{"push_id":729927989,"size":21,"distinct_size":21,"ref":"refs/heads/master","head":"8be5701342790eb42c67f4f8609e203d6a461a4a","before":"eb254374a30cc53f976f2302f2198813a3b687ea","commits":[{"sha":"4c7e309340ff85072e96f529582d159002c36734","author":{"email":"905833befed450d0e2a094d927d7a7bbe432983c@gmail.com","name":"Dennis Yang"},"message":"dm btree remove: fix bug in redistribute3\n\nredistribute3() shares entries out across 3 nodes.  Some entries were\nbeing moved the wrong way, breaking the ordering.  This manifested as a\nBUG() in dm-btree-remove.c:shift() when entries were removed from the\nbtree.\n\nFor additional context see:\nhttps://www.redhat.com/archives/dm-devel/2015-May/msg00113.html\n\nSigned-off-by: Dennis Yang <shinrairis@gmail.com>\nSigned-off-by: Joe Thornber <ejt@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nCc: stable@vger.kernel.org","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/4c7e309340ff85072e96f529582d159002c36734"},{"sha":"a822c83e47d97cdef38c4352e1ef62d9f46cfe98","author":{"email":"61d5fad70554ae22d57a37634e04f12f58acc678@redhat.com","name":"Joe Thornber"},"message":"dm thin: allocate the cell_sort_array dynamically\n\nGiven the pool's cell_sort_array holds 8192 pointers it triggers an\norder 5 allocation via kmalloc.  This order 5 allocation is prone to\nfailure as system memory gets more fragmented over time.\n\nFix this by allocating the cell_sort_array using vmalloc.\n\nSigned-off-by: Joe Thornber <ejt@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nCc: stable@vger.kernel.org","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/a822c83e47d97cdef38c4352e1ef62d9f46cfe98"},{"sha":"1c7518794a3647eb345d59ee52844e8a40405198","author":{"email":"61d5fad70554ae22d57a37634e04f12f58acc678@redhat.com","name":"Joe Thornber"},"message":"dm btree: silence lockdep lock inversion in dm_btree_del()\n\nAllocate memory using GFP_NOIO when deleting a btree.  dm_btree_del()\ncan be called via an ioctl and we don't want to recurse into the FS or\nblock layer.\n\nSigned-off-by: Joe Thornber <ejt@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nCc: stable@vger.kernel.org","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/1c7518794a3647eb345d59ee52844e8a40405198"},{"sha":"621739b00e16ca2d80411dc9b111cb15b91f3ba9","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"Revert \"dm: only run the queue on completion if congested or no requests pending\"\n\nThis reverts commit 9a0e609e3fd8a95c96629b9fbde6b8c5b9a1456a.\n(Resolved a conflict during revert due to commit bfebd1cdb4 that came\nafter)\n\nThis revert is motivated by a couple failure reports on request-based DM\nmultipath testbeds:\n1) Netapp reported that their multipath fault injection test under heavy\n   IO load can stall longer than 300 seconds.\n2) IBM reported elevated lock contention in their testbed (likely due to\n   increased back pressure due to IO not being dispatched as quickly):\n   https://www.redhat.com/archives/dm-devel/2015-July/msg00057.html\n\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nCc: stable@vger.kernel.org # 4.1+","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/621739b00e16ca2d80411dc9b111cb15b91f3ba9"},{"sha":"c1aa45759e90b4204ab8bce027a925fc7c87d00a","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix shrinking truncate when the no_holes feature is enabled\n\nIf the no_holes feature is enabled, we attempt to shrink a file to a size\nthat ends up in the middle of a hole and we don't have any file extent\nitems in the fs/subvol tree that go beyond the new file size (or any\nordered extents that will insert such file extent items), we end up not\nupdating the inode's disk_i_size, we only update the inode's i_size.\n\nThis means that after unmounting and mounting the filesystem, or after\nthe inode is evicted and reloaded, its i_size ends up being incorrect\n(an inode's i_size is set to the disk_i_size field when an inode is\nloaded). This happens when btrfs_truncate_inode_items() doesn't find\nany file extent items to drop - in this case it never makes a call to\nbtrfs_ordered_update_i_size() in order to update the inode's disk_i_size.\n\nExample reproducer:\n\n  $ mkfs.btrfs -O no-holes -f /dev/sdd\n  $ mount /dev/sdd /mnt\n\n  # Create our test file with some data and durably persist it.\n  $ xfs_io -f -c \"pwrite -S 0xaa 0 128K\" /mnt/foo\n  $ sync\n\n  # Append some data to the file, increasing its size, and leave a hole\n  # between the old size and the start offset if the following write. So\n  # our file gets a hole in the range [128Kb, 256Kb[.\n  $ xfs_io -c \"truncate 160K\" /mnt/foo\n\n  # We expect to see our file with a size of 160Kb, with the first 128Kb\n  # of data all having the value 0xaa and the remaining 32Kb of data all\n  # having the value 0x00.\n  $ od -t x1 /mnt/foo\n  0000000 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa\n  *\n  0400000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  *\n  0500000\n\n  # Now cleanly unmount and mount again the filesystem.\n  $ umount /mnt\n  $ mount /dev/sdd /mnt\n\n  # We expect to get the same result as before, a file with a size of\n  # 160Kb, with the first 128Kb of data all having the value 0xaa and the\n  # remaining 32Kb of data all having the value 0x00.\n  $ od -t x1 /mnt/foo\n  0000000 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa\n  *\n  0400000\n\nIn the example above the file size/data do not match what they were before\nthe remount.\n\nFix this by always calling btrfs_ordered_update_i_size() with a size\nmatching the size the file was truncated to if btrfs_truncate_inode_items()\nis not called for a log tree and no file extent items were dropped. This\nensures the same behaviour as when the no_holes feature is not enabled.\n\nA test case for fstests follows soon.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/c1aa45759e90b4204ab8bce027a925fc7c87d00a"},{"sha":"497b4050e0eacd4c746dd396d14916b1e669849d","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix memory leak in the extent_same ioctl\n\nWe were allocating memory with memdup_user() but we were never releasing\nthat memory. This affected pretty much every call to the ioctl, whether\nit deduplicated extents or not.\n\nThis issue was reported on IRC by Julian Taylor and on the mailing list\nby Marcel Ritter, credit goes to them for finding the issue.\n\nReported-by: Julian Taylor <jtaylor.debian@googlemail.com>\nReported-by: Marcel Ritter <ritter.marcel@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Mark Fasheh <mfasheh@suse.de>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/497b4050e0eacd4c746dd396d14916b1e669849d"},{"sha":"d3efe08400317888f559bbedf0e42cd31575d0ef","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix list transaction->pending_ordered corruption\n\nWhen we call btrfs_commit_transaction(), we splice the list \"ordered\"\nof our transaction handle into the transaction's \"pending_ordered\"\nlist, but we don't re-initialize the \"ordered\" list of our transaction\nhandle, this means it still points to the same elements it used to\nbefore the splice. Then we check if the current transaction's state is\n>= TRANS_STATE_COMMIT_START and if it is we end up calling\nbtrfs_end_transaction() which simply splices again the \"ordered\" list\nof our handle into the transaction's \"pending_ordered\" list, leaving\nmultiple pointers to the same ordered extents which results in list\ncorruption when we are iterating, removing and freeing ordered extents\nat btrfs_wait_pending_ordered(), resulting in access to dangling\npointers / use-after-free issues.\nSimilarly, btrfs_end_transaction() can end up in some cases calling\nbtrfs_commit_transaction(), and both did a list splice of the transaction\nhandle's \"ordered\" list into the transaction's \"pending_ordered\" without\nre-initializing the handle's \"ordered\" list, resulting in exactly the\nsame problem.\n\nThis produces the following warning on a kernel with linked list\ndebugging enabled:\n\n[109749.265416] ------------[ cut here ]------------\n[109749.266410] WARNING: CPU: 7 PID: 324 at lib/list_debug.c:59 __list_del_entry+0x5a/0x98()\n[109749.267969] list_del corruption. prev->next should be ffff8800ba087e20, but was fffffff8c1f7c35d\n(...)\n[109749.287505] Call Trace:\n[109749.288135]  [<ffffffff8145f077>] dump_stack+0x4f/0x7b\n[109749.298080]  [<ffffffff81095de5>] ? console_unlock+0x356/0x3a2\n[109749.331605]  [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb\n[109749.334849]  [<ffffffff81260642>] ? __list_del_entry+0x5a/0x98\n[109749.337093]  [<ffffffff8104b410>] warn_slowpath_fmt+0x46/0x48\n[109749.337847]  [<ffffffff81260642>] __list_del_entry+0x5a/0x98\n[109749.338678]  [<ffffffffa053e8bf>] btrfs_wait_pending_ordered+0x46/0xdb [btrfs]\n[109749.340145]  [<ffffffffa058a65f>] ? __btrfs_run_delayed_items+0x149/0x163 [btrfs]\n[109749.348313]  [<ffffffffa054077d>] btrfs_commit_transaction+0x36b/0xa10 [btrfs]\n[109749.349745]  [<ffffffff81087310>] ? trace_hardirqs_on+0xd/0xf\n[109749.350819]  [<ffffffffa055370d>] btrfs_sync_file+0x36f/0x3fc [btrfs]\n[109749.351976]  [<ffffffff8118ec98>] vfs_fsync_range+0x8f/0x9e\n[109749.360341]  [<ffffffff8118ecc3>] vfs_fsync+0x1c/0x1e\n[109749.368828]  [<ffffffff8118ee1d>] do_fsync+0x34/0x4e\n[109749.369790]  [<ffffffff8118f045>] SyS_fsync+0x10/0x14\n[109749.370925]  [<ffffffff81465197>] system_call_fastpath+0x12/0x6f\n[109749.382274] ---[ end trace 48e0d07f7c03d95a ]---\n\nOn a non-debug kernel this leads to invalid memory accesses, causing a\ncrash. Fix this by using list_splice_init() instead of list_splice() in\nbtrfs_commit_transaction() and btrfs_end_transaction().\n\nCc: stable@vger.kernel.org\nFixes: 50d9aa99bd35 (\"Btrfs: make sure logged extents complete in the current transaction V3\"\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: David Sterba <dsterba@suse.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/d3efe08400317888f559bbedf0e42cd31575d0ef"},{"sha":"cffc3374e567ef42954f3c7070b3fa83f20f9684","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix order by which delayed references are run\n\nWhen we have an extent that got N references removed and N new references\nadded in the same transaction, we must run the insertion of the references\nfirst because otherwise the last removed reference will remove the extent\nitem from the extent tree, resulting in a failure for the insertions.\n\nThis is a regression introduced in the 4.2-rc1 release and this fix just\nbrings back the behaviour of selecting reference additions before any\nreference removals.\n\nThe following test case for fstests reproduces the issue:\n\n  seq=`basename $0`\n  seqres=$RESULT_DIR/$seq\n  echo \"QA output created by $seq\"\n  tmp=/tmp/$$\n  status=1\t# failure is the default!\n  trap \"_cleanup; exit \\$status\" 0 1 2 3 15\n\n  _cleanup()\n  {\n      _cleanup_flakey\n      rm -f $tmp.*\n  }\n\n  # get standard environment, filters and checks\n  . ./common/rc\n  . ./common/filter\n  . ./common/dmflakey\n\n  # real QA test starts here\n  _need_to_be_root\n  _supported_fs btrfs\n  _supported_os Linux\n  _require_scratch\n  _require_dm_flakey\n  _require_cloner\n  _require_metadata_journaling $SCRATCH_DEV\n\n  rm -f $seqres.full\n\n  _scratch_mkfs >>$seqres.full 2>&1\n  _init_flakey\n  _mount_flakey\n\n  # Create prealloc extent covering range [160K, 620K[\n  $XFS_IO_PROG -f -c \"falloc 160K 460K\" $SCRATCH_MNT/foo\n\n  # Now write to the last 80K of the prealloc extent plus 40K to the unallocated\n  # space that immediately follows it. This creates a new extent of 40K that spans\n  # the range [620K, 660K[.\n  $XFS_IO_PROG -c \"pwrite -S 0xaa 540K 120K\" $SCRATCH_MNT/foo | _filter_xfs_io\n\n  # At this point, there are now 2 back references to the prealloc extent in our\n  # extent tree. Both are for our file offset 160K and one relates to a file\n  # extent item with a data offset of 0 and a length of 380K, while the other\n  # relates to a file extent item with a data offset of 380K and a length of 80K.\n\n  # Make sure everything done so far is durably persisted (all back references are\n  # in the extent tree, etc).\n  sync\n\n  # Now clone all extents of our file that cover the offset 160K up to its eof\n  # (660K at this point) into itself at offset 2M. This leaves a hole in the file\n  # covering the range [660K, 2M[. The prealloc extent will now be referenced by\n  # the file twice, once for offset 160K and once for offset 2M. The 40K extent\n  # that follows the prealloc extent will also be referenced twice by our file,\n  # once for offset 620K and once for offset 2M + 460K.\n  $CLONER_PROG -s $((160 * 1024)) -d $((2 * 1024 * 1024)) -l 0 $SCRATCH_MNT/foo \\\n\t$SCRATCH_MNT/foo\n\n  # Now create one new extent in our file with a size of 100Kb. It will span the\n  # range [3M, 3M + 100K[. It also will cause creation of a hole spanning the\n  # range [2M + 460K, 3M[. Our new file size is 3M + 100K.\n  $XFS_IO_PROG -c \"pwrite -S 0xbb 3M 100K\" $SCRATCH_MNT/foo | _filter_xfs_io\n\n  # At this point, there are now (in memory) 4 back references to the prealloc\n  # extent.\n  #\n  # Two of them are for file offset 160K, related to file extent items\n  # matching the file offsets 160K and 540K respectively, with data offsets of\n  # 0 and 380K respectively, and with lengths of 380K and 80K respectively.\n  #\n  # The other two references are for file offset 2M, related to file extent items\n  # matching the file offsets 2M and 2M + 380K respectively, with data offsets of\n  # 0 and 380K respectively, and with lengths of 389K and 80K respectively.\n  #\n  # The 40K extent has 2 back references, one for file offset 620K and the other\n  # for file offset 2M + 460K.\n  #\n  # The 100K extent has a single back reference and it relates to file offset 3M.\n\n  # Now clone our 100K extent into offset 600K. That offset covers the last 20K\n  # of the prealloc extent, the whole 40K extent and 40K of the hole starting at\n  # offset 660K.\n  $CLONER_PROG -s $((3 * 1024 * 1024)) -d $((600 * 1024)) -l $((100 * 1024)) \\\n      $SCRATCH_MNT/foo $SCRATCH_MNT/foo\n\n  # At this point there's only one reference to the 40K extent, at file offset\n  # 2M + 460K, we have 4 references for the prealloc extent (2 for file offset\n  # 160K and 2 for file offset 2M) and 2 references for the 100K extent (1 for\n  # file offset 3M and a new one for file offset 600K).\n\n  # Now fsync our file to make all its new data and metadata updates are durably\n  # persisted and present if a power failure/crash happens after a successful\n  # fsync and before the next transaction commit.\n  $XFS_IO_PROG -c \"fsync\" $SCRATCH_MNT/foo\n\n  echo \"File digest before power failure:\"\n  md5sum $SCRATCH_MNT/foo | _filter_scratch\n\n  # Silently drop all writes and ummount to simulate a crash/power failure.\n  _load_flakey_table $FLAKEY_DROP_WRITES\n  _unmount_flakey\n\n  # Allow writes again, mount to trigger log replay and validate file contents.\n  # During log replay, the btrfs delayed references implementation used to run the\n  # deletion of back references before the addition of new back references, which\n  # made the addition fail as it didn't find the key in the extent tree that it\n  # was looking for. The failure triggered by this test was related to the 40K\n  # extent, which got 1 reference dropped and 1 reference added during the fsync\n  # log replay - when running the delayed references at transaction commit time,\n  # btrfs was applying the deletion before the insertion, resulting in a failure\n  # of the insertion that ended up turning the fs into read-only mode.\n  _load_flakey_table $FLAKEY_ALLOW_WRITES\n  _mount_flakey\n\n  echo \"File digest after log replay:\"\n  md5sum $SCRATCH_MNT/foo | _filter_scratch\n\n  _unmount_flakey\n\n  status=0\n  exit\n\nThis issue turned the filesystem into read-only mode (current transaction\naborted) and produced the following traces:\n\n  [ 8247.578385] ------------[ cut here ]------------\n  [ 8247.579947] WARNING: CPU: 0 PID: 11341 at fs/btrfs/extent-tree.c:1547 lookup_inline_extent_backref+0x17d/0x45d [btrfs]()\n  (...)\n  [ 8247.601697] Call Trace:\n  [ 8247.602222]  [<ffffffff8145f077>] dump_stack+0x4f/0x7b\n  [ 8247.604320]  [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb\n  [ 8247.605488]  [<ffffffffa0506c8d>] ? lookup_inline_extent_backref+0x17d/0x45d [btrfs]\n  [ 8247.608226]  [<ffffffffa0506c8d>] lookup_inline_extent_backref+0x17d/0x45d [btrfs]\n  [ 8247.617061]  [<ffffffffa0507957>] insert_inline_extent_backref+0x41/0xb2 [btrfs]\n  [ 8247.621856]  [<ffffffffa0507c4f>] __btrfs_inc_extent_ref+0x8c/0x20a [btrfs]\n  [ 8247.624366]  [<ffffffffa050ee60>] __btrfs_run_delayed_refs+0xb0c/0xd49 [btrfs]\n  [ 8247.626176]  [<ffffffffa0510dcd>] btrfs_run_delayed_refs+0x6d/0x1d4 [btrfs]\n  [ 8247.627435]  [<ffffffff81155c9b>] ? __cache_free+0x4a7/0x4b6\n  [ 8247.628531]  [<ffffffffa0520482>] btrfs_commit_transaction+0x4c/0xa20 [btrfs]\n  (...)\n  [ 8247.648430] ---[ end trace 2461e55f92c2ac2d ]---\n\n  [ 8247.727263] WARNING: CPU: 3 PID: 11341 at fs/btrfs/extent-tree.c:2771 btrfs_run_delayed_refs+0xa4/0x1d4 [btrfs]()\n  [ 8247.728954] BTRFS: Transaction aborted (error -5)\n  (...)\n  [ 8247.760866] Call Trace:\n  [ 8247.761534]  [<ffffffff8145f077>] dump_stack+0x4f/0x7b\n  [ 8247.764271]  [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb\n  [ 8247.767582]  [<ffffffffa0510e04>] ? btrfs_run_delayed_refs+0xa4/0x1d4 [btrfs]\n  [ 8247.769373]  [<ffffffff8104b410>] warn_slowpath_fmt+0x46/0x48\n  [ 8247.770836]  [<ffffffffa0510e04>] btrfs_run_delayed_refs+0xa4/0x1d4 [btrfs]\n  [ 8247.772532]  [<ffffffff81155c9b>] ? __cache_free+0x4a7/0x4b6\n  [ 8247.773664]  [<ffffffffa0520482>] btrfs_commit_transaction+0x4c/0xa20 [btrfs]\n  [ 8247.775047]  [<ffffffff81087310>] ? trace_hardirqs_on+0xd/0xf\n  [ 8247.776176]  [<ffffffff81155dd5>] ? kmem_cache_free+0x12b/0x189\n  [ 8247.777427]  [<ffffffffa055a920>] btrfs_recover_log_trees+0x2da/0x33d [btrfs]\n  [ 8247.778575]  [<ffffffffa055898e>] ? replay_one_extent+0x4fc/0x4fc [btrfs]\n  [ 8247.779838]  [<ffffffffa051e265>] open_ctree+0x1cc0/0x201a [btrfs]\n  [ 8247.781020]  [<ffffffff81120f48>] ? register_shrinker+0x56/0x81\n  [ 8247.782285]  [<ffffffffa04fb12c>] btrfs_mount+0x5f0/0x734 [btrfs]\n  (...)\n  [ 8247.793394] ---[ end trace 2461e55f92c2ac2e ]---\n  [ 8247.794276] BTRFS: error (device dm-0) in btrfs_run_delayed_refs:2771: errno=-5 IO failure\n  [ 8247.797335] BTRFS: error (device dm-0) in btrfs_replay_log:2375: errno=-5 IO failure (Failed to recover log tree)\n\nFixes: c6fc24549960 (\"btrfs: delayed-ref: Use list to replace the ref_root in ref_head.\")\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nAcked-by: Qu Wenruo <quwenruo@cn.fujitsu.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/cffc3374e567ef42954f3c7070b3fa83f20f9684"},{"sha":"b06075a98d595b761881fb2d7b8a557ea2f8b7ac","author":{"email":"52f8f9962b7f38d8269c63c0859d68147c8d10f0@redhat.com","name":"Mikulas Patocka"},"message":"dm: fix use after free crash due to incorrect cleanup sequence\n\nLinux 4.2-rc1 Commit 0f20972f7bf6 (\"dm: factor out a common\ncleanup_mapped_device()\") moved a common cleanup code to a separate\nfunction.  Unfortunately, that commit incorrectly changed the order of\ncleanup, so that it destroys the mapped_device's srcu structure\n'io_barrier' before destroying its workqueue.\n\nThe function that is executed on the workqueue (dm_wq_work) uses the srcu\nstructure, thus it may use it after being freed.  That results in a\ncrash in the LVM test suite's mirror-vgreduce-removemissing.sh test.\n\nSigned-off-by: Mikulas Patocka <mpatocka@redhat.com>\nFixes: 0f20972f7bf6 (\"dm: factor out a common cleanup_mapped_device()\")\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/b06075a98d595b761881fb2d7b8a557ea2f8b7ac"},{"sha":"ed958762644b404654a6f5d23e869f496fe127c6","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix file corruption after cloning inline extents\n\nUsing the clone ioctl (or extent_same ioctl, which calls the same extent\ncloning function as well) we end up allowing copy an inline extent from\nthe source file into a non-zero offset of the destination file. This is\nsomething not expected and that the btrfs code is not prepared to deal\nwith - all inline extents must be at a file offset equals to 0.\n\nFor example, the following excerpt of a test case for fstests triggers\na crash/BUG_ON() on a write operation after an inline extent is cloned\ninto a non-zero offset:\n\n  _scratch_mkfs >>$seqres.full 2>&1\n  _scratch_mount\n\n  # Create our test files. File foo has the same 2K of data at offset 4K\n  # as file bar has at its offset 0.\n  $XFS_IO_PROG -f -s -c \"pwrite -S 0xaa 0 4K\" \\\n      -c \"pwrite -S 0xbb 4k 2K\" \\\n      -c \"pwrite -S 0xcc 8K 4K\" \\\n      $SCRATCH_MNT/foo | _filter_xfs_io\n\n  # File bar consists of a single inline extent (2K size).\n  $XFS_IO_PROG -f -s -c \"pwrite -S 0xbb 0 2K\" \\\n     $SCRATCH_MNT/bar | _filter_xfs_io\n\n  # Now call the clone ioctl to clone the extent of file bar into file\n  # foo at its offset 4K. This made file foo have an inline extent at\n  # offset 4K, something which the btrfs code can not deal with in future\n  # IO operations because all inline extents are supposed to start at an\n  # offset of 0, resulting in all sorts of chaos.\n  # So here we validate that clone ioctl returns an EOPNOTSUPP, which is\n  # what it returns for other cases dealing with inlined extents.\n  $CLONER_PROG -s 0 -d $((4 * 1024)) -l $((2 * 1024)) \\\n      $SCRATCH_MNT/bar $SCRATCH_MNT/foo\n\n  # Because of the inline extent at offset 4K, the following write made\n  # the kernel crash with a BUG_ON().\n  $XFS_IO_PROG -c \"pwrite -S 0xdd 6K 2K\" $SCRATCH_MNT/foo | _filter_xfs_io\n\n  status=0\n  exit\n\nThe stack trace of the BUG_ON() triggered by the last write is:\n\n  [152154.035903] ------------[ cut here ]------------\n  [152154.036424] kernel BUG at mm/page-writeback.c:2286!\n  [152154.036424] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n  [152154.036424] Modules linked in: btrfs dm_flakey dm_mod crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc acpi_cpu$\n  [152154.036424] CPU: 2 PID: 17873 Comm: xfs_io Tainted: G        W       4.1.0-rc6-btrfs-next-11+ #2\n  [152154.036424] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014\n  [152154.036424] task: ffff880429f70990 ti: ffff880429efc000 task.ti: ffff880429efc000\n  [152154.036424] RIP: 0010:[<ffffffff8111a9d5>]  [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90\n  [152154.036424] RSP: 0018:ffff880429effc68  EFLAGS: 00010246\n  [152154.036424] RAX: 0200000000000806 RBX: ffffea0006a6d8f0 RCX: 0000000000000001\n  [152154.036424] RDX: 0000000000000000 RSI: ffffffff81155d1b RDI: ffffea0006a6d8f0\n  [152154.036424] RBP: ffff880429effc78 R08: ffff8801ce389fe0 R09: 0000000000000001\n  [152154.036424] R10: 0000000000002000 R11: ffffffffffffffff R12: ffff8800200dce68\n  [152154.036424] R13: 0000000000000000 R14: ffff8800200dcc88 R15: ffff8803d5736d80\n  [152154.036424] FS:  00007fbf119f6700(0000) GS:ffff88043d280000(0000) knlGS:0000000000000000\n  [152154.036424] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [152154.036424] CR2: 0000000001bdc000 CR3: 00000003aa555000 CR4: 00000000000006e0\n  [152154.036424] Stack:\n  [152154.036424]  ffff8803d5736d80 0000000000000001 ffff880429effcd8 ffffffffa04e97c1\n  [152154.036424]  ffff880429effd68 ffff880429effd60 0000000000000001 ffff8800200dc9c8\n  [152154.036424]  0000000000000001 ffff8800200dcc88 0000000000000000 0000000000001000\n  [152154.036424] Call Trace:\n  [152154.036424]  [<ffffffffa04e97c1>] lock_and_cleanup_extent_if_need+0x147/0x18d [btrfs]\n  [152154.036424]  [<ffffffffa04ea82c>] __btrfs_buffered_write+0x245/0x4c8 [btrfs]\n  [152154.036424]  [<ffffffffa04ed14b>] ? btrfs_file_write_iter+0x150/0x3e0 [btrfs]\n  [152154.036424]  [<ffffffffa04ed15a>] ? btrfs_file_write_iter+0x15f/0x3e0 [btrfs]\n  [152154.036424]  [<ffffffffa04ed2c7>] btrfs_file_write_iter+0x2cc/0x3e0 [btrfs]\n  [152154.036424]  [<ffffffff81165a4a>] __vfs_write+0x7c/0xa5\n  [152154.036424]  [<ffffffff81165f89>] vfs_write+0xa0/0xe4\n  [152154.036424]  [<ffffffff81166855>] SyS_pwrite64+0x64/0x82\n  [152154.036424]  [<ffffffff81465197>] system_call_fastpath+0x12/0x6f\n  [152154.036424] Code: 48 89 c7 e8 0f ff ff ff 5b 41 5c 5d c3 0f 1f 44 00 00 55 48 89 e5 41 54 53 48 89 fb e8 ae ef 00 00 49 89 c4 48 8b 03 a8 01 75 02 <0f> 0b 4d 85 e4 74 59 49 8b 3c 2$\n  [152154.036424] RIP  [<ffffffff8111a9d5>] clear_page_dirty_for_io+0x1e/0x90\n  [152154.036424]  RSP <ffff880429effc68>\n  [152154.242621] ---[ end trace e3d3376b23a57041 ]---\n\nFix this by returning the error EOPNOTSUPP if an attempt to copy an\ninline extent into a non-zero offset happens, just like what is done for\nother scenarios that would require copying/splitting inline extents,\nwhich were introduced by the following commits:\n\n   00fdf13a2e9f (\"Btrfs: fix a crash of clone with inline extents's split\")\n   3f9e3df8da3c (\"btrfs: replace error code from btrfs_drop_extents\")\n\nCc: stable@vger.kernel.org\nSigned-off-by: Filipe Manana <fdmanana@suse.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/ed958762644b404654a6f5d23e869f496fe127c6"},{"sha":"bcc696fac11fe13e59dda5aaec6322a25b7c9a3a","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm thin: stay in out-of-data-space mode once no_space_timeout expires\n\nThis fixes an issue where running out of data space would cause the\nthin-pool's metadata to become read-only.  There was no reason to make\nmetadata read-only -- calling set_pool_mode() with PM_READ_ONLY was a\nmisguided way to error all queued and future write IOs.  We can\naccomplish the same by degrading from PM_OUT_OF_DATA_SPACE to\nPM_OUT_OF_DATA_SPACE with error_if_no_space enabled.\n\nOtherwise, the use of PM_READ_ONLY could cause a race where commit() was\nstarted before the PM_READ_ONLY transition but dm_pool_commit_metadata()\nwould go on to fail because the block manager had transitioned to\nread-only.  The return of -EPERM from dm_pool_commit_metadata(), due to\nattempting to commit while in read-only mode, caused the thin-pool to\nset 'needs_check' because a metadata_operation_failed().  This needless\ncascade of failures makes life for users more difficult than needed.\n\nReported-by: Vivek Goyal <vgoyal@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/bcc696fac11fe13e59dda5aaec6322a25b7c9a3a"},{"sha":"e4c78e210daea17f82f12037005df225e22189b9","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm thin: display 'needs_check' in status if it is set\n\nThere is currently no way to see that the needs_check flag has been set\nin the metadata.  Display 'needs_check' in the thin-pool status if it is\nset in the thinp metadata.\n\nAlso, update thinp documentation.\n\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/e4c78e210daea17f82f12037005df225e22189b9"},{"sha":"255eac20054e90ac7a52b3e179b61de1168a8fe6","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm cache: display 'needs_check' in status if it is set\n\nThere is currently no way to see that the needs_check flag has been set\nin the metadata.  Display 'needs_check' in the cache status if it is set\nin the cache metadata.\n\nAlso, update cache documentation.\n\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/255eac20054e90ac7a52b3e179b61de1168a8fe6"},{"sha":"386cb7cdeeef97e0bf082a8d6bbfc07a2ccce07b","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm cache: do not wake_worker() in free_migration()\n\nAll methods that queue work call wake_worker() as you'd expect.\nE.g. cell_defer, defer_bio, quiesce_migration (which is called by\nwriteback, promote, demote_then_promote, invalidate, discard, etc).\n\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/386cb7cdeeef97e0bf082a8d6bbfc07a2ccce07b"},{"sha":"e782eff591bca2d96bac30ab5d1cfa4ccd3b0f86","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm cache: avoid preallocation if no work in writeback_some_dirty_blocks()\n\nRefactor writeback_some_dirty_blocks() to avoid prealloc_data_structs()\nif the policy doesn't have any dirty blocks ready for writeback.\n\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/e782eff591bca2d96bac30ab5d1cfa4ccd3b0f86"},{"sha":"665022d72f9b5762f21b5ea02fa0503d04802849","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm cache: avoid calls to prealloc_free_structs() if possible\n\nIf no work was performed then prealloc_data_structs() wasn't ever called\nso there isn't any need to call prealloc_free_structs().\n\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/665022d72f9b5762f21b5ea02fa0503d04802849"},{"sha":"baeca4495f53bd0c51c24e5467ef1a7ba5e17f6d","author":{"email":"197c169951aeef0485c6aeb1572203d47803b127@chromium.org","name":"Wei-Ning Huang"},"message":"rtc: mt6397: enable wakeup before registering rtc device\n\nrtc_sysfs_add_device checks if device can wakeup before creating the\nwakealarm file in sysfs. Thus the driver must set wakeup capability\nbefore registering the rtc device.\n\nSigned-off-by: Wei-Ning Huang <wnhuang@google.com>\nAcked-by: Eddie Huang <eddie.huang@mediatek.com>\nSigned-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/baeca4495f53bd0c51c24e5467ef1a7ba5e17f6d"},{"sha":"d80238bbcad33218c8d34662f144dfb146c2d57b","author":{"email":"679188261afeb60eb822cd934fd7b46a48ddd743@freescale.com","name":"Fabio Estevam"},"message":"rtc: armada38x: Remove unused variable from armada38x_rtc_set_time()\n\nRemove the 'flags' variable in order to fix the following warning:\n\ndrivers/rtc/rtc-armada38x.c:91:22: warning: unused variable 'flags' [-Wunused-variable]\n\nSigned-off-by: Fabio Estevam <fabio.estevam@freescale.com>\nSigned-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/d80238bbcad33218c8d34662f144dfb146c2d57b"},{"sha":"3f8476fe892c58c0583f98f17e98fd67c3fec466","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Merge tag 'dm-4.2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fixes from Mike Snitzer:\n\n - revert a request-based DM core change that caused IO latency to\n   increase and adversely impact both throughput and system load\n\n - fix for a use after free bug in DM core's device cleanup\n\n - a couple DM btree removal fixes (used by dm-thinp)\n\n - a DM thinp fix for order-5 allocation failure\n\n - a DM thinp fix to not degrade to read-only metadata mode when in\n   out-of-data-space mode for longer than the 'no_space_timeout'\n\n - fix a long-standing oversight in both dm-thinp and dm-cache by now\n   exporting 'needs_check' in status if it was set in metadata\n\n - fix an embarrassing dm-cache busy-loop that caused worker threads to\n   eat cpu even if no IO was actively being issued to the cache device\n\n* tag 'dm-4.2-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n  dm cache: avoid calls to prealloc_free_structs() if possible\n  dm cache: avoid preallocation if no work in writeback_some_dirty_blocks()\n  dm cache: do not wake_worker() in free_migration()\n  dm cache: display 'needs_check' in status if it is set\n  dm thin: display 'needs_check' in status if it is set\n  dm thin: stay in out-of-data-space mode once no_space_timeout expires\n  dm: fix use after free crash due to incorrect cleanup sequence\n  Revert \"dm: only run the queue on completion if congested or no requests pending\"\n  dm btree: silence lockdep lock inversion in dm_btree_del()\n  dm thin: allocate the cell_sort_array dynamically\n  dm btree remove: fix bug in redistribute3","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/3f8476fe892c58c0583f98f17e98fd67c3fec466"},{"sha":"dfe91c9766578f2ec24ebf53b7fd07e288f170d1","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Merge tag 'rtc-v4.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull rtc fixes from Alexandre Belloni:\n \"A few fixes for the RTC susbsystem for 4.2.\n\n  The mt6397 driver was introduce in 4.2 so it is worth fixing before\n  the final release.  I though the compilation warning for armada38x was\n  fixed by akpm in commit f98b733e93e0 (\"rtc-armada38x.c: remove unused\n  local `flags'\") but he actually missed some occurrences of the\n  variables.  Since I received 4 patches for that, I think we can\n  include it now.\n\n  Summary:\n   - fix mt6397 wakealarm creation\n   - remove a compilation warning for armada38x that was forgotten\"\n\n* tag 'rtc-v4.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n  rtc: armada38x: Remove unused variable from armada38x_rtc_set_time()\n  rtc: mt6397: enable wakeup before registering rtc device","distinct":true,"url":"https://api.github.com/repos/torvalds/linux/commits/dfe91c9766578f2ec24ebf53b7fd07e288f170d1"}]}