup
    rtlwifi: fix a potential NULL pointer dereference
    iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
    iio: hmc5843: fix potential NULL pointer dereferences
    iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
    x86/build: Keep local relocations with ld.lld
    cpufreq: pmac32: fix possible object reference leak
    cpufreq/pasemi: fix possible object reference leak
    cpufreq: ppc_cbe: fix possible object reference leak
    s390: cio: fix cio_irb declaration
    extcon: arizona: Disable mic detect if running when driver is removed
  * PM / core: Propagate dev->power.wakeup_path when no callbacks
      drivers/base/power/main.c
    mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
    mmc: sdhci-of-esdhc: add erratum eSDHC5 support
    mmc_spi: add a status check for spi_sync_locked
    scsi: libsas: Do discovery on empty PHY to update PHY info
    hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
    hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
    hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
    hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
    hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
    RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
    i40e: don't allow changes to HW VLAN stripping on active port VLANs
    x86/irq/64: Limit IST stack overflow check to #DB stack
  * USB: core: Don't unbind interfaces following device reset failure
      drivers/usb/core/hub.c
  * sched/core: Handle overflow in cpu_shares_write_u64
      kernel/sched/core.c
  * sched/core: Check quota and period overflow at usec to nsec conversion
      kernel/sched/core.c
    powerpc/numa: improve control of topology updates
    media: pvrusb2: Prevent a buffer overflow
    media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
  * audit: fix a memory leak bug
      kernel/auditfilter.c
    media: ov2659: make S_FMT succeed even if requested format doesn't match
    media: au0828: stop video streaming only when last user stops
    media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
    media: coda: clear error return value before picture run
    dmaengine: at_xdmac: remove BUG_ON macro in tasklet
    pinctrl: pistachio: fix leaked of_node references
  * HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
      drivers/hid/hid-logitech-hidpp.c
  * mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
      lib/strncpy_from_user.c
      lib/strnlen_user.c
    x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
  * smpboot: Place the __percpu annotation correctly
      include/linux/smpboot.h
    x86/build: Move _etext to actual end of .text
    bcache: avoid clang -Wunintialized warning
    bcache: add failure check to run_cache_set() for journal replay
    bcache: fix failure in journal relplay
    bcache: return error immediately in bch_journal_replay()
    net: cw1200: fix a NULL pointer dereference
    mwifiex: prevent an array overflow
    ASoC: fsl_sai: Update is_slave_mode with correct value
  * mac80211/cfg80211: update bss channel on channel switch
      net/wireless/nl80211.c
    dmaengine: pl330: _stop: clear interrupt status
    w1: fix the resume command API
    rtc: 88pm860x: prevent use-after-free on device remove
    brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
    spi: pxa2xx: fix SCR (divisor) calculation
  * ASoC: imx: fix fiq dependencies
      sound/soc/fsl/Kconfig
    powerpc/boot: Fix missing check of lseek() return value
    mmc: core: Verify SD bus width
    cxgb4: Fix error path in cxgb4_init_module
    gfs2: Fix lru_count going negative
    tools include: Adopt linux/bits.h
    perf tools: No need to include bitops.h in util.h
    at76c50x-usb: Don't register led_trigger if usb_register_driver failed
    ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
    media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
    media: cpia2: Fix use-after-free in cpia2_exit
  * fbdev: fix WARNING in __alloc_pages_nodemask bug
      drivers/video/fbdev/core/fbcmap.c
  * hugetlb: use same fault hash key for shared and private mappings
      include/linux/hugetlb.h
  * fbdev: fix divide error in fb_var_to_videomode
      drivers/video/fbdev/core/modedb.c
    btrfs: sysfs: don't leak memory when failing add fsid
    Btrfs: fix race between ranged fsync and writeback of adjacent ranges
    gfs2: Fix sign extension bug in gfs2_update_stats
    crypto: vmx - CTR: always increment IV as quadword
  * Revert "scsi: sd: Keep disk read-only when re-reading partition"
      drivers/scsi/sd.c
  * bio: fix improper use of smp_mb__before_atomic()
      include/linux/bio.h
    KVM: x86: fix return value for reserved EFER
  * ext4: do not delete unlinked inode from orphan list on failed truncate
      fs/ext4/inode.c
    fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough
    btrfs: Honour FITRIM range constraints during free space trim
    md/raid: raid5 preserve the writeback action after the parity check
    Revert "Don't jump to compute_result state from check_result state"
    perf bench numa: Add define for RUSAGE_THREAD if not present
    ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
  * power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
      drivers/power/power_supply_sysfs.c
    KVM: arm/arm64: Ensure vcpu target is unset on reset failure
  * xfrm4: Fix uninitialized memory read in _decode_session4
      net/ipv4/xfrm4_policy.c
  * vti4: ipip tunnel deregistration fixes.
      net/ipv4/ip_vti.c
  * xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
      net/ipv6/xfrm6_tunnel.c
  * xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
      net/xfrm/xfrm_user.c
    dm delay: fix a crash when invalid device is specified
  * PCI: Mark Atheros AR9462 to avoid bus reset
      drivers/pci/quirks.c
    fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting
    fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
    fbdev: sm712fb: fix support for 1024x768-16 mode
    fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM
    fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA
    fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F
    fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
    fbdev: sm712fb: fix brightness control on reboot, don't set SR30
    perf intel-pt: Fix sample timestamp wrt non-taken branches
    perf intel-pt: Fix improved sample timestamp
    perf intel-pt: Fix instructions sampling rate
    memory: tegra: Fix integer overflow on tick value calculation
  * tracing: Fix partial reading of trace event's id file
      kernel/trace/trace_events.c
    ceph: flush dirty inodes before proceeding with remount
    iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
  * fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
      fs/fuse/file.c
  * fuse: fix writepages on 32bit
      fs/fuse/file.c
    clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
    NFS4: Fix v4.0 client state corruption when mount
    media: ov6650: Fix sensor possibly not detected on probe
    cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
  * of: fix clang -Wunsequenced for be32_to_cpu()
      include/linux/of.h
    intel_th: msu: Fix single mode with IOMMU
  * md: add mddev->pers to avoid potential NULL pointer dereference
      drivers/md/md.c
    stm class: Fix channel free in stm output free path
    tipc: fix modprobe tipc failed after switch order of device registration
    tipc: switch order of device registration to fix a crash
  * ppp: deflate: Fix possible crash in deflate_init
      drivers/net/ppp/ppp_deflate.c
    net/mlx4_core: Change the error print to info print
  * net: avoid weird emergency message
      net/core/dev.c
    KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
    ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
  * ext4: zero out the unused memory region in the extent tree block
      fs/ext4/extents.c
  * fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
      fs/fs-writeback.c
  * writeback: synchronize sync(2) against cgroup writeback membership switches
      fs/fs-writeback.c
      include/linux/backing-dev-defs.h
      mm/backing-dev.c
    crypto: arm/aes-neonbs - don't access already-freed walk.iv
    crypto: salsa20 - don't access already-freed walk.iv
    crypto: chacha20poly1305 - set cra_name correctly
  * crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
      crypto/gcm.c
  * crypto: gcm - Fix error return code in crypto_gcm_create_common()
      crypto/gcm.c
    ipmi:ssif: compare block number correctly for multi-part return messages
    bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
    bcache: fix a race between cache register and cacheset unregister
    Btrfs: do not start a transaction at iterate_extent_inodes()
  * ext4: fix ext4_show_options for file systems w/o journal
      fs/ext4/super.c
  * ext4: actually request zeroing of inode table after grow
      fs/ext4/ioctl.c
    tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
    mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L
    ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
  * mm/mincore.c: make mincore() more conservative
      mm/mincore.c
    ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
    ASoC: max98090: Fix restore of DAPM Muxes
    ALSA: hda/realtek - EAPD turn on later
    ALSA: hda/hdmi - Consider eld_valid when reporting jack event
  * ALSA: usb-audio: Fix a memory leak bug
      sound/usb/mixer.c
    crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
    crypto: crct10dif-generic - fix use via crypto_shash_digest()
    crypto: vmx - fix copy-paste error in CTR mode
    ARM: exynos: Fix a leaked reference by adding missing of_node_put
    x86/speculation/mds: Improve CPU buffer clear documentation
    x86/speculation/mds: Revert CPU buffer clear on double fault exit
Linux 4.4.180
    powerpc/lib: fix book3s/32 boot failure due to code patching
    powerpc/booke64: set RI in default MSR
    drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
    drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
  * bonding: fix arp_validate toggling in active-backup mode
      drivers/net/bonding/bond_options.c
  * ipv4: Fix raw socket lookup for local traffic
      net/ipv4/raw.c
  * vrf: sit mtu should not be updated when vrf netdev is the link
      net/ipv6/sit.c
    vlan: disable SIOCSHWTSTAMP in container
  * packet: Fix error path in packet_init
      net/packet/af_packet.c
    net: ucc_geth - fix Oops when changing number of buffers in the ring
  * bridge: Fix error path for kobject_init_and_add()
      net/bridge/br_if.c
    powerpc/64s: Include cpu header
    USB: serial: fix unthrottle races
    USB: serial: use variable for status
    x86/bugs: Change L1TF mitigation string to match upstream
    x86/speculation/mds: Fix documentation typo
    Documentation: Correct the possible MDS sysfs values
    x86/mds: Add MDSUM variant to the MDS documentation
    x86/speculation/mds: Add 'mitigations=' support for MDS
    x86/speculation: Support 'mitigations=' cmdline option
  * cpu/speculation: Add 'mitigations=' cmdline option
      include/linux/cpu.h
      kernel/cpu.c
    x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
    x86/speculation/mds: Fix comment
    x86/speculation/mds: Add SMT warning message
    x86/speculation: Move arch_smt_update() call to after mitigation decisions
    x86/cpu/bugs: Use __initconst for 'const' init data
    Documentation: Add MDS vulnerability documentation
    Documentation: Move L1TF to separate directory
    x86/speculation/mds: Add mitigation mode VMWERV
  * x86/speculation/mds: Add sysfs reporting for MDS
      drivers/base/cpu.c
      include/linux/cpu.h
    x86/speculation/l1tf: Document l1tf in sysfs
    x86/speculation/mds: Add mitigation control for MDS
    x86/speculation/mds: Conditionally clear CPU buffers on idle entry
    x86/speculation/mds: Clear CPU buffers on exit to user
    x86/speculation/mds: Add mds_clear_cpu_buffers()
    x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
    x86/speculation/mds: Add BUG_MSBDS_ONLY
    x86/speculation/mds: Add basic bug infrastructure for MDS
    x86/speculation: Consolidate CPU whitelists
    x86/msr-index: Cleanup bit defines
    kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
    x86/speculation: Provide IBPB always command line options
    x86/speculation: Add seccomp Spectre v2 user space protection mode
    x86/speculation: Enable prctl mode for spectre_v2_user
  * x86/speculation: Add prctl() control for indirect branch speculation
      include/linux/sched.h
      include/uapi/linux/prctl.h
    x86/speculation: Prevent stale SPEC_CTRL msr content
    x86/speculation: Prepare arch_smt_update() for PRCTL mode
    x86/speculation: Split out TIF update
    x86/speculation: Prepare for conditional IBPB in switch_mm()
    x86/speculation: Avoid __switch_to_xtra() calls
    x86/process: Consolidate and simplify switch_to_xtra() code
    x86/speculation: Prepare for per task indirect branch speculation control
    x86/speculation: Add command line control for indirect branch speculation
    x86/speculation: Unify conditional spectre v2 print functions
    x86/speculataion: Mark command line parser data __initdata
    x86/speculation: Mark string arrays const correctly
    x86/speculation: Reorder the spec_v2 code
  * x86/speculation: Rework SMT state change
      include/linux/sched/smt.h
      kernel/cpu.c
  * sched: Add sched_smt_active()
      include/linux/sched/smt.h
      kernel/sched/core.c
      kernel/sched/sched.h
    x86/Kconfig: Select SCHED_SMT if SMP enabled
    x86/speculation: Reorganize speculation control MSRs update
    x86/speculation: Rename SSBD update functions
    x86/speculation: Disable STIBP when enhanced IBRS is in use
    x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common()
    x86/speculation: Remove unnecessary ret variable in cpu_show_common()
    x86/speculation: Clean up spectre_v2_parse_cmdline()
    x86/speculation: Update the TIF_SSBD comment
    x86/speculation: Propagate information about RSB filling mitigation to sysfs
    x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
  * x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
      include/linux/ptrace.h
      kernel/ptrace.c
    x86/mm: Use WRITE_ONCE() when setting PTEs
    KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled
    x86/cpu: Sanitize FAM6_ATOM naming
    x86/microcode: Update the new microcode revision unconditionally
    x86/microcode: Make sure boot_cpu_data.microcode is up-to-date
    x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation
    x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
  * locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file
      include/linux/bitops.h
      include/linux/bits.h
    x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
    x86/bugs: Add AMD's SPEC_CTRL MSR usage
    x86/bugs: Add AMD's variant of SSB_NO
    x86/speculation: Simplify the CPU bug detection logic
    x86/speculation: Support Enhanced IBRS on future CPUs
    x86/cpufeatures: Hide AMD-specific speculation flags
    x86/MCE: Save microcode revision in machine check records
    x86/microcode/intel: Check microcode revision before updating sibling threads
  * bitops: avoid integer overflow in GENMASK(_ULL)
      include/linux/bitops.h
    x86: stop exporting msr-index.h to userland
    x86/microcode/intel: Add a helper which gives the microcode revision
  * locking/static_keys: Provide DECLARE and well as DEFINE macros
      include/linux/jump_label.h
    Don't jump to compute_result state from check_result state
    x86/vdso: Pass --eh-frame-hdr to the linker
    cw1200: fix missing unlock on error in cw1200_hw_scan()
    gpu: ipu-v3: dp: fix CSC handling
    selftests/net: correct the return value for run_netsocktests
    s390: ctcm: fix ctcm_new_device error return code
    ipvs: do not schedule icmp errors from tunnels
  * init: initialize jump labels before command line option parsing
      init/main.c
    tools lib traceevent: Fix missing equality check for strcmp
    KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing
    s390/3270: fix lockdep false positive on view->lock
    s390/dasd: Fix capacity calculation for large volumes
    libnvdimm/btt: Fix a kmemdup failure check
  * HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys
      drivers/hid/hid-input.c
  * HID: input: add mapping for Expose/Overview key
      drivers/hid/hid-input.c
    iio: adc: xilinx: fix potential use-after-free on remove
    platform/x86: sony-laptop: Fix unintentional fall-through
  * netfilter: compat: initialize all fields in xt_init
      net/netfilter/x_tables.c
  * timer/debug: Change /proc/timer_stats from 0644 to 0600
      kernel/time/timer_stats.c
    ASoC: Intel: avoid Oops if DMA setup fails
  * ipv6: fix a potential deadlock in do_ipv6_setsockopt()
      include/net/addrconf.h
      net/ipv6/ipv6_sockglue.c
      net/ipv6/mcast.c
    UAS: fix alignment of scatter/gather segments
  * Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
      include/net/bluetooth/hci_core.h
      net/bluetooth/hci_conn.c
    Bluetooth: hidp: fix buffer overflow
    scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines
  * usb: dwc3: Fix default lpm_nyet_threshold value
      drivers/usb/dwc3/core.c
  * genirq: Prevent use-after-free and work list corruption
      kernel/irq/manage.c
    iommu/amd: Set exclusion range correctly
    scsi: csiostor: fix missing data copy in csio_scsi_err_handler()
    perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS
    ASoC: tlv320aic32x4: Fix Common Pins
    ASoC: cs4270: Set auto-increment bit for register writes
  * ASoC:soc-pcm:fix a codec fixup issue in TDM case
      sound/soc/soc-pcm.c
    scsi: libsas: fix a race condition when smp task timeout
    media: v4l2: i2c: ov7670: Fix PLL bypass register values
    x86/mce: Improve error message when kernel cannot recover, p2
  * selinux: never allow relabeling on context mounts
      security/selinux/hooks.c
    Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ
    staging: iio: adt7316: fix the dac write calculation
    staging: iio: adt7316: fix the dac read calculation
    staging: iio: adt7316: allow adt751x to use internal vref for all dacs
    usb: usbip: fix isoc packet num validation in get_pipe
    ARM: iop: don't use using 64-bit DMA masks
    ARM: orion: don't use using 64-bit DMA masks
    xsysace: Fix error handling in ace_setup
    hugetlbfs: fix memory leak for resv_map
    net: hns: Fix WARNING when remove HNS driver with SMMU enabled
    net: hns: Use NAPI_POLL_WEIGHT for hns driver
    scsi: storvsc: Fix calculation of sub-channel count
    vfio/pci: use correct format characters
    rtc: da9063: set uie_unsupported when relevant
  * debugfs: fix use-after-free on symlink traversal
      fs/debugfs/inode.c
    jffs2: fix use-after-free on symlink traversal
  * bonding: show full hw address in sysfs for slave entries
      drivers/net/bonding/bond_sysfs_slave.c
    igb: Fix WARN_ONCE on runtime suspend
    rtc: sh: Fix invalid alarm warning for non-enabled alarm
  * HID: debug: fix race condition with between rdesc_show() and device removal
      drivers/hid/hid-debug.c
  * USB: core: Fix bug caused by duplicate interface PM usage counter
      drivers/usb/core/driver.c
      include/linux/usb.h
  * USB: core: Fix unterminated string returned by usb_string()
      drivers/usb/core/message.c
    USB: w1 ds2490: Fix bug caused by improper use of altsetting array
    USB: yurex: Fix protection fault after device removal
  * packet: validate msg_namelen in send directly
      net/packet/af_packet.c
    bnxt_en: Improve multicast address setup logic.
  * ipv6: invert flowlabel sharing check in process and user mode
      net/ipv6/ip6_flowlabel.c
  * ipv6/flowlabel: wait rcu grace period before put_pid()
      net/ipv6/ip6_flowlabel.c
  * ipv4: ip_do_fragment: Preserve skb_iif during fragmentation
      net/ipv4/ip_output.c
    ALSA: line6: use dynamic buffers
    vfio/type1: Limit DMA mappings per container
    kconfig/[mn]conf: handle backspace (^H) key
    libata: fix using DMA buffers on stack
    scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN
    ceph: fix use-after-free on symlink traversal
    usb: u132-hcd: fix resource leak
    scsi: qla4xxx: fix a potential NULL pointer dereference
    net: ethernet: ti: fix possible object reference leak
    net: ibm: fix possible object reference leak
    net: xilinx: fix possible object reference leak
    net: ks8851: Set initial carrier state to down
    net: ks8851: Delay requesting IRQ until opened
    net: ks8851: Reassert reset pin if chip ID check fails
    net: ks8851: Dequeue RX packets explicitly
    ARM: dts: pfla02: increase phy reset duration
    usb: gadget: net2272: Fix net2272_dequeue()
    usb: gadget: net2280: Fix net2280_dequeue()
    usb: gadget: net2280: Fix overrun of OUT messages
    sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
    netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING
    qlcnic: Avoid potential NULL pointer dereference
    usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set
    usbnet: ipheth: prevent TX queue timeouts when device not ready
    Documentation: Add nospectre_v1 parameter
    powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg
    powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup'
    powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms
    powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit)
    powerpc/fsl: Emulate SPRN_BUCSR register
    powerpc/fsl: Flush branch predictor when entering KVM
    powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used
  * ipv4: set the tcp_min_rtt_wlen range from 0 to one day
      net/ipv4/sysctl_net_ipv4.c
    net: stmmac: move stmmac_check_ether_addr() to driver probe
    team: fix possible recursive locking when add slaves
  * ipv4: add sanity checks in ipv4_link_failure()
      net/ipv4/route.c
  * Revert "block/loop: Use global lock for ioctl() operation."
      drivers/block/loop.c
      drivers/block/loop.h
  * bpf: reject wrong sized filters earlier
      net/core/filter.c
    tipc: check link name with right length in tipc_nl_compat_link_set
    tipc: check bearer name with right length in tipc_nl_compat_bearer_enable
  * netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON
      net/bridge/netfilter/ebtables.c
    NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family.
  * fs/proc/proc_sysctl.c: Fix a NULL pointer dereference
      fs/proc/proc_sysctl.c
    intel_th: gth: Fix an off-by-one in output unassigning
  * slip: make slhc_free() silently accept an error pointer
      drivers/net/slip/slhc.c
    tipc: handle the err returned from cmd header function
    powerpc/fsl: Fix the flush of branch predictor.
    powerpc/security: Fix spectre_v2 reporting
    powerpc/fsl: Update Spectre v2 reporting
    powerpc/fsl: Flush the branch predictor at each kernel entry (64bit)
    powerpc/fsl: Add nospectre_v2 command line argument
    powerpc/fsl: Fix spectre_v2 mitigations reporting
    powerpc/fsl: Add macro to flush the branch predictor
    powerpc/fsl: Add infrastructure to fixup branch predictor flush
    powerpc: Avoid code patching freed init sections
    powerpc/powernv: Query firmware for count cache flush settings
    powerpc/pseries: Query hypervisor for count cache flush settings
    powerpc/64s: Add support for software count cache flush
    powerpc/64s: Add new security feature flags for count cache flush
    powerpc/asm: Add a patch_site macro & helpers for patching instructions
    powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book3E
    powerpc/64: Make meltdown reporting Book3S 64 specific
    powerpc/64: Call setup_barrier_nospec() from setup_arch()
    powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC
    powerpc/64: Make stf barrier PPC_BOOK3S_64 specific.
    powerpc/64: Disable the speculation barrier from the command line
    powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
    powerpc/64s: Enhance the information in cpu_show_spectre_v1()
    powerpc: Use barrier_nospec in copy_from_user()
    powerpc/64: Use barrier_nospec in syscall entry
    powerpc/64s: Enable barrier_nospec based on firmware settings
    powerpc/64s: Patch barrier_nospec in modules
    powerpc/64s: Add support for ori barrier_nospec patching
    powerpc/64s: Add barrier_nospec
    powerpc/64s: Add support for a store forwarding barrier at kernel entry/exit
    powerpc/64s: Fix section mismatch warnings from setup_rfi_flush()
    powerpc/pseries: Restore default security feature flags on setup
    powerpc: Move default security feature flags
    powerpc/pseries: Fix clearing of security feature flags
    powerpc/64s: Wire up cpu_show_spectre_v2()
    powerpc/64s: Wire up cpu_show_spectre_v1()
    powerpc/pseries: Use the security flags in pseries_setup_rfi_flush()
    powerpc/powernv: Use the security flags in pnv_setup_rfi_flush()
    powerpc/64s: Enhance the information in cpu_show_meltdown()
    powerpc/64s: Move cpu_show_meltdown()
    powerpc/powernv: Set or clear security feature flags
    powerpc/pseries: Set or clear security feature flags
    powerpc: Add security feature flags for Spectre/Meltdown
    powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration
    powerpc/pseries: Add new H_GET_CPU_CHARACTERISTICS flags
    powerpc/rfi-flush: Differentiate enabled and patched flush types
    powerpc/rfi-flush: Always enable fallback flush on pseries
    powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again
    powerpc/rfi-flush: Move the logic to avoid a redo into the debugfs code
    powerpc/powernv: Support firmware disable of RFI flush
    powerpc/pseries: Support firmware disable of RFI flush
    powerpc/64s: Improve RFI L1-D cache flush fallback
    powerpc/xmon: Add RFI flush related fields to paca dump
  * USB: Consolidate LPM checks to avoid enabling LPM twice
      drivers/usb/core/driver.c
      drivers/usb/core/hub.c
      drivers/usb/core/message.c
  * USB: Add new USB LPM helpers
      drivers/usb/core/driver.c
      drivers/usb/core/hub.c
      drivers/usb/core/message.c
      drivers/usb/core/sysfs.c
      drivers/usb/core/usb.h
    sunrpc: don't mark uninitialised items as VALID.
    nfsd: Don't release the callback slot unless it was actually held
    ceph: fix ci->i_head_snapc leak
    ceph: ensure d_name stability in ceph_dentry_hash()
  * sched/numa: Fix a possible divide-by-zero
      kernel/sched/fair.c
  * trace: Fix preempt_enable_no_resched() abuse
      kernel/trace/ring_buffer.c
    MIPS: scall64-o32: Fix indirect syscall number load
    cifs: do not attempt cifs operation on smb2+ rename error
    KVM: fail KVM_SET_VCPU_EVENTS with invalid exception number
  * kbuild: simplify ld-option implementation
      scripts/Kbuild.include
Linux 4.4.179
  * kernel/sysctl.c: fix out-of-bounds access when setting file-max
      kernel/sysctl.c
    Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()"
  * ALSA: info: Fix racy addition/deletion of nodes
      sound/core/info.c
  * mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
      mm/vmstat.c
    device_cgroup: fix RCU imbalance in error case
  * sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
      kernel/sched/fair.c
  * Revert "kbuild: use -Oz instead of -Os when using clang"
      Makefile
    mac80211: do not call driver wake_tx_queue op during reconfig
    kprobes: Fix error check when reusing optimized probes
    kprobes: Mark ftrace mcount handler functions nokprobe
  * x86/kprobes: Verify stack frame on kretprobe
      include/linux/kprobes.h
  * arm64: futex: Restore oldval initialization to work around buggy compilers
      arch/arm64/include/asm/futex.h
    crypto: x86/poly1305 - fix overflow during partial reduction
  * ALSA: core: Fix card races between register and disconnect
      sound/core/init.c
    staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
    staging: comedi: ni_usb6501: Fix use of uninitialized mutex
    staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
    staging: comedi: vmk80xx: Fix use of uninitialized semaphore
    io: accel: kxcjk1013: restore the range after resume.
    iio: adc: at91: disable adc channel interrupt in timeout case
    iio: ad_sigma_delta: select channel when reading register
    iio/gyro/bmg160: Use millidegrees for temperature scale
    KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
    tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
  * modpost: file2alias: check prototype of handler
      scripts/mod/file2alias.c
  * modpost: file2alias: go back to simple devtable lookup
      scripts/mod/file2alias.c
    crypto: crypto4xx - properly set IV after de- and encrypt
  * ipv4: ensure rcu_read_lock() in ipv4_link_failure()
      net/ipv4/route.c
  * ipv4: recompile ip options in ipv4_link_failure
      net/ipv4/route.c
  * tcp: tcp_grow_window() needs to respect tcp_space()
      net/ipv4/tcp_input.c
    net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
  * net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
      net/bridge/br_multicast.c
    net: atm: Fix potential Spectre v1 vulnerabilities
  * bonding: fix event handling for stacked bonds
      drivers/net/bonding/bond_main.c
  * appletalk: Fix compile regression
      include/linux/atalk.h
  * ovl: fix uid/gid when creating over whiteout
      fs/overlayfs/dir.c
    tpm/tpm_crb: Avoid unaligned reads in crb_recv()
  * include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
      include/linux/swap.h
  * lib/div64.c: off by one in shift
      lib/div64.c
  * appletalk: Fix use-after-free in atalk_proc_exit
      include/linux/atalk.h
    ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t
    iommu/dmar: Fix buffer overflow during PCI bus notification
    crypto: sha512/arm - fix crash bug in Thumb2 build
    crypto: sha256/arm - fix crash bug in Thumb2 build
    cifs: fallback to older infolevels on findfirst queryinfo retry
    ACPI / SBS: Fix GPE storm on recent MacBookPro's
    ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms
    serial: uartps: console_setup() can't be placed to init section
    f2fs: fix to do sanity check with current segment number
    9p locks: add mount option for lock retry interval
    9p: do not trust pdu content for stat item size
    rsi: improve kernel thread handling to fix kernel panic
  * ext4: prohibit fstrim in norecovery mode
      fs/ext4/ioctl.c
    fix incorrect error code mapping for OBJECTID_NOT_FOUND
    x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error
    iommu/vt-d: Check capability before disabling protected memory
    x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors
    x86/hpet: Prevent potential NULL pointer dereference
    perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test()
    perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test
    perf evsel: Free evsel->counts in perf_evsel__exit()
    perf top: Fix error handling in cmd_top()
    tools/power turbostat: return the exit status of a command
    thermal/int340x_thermal: fix mode setting
    thermal/int340x_thermal: Add additional UUIDs
    ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration
    mmc: davinci: remove extraneous __init annotation
    IB/mlx4: Fix race condition between catas error reset and aliasguid flows
    ALSA: sb8: add a check for request_region
    ALSA: echoaudio: add a check for ioremap_nocache
  * ext4: report real fs size after failed resize
      fs/ext4/resize.c
  * ext4: add missing brelse() in add_new_gdb_meta_bg()
      fs/ext4/resize.c
  * perf/core: Restore mmap record type correctly
      kernel/events/core.c
  * PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
      drivers/pci/quirks.c
    xtensa: fix return_address
  * sched/fair: Do not re-read ->h_load_next during hierarchical load calculation
      kernel/sched/fair.c
    xen: Prevent buffer overflow in privcmd ioctl
  * arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
      arch/arm64/include/asm/futex.h
    ARM: dts: at91: Fix typo in ISC_D0 on PC9
  * genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
      kernel/irq/chip.c
  * block: do not leak memory in bio_copy_user_iov()
      block/bio.c
    ASoC: fsl_esai: fix channel swap issue when stream starts
  * include/linux/bitrev.h: fix constant bitrev
      include/linux/bitrev.h
    ALSA: seq: Fix OOB-reads from strlcpy
  * ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
      net/ipv6/ip6_tunnel.c
  * net: ethtool: not call vzalloc for zero sized memory request
      net/core/ethtool.c
  * netns: provide pure entropy for net_hash_mix()
      include/net/net_namespace.h
      include/net/netns/hash.h
      net/core/net_namespace.c
    tcp: Ensure DCTCP reacts to losses
    sctp: initialize _pad of sockaddr_in before copying to user memory
    qmi_wwan: add Olicard 600
    openvswitch: fix flow actions reallocation
    net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().
  * ipv6: sit: reset ip header pointer in ipip6_rcv
      net/ipv6/sit.c
  * ipv6: Fix dangling pointer when ipv6 fragment
      net/ipv6/ip6_output.c
  * tty: ldisc: add sysctl to prevent autoloading of ldiscs
      drivers/tty/Kconfig
      drivers/tty/tty_io.c
      drivers/tty/tty_ldisc.c
  * tty: mark Siemens R3964 line discipline as BROKEN
      drivers/char/Kconfig
  * lib/string.c: implement a basic bcmp
      include/linux/string.h
      lib/string.c
    x86/vdso: Drop implicit common-page-size linker flag
    x86: vdso: Use $LD instead of $CC to link
    x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
  * kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD
      Makefile
  * binfmt_elf: switch to new creds when switching to new mm
      fs/binfmt_elf.c
    drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
    dmaengine: tegra: avoid overflow of byte tracking
    x86/build: Mark per-CPU symbols as absolute explicitly for LLD
    wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
    regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
    media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
    netfilter: physdev: relax br_netfilter dependency
    dmaengine: imx-dma: fix warning comparison of distinct pointer types
    hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
    soc/tegra: fuse: Fix illegal free of IO base address
    hwrng: virtio - Avoid repeated init of completion
    media: mt9m111: set initial frame size other than 0x0
  * tty: increase the default flip buffer limit to 2*640K
      drivers/tty/tty_buffer.c
    ARM: avoid Cortex-A9 livelock on tight dmb loops
    mt7601u: bump supported EEPROM version
    soc: qcom: gsbi: Fix error handling in gsbi_probe()
    ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
    cdrom: Fix race condition in cdrom_sysctl_register
  * fbdev: fbmem: fix memory access if logo is bigger than the screen
      drivers/video/fbdev/core/fbmem.c
    bcache: improve sysfs_strtoul_clamp()
    bcache: fix input overflow to sequential_cutoff
    bcache: fix input overflow to cache set sysfs file io_error_halflife
  * ALSA: PCM: check if ops are defined before suspending PCM
      sound/core/pcm_native.c
    ARM: 8833/1: Ensure that NEON code always compiles with Clang
  * kprobes: Prohibit probing on bsearch()
      lib/bsearch.c
    leds: lp55xx: fix null deref on firmware load failure
    media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
    media: s5p-g2d: Correct return type for mem2mem buffer helpers
    media: s5p-jpeg: Correct return type for mem2mem buffer helpers
    media: sh_veu: Correct return type for mem2mem buffer helpers
    SoC: imx-sgtl5000: add missing put_device()
    perf test: Fix failure of 'evsel-tp-sched' test on s390
    scsi: megaraid_sas: return error when create DMA pool failed
    IB/mlx4: Increase the timeout for CM cache
    e1000e: Fix -Wformat-truncation warnings
    mmc: omap: fix the maximum timeout setting
    ARM: 8840/1: use a raw_spinlock_t in unwind
    coresight: etm4x: Add support to enable ETMv4.2
  * scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
      drivers/scsi/scsi_scan.c
    usb: chipidea: Grab the (legacy) USB PHY by phandle first
    tools lib traceevent: Fix buffer overflow in arg_eval
  * fs: fix guard_bio_eod to check for real EOD errors
      fs/buffer.c
    cifs: Fix NULL pointer dereference of devname
    dm thin: add sanity checks to thin-pool and external snapshot creation
    cifs: use correct format characters
  * fs/file.c: initialize init_files.resize_wait
      fs/file.c
    f2fs: do not use mutex lock in atomic context
    ocfs2: fix a panic problem caused by o2cb_ctl
    mm/slab.c: kmemleak no scan alien caches
  * mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
      mm/vmalloc.c
    mm/page_ext.c: fix an imbalance with kmemleak
  * mm/cma.c: cma_declare_contiguous: correct err handling
      mm/cma.c
    enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
  * sysctl: handle overflow for file-max
      kernel/sysctl.c
    gpio: gpio-omap: fix level interrupt idling
  * tracing: kdb: Fix ftdump to not sleep
      include/linux/ring_buffer.h
      kernel/trace/ring_buffer.c
      kernel/trace/trace.c
    h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
    CIFS: fix POSIX lock leak and invalid ptr deref
    tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
  * Bluetooth: Fix decrementing reference count twice in releasing socket
      net/bluetooth/hci_sock.c
  * i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
      drivers/i2c/i2c-core.c
    mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
    tty/serial: atmel: Add is_half_duplex helper
  * lib/int_sqrt: optimize initial value compute
      lib/int_sqrt.c
  * ext4: cleanup bh release code in ext4_ind_remove_space()
      fs/ext4/indirect.c
    arm64: debug: Ensure debug handlers check triggering exception level
  * arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
      arch/arm64/mm/fault.c
Linux 4.4.178
  * stm class: Hide STM-specific options if STM is disabled
      drivers/hwtracing/stm/Kconfig
    coresight: removing bind/unbind options from sysfs
  * arm64: support keyctl() system call in 32-bit mode
      arch/arm64/Kconfig
  * Revert "USB: core: only clean up what we allocated"
      drivers/usb/core/config.c
  * xhci: Fix port resume done detection for SS ports with LPM enabled
      drivers/usb/host/xhci-ring.c
      drivers/usb/host/xhci.h
    KVM: Reject device ioctls from processes other than the VM's creator
    x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
    perf intel-pt: Fix TSC slip
    gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
  * fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
      fs/proc/proc_sysctl.c
    Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
    USB: serial: option: add Olicard 600
    USB: serial: option: set driver_info for SIM5218 and compatibles
    USB: serial: mos7720: fix mos_parport refcount imbalance on error path
    USB: serial: ftdi_sio: add additional NovaTech products
    USB: serial: cp210x: add new device id
    serial: sh-sci: Fix setting SCSCR_TIE while transferring data
    serial: max310x: Fix to avoid potential NULL pointer dereference
    staging: vt6655: Fix interrupt race condition on device start up.
    staging: vt6655: Remove vif check from vnt_interrupt
    tty: atmel_serial: fix a potential NULL pointer dereference
    scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices
    scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
  * scsi: sd: Fix a race between closing an sd device and sd I/O
      drivers/scsi/sd.c
  * ALSA: pcm: Don't suspend stream in unrecoverable PCM state
      sound/core/pcm_native.c
    ALSA: pcm: Fix possible OOB access in PCM oss plugins
    ALSA: seq: oss: Fix Spectre v1 vulnerability
  * ALSA: rawmidi: Fix potential Spectre v1 vulnerability
      sound/core/rawmidi.c
  * ALSA: compress: add support for 32bit calls in a 64bit kernel
      sound/core/compress_offload.c
    ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
    btrfs: raid56: properly unmap parity page in finish_parity_scrub()
    btrfs: remove WARN_ON in log_dir_items
    mac8390: Fix mmio access size probe
  * sctp: get sctphdr by offset in sctp_compute_cksum
      include/net/sctp/checksum.h
    vxlan: Don't call gro_cells_destroy() before device is unregistered
  * tcp: do not use ipv6 header for ipv4 flow
      net/ipv6/tcp_ipv6.c
  * packets: Always register packet sk in the same order
      include/net/sock.h
      net/packet/af_packet.c
  * Add hlist_add_tail_rcu() (Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net)
      include/linux/rculist.h
    net: rose: fix a possible stack overflow
  * net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
      net/packet/af_packet.c
    mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
    dccp: do not use ipv6 header for ipv4 flow
    stmmac: copy unicast mac address to MAC registers
  * cfg80211: size various nl80211 messages correctly
      net/wireless/nl80211.c
    mmc: mmc: fix switch timeout issue caused by jiffies precision
  * arm64: kconfig: drop CONFIG_RTC_LIB dependency
      arch/arm64/Kconfig
    video: fbdev: Set pixclock = 0 in goldfishfb
  * cpu/hotplug: Handle unbalanced hotplug enable/disable
      kernel/cpu.c
  * usb: gadget: rndis: free response queue during REMOTE_NDIS_RESET_MSG
      drivers/usb/gadget/function/rndis.c
  * usb: gadget: configfs: add mutex lock before unregister gadget
      drivers/usb/gadget/configfs.c
  * ipv6: fix endianness error in icmpv6_err
      net/ipv6/icmp.c
    stm class: Fix stm device initialization order
    stm class: Do not leak the chrdev in error path
    PM / Hibernate: Call flush_icache_range() on pages restored in-place
  * arm64: kernel: Include _AC definition in page.h
      arch/arm64/include/asm/page.h
  * perf/ring_buffer: Refuse to begin AUX transaction after rb->aux_mmap_count drops
      kernel/events/ring_buffer.c
    mac80211: fix "warning: ‘target_metric’ may be used uninitialized"
  * arm64/kernel: fix incorrect EL0 check in inv_entry macro
      arch/arm64/kernel/entry.S
    ARM: 8510/1: rework ARM_CPU_SUSPEND dependencies
    staging: goldfish: audio: fix compiliation on arm
  * staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT
      drivers/staging/android/ion/ion_carveout_heap.c
  * staging: ashmem: Add missing include
      drivers/staging/android/uapi/ashmem.h
  * staging: ashmem: Avoid deadlock with mmap/shrink
      drivers/staging/android/ashmem.c
  * asm-generic: Fix local variable shadow in __set_fixmap_offset
      include/asm-generic/fixmap.h
    coresight: etm4x: Check every parameter used by dma_xx_coherent.
    coresight: "DEVICE_ATTR_RO" should defined as static.
    stm class: Fix a race in unlinking
    stm class: Fix unbalanced module/device refcounting
    stm class: Guard output assignment against concurrency
    stm class: Fix unlocking braino in the error path
    stm class: Support devices with multiple instances
    stm class: Prevent user-controllable allocations
    stm class: Fix link list locking
    stm class: Fix locking in unbinding policy path
    coresight: remove csdev's link from topology
    coresight: release reference taken by 'bus_find_device()'
    coresight: coresight_unregister() function cleanup
    coresight: fixing lockdep error
  * writeback: initialize inode members that track writeback history
      fs/inode.c
    Revert "mmc: block: don't use parameter prefix if built as module"
  * net: diag: support v4mapped sockets in inet_diag_find_one_icsk()
      net/ipv4/inet_diag.c
  * perf: Synchronously free aux pages in case of allocation failure
      kernel/events/ring_buffer.c
  * arm64: hide __efistub_ aliases from kallsyms
      arch/arm64/kernel/image.h
    hid-sensor-hub.c: fix wrong do_div() usage
  * vmstat: make vmstat_updater deferrable again and shut down on idle
      include/linux/vmstat.h
      kernel/sched/idle.c
      mm/vmstat.c
  * android: unconditionally remove callbacks in sync_fence_free()
      drivers/staging/android/sync.c
    ARM: 8494/1: mm: Enable PXN when running non-LPAE kernel on LPAE processor
    ARM: 8458/1: bL_switcher: add GIC dependency
  * efi: stub: define DISABLE_BRANCH_PROFILING for all architectures
      drivers/firmware/efi/libstub/Makefile
  * arm64: fix COMPAT_SHMLBA definition for large pages
      arch/arm64/include/asm/shmparam.h
    mmc: block: Allow more than 8 partitions per card
  * sched/fair: Fix new task's load avg removed from source CPU in wake_up_new_task()
      kernel/sched/fair.c
  * Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
      net/bluetooth/l2cap_core.c
  * Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
      net/bluetooth/l2cap_core.c
    ath10k: avoid possible string overflow
  * rtc: Fix overflow when converting time64_t to rtc_time
      drivers/rtc/rtc-lib.c
  * USB: core: only clean up what we allocated
      drivers/usb/core/config.c
  * lib/int_sqrt: optimize small argument
      lib/int_sqrt.c
    serial: sprd: clear timeout interrupt only rather than all interrupts
    usb: renesas_usbhs: gadget: fix unused-but-set-variable warning
  * arm64: traps: disable irq in die()
      arch/arm64/kernel/traps.c
  * Hang/soft lockup in d_invalidate with simultaneous calls
      fs/dcache.c
    serial: sprd: adjust TIMEOUT to a big value
  * tcp/dccp: drop SYN packets if accept queue is full
      include/net/inet_connection_sock.h
      net/ipv4/tcp_input.c
    usb: gadget: Add the gserial port checking in gs_start_tx()
  * usb: gadget: composite: fix dereference after null check coverify warning
      drivers/usb/gadget/composite.c
  * kbuild: setlocalversion: print error to STDERR
      scripts/setlocalversion
    extcon: usb-gpio: Don't miss event during suspend/resume
  * mm/rmap: replace BUG_ON(anon_vma->degree) with VM_WARN_ON
      mm/rmap.c
    mmc: core: fix using wrong io voltage if mmc_select_hs200 fails
  * arm64: mm: Add trace_irqflags annotations to do_debug_exception()
      arch/arm64/mm/fault.c
  * usb: dwc3: gadget: Fix suspend/resume during device mode
      drivers/usb/dwc3/gadget.c
    mmc: core: shut up "voltage-ranges unspecified" pr_info()
    mmc: sanitize 'bus width' in debug output
    mmc: make MAN_BKOPS_EN message a debug
    mmc: debugfs: Add a restriction to mmc debugfs clock setting
    mmc: pwrseq_simple: Make reset-gpios optional to match doc
    ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
    ALSA: hda - Record the current power state before suspend/resume calls
    locking/lockdep: Add debug_locks check in __lock_downgrade()
  * media: v4l2-ctrls.c/uvc: zero v4l2_event
      drivers/media/v4l2-core/v4l2-ctrls.c
    mmc: tmio_mmc_core: don't claim spurious interrupts
  * ext4: brelse all indirect buffer in ext4_ind_remove_space()
      fs/ext4/indirect.c
  * ext4: fix data corruption caused by unaligned direct AIO
      fs/ext4/file.c
  * ext4: fix NULL pointer dereference while journal is aborted
      fs/ext4/ext4_jbd2.h
  * futex: Ensure that futex address is aligned in handle_futex_death()
      kernel/futex.c
    MIPS: Fix kernel crash for R6 in jump label branch function
    mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
    udf: Fix crash on IO error during truncate
    drm/vmwgfx: Don't double-free the mode stored in par->set_mode
    mmc: pxamci: fix enum type confusion

Change-Id: Ib7e4ac2952d7fc0808e515749ea6b3c2bbfc40e5
Signed-off-by: Robin Peng <robinpeng@google.com>
2019-11-01 12:32:03 +08:00

3493 lines
90 KiB
C

/*
* linux/fs/buffer.c
*
* Copyright (C) 1991, 1992, 2002 Linus Torvalds
*/
/*
* Start bdflush() with kernel_thread not syscall - Paul Gortmaker, 12/95
*
* Removed a lot of unnecessary code and simplified things now that
* the buffer cache isn't our primary cache - Andrew Tridgell 12/96
*
* Speed up hash, lru, and free list operations. Use gfp() for allocating
* hash table, use SLAB cache for buffer heads. SMP threading. -DaveM
*
* Added 32k buffer block sizes - these are required older ARM systems. - RMK
*
* async buffer flushing, 1999 Andrea Arcangeli <andrea@suse.de>
*/
#include <linux/kernel.h>
#include <linux/syscalls.h>
#include <linux/fs.h>
#include <linux/mm.h>
#include <linux/percpu.h>
#include <linux/slab.h>
#include <linux/capability.h>
#include <linux/blkdev.h>
#include <linux/file.h>
#include <linux/quotaops.h>
#include <linux/highmem.h>
#include <linux/export.h>
#include <linux/backing-dev.h>
#include <linux/writeback.h>
#include <linux/hash.h>
#include <linux/suspend.h>
#include <linux/buffer_head.h>
#include <linux/task_io_accounting_ops.h>
#include <linux/bio.h>
#include <linux/notifier.h>
#include <linux/cpu.h>
#include <linux/bitops.h>
#include <linux/mpage.h>
#include <linux/bit_spinlock.h>
#include <trace/events/block.h>
static int fsync_buffers_list(spinlock_t *lock, struct list_head *list);
static int submit_bh_wbc(int rw, struct buffer_head *bh,
unsigned long bio_flags,
struct writeback_control *wbc);
#define BH_ENTRY(list) list_entry((list), struct buffer_head, b_assoc_buffers)
void init_buffer(struct buffer_head *bh, bh_end_io_t *handler, void *private)
{
bh->b_end_io = handler;
bh->b_private = private;
}
EXPORT_SYMBOL(init_buffer);
inline void touch_buffer(struct buffer_head *bh)
{
trace_block_touch_buffer(bh);
mark_page_accessed(bh->b_page);
}
EXPORT_SYMBOL(touch_buffer);
void __lock_buffer(struct buffer_head *bh)
{
wait_on_bit_lock_io(&bh->b_state, BH_Lock, TASK_UNINTERRUPTIBLE);
}
EXPORT_SYMBOL(__lock_buffer);
void unlock_buffer(struct buffer_head *bh)
{
clear_bit_unlock(BH_Lock, &bh->b_state);
smp_mb__after_atomic();
wake_up_bit(&bh->b_state, BH_Lock);
}
EXPORT_SYMBOL(unlock_buffer);
/*
* Returns if the page has dirty or writeback buffers. If all the buffers
* are unlocked and clean then the PageDirty information is stale. If
* any of the pages are locked, it is assumed they are locked for IO.
*/
void buffer_check_dirty_writeback(struct page *page,
bool *dirty, bool *writeback)
{
struct buffer_head *head, *bh;
*dirty = false;
*writeback = false;
BUG_ON(!PageLocked(page));
if (!page_has_buffers(page))
return;
if (PageWriteback(page))
*writeback = true;
head = page_buffers(page);
bh = head;
do {
if (buffer_locked(bh))
*writeback = true;
if (buffer_dirty(bh))
*dirty = true;
bh = bh->b_this_page;
} while (bh != head);
}
EXPORT_SYMBOL(buffer_check_dirty_writeback);
/*
* Block until a buffer comes unlocked. This doesn't stop it
* from becoming locked again - you have to lock it yourself
* if you want to preserve its state.
*/
void __wait_on_buffer(struct buffer_head * bh)
{
wait_on_bit_io(&bh->b_state, BH_Lock, TASK_UNINTERRUPTIBLE);
}
EXPORT_SYMBOL(__wait_on_buffer);
static void
__clear_page_buffers(struct page *page)
{
ClearPagePrivate(page);
set_page_private(page, 0);
page_cache_release(page);
}
static void buffer_io_error(struct buffer_head *bh, char *msg)
{
char b[BDEVNAME_SIZE];
if (!test_bit(BH_Quiet, &bh->b_state))
printk_ratelimited(KERN_ERR
"Buffer I/O error on dev %s, logical block %llu%s\n",
bdevname(bh->b_bdev, b),
(unsigned long long)bh->b_blocknr, msg);
}
/*
* End-of-IO handler helper function which does not touch the bh after
* unlocking it.
* Note: unlock_buffer() sort-of does touch the bh after unlocking it, but
* a race there is benign: unlock_buffer() only use the bh's address for
* hashing after unlocking the buffer, so it doesn't actually touch the bh
* itself.
*/
static void __end_buffer_read_notouch(struct buffer_head *bh, int uptodate)
{
if (uptodate) {
set_buffer_uptodate(bh);
} else {
/* This happens, due to failed READA attempts. */
clear_buffer_uptodate(bh);
}
unlock_buffer(bh);
}
/*
* Default synchronous end-of-IO handler.. Just mark it up-to-date and
* unlock the buffer. This is what ll_rw_block uses too.
*/
void end_buffer_read_sync(struct buffer_head *bh, int uptodate)
{
__end_buffer_read_notouch(bh, uptodate);
put_bh(bh);
}
EXPORT_SYMBOL(end_buffer_read_sync);
void end_buffer_write_sync(struct buffer_head *bh, int uptodate)
{
if (uptodate) {
set_buffer_uptodate(bh);
} else {
buffer_io_error(bh, ", lost sync page write");
set_buffer_write_io_error(bh);
clear_buffer_uptodate(bh);
}
unlock_buffer(bh);
put_bh(bh);
}
EXPORT_SYMBOL(end_buffer_write_sync);
/*
* Various filesystems appear to want __find_get_block to be non-blocking.
* But it's the page lock which protects the buffers. To get around this,
* we get exclusion from try_to_free_buffers with the blockdev mapping's
* private_lock.
*
* Hack idea: for the blockdev mapping, i_bufferlist_lock contention
* may be quite high. This code could TryLock the page, and if that
* succeeds, there is no need to take private_lock. (But if
* private_lock is contended then so is mapping->tree_lock).
*/
static struct buffer_head *
__find_get_block_slow(struct block_device *bdev, sector_t block)
{
struct inode *bd_inode = bdev->bd_inode;
struct address_space *bd_mapping = bd_inode->i_mapping;
struct buffer_head *ret = NULL;
pgoff_t index;
struct buffer_head *bh;
struct buffer_head *head;
struct page *page;
int all_mapped = 1;
index = block >> (PAGE_CACHE_SHIFT - bd_inode->i_blkbits);
page = find_get_page_flags(bd_mapping, index, FGP_ACCESSED);
if (!page)
goto out;
spin_lock(&bd_mapping->private_lock);
if (!page_has_buffers(page))
goto out_unlock;
head = page_buffers(page);
bh = head;
do {
if (!buffer_mapped(bh))
all_mapped = 0;
else if (bh->b_blocknr == block) {
ret = bh;
get_bh(bh);
goto out_unlock;
}
bh = bh->b_this_page;
} while (bh != head);
/* we might be here because some of the buffers on this page are
* not mapped. This is due to various races between
* file io on the block device and getblk. It gets dealt with
* elsewhere, don't buffer_error if we had some unmapped buffers
*/
if (all_mapped) {
char b[BDEVNAME_SIZE];
printk("__find_get_block_slow() failed. "
"block=%llu, b_blocknr=%llu\n",
(unsigned long long)block,
(unsigned long long)bh->b_blocknr);
printk("b_state=0x%08lx, b_size=%zu\n",
bh->b_state, bh->b_size);
printk("device %s blocksize: %d\n", bdevname(bdev, b),
1 << bd_inode->i_blkbits);
}
out_unlock:
spin_unlock(&bd_mapping->private_lock);
page_cache_release(page);
out:
return ret;
}
/*
* Kick the writeback threads then try to free up some ZONE_NORMAL memory.
*/
static void free_more_memory(void)
{
struct zone *zone;
int nid;
wakeup_flusher_threads(1024, WB_REASON_FREE_MORE_MEM);
yield();
for_each_online_node(nid) {
(void)first_zones_zonelist(node_zonelist(nid, GFP_NOFS),
gfp_zone(GFP_NOFS), NULL,
&zone);
if (zone)
try_to_free_pages(node_zonelist(nid, GFP_NOFS), 0,
GFP_NOFS, NULL);
}
}
/*
* I/O completion handler for block_read_full_page() - pages
* which come unlocked at the end of I/O.
*/
static void end_buffer_async_read(struct buffer_head *bh, int uptodate)
{
unsigned long flags;
struct buffer_head *first;
struct buffer_head *tmp;
struct page *page;
int page_uptodate = 1;
BUG_ON(!buffer_async_read(bh));
page = bh->b_page;
if (uptodate) {
set_buffer_uptodate(bh);
} else {
clear_buffer_uptodate(bh);
buffer_io_error(bh, ", async page read");
SetPageError(page);
}
/*
* Be _very_ careful from here on. Bad things can happen if
* two buffer heads end IO at almost the same time and both
* decide that the page is now completely done.
*/
first = page_buffers(page);
local_irq_save(flags);
bit_spin_lock(BH_Uptodate_Lock, &first->b_state);
clear_buffer_async_read(bh);
unlock_buffer(bh);
tmp = bh;
do {
if (!buffer_uptodate(tmp))
page_uptodate = 0;
if (buffer_async_read(tmp)) {
BUG_ON(!buffer_locked(tmp));
goto still_busy;
}
tmp = tmp->b_this_page;
} while (tmp != bh);
bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
local_irq_restore(flags);
/*
* If none of the buffers had errors and they are all
* uptodate then we can set the page uptodate.
*/
if (page_uptodate && !PageError(page))
SetPageUptodate(page);
unlock_page(page);
return;
still_busy:
bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
local_irq_restore(flags);
return;
}
/*
* Completion handler for block_write_full_page() - pages which are unlocked
* during I/O, and which have PageWriteback cleared upon I/O completion.
*/
void end_buffer_async_write(struct buffer_head *bh, int uptodate)
{
unsigned long flags;
struct buffer_head *first;
struct buffer_head *tmp;
struct page *page;
BUG_ON(!buffer_async_write(bh));
page = bh->b_page;
if (uptodate) {
set_buffer_uptodate(bh);
} else {
buffer_io_error(bh, ", lost async page write");
set_bit(AS_EIO, &page->mapping->flags);
set_buffer_write_io_error(bh);
clear_buffer_uptodate(bh);
SetPageError(page);
}
first = page_buffers(page);
local_irq_save(flags);
bit_spin_lock(BH_Uptodate_Lock, &first->b_state);
clear_buffer_async_write(bh);
unlock_buffer(bh);
tmp = bh->b_this_page;
while (tmp != bh) {
if (buffer_async_write(tmp)) {
BUG_ON(!buffer_locked(tmp));
goto still_busy;
}
tmp = tmp->b_this_page;
}
bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
local_irq_restore(flags);
end_page_writeback(page);
return;
still_busy:
bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
local_irq_restore(flags);
return;
}
EXPORT_SYMBOL(end_buffer_async_write);
/*
* If a page's buffers are under async readin (end_buffer_async_read
* completion) then there is a possibility that another thread of
* control could lock one of the buffers after it has completed
* but while some of the other buffers have not completed. This
* locked buffer would confuse end_buffer_async_read() into not unlocking
* the page. So the absence of BH_Async_Read tells end_buffer_async_read()
* that this buffer is not under async I/O.
*
* The page comes unlocked when it has no locked buffer_async buffers
* left.
*
* PageLocked prevents anyone starting new async I/O reads any of
* the buffers.
*
* PageWriteback is used to prevent simultaneous writeout of the same
* page.
*
* PageLocked prevents anyone from starting writeback of a page which is
* under read I/O (PageWriteback is only ever set against a locked page).
*/
static void mark_buffer_async_read(struct buffer_head *bh)
{
bh->b_end_io = end_buffer_async_read;
set_buffer_async_read(bh);
}
static void mark_buffer_async_write_endio(struct buffer_head *bh,
bh_end_io_t *handler)
{
bh->b_end_io = handler;
set_buffer_async_write(bh);
}
void mark_buffer_async_write(struct buffer_head *bh)
{
mark_buffer_async_write_endio(bh, end_buffer_async_write);
}
EXPORT_SYMBOL(mark_buffer_async_write);
/*
* fs/buffer.c contains helper functions for buffer-backed address space's
* fsync functions. A common requirement for buffer-based filesystems is
* that certain data from the backing blockdev needs to be written out for
* a successful fsync(). For example, ext2 indirect blocks need to be
* written back and waited upon before fsync() returns.
*
* The functions mark_buffer_inode_dirty(), fsync_inode_buffers(),
* inode_has_buffers() and invalidate_inode_buffers() are provided for the
* management of a list of dependent buffers at ->i_mapping->private_list.
*
* Locking is a little subtle: try_to_free_buffers() will remove buffers
* from their controlling inode's queue when they are being freed. But
* try_to_free_buffers() will be operating against the *blockdev* mapping
* at the time, not against the S_ISREG file which depends on those buffers.
* So the locking for private_list is via the private_lock in the address_space
* which backs the buffers. Which is different from the address_space
* against which the buffers are listed. So for a particular address_space,
* mapping->private_lock does *not* protect mapping->private_list! In fact,
* mapping->private_list will always be protected by the backing blockdev's
* ->private_lock.
*
* Which introduces a requirement: all buffers on an address_space's
* ->private_list must be from the same address_space: the blockdev's.
*
* address_spaces which do not place buffers at ->private_list via these
* utility functions are free to use private_lock and private_list for
* whatever they want. The only requirement is that list_empty(private_list)
* be true at clear_inode() time.
*
* FIXME: clear_inode should not call invalidate_inode_buffers(). The
* filesystems should do that. invalidate_inode_buffers() should just go
* BUG_ON(!list_empty).
*
* FIXME: mark_buffer_dirty_inode() is a data-plane operation. It should
* take an address_space, not an inode. And it should be called
* mark_buffer_dirty_fsync() to clearly define why those buffers are being
* queued up.
*
* FIXME: mark_buffer_dirty_inode() doesn't need to add the buffer to the
* list if it is already on a list. Because if the buffer is on a list,
* it *must* already be on the right one. If not, the filesystem is being
* silly. This will save a ton of locking. But first we have to ensure
* that buffers are taken *off* the old inode's list when they are freed
* (presumably in truncate). That requires careful auditing of all
* filesystems (do it inside bforget()). It could also be done by bringing
* b_inode back.
*/
/*
* The buffer's backing address_space's private_lock must be held
*/
static void __remove_assoc_queue(struct buffer_head *bh)
{
list_del_init(&bh->b_assoc_buffers);
WARN_ON(!bh->b_assoc_map);
if (buffer_write_io_error(bh))
set_bit(AS_EIO, &bh->b_assoc_map->flags);
bh->b_assoc_map = NULL;
}
int inode_has_buffers(struct inode *inode)
{
return !list_empty(&inode->i_data.private_list);
}
/*
* osync is designed to support O_SYNC io. It waits synchronously for
* all already-submitted IO to complete, but does not queue any new
* writes to the disk.
*
* To do O_SYNC writes, just queue the buffer writes with ll_rw_block as
* you dirty the buffers, and then use osync_inode_buffers to wait for
* completion. Any other dirty buffers which are not yet queued for
* write will not be flushed to disk by the osync.
*/
static int osync_buffers_list(spinlock_t *lock, struct list_head *list)
{
struct buffer_head *bh;
struct list_head *p;
int err = 0;
spin_lock(lock);
repeat:
list_for_each_prev(p, list) {
bh = BH_ENTRY(p);
if (buffer_locked(bh)) {
get_bh(bh);
spin_unlock(lock);
wait_on_buffer(bh);
if (!buffer_uptodate(bh))
err = -EIO;
brelse(bh);
spin_lock(lock);
goto repeat;
}
}
spin_unlock(lock);
return err;
}
static void do_thaw_one(struct super_block *sb, void *unused)
{
char b[BDEVNAME_SIZE];
while (sb->s_bdev && !thaw_bdev(sb->s_bdev, sb))
printk(KERN_WARNING "Emergency Thaw on %s\n",
bdevname(sb->s_bdev, b));
}
static void do_thaw_all(struct work_struct *work)
{
iterate_supers(do_thaw_one, NULL);
kfree(work);
printk(KERN_WARNING "Emergency Thaw complete\n");
}
/**
* emergency_thaw_all -- forcibly thaw every frozen filesystem
*
* Used for emergency unfreeze of all filesystems via SysRq
*/
void emergency_thaw_all(void)
{
struct work_struct *work;
work = kmalloc(sizeof(*work), GFP_ATOMIC);
if (work) {
INIT_WORK(work, do_thaw_all);
schedule_work(work);
}
}
/**
* sync_mapping_buffers - write out & wait upon a mapping's "associated" buffers
* @mapping: the mapping which wants those buffers written
*
* Starts I/O against the buffers at mapping->private_list, and waits upon
* that I/O.
*
* Basically, this is a convenience function for fsync().
* @mapping is a file or directory which needs those buffers to be written for
* a successful fsync().
*/
int sync_mapping_buffers(struct address_space *mapping)
{
struct address_space *buffer_mapping = mapping->private_data;
if (buffer_mapping == NULL || list_empty(&mapping->private_list))
return 0;
return fsync_buffers_list(&buffer_mapping->private_lock,
&mapping->private_list);
}
EXPORT_SYMBOL(sync_mapping_buffers);
/*
* Called when we've recently written block `bblock', and it is known that
* `bblock' was for a buffer_boundary() buffer. This means that the block at
* `bblock + 1' is probably a dirty indirect block. Hunt it down and, if it's
* dirty, schedule it for IO. So that indirects merge nicely with their data.
*/
void write_boundary_block(struct block_device *bdev,
sector_t bblock, unsigned blocksize)
{
struct buffer_head *bh = __find_get_block(bdev, bblock + 1, blocksize);
if (bh) {
if (buffer_dirty(bh))
ll_rw_block(WRITE, 1, &bh);
put_bh(bh);
}
}
void mark_buffer_dirty_inode(struct buffer_head *bh, struct inode *inode)
{
struct address_space *mapping = inode->i_mapping;
struct address_space *buffer_mapping = bh->b_page->mapping;
mark_buffer_dirty(bh);
if (!mapping->private_data) {
mapping->private_data = buffer_mapping;
} else {
BUG_ON(mapping->private_data != buffer_mapping);
}
if (!bh->b_assoc_map) {
spin_lock(&buffer_mapping->private_lock);
list_move_tail(&bh->b_assoc_buffers,
&mapping->private_list);
bh->b_assoc_map = mapping;
spin_unlock(&buffer_mapping->private_lock);
}
}
EXPORT_SYMBOL(mark_buffer_dirty_inode);
#ifdef CONFIG_BLK_DEV_IO_TRACE
static inline void save_dirty_task(struct page *page)
{
/* Save the task that is dirtying this page */
page->tsk_dirty = current;
}
#else
static inline void save_dirty_task(struct page *page)
{
}
#endif
/*
* Mark the page dirty, and set it dirty in the radix tree, and mark the inode
* dirty.
*
* If warn is true, then emit a warning if the page is not uptodate and has
* not been truncated.
*
* The caller must hold mem_cgroup_begin_page_stat() lock.
*/
static void __set_page_dirty(struct page *page, struct address_space *mapping,
struct mem_cgroup *memcg, int warn)
{
unsigned long flags;
spin_lock_irqsave(&mapping->tree_lock, flags);
if (page->mapping) { /* Race with truncate? */
WARN_ON_ONCE(warn && !PageUptodate(page));
account_page_dirtied(page, mapping, memcg);
radix_tree_tag_set(&mapping->page_tree,
page_index(page), PAGECACHE_TAG_DIRTY);
save_dirty_task(page);
}
spin_unlock_irqrestore(&mapping->tree_lock, flags);
}
/*
* Add a page to the dirty page list.
*
* It is a sad fact of life that this function is called from several places
* deeply under spinlocking. It may not sleep.
*
* If the page has buffers, the uptodate buffers are set dirty, to preserve
* dirty-state coherency between the page and the buffers. It the page does
* not have buffers then when they are later attached they will all be set
* dirty.
*
* The buffers are dirtied before the page is dirtied. There's a small race
* window in which a writepage caller may see the page cleanness but not the
* buffer dirtiness. That's fine. If this code were to set the page dirty
* before the buffers, a concurrent writepage caller could clear the page dirty
* bit, see a bunch of clean buffers and we'd end up with dirty buffers/clean
* page on the dirty page list.
*
* We use private_lock to lock against try_to_free_buffers while using the
* page's buffer list. Also use this to protect against clean buffers being
* added to the page after it was set dirty.
*
* FIXME: may need to call ->reservepage here as well. That's rather up to the
* address_space though.
*/
int __set_page_dirty_buffers(struct page *page)
{
int newly_dirty;
struct mem_cgroup *memcg;
struct address_space *mapping = page_mapping(page);
if (unlikely(!mapping))
return !TestSetPageDirty(page);
spin_lock(&mapping->private_lock);
if (page_has_buffers(page)) {
struct buffer_head *head = page_buffers(page);
struct buffer_head *bh = head;
do {
set_buffer_dirty(bh);
bh = bh->b_this_page;
} while (bh != head);
}
/*
* Use mem_group_begin_page_stat() to keep PageDirty synchronized with
* per-memcg dirty page counters.
*/
memcg = mem_cgroup_begin_page_stat(page);
newly_dirty = !TestSetPageDirty(page);
spin_unlock(&mapping->private_lock);
if (newly_dirty)
__set_page_dirty(page, mapping, memcg, 1);
mem_cgroup_end_page_stat(memcg);
if (newly_dirty)
__mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
return newly_dirty;
}
EXPORT_SYMBOL(__set_page_dirty_buffers);
/*
* Write out and wait upon a list of buffers.
*
* We have conflicting pressures: we want to make sure that all
* initially dirty buffers get waited on, but that any subsequently
* dirtied buffers don't. After all, we don't want fsync to last
* forever if somebody is actively writing to the file.
*
* Do this in two main stages: first we copy dirty buffers to a
* temporary inode list, queueing the writes as we go. Then we clean
* up, waiting for those writes to complete.
*
* During this second stage, any subsequent updates to the file may end
* up refiling the buffer on the original inode's dirty list again, so
* there is a chance we will end up with a buffer queued for write but
* not yet completed on that list. So, as a final cleanup we go through
* the osync code to catch these locked, dirty buffers without requeuing
* any newly dirty buffers for write.
*/
static int fsync_buffers_list(spinlock_t *lock, struct list_head *list)
{
struct buffer_head *bh;
struct list_head tmp;
struct address_space *mapping;
int err = 0, err2;
struct blk_plug plug;
INIT_LIST_HEAD(&tmp);
blk_start_plug(&plug);
spin_lock(lock);
while (!list_empty(list)) {
bh = BH_ENTRY(list->next);
mapping = bh->b_assoc_map;
__remove_assoc_queue(bh);
/* Avoid race with mark_buffer_dirty_inode() which does
* a lockless check and we rely on seeing the dirty bit */
smp_mb();
if (buffer_dirty(bh) || buffer_locked(bh)) {
list_add(&bh->b_assoc_buffers, &tmp);
bh->b_assoc_map = mapping;
if (buffer_dirty(bh)) {
get_bh(bh);
spin_unlock(lock);
/*
* Ensure any pending I/O completes so that
* write_dirty_buffer() actually writes the
* current contents - it is a noop if I/O is
* still in flight on potentially older
* contents.
*/
write_dirty_buffer(bh, WRITE_SYNC);
/*
* Kick off IO for the previous mapping. Note
* that we will not run the very last mapping,
* wait_on_buffer() will do that for us
* through sync_buffer().
*/
brelse(bh);
spin_lock(lock);
}
}
}
spin_unlock(lock);
blk_finish_plug(&plug);
spin_lock(lock);
while (!list_empty(&tmp)) {
bh = BH_ENTRY(tmp.prev);
get_bh(bh);
mapping = bh->b_assoc_map;
__remove_assoc_queue(bh);
/* Avoid race with mark_buffer_dirty_inode() which does
* a lockless check and we rely on seeing the dirty bit */
smp_mb();
if (buffer_dirty(bh)) {
list_add(&bh->b_assoc_buffers,
&mapping->private_list);
bh->b_assoc_map = mapping;
}
spin_unlock(lock);
wait_on_buffer(bh);
if (!buffer_uptodate(bh))
err = -EIO;
brelse(bh);
spin_lock(lock);
}
spin_unlock(lock);
err2 = osync_buffers_list(lock, list);
if (err)
return err;
else
return err2;
}
/*
* Invalidate any and all dirty buffers on a given inode. We are
* probably unmounting the fs, but that doesn't mean we have already
* done a sync(). Just drop the buffers from the inode list.
*
* NOTE: we take the inode's blockdev's mapping's private_lock. Which
* assumes that all the buffers are against the blockdev. Not true
* for reiserfs.
*/
void invalidate_inode_buffers(struct inode *inode)
{
if (inode_has_buffers(inode)) {
struct address_space *mapping = &inode->i_data;
struct list_head *list = &mapping->private_list;
struct address_space *buffer_mapping = mapping->private_data;
spin_lock(&buffer_mapping->private_lock);
while (!list_empty(list))
__remove_assoc_queue(BH_ENTRY(list->next));
spin_unlock(&buffer_mapping->private_lock);
}
}
EXPORT_SYMBOL(invalidate_inode_buffers);
/*
* Remove any clean buffers from the inode's buffer list. This is called
* when we're trying to free the inode itself. Those buffers can pin it.
*
* Returns true if all buffers were removed.
*/
int remove_inode_buffers(struct inode *inode)
{
int ret = 1;
if (inode_has_buffers(inode)) {
struct address_space *mapping = &inode->i_data;
struct list_head *list = &mapping->private_list;
struct address_space *buffer_mapping = mapping->private_data;
spin_lock(&buffer_mapping->private_lock);
while (!list_empty(list)) {
struct buffer_head *bh = BH_ENTRY(list->next);
if (buffer_dirty(bh)) {
ret = 0;
break;
}
__remove_assoc_queue(bh);
}
spin_unlock(&buffer_mapping->private_lock);
}
return ret;
}
/*
* Create the appropriate buffers when given a page for data area and
* the size of each buffer.. Use the bh->b_this_page linked list to
* follow the buffers created. Return NULL if unable to create more
* buffers.
*
* The retry flag is used to differentiate async IO (paging, swapping)
* which may not fail from ordinary buffer allocations.
*/
struct buffer_head *alloc_page_buffers(struct page *page, unsigned long size,
int retry)
{
struct buffer_head *bh, *head;
long offset;
try_again:
head = NULL;
offset = PAGE_SIZE;
while ((offset -= size) >= 0) {
bh = alloc_buffer_head(GFP_NOFS);
if (!bh)
goto no_grow;
bh->b_this_page = head;
bh->b_blocknr = -1;
head = bh;
bh->b_size = size;
/* Link the buffer to its page */
set_bh_page(bh, page, offset);
}
return head;
/*
* In case anything failed, we just free everything we got.
*/
no_grow:
if (head) {
do {
bh = head;
head = head->b_this_page;
free_buffer_head(bh);
} while (head);
}
/*
* Return failure for non-async IO requests. Async IO requests
* are not allowed to fail, so we have to wait until buffer heads
* become available. But we don't want tasks sleeping with
* partially complete buffers, so all were released above.
*/
if (!retry)
return NULL;
/* We're _really_ low on memory. Now we just
* wait for old buffer heads to become free due to
* finishing IO. Since this is an async request and
* the reserve list is empty, we're sure there are
* async buffer heads in use.
*/
free_more_memory();
goto try_again;
}
EXPORT_SYMBOL_GPL(alloc_page_buffers);
static inline void
link_dev_buffers(struct page *page, struct buffer_head *head)
{
struct buffer_head *bh, *tail;
bh = head;
do {
tail = bh;
bh = bh->b_this_page;
} while (bh);
tail->b_this_page = head;
attach_page_buffers(page, head);
}
static sector_t blkdev_max_block(struct block_device *bdev, unsigned int size)
{
sector_t retval = ~((sector_t)0);
loff_t sz = i_size_read(bdev->bd_inode);
if (sz) {
unsigned int sizebits = blksize_bits(size);
retval = (sz >> sizebits);
}
return retval;
}
/*
* Initialise the state of a blockdev page's buffers.
*/
static sector_t
init_page_buffers(struct page *page, struct block_device *bdev,
sector_t block, int size)
{
struct buffer_head *head = page_buffers(page);
struct buffer_head *bh = head;
int uptodate = PageUptodate(page);
sector_t end_block = blkdev_max_block(I_BDEV(bdev->bd_inode), size);
do {
if (!buffer_mapped(bh)) {
init_buffer(bh, NULL, NULL);
bh->b_bdev = bdev;
bh->b_blocknr = block;
if (uptodate)
set_buffer_uptodate(bh);
if (block < end_block)
set_buffer_mapped(bh);
}
block++;
bh = bh->b_this_page;
} while (bh != head);
/*
* Caller needs to validate requested block against end of device.
*/
return end_block;
}
/*
* Create the page-cache page that contains the requested block.
*
* This is used purely for blockdev mappings.
*/
static int
grow_dev_page(struct block_device *bdev, sector_t block,
pgoff_t index, int size, int sizebits, gfp_t gfp)
{
struct inode *inode = bdev->bd_inode;
struct page *page;
struct buffer_head *bh;
sector_t end_block;
int ret = 0; /* Will call free_more_memory() */
gfp_t gfp_mask;
gfp_mask = mapping_gfp_constraint(inode->i_mapping, ~__GFP_FS) | gfp;
/*
* XXX: __getblk_slow() can not really deal with failure and
* will endlessly loop on improvised global reclaim. Prefer
* looping in the allocator rather than here, at least that
* code knows what it's doing.
*/
gfp_mask |= __GFP_NOFAIL;
page = find_or_create_page(inode->i_mapping, index, gfp_mask);
if (!page)
return ret;
BUG_ON(!PageLocked(page));
if (page_has_buffers(page)) {
bh = page_buffers(page);
if (bh->b_size == size) {
end_block = init_page_buffers(page, bdev,
(sector_t)index << sizebits,
size);
goto done;
}
if (!try_to_free_buffers(page))
goto failed;
}
/*
* Allocate some buffers for this page
*/
bh = alloc_page_buffers(page, size, 0);
if (!bh)
goto failed;
/*
* Link the page to the buffers and initialise them. Take the
* lock to be atomic wrt __find_get_block(), which does not
* run under the page lock.
*/
spin_lock(&inode->i_mapping->private_lock);
link_dev_buffers(page, bh);
end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
size);
spin_unlock(&inode->i_mapping->private_lock);
done:
ret = (block < end_block) ? 1 : -ENXIO;
failed:
unlock_page(page);
page_cache_release(page);
return ret;
}
/*
* Create buffers for the specified block device block's page. If
* that page was dirty, the buffers are set dirty also.
*/
static int
grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp)
{
pgoff_t index;
int sizebits;
sizebits = -1;
do {
sizebits++;
} while ((size << sizebits) < PAGE_SIZE);
index = block >> sizebits;
/*
* Check for a block which wants to lie outside our maximum possible
* pagecache index. (this comparison is done using sector_t types).
*/
if (unlikely(index != block >> sizebits)) {
char b[BDEVNAME_SIZE];
printk(KERN_ERR "%s: requested out-of-range block %llu for "
"device %s\n",
__func__, (unsigned long long)block,
bdevname(bdev, b));
return -EIO;
}
/* Create a page with the proper size buffers.. */
return grow_dev_page(bdev, block, index, size, sizebits, gfp);
}
struct buffer_head *
__getblk_slow(struct block_device *bdev, sector_t block,
unsigned size, gfp_t gfp)
{
/* Size must be multiple of hard sectorsize */
if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
(size < 512 || size > PAGE_SIZE))) {
printk(KERN_ERR "getblk(): invalid block size %d requested\n",
size);
printk(KERN_ERR "logical block size: %d\n",
bdev_logical_block_size(bdev));
dump_stack();
return NULL;
}
for (;;) {
struct buffer_head *bh;
int ret;
bh = __find_get_block(bdev, block, size);
if (bh)
return bh;
ret = grow_buffers(bdev, block, size, gfp);
if (ret < 0)
return NULL;
if (ret == 0)
free_more_memory();
}
}
EXPORT_SYMBOL(__getblk_slow);
/*
* The relationship between dirty buffers and dirty pages:
*
* Whenever a page has any dirty buffers, the page's dirty bit is set, and
* the page is tagged dirty in its radix tree.
*
* At all times, the dirtiness of the buffers represents the dirtiness of
* subsections of the page. If the page has buffers, the page dirty bit is
* merely a hint about the true dirty state.
*
* When a page is set dirty in its entirety, all its buffers are marked dirty
* (if the page has buffers).
*
* When a buffer is marked dirty, its page is dirtied, but the page's other
* buffers are not.
*
* Also. When blockdev buffers are explicitly read with bread(), they
* individually become uptodate. But their backing page remains not
* uptodate - even if all of its buffers are uptodate. A subsequent
* block_read_full_page() against that page will discover all the uptodate
* buffers, will set the page uptodate and will perform no I/O.
*/
/**
* mark_buffer_dirty - mark a buffer_head as needing writeout
* @bh: the buffer_head to mark dirty
*
* mark_buffer_dirty() will set the dirty bit against the buffer, then set its
* backing page dirty, then tag the page as dirty in its address_space's radix
* tree and then attach the address_space's inode to its superblock's dirty
* inode list.
*
* mark_buffer_dirty() is atomic. It takes bh->b_page->mapping->private_lock,
* mapping->tree_lock and mapping->host->i_lock.
*/
void mark_buffer_dirty(struct buffer_head *bh)
{
WARN_ON_ONCE(!buffer_uptodate(bh));
trace_block_dirty_buffer(bh);
/*
* Very *carefully* optimize the it-is-already-dirty case.
*
* Don't let the final "is it dirty" escape to before we
* perhaps modified the buffer.
*/
if (buffer_dirty(bh)) {
smp_mb();
if (buffer_dirty(bh))
return;
}
if (!test_set_buffer_dirty(bh)) {
struct page *page = bh->b_page;
struct address_space *mapping = NULL;
struct mem_cgroup *memcg;
memcg = mem_cgroup_begin_page_stat(page);
if (!TestSetPageDirty(page)) {
mapping = page_mapping(page);
if (mapping)
__set_page_dirty(page, mapping, memcg, 0);
}
mem_cgroup_end_page_stat(memcg);
if (mapping)
__mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
}
}
EXPORT_SYMBOL(mark_buffer_dirty);
/*
* Decrement a buffer_head's reference count. If all buffers against a page
* have zero reference count, are clean and unlocked, and if the page is clean
* and unlocked then try_to_free_buffers() may strip the buffers from the page
* in preparation for freeing it (sometimes, rarely, buffers are removed from
* a page but it ends up not being freed, and buffers may later be reattached).
*/
void __brelse(struct buffer_head * buf)
{
if (atomic_read(&buf->b_count)) {
put_bh(buf);
return;
}
WARN(1, KERN_ERR "VFS: brelse: Trying to free free buffer\n");
}
EXPORT_SYMBOL(__brelse);
/*
* bforget() is like brelse(), except it discards any
* potentially dirty data.
*/
void __bforget(struct buffer_head *bh)
{
clear_buffer_dirty(bh);
if (bh->b_assoc_map) {
struct address_space *buffer_mapping = bh->b_page->mapping;
spin_lock(&buffer_mapping->private_lock);
list_del_init(&bh->b_assoc_buffers);
bh->b_assoc_map = NULL;
spin_unlock(&buffer_mapping->private_lock);
}
__brelse(bh);
}
EXPORT_SYMBOL(__bforget);
static struct buffer_head *__bread_slow(struct buffer_head *bh)
{
lock_buffer(bh);
if (buffer_uptodate(bh)) {
unlock_buffer(bh);
return bh;
} else {
get_bh(bh);
bh->b_end_io = end_buffer_read_sync;
submit_bh(READ, bh);
wait_on_buffer(bh);
if (buffer_uptodate(bh))
return bh;
}
brelse(bh);
return NULL;
}
/*
* Per-cpu buffer LRU implementation. To reduce the cost of __find_get_block().
* The bhs[] array is sorted - newest buffer is at bhs[0]. Buffers have their
* refcount elevated by one when they're in an LRU. A buffer can only appear
* once in a particular CPU's LRU. A single buffer can be present in multiple
* CPU's LRUs at the same time.
*
* This is a transparent caching front-end to sb_bread(), sb_getblk() and
* sb_find_get_block().
*
* The LRUs themselves only need locking against invalidate_bh_lrus. We use
* a local interrupt disable for that.
*/
#define BH_LRU_SIZE 16
struct bh_lru {
struct buffer_head *bhs[BH_LRU_SIZE];
};
static DEFINE_PER_CPU(struct bh_lru, bh_lrus) = {{ NULL }};
#ifdef CONFIG_SMP
#define bh_lru_lock() local_irq_disable()
#define bh_lru_unlock() local_irq_enable()
#else
#define bh_lru_lock() preempt_disable()
#define bh_lru_unlock() preempt_enable()
#endif
static inline void check_irqs_on(void)
{
#ifdef irqs_disabled
BUG_ON(irqs_disabled());
#endif
}
/*
* The LRU management algorithm is dopey-but-simple. Sorry.
*/
static void bh_lru_install(struct buffer_head *bh)
{
struct buffer_head *evictee = NULL;
check_irqs_on();
bh_lru_lock();
if (__this_cpu_read(bh_lrus.bhs[0]) != bh) {
struct buffer_head *bhs[BH_LRU_SIZE];
int in;
int out = 0;
get_bh(bh);
bhs[out++] = bh;
for (in = 0; in < BH_LRU_SIZE; in++) {
struct buffer_head *bh2 =
__this_cpu_read(bh_lrus.bhs[in]);
if (bh2 == bh) {
__brelse(bh2);
} else {
if (out >= BH_LRU_SIZE) {
BUG_ON(evictee != NULL);
evictee = bh2;
} else {
bhs[out++] = bh2;
}
}
}
while (out < BH_LRU_SIZE)
bhs[out++] = NULL;
memcpy(this_cpu_ptr(&bh_lrus.bhs), bhs, sizeof(bhs));
}
bh_lru_unlock();
if (evictee)
__brelse(evictee);
}
/*
* Look up the bh in this cpu's LRU. If it's there, move it to the head.
*/
static struct buffer_head *
lookup_bh_lru(struct block_device *bdev, sector_t block, unsigned size)
{
struct buffer_head *ret = NULL;
unsigned int i;
check_irqs_on();
bh_lru_lock();
for (i = 0; i < BH_LRU_SIZE; i++) {
struct buffer_head *bh = __this_cpu_read(bh_lrus.bhs[i]);
if (bh && bh->b_blocknr == block && bh->b_bdev == bdev &&
bh->b_size == size) {
if (i) {
while (i) {
__this_cpu_write(bh_lrus.bhs[i],
__this_cpu_read(bh_lrus.bhs[i - 1]));
i--;
}
__this_cpu_write(bh_lrus.bhs[0], bh);
}
get_bh(bh);
ret = bh;
break;
}
}
bh_lru_unlock();
return ret;
}
/*
* Perform a pagecache lookup for the matching buffer. If it's there, refresh
* it in the LRU and mark it as accessed. If it is not present then return
* NULL
*/
struct buffer_head *
__find_get_block(struct block_device *bdev, sector_t block, unsigned size)
{
struct buffer_head *bh = lookup_bh_lru(bdev, block, size);
if (bh == NULL) {
/* __find_get_block_slow will mark the page accessed */
bh = __find_get_block_slow(bdev, block);
if (bh)
bh_lru_install(bh);
} else
touch_buffer(bh);
return bh;
}
EXPORT_SYMBOL(__find_get_block);
/*
* __getblk_gfp() will locate (and, if necessary, create) the buffer_head
* which corresponds to the passed block_device, block and size. The
* returned buffer has its reference count incremented.
*
* __getblk_gfp() will lock up the machine if grow_dev_page's
* try_to_free_buffers() attempt is failing. FIXME, perhaps?
*/
struct buffer_head *
__getblk_gfp(struct block_device *bdev, sector_t block,
unsigned size, gfp_t gfp)
{
struct buffer_head *bh = __find_get_block(bdev, block, size);
might_sleep();
if (bh == NULL)
bh = __getblk_slow(bdev, block, size, gfp);
return bh;
}
EXPORT_SYMBOL(__getblk_gfp);
/*
* Do async read-ahead on a buffer..
*/
void __breadahead(struct block_device *bdev, sector_t block, unsigned size)
{
struct buffer_head *bh = __getblk(bdev, block, size);
if (likely(bh)) {
ll_rw_block(READA, 1, &bh);
brelse(bh);
}
}
EXPORT_SYMBOL(__breadahead);
/**
* __bread_gfp() - reads a specified block and returns the bh
* @bdev: the block_device to read from
* @block: number of block
* @size: size (in bytes) to read
* @gfp: page allocation flag
*
* Reads a specified block, and returns buffer head that contains it.
* The page cache can be allocated from non-movable area
* not to prevent page migration if you set gfp to zero.
* It returns NULL if the block was unreadable.
*/
struct buffer_head *
__bread_gfp(struct block_device *bdev, sector_t block,
unsigned size, gfp_t gfp)
{
struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp);
if (likely(bh) && !buffer_uptodate(bh))
bh = __bread_slow(bh);
return bh;
}
EXPORT_SYMBOL(__bread_gfp);
/*
* invalidate_bh_lrus() is called rarely - but not only at unmount.
* This doesn't race because it runs in each cpu either in irq
* or with preempt disabled.
*/
static void invalidate_bh_lru(void *arg)
{
struct bh_lru *b = &get_cpu_var(bh_lrus);
int i;
for (i = 0; i < BH_LRU_SIZE; i++) {
brelse(b->bhs[i]);
b->bhs[i] = NULL;
}
put_cpu_var(bh_lrus);
}
static bool has_bh_in_lru(int cpu, void *dummy)
{
struct bh_lru *b = per_cpu_ptr(&bh_lrus, cpu);
int i;
for (i = 0; i < BH_LRU_SIZE; i++) {
if (b->bhs[i])
return 1;
}
return 0;
}
static void __evict_bh_lru(void *arg)
{
struct bh_lru *b = &get_cpu_var(bh_lrus);
struct buffer_head *bh = arg;
int i;
for (i = 0; i < BH_LRU_SIZE; i++) {
if (b->bhs[i] == bh) {
brelse(b->bhs[i]);
b->bhs[i] = NULL;
goto out;
}
}
out:
put_cpu_var(bh_lrus);
}
static bool bh_exists_in_lru(int cpu, void *arg)
{
struct bh_lru *b = per_cpu_ptr(&bh_lrus, cpu);
struct buffer_head *bh = arg;
int i;
for (i = 0; i < BH_LRU_SIZE; i++) {
if (b->bhs[i] == bh)
return 1;
}
return 0;
}
void invalidate_bh_lrus(void)
{
on_each_cpu_cond(has_bh_in_lru, invalidate_bh_lru, NULL, 1, GFP_KERNEL);
}
EXPORT_SYMBOL_GPL(invalidate_bh_lrus);
static void evict_bh_lrus(struct buffer_head *bh)
{
on_each_cpu_cond(bh_exists_in_lru, __evict_bh_lru, bh, 1, GFP_ATOMIC);
}
void set_bh_page(struct buffer_head *bh,
struct page *page, unsigned long offset)
{
bh->b_page = page;
BUG_ON(offset >= PAGE_SIZE);
if (PageHighMem(page))
/*
* This catches illegal uses and preserves the offset:
*/
bh->b_data = (char *)(0 + offset);
else
bh->b_data = page_address(page) + offset;
}
EXPORT_SYMBOL(set_bh_page);
/*
* Called when truncating a buffer on a page completely.
*/
/* Bits that are cleared during an invalidate */
#define BUFFER_FLAGS_DISCARD \
(1 << BH_Mapped | 1 << BH_New | 1 << BH_Req | \
1 << BH_Delay | 1 << BH_Unwritten)
static void discard_buffer(struct buffer_head * bh)
{
unsigned long b_state, b_state_old;
lock_buffer(bh);
clear_buffer_dirty(bh);
bh->b_bdev = NULL;
b_state = bh->b_state;
for (;;) {
b_state_old = cmpxchg(&bh->b_state, b_state,
(b_state & ~BUFFER_FLAGS_DISCARD));
if (b_state_old == b_state)
break;
b_state = b_state_old;
}
unlock_buffer(bh);
}
/**
* block_invalidatepage - invalidate part or all of a buffer-backed page
*
* @page: the page which is affected
* @offset: start of the range to invalidate
* @length: length of the range to invalidate
*
* block_invalidatepage() is called when all or part of the page has become
* invalidated by a truncate operation.
*
* block_invalidatepage() does not have to release all buffers, but it must
* ensure that no dirty buffer is left outside @offset and that no I/O
* is underway against any of the blocks which are outside the truncation
* point. Because the caller is about to free (and possibly reuse) those
* blocks on-disk.
*/
void block_invalidatepage(struct page *page, unsigned int offset,
unsigned int length)
{
struct buffer_head *head, *bh, *next;
unsigned int curr_off = 0;
unsigned int stop = length + offset;
BUG_ON(!PageLocked(page));
if (!page_has_buffers(page))
goto out;
/*
* Check for overflow
*/
BUG_ON(stop > PAGE_CACHE_SIZE || stop < length);
head = page_buffers(page);
bh = head;
do {
unsigned int next_off = curr_off + bh->b_size;
next = bh->b_this_page;
/*
* Are we still fully in range ?
*/
if (next_off > stop)
goto out;
/*
* is this block fully invalidated?
*/
if (offset <= curr_off)
discard_buffer(bh);
curr_off = next_off;
bh = next;
} while (bh != head);
/*
* We release buffers only if the entire page is being invalidated.
* The get_block cached value has been unconditionally invalidated,
* so real IO is not possible anymore.
*/
if (offset == 0)
try_to_release_page(page, 0);
out:
return;
}
EXPORT_SYMBOL(block_invalidatepage);
/*
* We attach and possibly dirty the buffers atomically wrt
* __set_page_dirty_buffers() via private_lock. try_to_free_buffers
* is already excluded via the page lock.
*/
void create_empty_buffers(struct page *page,
unsigned long blocksize, unsigned long b_state)
{
struct buffer_head *bh, *head, *tail;
head = alloc_page_buffers(page, blocksize, 1);
bh = head;
do {
bh->b_state |= b_state;
tail = bh;
bh = bh->b_this_page;
} while (bh);
tail->b_this_page = head;
spin_lock(&page->mapping->private_lock);
if (PageUptodate(page) || PageDirty(page)) {
bh = head;
do {
if (PageDirty(page))
set_buffer_dirty(bh);
if (PageUptodate(page))
set_buffer_uptodate(bh);
bh = bh->b_this_page;
} while (bh != head);
}
attach_page_buffers(page, head);
spin_unlock(&page->mapping->private_lock);
}
EXPORT_SYMBOL(create_empty_buffers);
/*
* We are taking a block for data and we don't want any output from any
* buffer-cache aliases starting from return from that function and
* until the moment when something will explicitly mark the buffer
* dirty (hopefully that will not happen until we will free that block ;-)
* We don't even need to mark it not-uptodate - nobody can expect
* anything from a newly allocated buffer anyway. We used to used
* unmap_buffer() for such invalidation, but that was wrong. We definitely
* don't want to mark the alias unmapped, for example - it would confuse
* anyone who might pick it with bread() afterwards...
*
* Also.. Note that bforget() doesn't lock the buffer. So there can
* be writeout I/O going on against recently-freed buffers. We don't
* wait on that I/O in bforget() - it's more efficient to wait on the I/O
* only if we really need to. That happens here.
*/
void unmap_underlying_metadata(struct block_device *bdev, sector_t block)
{
struct buffer_head *old_bh;
might_sleep();
old_bh = __find_get_block_slow(bdev, block);
if (old_bh) {
clear_buffer_dirty(old_bh);
wait_on_buffer(old_bh);
clear_buffer_req(old_bh);
__brelse(old_bh);
}
}
EXPORT_SYMBOL(unmap_underlying_metadata);
/*
* Size is a power-of-two in the range 512..PAGE_SIZE,
* and the case we care about most is PAGE_SIZE.
*
* So this *could* possibly be written with those
* constraints in mind (relevant mostly if some
* architecture has a slow bit-scan instruction)
*/
static inline int block_size_bits(unsigned int blocksize)
{
return ilog2(blocksize);
}
static struct buffer_head *create_page_buffers(struct page *page, struct inode *inode, unsigned int b_state)
{
BUG_ON(!PageLocked(page));
if (!page_has_buffers(page))
create_empty_buffers(page, 1 << ACCESS_ONCE(inode->i_blkbits), b_state);
return page_buffers(page);
}
/*
* NOTE! All mapped/uptodate combinations are valid:
*
* Mapped Uptodate Meaning
*
* No No "unknown" - must do get_block()
* No Yes "hole" - zero-filled
* Yes No "allocated" - allocated on disk, not read in
* Yes Yes "valid" - allocated and up-to-date in memory.
*
* "Dirty" is valid only with the last case (mapped+uptodate).
*/
/*
* While block_write_full_page is writing back the dirty buffers under
* the page lock, whoever dirtied the buffers may decide to clean them
* again at any time. We handle that by only looking at the buffer
* state inside lock_buffer().
*
* If block_write_full_page() is called for regular writeback
* (wbc->sync_mode == WB_SYNC_NONE) then it will redirty a page which has a
* locked buffer. This only can happen if someone has written the buffer
* directly, with submit_bh(). At the address_space level PageWriteback
* prevents this contention from occurring.
*
* If block_write_full_page() is called with wbc->sync_mode ==
* WB_SYNC_ALL, the writes are posted using WRITE_SYNC; this
* causes the writes to be flagged as synchronous writes.
*/
static int __block_write_full_page(struct inode *inode, struct page *page,
get_block_t *get_block, struct writeback_control *wbc,
bh_end_io_t *handler)
{
int err;
sector_t block;
sector_t last_block;
struct buffer_head *bh, *head;
unsigned int blocksize, bbits;
int nr_underway = 0;
int write_op = (wbc->sync_mode == WB_SYNC_ALL ? WRITE_SYNC : WRITE);
head = create_page_buffers(page, inode,
(1 << BH_Dirty)|(1 << BH_Uptodate));
/*
* Be very careful. We have no exclusion from __set_page_dirty_buffers
* here, and the (potentially unmapped) buffers may become dirty at
* any time. If a buffer becomes dirty here after we've inspected it
* then we just miss that fact, and the page stays dirty.
*
* Buffers outside i_size may be dirtied by __set_page_dirty_buffers;
* handle that here by just cleaning them.
*/
bh = head;
blocksize = bh->b_size;
bbits = block_size_bits(blocksize);
block = (sector_t)page->index << (PAGE_CACHE_SHIFT - bbits);
last_block = (i_size_read(inode) - 1) >> bbits;
/*
* Get all the dirty buffers mapped to disk addresses and
* handle any aliases from the underlying blockdev's mapping.
*/
do {
if (block > last_block) {
/*
* mapped buffers outside i_size will occur, because
* this page can be outside i_size when there is a
* truncate in progress.
*/
/*
* The buffer was zeroed by block_write_full_page()
*/
clear_buffer_dirty(bh);
set_buffer_uptodate(bh);
} else if ((!buffer_mapped(bh) || buffer_delay(bh)) &&
buffer_dirty(bh)) {
WARN_ON(bh->b_size != blocksize);
err = get_block(inode, block, bh, 1);
if (err)
goto recover;
clear_buffer_delay(bh);
if (buffer_new(bh)) {
/* blockdev mappings never come here */
clear_buffer_new(bh);
unmap_underlying_metadata(bh->b_bdev,
bh->b_blocknr);
}
}
bh = bh->b_this_page;
block++;
} while (bh != head);
do {
if (!buffer_mapped(bh))
continue;
/*
* If it's a fully non-blocking write attempt and we cannot
* lock the buffer then redirty the page. Note that this can
* potentially cause a busy-wait loop from writeback threads
* and kswapd activity, but those code paths have their own
* higher-level throttling.
*/
if (wbc->sync_mode != WB_SYNC_NONE) {
lock_buffer(bh);
} else if (!trylock_buffer(bh)) {
redirty_page_for_writepage(wbc, page);
continue;
}
if (test_clear_buffer_dirty(bh)) {
mark_buffer_async_write_endio(bh, handler);
} else {
unlock_buffer(bh);
}
} while ((bh = bh->b_this_page) != head);
/*
* The page and its buffers are protected by PageWriteback(), so we can
* drop the bh refcounts early.
*/
BUG_ON(PageWriteback(page));
set_page_writeback(page);
do {
struct buffer_head *next = bh->b_this_page;
if (buffer_async_write(bh)) {
submit_bh_wbc(write_op, bh, 0, wbc);
nr_underway++;
}
bh = next;
} while (bh != head);
unlock_page(page);
err = 0;
done:
if (nr_underway == 0) {
/*
* The page was marked dirty, but the buffers were
* clean. Someone wrote them back by hand with
* ll_rw_block/submit_bh. A rare case.
*/
end_page_writeback(page);
/*
* The page and buffer_heads can be released at any time from
* here on.
*/
}
return err;
recover:
/*
* ENOSPC, or some other error. We may already have added some
* blocks to the file, so we need to write these out to avoid
* exposing stale data.
* The page is currently locked and not marked for writeback
*/
bh = head;
/* Recovery: lock and submit the mapped buffers */
do {
if (buffer_mapped(bh) && buffer_dirty(bh) &&
!buffer_delay(bh)) {
lock_buffer(bh);
mark_buffer_async_write_endio(bh, handler);
} else {
/*
* The buffer may have been set dirty during
* attachment to a dirty page.
*/
clear_buffer_dirty(bh);
}
} while ((bh = bh->b_this_page) != head);
SetPageError(page);
BUG_ON(PageWriteback(page));
mapping_set_error(page->mapping, err);
set_page_writeback(page);
do {
struct buffer_head *next = bh->b_this_page;
if (buffer_async_write(bh)) {
clear_buffer_dirty(bh);
submit_bh_wbc(write_op, bh, 0, wbc);
nr_underway++;
}
bh = next;
} while (bh != head);
unlock_page(page);
goto done;
}
/*
* If a page has any new buffers, zero them out here, and mark them uptodate
* and dirty so they'll be written out (in order to prevent uninitialised
* block data from leaking). And clear the new bit.
*/
void page_zero_new_buffers(struct page *page, unsigned from, unsigned to)
{
unsigned int block_start, block_end;
struct buffer_head *head, *bh;
BUG_ON(!PageLocked(page));
if (!page_has_buffers(page))
return;
bh = head = page_buffers(page);
block_start = 0;
do {
block_end = block_start + bh->b_size;
if (buffer_new(bh)) {
if (block_end > from && block_start < to) {
if (!PageUptodate(page)) {
unsigned start, size;
start = max(from, block_start);
size = min(to, block_end) - start;
zero_user(page, start, size);
set_buffer_uptodate(bh);
}
clear_buffer_new(bh);
mark_buffer_dirty(bh);
}
}
block_start = block_end;
bh = bh->b_this_page;
} while (bh != head);
}
EXPORT_SYMBOL(page_zero_new_buffers);
int __block_write_begin(struct page *page, loff_t pos, unsigned len,
get_block_t *get_block)
{
unsigned from = pos & (PAGE_CACHE_SIZE - 1);
unsigned to = from + len;
struct inode *inode = page->mapping->host;
unsigned block_start, block_end;
sector_t block;
int err = 0;
unsigned blocksize, bbits;
struct buffer_head *bh, *head, *wait[2], **wait_bh=wait;
BUG_ON(!PageLocked(page));
BUG_ON(from > PAGE_CACHE_SIZE);
BUG_ON(to > PAGE_CACHE_SIZE);
BUG_ON(from > to);
head = create_page_buffers(page, inode, 0);
blocksize = head->b_size;
bbits = block_size_bits(blocksize);
block = (sector_t)page->index << (PAGE_CACHE_SHIFT - bbits);
for(bh = head, block_start = 0; bh != head || !block_start;
block++, block_start=block_end, bh = bh->b_this_page) {
block_end = block_start + blocksize;
if (block_end <= from || block_start >= to) {
if (PageUptodate(page)) {
if (!buffer_uptodate(bh))
set_buffer_uptodate(bh);
}
continue;
}
if (buffer_new(bh))
clear_buffer_new(bh);
if (!buffer_mapped(bh)) {
WARN_ON(bh->b_size != blocksize);
err = get_block(inode, block, bh, 1);
if (err)
break;
if (buffer_new(bh)) {
unmap_underlying_metadata(bh->b_bdev,
bh->b_blocknr);
if (PageUptodate(page)) {
clear_buffer_new(bh);
set_buffer_uptodate(bh);
mark_buffer_dirty(bh);
continue;
}
if (block_end > to || block_start < from)
zero_user_segments(page,
to, block_end,
block_start, from);
continue;
}
}
if (PageUptodate(page)) {
if (!buffer_uptodate(bh))
set_buffer_uptodate(bh);
continue;
}
if (!buffer_uptodate(bh) && !buffer_delay(bh) &&
!buffer_unwritten(bh) &&
(block_start < from || block_end > to)) {
ll_rw_block(READ, 1, &bh);
*wait_bh++=bh;
}
}
/*
* If we issued read requests - let them complete.
*/
while(wait_bh > wait) {
wait_on_buffer(*--wait_bh);
if (!buffer_uptodate(*wait_bh))
err = -EIO;
}
if (unlikely(err))
page_zero_new_buffers(page, from, to);
return err;
}
EXPORT_SYMBOL(__block_write_begin);
static int __block_commit_write(struct inode *inode, struct page *page,
unsigned from, unsigned to)
{
unsigned block_start, block_end;
int partial = 0;
unsigned blocksize;
struct buffer_head *bh, *head;
bh = head = page_buffers(page);
blocksize = bh->b_size;
block_start = 0;
do {
block_end = block_start + blocksize;
if (block_end <= from || block_start >= to) {
if (!buffer_uptodate(bh))
partial = 1;
} else {
set_buffer_uptodate(bh);
mark_buffer_dirty(bh);
}
clear_buffer_new(bh);
block_start = block_end;
bh = bh->b_this_page;
} while (bh != head);
/*
* If this is a partial write which happened to make all buffers
* uptodate then we can optimize away a bogus readpage() for
* the next read(). Here we 'discover' whether the page went
* uptodate as a result of this (potentially partial) write.
*/
if (!partial)
SetPageUptodate(page);
return 0;
}
/*
* block_write_begin takes care of the basic task of block allocation and
* bringing partial write blocks uptodate first.
*
* The filesystem needs to handle block truncation upon failure.
*/
int block_write_begin(struct address_space *mapping, loff_t pos, unsigned len,
unsigned flags, struct page **pagep, get_block_t *get_block)
{
pgoff_t index = pos >> PAGE_CACHE_SHIFT;
struct page *page;
int status;
page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
status = __block_write_begin(page, pos, len, get_block);
if (unlikely(status)) {
unlock_page(page);
page_cache_release(page);
page = NULL;
}
*pagep = page;
return status;
}
EXPORT_SYMBOL(block_write_begin);
int block_write_end(struct file *file, struct address_space *mapping,
loff_t pos, unsigned len, unsigned copied,
struct page *page, void *fsdata)
{
struct inode *inode = mapping->host;
unsigned start;
start = pos & (PAGE_CACHE_SIZE - 1);
if (unlikely(copied < len)) {
/*
* The buffers that were written will now be uptodate, so we
* don't have to worry about a readpage reading them and
* overwriting a partial write. However if we have encountered
* a short write and only partially written into a buffer, it
* will not be marked uptodate, so a readpage might come in and
* destroy our partial write.
*
* Do the simplest thing, and just treat any short write to a
* non uptodate page as a zero-length write, and force the
* caller to redo the whole thing.
*/
if (!PageUptodate(page))
copied = 0;
page_zero_new_buffers(page, start+copied, start+len);
}
flush_dcache_page(page);
/* This could be a short (even 0-length) commit */
__block_commit_write(inode, page, start, start+copied);
return copied;
}
EXPORT_SYMBOL(block_write_end);
int generic_write_end(struct file *file, struct address_space *mapping,
loff_t pos, unsigned len, unsigned copied,
struct page *page, void *fsdata)
{
struct inode *inode = mapping->host;
loff_t old_size = inode->i_size;
int i_size_changed = 0;
copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
/*
* No need to use i_size_read() here, the i_size
* cannot change under us because we hold i_mutex.
*
* But it's important to update i_size while still holding page lock:
* page writeout could otherwise come in and zero beyond i_size.
*/
if (pos+copied > inode->i_size) {
i_size_write(inode, pos+copied);
i_size_changed = 1;
}
unlock_page(page);
page_cache_release(page);
if (old_size < pos)
pagecache_isize_extended(inode, old_size, pos);
/*
* Don't mark the inode dirty under page lock. First, it unnecessarily
* makes the holding time of page lock longer. Second, it forces lock
* ordering of page lock and transaction start for journaling
* filesystems.
*/
if (i_size_changed)
mark_inode_dirty(inode);
return copied;
}
EXPORT_SYMBOL(generic_write_end);
/*
* block_is_partially_uptodate checks whether buffers within a page are
* uptodate or not.
*
* Returns true if all buffers which correspond to a file portion
* we want to read are uptodate.
*/
int block_is_partially_uptodate(struct page *page, unsigned long from,
unsigned long count)
{
unsigned block_start, block_end, blocksize;
unsigned to;
struct buffer_head *bh, *head;
int ret = 1;
if (!page_has_buffers(page))
return 0;
head = page_buffers(page);
blocksize = head->b_size;
to = min_t(unsigned, PAGE_CACHE_SIZE - from, count);
to = from + to;
if (from < blocksize && to > PAGE_CACHE_SIZE - blocksize)
return 0;
bh = head;
block_start = 0;
do {
block_end = block_start + blocksize;
if (block_end > from && block_start < to) {
if (!buffer_uptodate(bh)) {
ret = 0;
break;
}
if (block_end >= to)
break;
}
block_start = block_end;
bh = bh->b_this_page;
} while (bh != head);
return ret;
}
EXPORT_SYMBOL(block_is_partially_uptodate);
/*
* Generic "read page" function for block devices that have the normal
* get_block functionality. This is most of the block device filesystems.
* Reads the page asynchronously --- the unlock_buffer() and
* set/clear_buffer_uptodate() functions propagate buffer state into the
* page struct once IO has completed.
*/
int block_read_full_page(struct page *page, get_block_t *get_block)
{
struct inode *inode = page->mapping->host;
sector_t iblock, lblock;
struct buffer_head *bh, *head, *arr[MAX_BUF_PER_PAGE];
unsigned int blocksize, bbits;
int nr, i;
int fully_mapped = 1;
head = create_page_buffers(page, inode, 0);
blocksize = head->b_size;
bbits = block_size_bits(blocksize);
iblock = (sector_t)page->index << (PAGE_CACHE_SHIFT - bbits);
lblock = (i_size_read(inode)+blocksize-1) >> bbits;
bh = head;
nr = 0;
i = 0;
do {
if (buffer_uptodate(bh))
continue;
if (!buffer_mapped(bh)) {
int err = 0;
fully_mapped = 0;
if (iblock < lblock) {
WARN_ON(bh->b_size != blocksize);
err = get_block(inode, iblock, bh, 0);
if (err)
SetPageError(page);
}
if (!buffer_mapped(bh)) {
zero_user(page, i * blocksize, blocksize);
if (!err)
set_buffer_uptodate(bh);
continue;
}
/*
* get_block() might have updated the buffer
* synchronously
*/
if (buffer_uptodate(bh))
continue;
}
arr[nr++] = bh;
} while (i++, iblock++, (bh = bh->b_this_page) != head);
if (fully_mapped)
SetPageMappedToDisk(page);
if (!nr) {
/*
* All buffers are uptodate - we can set the page uptodate
* as well. But not if get_block() returned an error.
*/
if (!PageError(page))
SetPageUptodate(page);
unlock_page(page);
return 0;
}
/* Stage two: lock the buffers */
for (i = 0; i < nr; i++) {
bh = arr[i];
lock_buffer(bh);
mark_buffer_async_read(bh);
}
/*
* Stage 3: start the IO. Check for uptodateness
* inside the buffer lock in case another process reading
* the underlying blockdev brought it uptodate (the sct fix).
*/
for (i = 0; i < nr; i++) {
bh = arr[i];
if (buffer_uptodate(bh))
end_buffer_async_read(bh, 1);
else
submit_bh(READ, bh);
}
return 0;
}
EXPORT_SYMBOL(block_read_full_page);
/* utility function for filesystems that need to do work on expanding
* truncates. Uses filesystem pagecache writes to allow the filesystem to
* deal with the hole.
*/
int generic_cont_expand_simple(struct inode *inode, loff_t size)
{
struct address_space *mapping = inode->i_mapping;
struct page *page;
void *fsdata;
int err;
err = inode_newsize_ok(inode, size);
if (err)
goto out;
err = pagecache_write_begin(NULL, mapping, size, 0,
AOP_FLAG_UNINTERRUPTIBLE|AOP_FLAG_CONT_EXPAND,
&page, &fsdata);
if (err)
goto out;
err = pagecache_write_end(NULL, mapping, size, 0, 0, page, fsdata);
BUG_ON(err > 0);
out:
return err;
}
EXPORT_SYMBOL(generic_cont_expand_simple);
static int cont_expand_zero(struct file *file, struct address_space *mapping,
loff_t pos, loff_t *bytes)
{
struct inode *inode = mapping->host;
unsigned int blocksize = i_blocksize(inode);
struct page *page;
void *fsdata;
pgoff_t index, curidx;
loff_t curpos;
unsigned zerofrom, offset, len;
int err = 0;
index = pos >> PAGE_CACHE_SHIFT;
offset = pos & ~PAGE_CACHE_MASK;
while (index > (curidx = (curpos = *bytes)>>PAGE_CACHE_SHIFT)) {
zerofrom = curpos & ~PAGE_CACHE_MASK;
if (zerofrom & (blocksize-1)) {
*bytes |= (blocksize-1);
(*bytes)++;
}
len = PAGE_CACHE_SIZE - zerofrom;
err = pagecache_write_begin(file, mapping, curpos, len,
AOP_FLAG_UNINTERRUPTIBLE,
&page, &fsdata);
if (err)
goto out;
zero_user(page, zerofrom, len);
err = pagecache_write_end(file, mapping, curpos, len, len,
page, fsdata);
if (err < 0)
goto out;
BUG_ON(err != len);
err = 0;
balance_dirty_pages_ratelimited(mapping);
if (unlikely(fatal_signal_pending(current))) {
err = -EINTR;
goto out;
}
}
/* page covers the boundary, find the boundary offset */
if (index == curidx) {
zerofrom = curpos & ~PAGE_CACHE_MASK;
/* if we will expand the thing last block will be filled */
if (offset <= zerofrom) {
goto out;
}
if (zerofrom & (blocksize-1)) {
*bytes |= (blocksize-1);
(*bytes)++;
}
len = offset - zerofrom;
err = pagecache_write_begin(file, mapping, curpos, len,
AOP_FLAG_UNINTERRUPTIBLE,
&page, &fsdata);
if (err)
goto out;
zero_user(page, zerofrom, len);
err = pagecache_write_end(file, mapping, curpos, len, len,
page, fsdata);
if (err < 0)
goto out;
BUG_ON(err != len);
err = 0;
}
out:
return err;
}
/*
* For moronic filesystems that do not allow holes in file.
* We may have to extend the file.
*/
int cont_write_begin(struct file *file, struct address_space *mapping,
loff_t pos, unsigned len, unsigned flags,
struct page **pagep, void **fsdata,
get_block_t *get_block, loff_t *bytes)
{
struct inode *inode = mapping->host;
unsigned int blocksize = i_blocksize(inode);
unsigned int zerofrom;
int err;
err = cont_expand_zero(file, mapping, pos, bytes);
if (err)
return err;
zerofrom = *bytes & ~PAGE_CACHE_MASK;
if (pos+len > *bytes && zerofrom & (blocksize-1)) {
*bytes |= (blocksize-1);
(*bytes)++;
}
return block_write_begin(mapping, pos, len, flags, pagep, get_block);
}
EXPORT_SYMBOL(cont_write_begin);
int block_commit_write(struct page *page, unsigned from, unsigned to)
{
struct inode *inode = page->mapping->host;
__block_commit_write(inode,page,from,to);
return 0;
}
EXPORT_SYMBOL(block_commit_write);
/*
* block_page_mkwrite() is not allowed to change the file size as it gets
* called from a page fault handler when a page is first dirtied. Hence we must
* be careful to check for EOF conditions here. We set the page up correctly
* for a written page which means we get ENOSPC checking when writing into
* holes and correct delalloc and unwritten extent mapping on filesystems that
* support these features.
*
* We are not allowed to take the i_mutex here so we have to play games to
* protect against truncate races as the page could now be beyond EOF. Because
* truncate writes the inode size before removing pages, once we have the
* page lock we can determine safely if the page is beyond EOF. If it is not
* beyond EOF, then the page is guaranteed safe against truncation until we
* unlock the page.
*
* Direct callers of this function should protect against filesystem freezing
* using sb_start_pagefault() - sb_end_pagefault() functions.
*/
int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
get_block_t get_block)
{
struct page *page = vmf->page;
struct inode *inode = file_inode(vma->vm_file);
unsigned long end;
loff_t size;
int ret;
lock_page(page);
size = i_size_read(inode);
if ((page->mapping != inode->i_mapping) ||
(page_offset(page) > size)) {
/* We overload EFAULT to mean page got truncated */
ret = -EFAULT;
goto out_unlock;
}
/* page is wholly or partially inside EOF */
if (((page->index + 1) << PAGE_CACHE_SHIFT) > size)
end = size & ~PAGE_CACHE_MASK;
else
end = PAGE_CACHE_SIZE;
ret = __block_write_begin(page, 0, end, get_block);
if (!ret)
ret = block_commit_write(page, 0, end);
if (unlikely(ret < 0))
goto out_unlock;
set_page_dirty(page);
wait_for_stable_page(page);
return 0;
out_unlock:
unlock_page(page);
return ret;
}
EXPORT_SYMBOL(block_page_mkwrite);
/*
* nobh_write_begin()'s prereads are special: the buffer_heads are freed
* immediately, while under the page lock. So it needs a special end_io
* handler which does not touch the bh after unlocking it.
*/
static void end_buffer_read_nobh(struct buffer_head *bh, int uptodate)
{
__end_buffer_read_notouch(bh, uptodate);
}
/*
* Attach the singly-linked list of buffers created by nobh_write_begin, to
* the page (converting it to circular linked list and taking care of page
* dirty races).
*/
static void attach_nobh_buffers(struct page *page, struct buffer_head *head)
{
struct buffer_head *bh;
BUG_ON(!PageLocked(page));
spin_lock(&page->mapping->private_lock);
bh = head;
do {
if (PageDirty(page))
set_buffer_dirty(bh);
if (!bh->b_this_page)
bh->b_this_page = head;
bh = bh->b_this_page;
} while (bh != head);
attach_page_buffers(page, head);
spin_unlock(&page->mapping->private_lock);
}
/*
* On entry, the page is fully not uptodate.
* On exit the page is fully uptodate in the areas outside (from,to)
* The filesystem needs to handle block truncation upon failure.
*/
int nobh_write_begin(struct address_space *mapping,
loff_t pos, unsigned len, unsigned flags,
struct page **pagep, void **fsdata,
get_block_t *get_block)
{
struct inode *inode = mapping->host;
const unsigned blkbits = inode->i_blkbits;
const unsigned blocksize = 1 << blkbits;
struct buffer_head *head, *bh;
struct page *page;
pgoff_t index;
unsigned from, to;
unsigned block_in_page;
unsigned block_start, block_end;
sector_t block_in_file;
int nr_reads = 0;
int ret = 0;
int is_mapped_to_disk = 1;
index = pos >> PAGE_CACHE_SHIFT;
from = pos & (PAGE_CACHE_SIZE - 1);
to = from + len;
page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
*fsdata = NULL;
if (page_has_buffers(page)) {
ret = __block_write_begin(page, pos, len, get_block);
if (unlikely(ret))
goto out_release;
return ret;
}
if (PageMappedToDisk(page))
return 0;
/*
* Allocate buffers so that we can keep track of state, and potentially
* attach them to the page if an error occurs. In the common case of
* no error, they will just be freed again without ever being attached
* to the page (which is all OK, because we're under the page lock).
*
* Be careful: the buffer linked list is a NULL terminated one, rather
* than the circular one we're used to.
*/
head = alloc_page_buffers(page, blocksize, 0);
if (!head) {
ret = -ENOMEM;
goto out_release;
}
block_in_file = (sector_t)page->index << (PAGE_CACHE_SHIFT - blkbits);
/*
* We loop across all blocks in the page, whether or not they are
* part of the affected region. This is so we can discover if the
* page is fully mapped-to-disk.
*/
for (block_start = 0, block_in_page = 0, bh = head;
block_start < PAGE_CACHE_SIZE;
block_in_page++, block_start += blocksize, bh = bh->b_this_page) {
int create;
block_end = block_start + blocksize;
bh->b_state = 0;
create = 1;
if (block_start >= to)
create = 0;
ret = get_block(inode, block_in_file + block_in_page,
bh, create);
if (ret)
goto failed;
if (!buffer_mapped(bh))
is_mapped_to_disk = 0;
if (buffer_new(bh))
unmap_underlying_metadata(bh->b_bdev, bh->b_blocknr);
if (PageUptodate(page)) {
set_buffer_uptodate(bh);
continue;
}
if (buffer_new(bh) || !buffer_mapped(bh)) {
zero_user_segments(page, block_start, from,
to, block_end);
continue;
}
if (buffer_uptodate(bh))
continue; /* reiserfs does this */
if (block_start < from || block_end > to) {
lock_buffer(bh);
bh->b_end_io = end_buffer_read_nobh;
submit_bh(READ, bh);
nr_reads++;
}
}
if (nr_reads) {
/*
* The page is locked, so these buffers are protected from
* any VM or truncate activity. Hence we don't need to care
* for the buffer_head refcounts.
*/
for (bh = head; bh; bh = bh->b_this_page) {
wait_on_buffer(bh);
if (!buffer_uptodate(bh))
ret = -EIO;
}
if (ret)
goto failed;
}
if (is_mapped_to_disk)
SetPageMappedToDisk(page);
*fsdata = head; /* to be released by nobh_write_end */
return 0;
failed:
BUG_ON(!ret);
/*
* Error recovery is a bit difficult. We need to zero out blocks that
* were newly allocated, and dirty them to ensure they get written out.
* Buffers need to be attached to the page at this point, otherwise
* the handling of potential IO errors during writeout would be hard
* (could try doing synchronous writeout, but what if that fails too?)
*/
attach_nobh_buffers(page, head);
page_zero_new_buffers(page, from, to);
out_release:
unlock_page(page);
page_cache_release(page);
*pagep = NULL;
return ret;
}
EXPORT_SYMBOL(nobh_write_begin);
int nobh_write_end(struct file *file, struct address_space *mapping,
loff_t pos, unsigned len, unsigned copied,
struct page *page, void *fsdata)
{
struct inode *inode = page->mapping->host;
struct buffer_head *head = fsdata;
struct buffer_head *bh;
BUG_ON(fsdata != NULL && page_has_buffers(page));
if (unlikely(copied < len) && head)
attach_nobh_buffers(page, head);
if (page_has_buffers(page))
return generic_write_end(file, mapping, pos, len,
copied, page, fsdata);
SetPageUptodate(page);
set_page_dirty(page);
if (pos+copied > inode->i_size) {
i_size_write(inode, pos+copied);
mark_inode_dirty(inode);
}
unlock_page(page);
page_cache_release(page);
while (head) {
bh = head;
head = head->b_this_page;
free_buffer_head(bh);
}
return copied;
}
EXPORT_SYMBOL(nobh_write_end);
/*
* nobh_writepage() - based on block_full_write_page() except
* that it tries to operate without attaching bufferheads to
* the page.
*/
int nobh_writepage(struct page *page, get_block_t *get_block,
struct writeback_control *wbc)
{
struct inode * const inode = page->mapping->host;
loff_t i_size = i_size_read(inode);
const pgoff_t end_index = i_size >> PAGE_CACHE_SHIFT;
unsigned offset;
int ret;
/* Is the page fully inside i_size? */
if (page->index < end_index)
goto out;
/* Is the page fully outside i_size? (truncate in progress) */
offset = i_size & (PAGE_CACHE_SIZE-1);
if (page->index >= end_index+1 || !offset) {
/*
* The page may have dirty, unmapped buffers. For example,
* they may have been added in ext3_writepage(). Make them
* freeable here, so the page does not leak.
*/
#if 0
/* Not really sure about this - do we need this ? */
if (page->mapping->a_ops->invalidatepage)
page->mapping->a_ops->invalidatepage(page, offset);
#endif
unlock_page(page);
return 0; /* don't care */
}
/*
* The page straddles i_size. It must be zeroed out on each and every
* writepage invocation because it may be mmapped. "A file is mapped
* in multiples of the page size. For a file that is not a multiple of
* the page size, the remaining memory is zeroed when mapped, and
* writes to that region are not written out to the file."
*/
zero_user_segment(page, offset, PAGE_CACHE_SIZE);
out:
ret = mpage_writepage(page, get_block, wbc);
if (ret == -EAGAIN)
ret = __block_write_full_page(inode, page, get_block, wbc,
end_buffer_async_write);
return ret;
}
EXPORT_SYMBOL(nobh_writepage);
int nobh_truncate_page(struct address_space *mapping,
loff_t from, get_block_t *get_block)
{
pgoff_t index = from >> PAGE_CACHE_SHIFT;
unsigned offset = from & (PAGE_CACHE_SIZE-1);
unsigned blocksize;
sector_t iblock;
unsigned length, pos;
struct inode *inode = mapping->host;
struct page *page;
struct buffer_head map_bh;
int err;
blocksize = i_blocksize(inode);
length = offset & (blocksize - 1);
/* Block boundary? Nothing to do */
if (!length)
return 0;
length = blocksize - length;
iblock = (sector_t)index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
page = grab_cache_page(mapping, index);
err = -ENOMEM;
if (!page)
goto out;
if (page_has_buffers(page)) {
has_buffers:
unlock_page(page);
page_cache_release(page);
return block_truncate_page(mapping, from, get_block);
}
/* Find the buffer that contains "offset" */
pos = blocksize;
while (offset >= pos) {
iblock++;
pos += blocksize;
}
map_bh.b_size = blocksize;
map_bh.b_state = 0;
err = get_block(inode, iblock, &map_bh, 0);
if (err)
goto unlock;
/* unmapped? It's a hole - nothing to do */
if (!buffer_mapped(&map_bh))
goto unlock;
/* Ok, it's mapped. Make sure it's up-to-date */
if (!PageUptodate(page)) {
err = mapping->a_ops->readpage(NULL, page);
if (err) {
page_cache_release(page);
goto out;
}
lock_page(page);
if (!PageUptodate(page)) {
err = -EIO;
goto unlock;
}
if (page_has_buffers(page))
goto has_buffers;
}
zero_user(page, offset, length);
set_page_dirty(page);
err = 0;
unlock:
unlock_page(page);
page_cache_release(page);
out:
return err;
}
EXPORT_SYMBOL(nobh_truncate_page);
int block_truncate_page(struct address_space *mapping,
loff_t from, get_block_t *get_block)
{
pgoff_t index = from >> PAGE_CACHE_SHIFT;
unsigned offset = from & (PAGE_CACHE_SIZE-1);
unsigned blocksize;
sector_t iblock;
unsigned length, pos;
struct inode *inode = mapping->host;
struct page *page;
struct buffer_head *bh;
int err;
blocksize = i_blocksize(inode);
length = offset & (blocksize - 1);
/* Block boundary? Nothing to do */
if (!length)
return 0;
length = blocksize - length;
iblock = (sector_t)index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
page = grab_cache_page(mapping, index);
err = -ENOMEM;
if (!page)
goto out;
if (!page_has_buffers(page))
create_empty_buffers(page, blocksize, 0);
/* Find the buffer that contains "offset" */
bh = page_buffers(page);
pos = blocksize;
while (offset >= pos) {
bh = bh->b_this_page;
iblock++;
pos += blocksize;
}
err = 0;
if (!buffer_mapped(bh)) {
WARN_ON(bh->b_size != blocksize);
err = get_block(inode, iblock, bh, 0);
if (err)
goto unlock;
/* unmapped? It's a hole - nothing to do */
if (!buffer_mapped(bh))
goto unlock;
}
/* Ok, it's mapped. Make sure it's up-to-date */
if (PageUptodate(page))
set_buffer_uptodate(bh);
if (!buffer_uptodate(bh) && !buffer_delay(bh) && !buffer_unwritten(bh)) {
err = -EIO;
ll_rw_block(READ, 1, &bh);
wait_on_buffer(bh);
/* Uhhuh. Read error. Complain and punt. */
if (!buffer_uptodate(bh))
goto unlock;
}
zero_user(page, offset, length);
mark_buffer_dirty(bh);
err = 0;
unlock:
unlock_page(page);
page_cache_release(page);
out:
return err;
}
EXPORT_SYMBOL(block_truncate_page);
/*
* The generic ->writepage function for buffer-backed address_spaces
*/
int block_write_full_page(struct page *page, get_block_t *get_block,
struct writeback_control *wbc)
{
struct inode * const inode = page->mapping->host;
loff_t i_size = i_size_read(inode);
const pgoff_t end_index = i_size >> PAGE_CACHE_SHIFT;
unsigned offset;
/* Is the page fully inside i_size? */
if (page->index < end_index)
return __block_write_full_page(inode, page, get_block, wbc,
end_buffer_async_write);
/* Is the page fully outside i_size? (truncate in progress) */
offset = i_size & (PAGE_CACHE_SIZE-1);
if (page->index >= end_index+1 || !offset) {
/*
* The page may have dirty, unmapped buffers. For example,
* they may have been added in ext3_writepage(). Make them
* freeable here, so the page does not leak.
*/
do_invalidatepage(page, 0, PAGE_CACHE_SIZE);
unlock_page(page);
return 0; /* don't care */
}
/*
* The page straddles i_size. It must be zeroed out on each and every
* writepage invocation because it may be mmapped. "A file is mapped
* in multiples of the page size. For a file that is not a multiple of
* the page size, the remaining memory is zeroed when mapped, and
* writes to that region are not written out to the file."
*/
zero_user_segment(page, offset, PAGE_CACHE_SIZE);
return __block_write_full_page(inode, page, get_block, wbc,
end_buffer_async_write);
}
EXPORT_SYMBOL(block_write_full_page);
sector_t generic_block_bmap(struct address_space *mapping, sector_t block,
get_block_t *get_block)
{
struct buffer_head tmp;
struct inode *inode = mapping->host;
tmp.b_state = 0;
tmp.b_blocknr = 0;
tmp.b_size = i_blocksize(inode);
get_block(inode, block, &tmp, 0);
return tmp.b_blocknr;
}
EXPORT_SYMBOL(generic_block_bmap);
static void end_bio_bh_io_sync(struct bio *bio)
{
struct buffer_head *bh = bio->bi_private;
if (unlikely(bio_flagged(bio, BIO_QUIET)))
set_bit(BH_Quiet, &bh->b_state);
bh->b_end_io(bh, !bio->bi_error);
bio_put(bio);
}
/*
* This allows us to do IO even on the odd last sectors
* of a device, even if the block size is some multiple
* of the physical sector size.
*
* We'll just truncate the bio to the size of the device,
* and clear the end of the buffer head manually.
*
* Truly out-of-range accesses will turn into actual IO
* errors, this only handles the "we need to be able to
* do IO at the final sector" case.
*/
void guard_bio_eod(int rw, struct bio *bio)
{
sector_t maxsector;
struct bio_vec *bvec = &bio->bi_io_vec[bio->bi_vcnt - 1];
unsigned truncated_bytes;
maxsector = i_size_read(bio->bi_bdev->bd_inode) >> 9;
if (!maxsector)
return;
/*
* If the *whole* IO is past the end of the device,
* let it through, and the IO layer will turn it into
* an EIO.
*/
if (unlikely(bio->bi_iter.bi_sector >= maxsector))
return;
maxsector -= bio->bi_iter.bi_sector;
if (likely((bio->bi_iter.bi_size >> 9) <= maxsector))
return;
/* Uhhuh. We've got a bio that straddles the device size! */
truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9);
/*
* The bio contains more than one segment which spans EOD, just return
* and let IO layer turn it into an EIO
*/
if (truncated_bytes > bvec->bv_len)
return;
/* Truncate the bio.. */
bio->bi_iter.bi_size -= truncated_bytes;
bvec->bv_len -= truncated_bytes;
/* ..and clear the end of the buffer for reads */
if ((rw & RW_MASK) == READ) {
zero_user(bvec->bv_page, bvec->bv_offset + bvec->bv_len,
truncated_bytes);
}
}
static int submit_bh_wbc(int rw, struct buffer_head *bh,
unsigned long bio_flags, struct writeback_control *wbc)
{
struct bio *bio;
BUG_ON(!buffer_locked(bh));
BUG_ON(!buffer_mapped(bh));
BUG_ON(!bh->b_end_io);
BUG_ON(buffer_delay(bh));
BUG_ON(buffer_unwritten(bh));
/*
* Only clear out a write error when rewriting
*/
if (test_set_buffer_req(bh) && (rw & WRITE))
clear_buffer_write_io_error(bh);
/*
* from here on down, it's all bio -- do the initial mapping,
* submit_bio -> generic_make_request may further map this bio around
*/
bio = bio_alloc(GFP_NOIO, 1);
if (wbc) {
wbc_init_bio(wbc, bio);
wbc_account_io(wbc, bh->b_page, bh->b_size);
}
bio->bi_iter.bi_sector = bh->b_blocknr * (bh->b_size >> 9);
bio->bi_bdev = bh->b_bdev;
bio_add_page(bio, bh->b_page, bh->b_size, bh_offset(bh));
BUG_ON(bio->bi_iter.bi_size != bh->b_size);
bio->bi_end_io = end_bio_bh_io_sync;
bio->bi_private = bh;
bio->bi_flags |= bio_flags;
/* Take care of bh's that straddle the end of the device */
guard_bio_eod(rw, bio);
if (buffer_meta(bh))
rw |= REQ_META;
if (buffer_prio(bh))
rw |= REQ_PRIO;
submit_bio(rw, bio);
return 0;
}
int _submit_bh(int rw, struct buffer_head *bh, unsigned long bio_flags)
{
return submit_bh_wbc(rw, bh, bio_flags, NULL);
}
EXPORT_SYMBOL_GPL(_submit_bh);
int submit_bh(int rw, struct buffer_head *bh)
{
return submit_bh_wbc(rw, bh, 0, NULL);
}
EXPORT_SYMBOL(submit_bh);
/**
* ll_rw_block: low-level access to block devices (DEPRECATED)
* @rw: whether to %READ or %WRITE or maybe %READA (readahead)
* @nr: number of &struct buffer_heads in the array
* @bhs: array of pointers to &struct buffer_head
*
* ll_rw_block() takes an array of pointers to &struct buffer_heads, and
* requests an I/O operation on them, either a %READ or a %WRITE. The third
* %READA option is described in the documentation for generic_make_request()
* which ll_rw_block() calls.
*
* This function drops any buffer that it cannot get a lock on (with the
* BH_Lock state bit), any buffer that appears to be clean when doing a write
* request, and any buffer that appears to be up-to-date when doing read
* request. Further it marks as clean buffers that are processed for
* writing (the buffer cache won't assume that they are actually clean
* until the buffer gets unlocked).
*
* ll_rw_block sets b_end_io to simple completion handler that marks
* the buffer up-to-date (if appropriate), unlocks the buffer and wakes
* any waiters.
*
* All of the buffers must be for the same device, and must also be a
* multiple of the current approved size for the device.
*/
void ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
{
int i;
for (i = 0; i < nr; i++) {
struct buffer_head *bh = bhs[i];
if (!trylock_buffer(bh))
continue;
if (rw == WRITE) {
if (test_clear_buffer_dirty(bh)) {
bh->b_end_io = end_buffer_write_sync;
get_bh(bh);
submit_bh(WRITE, bh);
continue;
}
} else {
if (!buffer_uptodate(bh)) {
bh->b_end_io = end_buffer_read_sync;
get_bh(bh);
submit_bh(rw, bh);
continue;
}
}
unlock_buffer(bh);
}
}
EXPORT_SYMBOL(ll_rw_block);
void write_dirty_buffer(struct buffer_head *bh, int rw)
{
lock_buffer(bh);
if (!test_clear_buffer_dirty(bh)) {
unlock_buffer(bh);
return;
}
bh->b_end_io = end_buffer_write_sync;
get_bh(bh);
submit_bh(rw, bh);
}
EXPORT_SYMBOL(write_dirty_buffer);
/*
* For a data-integrity writeout, we need to wait upon any in-progress I/O
* and then start new I/O and then wait upon it. The caller must have a ref on
* the buffer_head.
*/
int __sync_dirty_buffer(struct buffer_head *bh, int rw)
{
int ret = 0;
WARN_ON(atomic_read(&bh->b_count) < 1);
lock_buffer(bh);
if (test_clear_buffer_dirty(bh)) {
get_bh(bh);
bh->b_end_io = end_buffer_write_sync;
ret = submit_bh(rw, bh);
wait_on_buffer(bh);
if (!ret && !buffer_uptodate(bh))
ret = -EIO;
} else {
unlock_buffer(bh);
}
return ret;
}
EXPORT_SYMBOL(__sync_dirty_buffer);
int sync_dirty_buffer(struct buffer_head *bh)
{
return __sync_dirty_buffer(bh, WRITE_SYNC);
}
EXPORT_SYMBOL(sync_dirty_buffer);
/*
* try_to_free_buffers() checks if all the buffers on this particular page
* are unused, and releases them if so.
*
* Exclusion against try_to_free_buffers may be obtained by either
* locking the page or by holding its mapping's private_lock.
*
* If the page is dirty but all the buffers are clean then we need to
* be sure to mark the page clean as well. This is because the page
* may be against a block device, and a later reattachment of buffers
* to a dirty page will set *all* buffers dirty. Which would corrupt
* filesystem data on the same device.
*
* The same applies to regular filesystem pages: if all the buffers are
* clean then we set the page clean and proceed. To do that, we require
* total exclusion from __set_page_dirty_buffers(). That is obtained with
* private_lock.
*
* try_to_free_buffers() is non-blocking.
*/
static inline int buffer_busy(struct buffer_head *bh)
{
return atomic_read(&bh->b_count) |
(bh->b_state & ((1 << BH_Dirty) | (1 << BH_Lock)));
}
static int
drop_buffers(struct page *page, struct buffer_head **buffers_to_free)
{
struct buffer_head *head = page_buffers(page);
struct buffer_head *bh;
bh = head;
do {
if (buffer_write_io_error(bh) && page->mapping)
set_bit(AS_EIO, &page->mapping->flags);
if (buffer_busy(bh)) {
/*
* Check if the busy failure was due to an
* outstanding LRU reference
*/
evict_bh_lrus(bh);
if (buffer_busy(bh))
goto failed;
}
bh = bh->b_this_page;
} while (bh != head);
do {
struct buffer_head *next = bh->b_this_page;
if (bh->b_assoc_map)
__remove_assoc_queue(bh);
bh = next;
} while (bh != head);
*buffers_to_free = head;
__clear_page_buffers(page);
return 1;
failed:
return 0;
}
int try_to_free_buffers(struct page *page)
{
struct address_space * const mapping = page->mapping;
struct buffer_head *buffers_to_free = NULL;
int ret = 0;
BUG_ON(!PageLocked(page));
if (PageWriteback(page))
return 0;
if (mapping == NULL) { /* can this still happen? */
ret = drop_buffers(page, &buffers_to_free);
goto out;
}
spin_lock(&mapping->private_lock);
ret = drop_buffers(page, &buffers_to_free);
/*
* If the filesystem writes its buffers by hand (eg ext3)
* then we can have clean buffers against a dirty page. We
* clean the page here; otherwise the VM will never notice
* that the filesystem did any IO at all.
*
* Also, during truncate, discard_buffer will have marked all
* the page's buffers clean. We discover that here and clean
* the page also.
*
* private_lock must be held over this entire operation in order
* to synchronise against __set_page_dirty_buffers and prevent the
* dirty bit from being lost.
*/
if (ret)
cancel_dirty_page(page);
spin_unlock(&mapping->private_lock);
out:
if (buffers_to_free) {
struct buffer_head *bh = buffers_to_free;
do {
struct buffer_head *next = bh->b_this_page;
free_buffer_head(bh);
bh = next;
} while (bh != buffers_to_free);
}
return ret;
}
EXPORT_SYMBOL(try_to_free_buffers);
/*
* There are no bdflush tunables left. But distributions are
* still running obsolete flush daemons, so we terminate them here.
*
* Use of bdflush() is deprecated and will be removed in a future kernel.
* The `flush-X' kernel threads fully replace bdflush daemons and this call.
*/
SYSCALL_DEFINE2(bdflush, int, func, long, data)
{
static int msg_count;
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
if (msg_count < 5) {
msg_count++;
printk(KERN_INFO
"warning: process `%s' used the obsolete bdflush"
" system call\n", current->comm);
printk(KERN_INFO "Fix your initscripts?\n");
}
if (func == 1)
do_exit(0);
return 0;
}
/*
* Buffer-head allocation
*/
static struct kmem_cache *bh_cachep __read_mostly;
/*
* Once the number of bh's in the machine exceeds this level, we start
* stripping them in writeback.
*/
static unsigned long max_buffer_heads;
int buffer_heads_over_limit;
struct bh_accounting {
int nr; /* Number of live bh's */
int ratelimit; /* Limit cacheline bouncing */
};
static DEFINE_PER_CPU(struct bh_accounting, bh_accounting) = {0, 0};
static void recalc_bh_state(void)
{
int i;
int tot = 0;
if (__this_cpu_inc_return(bh_accounting.ratelimit) - 1 < 4096)
return;
__this_cpu_write(bh_accounting.ratelimit, 0);
for_each_online_cpu(i)
tot += per_cpu(bh_accounting, i).nr;
buffer_heads_over_limit = (tot > max_buffer_heads);
}
struct buffer_head *alloc_buffer_head(gfp_t gfp_flags)
{
struct buffer_head *ret = kmem_cache_zalloc(bh_cachep, gfp_flags);
if (ret) {
INIT_LIST_HEAD(&ret->b_assoc_buffers);
preempt_disable();
__this_cpu_inc(bh_accounting.nr);
recalc_bh_state();
preempt_enable();
}
return ret;
}
EXPORT_SYMBOL(alloc_buffer_head);
void free_buffer_head(struct buffer_head *bh)
{
BUG_ON(!list_empty(&bh->b_assoc_buffers));
kmem_cache_free(bh_cachep, bh);
preempt_disable();
__this_cpu_dec(bh_accounting.nr);
recalc_bh_state();
preempt_enable();
}
EXPORT_SYMBOL(free_buffer_head);
static void buffer_exit_cpu(int cpu)
{
int i;
struct bh_lru *b = &per_cpu(bh_lrus, cpu);
for (i = 0; i < BH_LRU_SIZE; i++) {
brelse(b->bhs[i]);
b->bhs[i] = NULL;
}
this_cpu_add(bh_accounting.nr, per_cpu(bh_accounting, cpu).nr);
per_cpu(bh_accounting, cpu).nr = 0;
}
static int buffer_cpu_notify(struct notifier_block *self,
unsigned long action, void *hcpu)
{
if (action == CPU_DEAD || action == CPU_DEAD_FROZEN)
buffer_exit_cpu((unsigned long)hcpu);
return NOTIFY_OK;
}
/**
* bh_uptodate_or_lock - Test whether the buffer is uptodate
* @bh: struct buffer_head
*
* Return true if the buffer is up-to-date and false,
* with the buffer locked, if not.
*/
int bh_uptodate_or_lock(struct buffer_head *bh)
{
if (!buffer_uptodate(bh)) {
lock_buffer(bh);
if (!buffer_uptodate(bh))
return 0;
unlock_buffer(bh);
}
return 1;
}
EXPORT_SYMBOL(bh_uptodate_or_lock);
/**
* bh_submit_read - Submit a locked buffer for reading
* @bh: struct buffer_head
*
* Returns zero on success and -EIO on error.
*/
int bh_submit_read(struct buffer_head *bh)
{
BUG_ON(!buffer_locked(bh));
if (buffer_uptodate(bh)) {
unlock_buffer(bh);
return 0;
}
get_bh(bh);
bh->b_end_io = end_buffer_read_sync;
submit_bh(READ, bh);
wait_on_buffer(bh);
if (buffer_uptodate(bh))
return 0;
return -EIO;
}
EXPORT_SYMBOL(bh_submit_read);
void __init buffer_init(void)
{
unsigned long nrpages;
bh_cachep = kmem_cache_create("buffer_head",
sizeof(struct buffer_head), 0,
(SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
SLAB_MEM_SPREAD),
NULL);
/*
* Limit the bh occupancy to 10% of ZONE_NORMAL
*/
nrpages = (nr_free_buffer_pages() * 10) / 100;
max_buffer_heads = nrpages * (PAGE_SIZE / sizeof(struct buffer_head));
hotcpu_notifier(buffer_cpu_notify, 0);
}