Merge tag 'v3.10.88' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into linux-linaro-lsk-v3.10lsk-v3.10-15.09

This is the 3.10.88 stable release

* tag 'v3.10.88' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (48 commits)
  Linux 3.10.88
  arm64/mm: Remove hack in mmap randomize layout
  crypto: caam - fix memory corruption in ahash_final_ctx
  libfc: Fix fc_fcp_cleanup_each_cmd()
  drm/radeon: add new OLAND pci id
  EDAC, ppc4xx: Access mci->csrows array elements properly
  localmodconfig: Use Kbuild files too
  dm thin metadata: delete btrees when releasing metadata snapshot
  perf: Fix fasync handling on inherited events
  mm/hwpoison: fix page refcount of unknown non LRU page
  ipc/sem.c: update/correct memory barriers
  ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
  Linux 3.10.87
  mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations
  md/bitmap: return an error when bitmap superblock is corrupt.
  kvm: x86: fix kvm_apic_has_events to check for NULL pointer
  signal: fix information leak in copy_siginfo_from_user32
  signal: fix information leak in copy_siginfo_to_user
  signalfd: fix information leak in signalfd_copyinfo
  ARM: 7819/1: fiq: Cast the first argument of flush_icache_range()
  ...

1 files changed, 17 insertions, 5 deletions

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index f78cbbb88bd4..01677543248d 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -457,6 +457,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...)
 #  define rbd_assert(expr)	((void) 0)
 #endif /* !RBD_DEBUG */
 
+static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request);
 static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request);
 static void rbd_img_parent_read(struct rbd_obj_request *obj_request);
 static void rbd_dev_remove_parent(struct rbd_device *rbd_dev);
@@ -1670,6 +1671,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request)
 	obj_request_done_set(obj_request);
 }
 
+static void rbd_osd_call_callback(struct rbd_obj_request *obj_request)
+{
+	dout("%s: obj %p\n", __func__, obj_request);
+
+	if (obj_request_img_data_test(obj_request))
+		rbd_osd_copyup_callback(obj_request);
+	else
+		obj_request_done_set(obj_request);
+}
+
 static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
 				struct ceph_msg *msg)
 {
@@ -1708,6 +1719,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req,
 		rbd_osd_stat_callback(obj_request);
 		break;
 	case CEPH_OSD_OP_CALL:
+		rbd_osd_call_callback(obj_request);
+		break;
 	case CEPH_OSD_OP_NOTIFY_ACK:
 	case CEPH_OSD_OP_WATCH:
 		rbd_osd_trivial_callback(obj_request);
@@ -2305,13 +2318,15 @@ out_unwind:
 }
 
 static void
-rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
+rbd_osd_copyup_callback(struct rbd_obj_request *obj_request)
 {
 	struct rbd_img_request *img_request;
 	struct rbd_device *rbd_dev;
 	struct page **pages;
 	u32 page_count;
 
+	dout("%s: obj %p\n", __func__, obj_request);
+
 	rbd_assert(obj_request->type == OBJ_REQUEST_BIO);
 	rbd_assert(obj_request_img_data_test(obj_request));
 	img_request = obj_request->img_request;
@@ -2337,9 +2352,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request)
 	if (!obj_request->result)
 		obj_request->xferred = obj_request->length;
 
-	/* Finish up with the normal image object callback */
-
-	rbd_img_obj_callback(obj_request);
+	obj_request_done_set(obj_request);
 }
 
 static void
@@ -2436,7 +2449,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request)
 
 	/* All set, send it off. */
 
-	orig_request->callback = rbd_img_obj_copyup_callback;
 	osdc = &rbd_dev->rbd_client->client->osdc;
 	img_result = rbd_obj_request_submit(osdc, orig_request);
 	if (!img_result)