linux-libre-{pae,xen}-3.19.3_gnu-3: fix btrfs deadlock on mount and kernel panic on shutdown for intel graphics card users

6 files changed, 250 insertions, 2 deletions

diff --git a/kernels/linux-libre-pae/0001-fix-btrfs-mount-deadlock.patch b/kernels/linux-libre-pae/0001-fix-btrfs-mount-deadlock.patch
new file mode 100644
index 000000000..9430d5833
--- /dev/null
+++ b/kernels/linux-libre-pae/0001-fix-btrfs-mount-deadlock.patch
@@ -0,0 +1,43 @@
+From 9c4f61f01d269815bb7c37be3ede59c5587747c6 Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.cz>
+Date: Fri, 2 Jan 2015 19:12:57 +0100
+Subject: btrfs: simplify insert_orphan_item
+
+We can search and add the orphan item in one go,
+btrfs_insert_orphan_item will find out if the item already exists.
+
+Signed-off-by: David Sterba <dsterba@suse.cz>
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 5be45c1..25a1c36 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1254,21 +1254,13 @@ out:
+ }
+ 
+ static int insert_orphan_item(struct btrfs_trans_handle *trans,
+-			      struct btrfs_root *root, u64 offset)
++			      struct btrfs_root *root, u64 ino)
+ {
+ 	int ret;
+-	struct btrfs_path *path;
+-
+-	path = btrfs_alloc_path();
+-	if (!path)
+-		return -ENOMEM;
+ 
+-	ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID,
+-			offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
+-	if (ret > 0)
+-		ret = btrfs_insert_orphan_item(trans, root, offset);
+-
+-	btrfs_free_path(path);
++	ret = btrfs_insert_orphan_item(trans, root, ino);
++	if (ret == -EEXIST)
++		ret = 0;
+ 
+ 	return ret;
+ }
+-- 
+cgit v0.10.2
+
diff --git a/kernels/linux-libre-pae/0001-fixup-drm.patch b/kernels/linux-libre-pae/0001-fixup-drm.patch
new file mode 100644
index 000000000..2acfb1ea6
--- /dev/null
+++ b/kernels/linux-libre-pae/0001-fixup-drm.patch
@@ -0,0 +1,70 @@
+From 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 27 Feb 2015 12:58:13 +0100
+Subject: drm: Fixup racy refcounting in plane_force_disable
+
+Originally it was impossible to be dropping the last refcount in this
+function since there was always one around still from the idr. But in
+
+commit 83f45fc360c8e16a330474860ebda872d1384c8c
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date:   Wed Aug 6 09:10:18 2014 +0200
+
+    drm: Don't grab an fb reference for the idr
+
+we've switched to weak references, broke that assumption but forgot to
+fix it up.
+
+Since we still force-disable planes it's only possible to hit this
+when racing multiple rmfb with fbdev restoring or similar evil things.
+As long as userspace is nice it's impossible to hit the BUG_ON.
+
+But the BUG_ON would most likely be hit from fbdev code, which usually
+invovles the console_lock besides all modeset locks. So very likely
+we'd never get the bug reports if this was hit in the wild, hence
+better be safe than sorry and backport.
+
+Spotted by Matt Roper while reviewing other patches.
+
+[airlied: pull this back into 4.0 - the oops happens there]
+
+Cc: stable@vger.kernel.org
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index f6d04c7..679b10e 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
+ }
+ EXPORT_SYMBOL(drm_framebuffer_reference);
+ 
+-static void drm_framebuffer_free_bug(struct kref *kref)
+-{
+-	BUG();
+-}
+-
+-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+-{
+-	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
+-	kref_put(&fb->refcount, drm_framebuffer_free_bug);
+-}
+-
+ /**
+  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+  * @fb: fb to unregister
+@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
+ 		return;
+ 	}
+ 	/* disconnect the plane from the fb and crtc: */
+-	__drm_framebuffer_unreference(plane->old_fb);
++	drm_framebuffer_unreference(plane->old_fb);
+ 	plane->old_fb = NULL;
+ 	plane->fb = NULL;
+ 	plane->crtc = NULL;
+-- 
+cgit v0.10.2
+
diff --git a/kernels/linux-libre-pae/PKGBUILD b/kernels/linux-libre-pae/PKGBUILD
index ba527ceda..456d22836 100644
--- a/kernels/linux-libre-pae/PKGBUILD
+++ b/kernels/linux-libre-pae/PKGBUILD
@@ -18,7 +18,7 @@ _replacesoldmodules=() # '%' gets replaced with _kernelname
 _srcname=linux-${_pkgbasever%-*}
 _archpkgver=${_pkgver%-*}
 pkgver=${_pkgver//-/_}
-pkgrel=1.1
+pkgrel=3
 arch=('i686')
 url="http://linux-libre.fsfla.org/"
 license=('GPL2')
@@ -34,6 +34,8 @@ source=("http://linux-libre.fsfla.org/pub/linux-libre/releases/${_pkgbasever}/li
         'linux.preset'
         'logo_linux_'{clut224.ppm,vga16.ppm,mono.pbm}
         'change-default-console-loglevel.patch'
+        '0001-fix-btrfs-mount-deadlock.patch'
+        '0001-fixup-drm.patch'
         '0001-drm-i915-Dont-enable-CS_PARSER_ERROR-interrupts-at-all.patch')
 sha256sums=('2a60ec99ae498e7cdafac63ecca1c0ca07643eaa6c9a1a83f19e4daa3e75b9d9'
             'SKIP'
@@ -45,6 +47,8 @@ sha256sums=('2a60ec99ae498e7cdafac63ecca1c0ca07643eaa6c9a1a83f19e4daa3e75b9d9'
             '6de8a8319271809ffdb072b68d53d155eef12438e6d04ff06a5a4db82c34fa8a'
             '13bd7a8d9ed6b6bc971e4cd162262c5a20448a83796af39ce394d827b0e5de74'
             '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99'
+            '5967cf53cb9db9f070e8f346c3d7045748e4823a7fe2ee330acd18c9d02bbb77'
+            '911872ef7000af471e649aaeb3490094a0b4c1514ca1024757ca2e90ac1d2a3d'
             '66cb2d859b253bc4e793baa3c0b95523d647a773b957dbc79b3eaacccf8692b5')
 validpgpkeys=(
               '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva
@@ -75,6 +79,13 @@ prepare() {
   # (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
   patch -p1 -i "${srcdir}/change-default-console-loglevel.patch"
 
+  # fix #44495 and #44385 deadlock on btrfs mount
+  # https://btrfs.wiki.kernel.org/index.php/Gotchas
+  patch -Np1 -i "${srcdir}/0001-fix-btrfs-mount-deadlock.patch"
+
+  # fix #44491
+  patch -Np1 -i "${srcdir}/0001-fixup-drm.patch"
+
   # drm/i915: Stop gathering error states for CS error interrupts
   # https://bugzilla.kernel.org/show_bug.cgi?id=93171
   patch -p1 -i "${srcdir}/0001-drm-i915-Dont-enable-CS_PARSER_ERROR-interrupts-at-all.patch"
diff --git a/kernels/linux-libre-xen/0001-fix-btrfs-mount-deadlock.patch b/kernels/linux-libre-xen/0001-fix-btrfs-mount-deadlock.patch
new file mode 100644
index 000000000..9430d5833
--- /dev/null
+++ b/kernels/linux-libre-xen/0001-fix-btrfs-mount-deadlock.patch
@@ -0,0 +1,43 @@
+From 9c4f61f01d269815bb7c37be3ede59c5587747c6 Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.cz>
+Date: Fri, 2 Jan 2015 19:12:57 +0100
+Subject: btrfs: simplify insert_orphan_item
+
+We can search and add the orphan item in one go,
+btrfs_insert_orphan_item will find out if the item already exists.
+
+Signed-off-by: David Sterba <dsterba@suse.cz>
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 5be45c1..25a1c36 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1254,21 +1254,13 @@ out:
+ }
+ 
+ static int insert_orphan_item(struct btrfs_trans_handle *trans,
+-			      struct btrfs_root *root, u64 offset)
++			      struct btrfs_root *root, u64 ino)
+ {
+ 	int ret;
+-	struct btrfs_path *path;
+-
+-	path = btrfs_alloc_path();
+-	if (!path)
+-		return -ENOMEM;
+ 
+-	ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID,
+-			offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
+-	if (ret > 0)
+-		ret = btrfs_insert_orphan_item(trans, root, offset);
+-
+-	btrfs_free_path(path);
++	ret = btrfs_insert_orphan_item(trans, root, ino);
++	if (ret == -EEXIST)
++		ret = 0;
+ 
+ 	return ret;
+ }
+-- 
+cgit v0.10.2
+
diff --git a/kernels/linux-libre-xen/0001-fixup-drm.patch b/kernels/linux-libre-xen/0001-fixup-drm.patch
new file mode 100644
index 000000000..2acfb1ea6
--- /dev/null
+++ b/kernels/linux-libre-xen/0001-fixup-drm.patch
@@ -0,0 +1,70 @@
+From 8218c3f4df3bb1c637c17552405039a6dd3c1ee1 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Fri, 27 Feb 2015 12:58:13 +0100
+Subject: drm: Fixup racy refcounting in plane_force_disable
+
+Originally it was impossible to be dropping the last refcount in this
+function since there was always one around still from the idr. But in
+
+commit 83f45fc360c8e16a330474860ebda872d1384c8c
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date:   Wed Aug 6 09:10:18 2014 +0200
+
+    drm: Don't grab an fb reference for the idr
+
+we've switched to weak references, broke that assumption but forgot to
+fix it up.
+
+Since we still force-disable planes it's only possible to hit this
+when racing multiple rmfb with fbdev restoring or similar evil things.
+As long as userspace is nice it's impossible to hit the BUG_ON.
+
+But the BUG_ON would most likely be hit from fbdev code, which usually
+invovles the console_lock besides all modeset locks. So very likely
+we'd never get the bug reports if this was hit in the wild, hence
+better be safe than sorry and backport.
+
+Spotted by Matt Roper while reviewing other patches.
+
+[airlied: pull this back into 4.0 - the oops happens there]
+
+Cc: stable@vger.kernel.org
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index f6d04c7..679b10e 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -525,17 +525,6 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
+ }
+ EXPORT_SYMBOL(drm_framebuffer_reference);
+ 
+-static void drm_framebuffer_free_bug(struct kref *kref)
+-{
+-	BUG();
+-}
+-
+-static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+-{
+-	DRM_DEBUG("%p: FB ID: %d (%d)\n", fb, fb->base.id, atomic_read(&fb->refcount.refcount));
+-	kref_put(&fb->refcount, drm_framebuffer_free_bug);
+-}
+-
+ /**
+  * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+  * @fb: fb to unregister
+@@ -1320,7 +1309,7 @@ void drm_plane_force_disable(struct drm_plane *plane)
+ 		return;
+ 	}
+ 	/* disconnect the plane from the fb and crtc: */
+-	__drm_framebuffer_unreference(plane->old_fb);
++	drm_framebuffer_unreference(plane->old_fb);
+ 	plane->old_fb = NULL;
+ 	plane->fb = NULL;
+ 	plane->crtc = NULL;
+-- 
+cgit v0.10.2
+
diff --git a/kernels/linux-libre-xen/PKGBUILD b/kernels/linux-libre-xen/PKGBUILD
index 14b6e9902..a7428abd6 100644
--- a/kernels/linux-libre-xen/PKGBUILD
+++ b/kernels/linux-libre-xen/PKGBUILD
@@ -18,7 +18,7 @@ _replacesoldmodules=() # '%' gets replaced with _kernelname
 _srcname=linux-${_pkgbasever%-*}
 _archpkgver=${_pkgver%-*}
 pkgver=${_pkgver//-/_}
-pkgrel=1.1
+pkgrel=3
 arch=('i686')
 url="http://linux-libre.fsfla.org/"
 license=('GPL2')
@@ -34,6 +34,8 @@ source=("http://linux-libre.fsfla.org/pub/linux-libre/releases/${_pkgbasever}/li
         'linux.preset'
         'logo_linux_'{clut224.ppm,vga16.ppm,mono.pbm}
         'change-default-console-loglevel.patch'
+        '0001-fix-btrfs-mount-deadlock.patch'
+        '0001-fixup-drm.patch'
         '0001-drm-i915-Dont-enable-CS_PARSER_ERROR-interrupts-at-all.patch')
 sha256sums=('2a60ec99ae498e7cdafac63ecca1c0ca07643eaa6c9a1a83f19e4daa3e75b9d9'
             'SKIP'
@@ -45,6 +47,8 @@ sha256sums=('2a60ec99ae498e7cdafac63ecca1c0ca07643eaa6c9a1a83f19e4daa3e75b9d9'
             '6de8a8319271809ffdb072b68d53d155eef12438e6d04ff06a5a4db82c34fa8a'
             '13bd7a8d9ed6b6bc971e4cd162262c5a20448a83796af39ce394d827b0e5de74'
             '1256b241cd477b265a3c2d64bdc19ffe3c9bbcee82ea3994c590c2c76e767d99'
+            '5967cf53cb9db9f070e8f346c3d7045748e4823a7fe2ee330acd18c9d02bbb77'
+            '911872ef7000af471e649aaeb3490094a0b4c1514ca1024757ca2e90ac1d2a3d'
             '66cb2d859b253bc4e793baa3c0b95523d647a773b957dbc79b3eaacccf8692b5')
 validpgpkeys=(
               '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva
@@ -75,6 +79,13 @@ prepare() {
   # (relevant patch sent upstream: https://lkml.org/lkml/2011/7/26/227)
   patch -p1 -i "${srcdir}/change-default-console-loglevel.patch"
 
+  # fix #44495 and #44385 deadlock on btrfs mount
+  # https://btrfs.wiki.kernel.org/index.php/Gotchas
+  patch -Np1 -i "${srcdir}/0001-fix-btrfs-mount-deadlock.patch"
+
+  # fix #44491
+  patch -Np1 -i "${srcdir}/0001-fixup-drm.patch"
+
   # drm/i915: Stop gathering error states for CS error interrupts
   # https://bugzilla.kernel.org/show_bug.cgi?id=93171
   patch -p1 -i "${srcdir}/0001-drm-i915-Dont-enable-CS_PARSER_ERROR-interrupts-at-all.patch"