---

yaml
---
r: 57001
b: refs/heads/master
c: bb31223
h: refs/heads/master
i:
  56999: 4824755
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: d9b08b9efece1f397143378938e626d0de29e911
+refs/heads/master: bb312235933689fb0f973ae61d19d7416de1e085

trunk/drivers/ata/sata_promise.c

@@ -297,7 +297,7 @@ static const struct ata_port_info pdc_port_info[] = {
 
 	/* board_2057x_pata */
 	{
-		.flags		= PDC_COMMON_FLAGS | ATA_FLAG_SLAVE_POSS,
+		.flags		= PDC_COMMON_FLAGS | ATA_FLAG_SLAVE_POSS |
 				  PDC_FLAG_GEN_II,
 		.pio_mask	= 0x1f, /* pio0-4 */
 		.mwdma_mask	= 0x07, /* mwdma0-2 */

trunk/fs/ocfs2/aops.c

@@ -222,10 +222,7 @@ static int ocfs2_readpage(struct file *file, struct page *page)
 		goto out;
 	}
 
-	if (down_read_trylock(&OCFS2_I(inode)->ip_alloc_sem) == 0) {
-		ret = AOP_TRUNCATED_PAGE;
-		goto out_meta_unlock;
-	}
+	down_read(&OCFS2_I(inode)->ip_alloc_sem);
 
 	/*
 	 * i_size might have just been updated as we grabed the meta lock.  We
@@ -238,7 +235,10 @@ static int ocfs2_readpage(struct file *file, struct page *page)
 	 * XXX sys_readahead() seems to get that wrong?
 	 */
 	if (start >= i_size_read(inode)) {
-		zero_user_page(page, 0, PAGE_SIZE, KM_USER0);
+		char *addr = kmap(page);
+		memset(addr, 0, PAGE_SIZE);
+		flush_dcache_page(page);
+		kunmap(page);
 		SetPageUptodate(page);
 		ret = 0;
 		goto out_alloc;
@@ -258,7 +258,6 @@ static int ocfs2_readpage(struct file *file, struct page *page)
 	ocfs2_data_unlock(inode, 0);
 out_alloc:
 	up_read(&OCFS2_I(inode)->ip_alloc_sem);
-out_meta_unlock:
 	ocfs2_meta_unlock(inode, 0);
 out:
 	if (unlock)

trunk/fs/ocfs2/file.c

@@ -326,7 +326,6 @@ static int ocfs2_truncate_file(struct inode *inode,
 		   (unsigned long long)OCFS2_I(inode)->ip_blkno,
 		   (unsigned long long)new_i_size);
 
-	unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
 	truncate_inode_pages(inode->i_mapping, new_i_size);
 
 	fe = (struct ocfs2_dinode *) di_bh->b_data;
@@ -1419,6 +1418,36 @@ static ssize_t ocfs2_file_buffered_write(struct file *file, loff_t *ppos,
 	return total ? total : ret;
 }
 
+static int ocfs2_check_iovec(const struct iovec *iov, size_t *counted,
+			     unsigned long *nr_segs)
+{
+	size_t ocount;		/* original count */
+	unsigned long seg;
+
+	ocount = 0;
+	for (seg = 0; seg < *nr_segs; seg++) {
+		const struct iovec *iv = &iov[seg];
+
+		/*
+		 * If any segment has a negative length, or the cumulative
+		 * length ever wraps negative then return -EINVAL.
+		 */
+		ocount += iv->iov_len;
+		if (unlikely((ssize_t)(ocount|iv->iov_len) < 0))
+			return -EINVAL;
+		if (access_ok(VERIFY_READ, iv->iov_base, iv->iov_len))
+			continue;
+		if (seg == 0)
+			return -EFAULT;
+		*nr_segs = seg;
+		ocount -= iv->iov_len;	/* This segment is no good */
+		break;
+	}
+
+	*counted = ocount;
+	return 0;
+}
+
 static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
 				    const struct iovec *iov,
 				    unsigned long nr_segs,
@@ -1441,7 +1470,7 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
 	if (iocb->ki_left == 0)
 		return 0;
 
-	ret = generic_segment_checks(iov, &nr_segs, &ocount, VERIFY_READ);
+	ret = ocfs2_check_iovec(iov, &ocount, &nr_segs);
 	if (ret)
 		return ret;
 

trunk/fs/ocfs2/localalloc.c

@@ -471,6 +471,9 @@ int ocfs2_reserve_local_alloc_bits(struct ocfs2_super *osb,
 
 	mutex_lock(&local_alloc_inode->i_mutex);
 
+	ac->ac_inode = local_alloc_inode;
+	ac->ac_which = OCFS2_AC_USE_LOCAL;
+
 	if (osb->local_alloc_state != OCFS2_LA_ENABLED) {
 		status = -ENOSPC;
 		goto bail;
@@ -508,14 +511,10 @@ int ocfs2_reserve_local_alloc_bits(struct ocfs2_super *osb,
 		}
 	}
 
-	ac->ac_inode = local_alloc_inode;
-	ac->ac_which = OCFS2_AC_USE_LOCAL;
 	get_bh(osb->local_alloc_bh);
 	ac->ac_bh = osb->local_alloc_bh;
 	status = 0;
 bail:
-	if (status < 0 && local_alloc_inode)
-		iput(local_alloc_inode);
 
 	mlog_exit(status);
 	return status;