Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1219064 > unrolled thread
| Started by | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| First post | 2015-09-04 16:00 +0200 |
| Last post | 2015-09-04 16:00 +0200 |
| Articles | 13 — 1 participant |
Back to article view | Back to linux.kernel
[3.16.y-ckt stable] Linux 3.16.7-ckt17 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 006/130] iscsi-target: Fix use-after-free during TPG session shutdown Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 025/130] netfilter: ctnetlink: put back references to master ct and expect objects Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 013/130] xfs: remote attribute headers contain an invalid LSN Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 004/130] ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 032/130] net/mlx4_core: Fix wrong index in propagating port change event to VFs Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 003/130] sysfs: Create mountpoints with sysfs_create_mount_point Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 005/130] ASoC: pcm1681: Fix setting de-emphasis sampling rate selection Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 014/130] xfs: remote attributes need to be considered data Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 026/130] ipvs: do not use random local source address for tunnels Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 021/130] ipr: Fix incorrect trace indexing Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 022/130] ipr: Fix invalid array indexing for HRRQ Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
[PATCH 3.16.y-ckt 016/130] ALSA: usb-audio: add dB range mapping for some devices Luis Henriques <luis.henriques@canonical.com> - 2015-09-04 16:00 +0200
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [3.16.y-ckt stable] Linux 3.16.7-ckt17 stable review |
| Message-ID | <q4YUF-2WE-7@gated-at.bofh.it> |
This is the start of the review cycle for the Linux 3.16.7-ckt17 stable kernel.
This version contains 130 new patches, summarized below. The new patches are
posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-3.16.y-review
The review period for version 3.16.7-ckt17 will be open for the next three days.
To report a problem, please reply to the relevant follow-up patch message.
For more information about the Linux 3.16.y-ckt extended stable kernel version,
see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Luis
--
Documentation/ABI/testing/ima_policy | 6 +-
arch/arm/boot/dts/imx35.dtsi | 8 +-
arch/arm/mach-omap2/omap_hwmod.c | 24 ++-
arch/arm64/kernel/efi.c | 4 +-
arch/arm64/kernel/signal32.c | 5 +-
arch/arm64/kvm/inject_fault.c | 12 +-
arch/avr32/mach-at32ap/clock.c | 20 +-
arch/mips/include/asm/pgtable.h | 31 +++
arch/mips/include/asm/stackframe.h | 25 +++
arch/mips/kernel/mips-mt-fpaff.c | 5 +-
arch/mips/kernel/scall64-64.S | 2 +-
arch/mips/kernel/scall64-n32.S | 2 +-
arch/mips/kernel/signal32.c | 2 -
arch/mips/kernel/traps.c | 13 ++
arch/mips/mti-malta/malta-time.c | 15 +-
arch/powerpc/kernel/signal_32.c | 2 -
arch/s390/hypfs/inode.c | 12 +-
arch/sparc/include/asm/visasm.h | 16 +-
arch/sparc/lib/NG4memcpy.S | 5 +-
arch/sparc/lib/VISsave.S | 67 +------
arch/sparc/lib/ksyms.c | 4 -
arch/x86/boot/compressed/eboot.c | 4 +
arch/x86/include/asm/desc.h | 15 --
arch/x86/include/asm/mmu.h | 3 +-
arch/x86/include/asm/mmu_context.h | 48 ++++-
arch/x86/kernel/cpu/common.c | 4 +-
arch/x86/kernel/cpu/perf_event.c | 13 +-
arch/x86/kernel/ldt.c | 262 ++++++++++++++-----------
arch/x86/kernel/process_64.c | 4 +-
arch/x86/kernel/step.c | 8 +-
arch/x86/kvm/x86.c | 2 +-
arch/x86/math-emu/fpu_entry.c | 3 +-
arch/x86/math-emu/fpu_system.h | 21 +-
arch/x86/math-emu/get_address.c | 3 +-
arch/x86/power/cpu.c | 3 +-
arch/x86/xen/enlighten.c | 40 ++++
drivers/ata/libata-core.c | 1 +
drivers/base/firmware_class.c | 16 +-
drivers/base/regmap/regcache-rbtree.c | 19 +-
drivers/block/rbd.c | 22 ++-
drivers/block/xen-blkback/blkback.c | 4 +-
drivers/block/xen-blkfront.c | 6 +-
drivers/crypto/caam/caamhash.c | 7 +-
drivers/crypto/ixp4xx_crypto.c | 1 -
drivers/edac/ppc4xx_edac.c | 2 +-
drivers/firmware/efi/efi.c | 6 +-
drivers/gpu/drm/i915/i915_drv.h | 17 +-
drivers/gpu/drm/radeon/radeon_combios.c | 7 +-
drivers/gpu/drm/radeon/radeon_irq_kms.c | 5 +
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
drivers/md/bitmap.c | 2 +
drivers/md/dm-thin-metadata.c | 4 +-
drivers/md/md.c | 2 +-
drivers/md/persistent-data/dm-btree-internal.h | 6 +
drivers/md/persistent-data/dm-btree-remove.c | 12 +-
drivers/md/persistent-data/dm-btree-spine.c | 37 ++++
drivers/md/persistent-data/dm-btree.c | 7 +-
drivers/md/raid1.c | 10 +-
drivers/mfd/arizona-core.c | 14 +-
drivers/net/bonding/bond_main.c | 20 ++
drivers/net/ethernet/brocade/bna/bnad.c | 2 +-
drivers/net/ethernet/mellanox/mlx4/eq.c | 4 +-
drivers/net/ethernet/sun/niu.c | 4 +-
drivers/s390/char/sclp_early.c | 1 +
drivers/scsi/ipr.c | 28 ++-
drivers/scsi/ipr.h | 1 +
drivers/scsi/libfc/fc_exch.c | 8 +-
drivers/scsi/libfc/fc_fcp.c | 19 +-
drivers/scsi/libiscsi.c | 25 +--
drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 +-
drivers/scsi/qla2xxx/qla_isr.c | 17 +-
drivers/scsi/scsi_pm.c | 22 +--
drivers/target/iscsi/iscsi_target.c | 50 ++++-
drivers/target/iscsi/iscsi_target_core.h | 1 +
drivers/target/iscsi/iscsi_target_login.c | 43 ++--
drivers/target/iscsi/iscsi_target_login.h | 3 +-
drivers/target/iscsi/iscsi_target_nego.c | 34 +++-
drivers/target/target_core_spc.c | 13 +-
drivers/thermal/samsung/exynos_tmu.c | 2 +
drivers/usb/host/xhci-mem.c | 3 +-
drivers/usb/host/xhci-ring.c | 2 +-
drivers/usb/serial/option.c | 2 +
drivers/usb/serial/qcserial.c | 2 +-
drivers/usb/serial/sierra.c | 1 +
drivers/vhost/vhost.c | 1 +
drivers/xen/gntdev.c | 42 ++--
fs/buffer.c | 45 +++--
fs/configfs/mount.c | 10 +-
fs/debugfs/inode.c | 11 +-
fs/ext4/extents.c | 6 +-
fs/fuse/inode.c | 9 +-
fs/nfs/inode.c | 8 +-
fs/nfsd/nfs4xdr.c | 11 +-
fs/notify/mark.c | 30 ++-
fs/ocfs2/dlmglue.c | 10 +-
fs/pstore/inode.c | 12 +-
fs/signalfd.c | 5 +-
fs/xfs/xfs_attr_remote.c | 44 ++++-
fs/xfs/xfs_log_recover.c | 11 +-
include/drm/drm_pciids.h | 1 +
include/linux/buffer_head.h | 54 ++++-
include/linux/compiler.h | 15 ++
include/net/act_api.h | 8 +-
include/net/ip.h | 1 +
include/uapi/linux/pci_regs.h | 1 +
ipc/mqueue.c | 5 -
ipc/sem.c | 46 ++++-
kernel/cgroup.c | 10 +-
kernel/events/core.c | 87 +++++---
kernel/signal.c | 7 +-
mm/memory-failure.c | 2 +
mm/vmscan.c | 14 +-
net/batman-adv/soft-interface.c | 3 +
net/batman-adv/translation-table.c | 29 ++-
net/bridge/br_mdb.c | 1 +
net/core/datagram.c | 57 +++++-
net/core/dev.c | 30 +--
net/core/pktgen.c | 4 +-
net/core/rtnetlink.c | 166 ++++++++--------
net/ipv4/af_inet.c | 2 +-
net/ipv4/datagram.c | 16 +-
net/ipv4/gre_offload.c | 2 +-
net/ipv4/udp.c | 15 +-
net/ipv6/datagram.c | 20 +-
net/ipv6/ip6_gre.c | 1 +
net/ipv6/ip6_offload.c | 2 +-
net/key/af_key.c | 46 ++---
net/mpls/mpls_gso.c | 2 +-
net/netfilter/ipvs/ip_vs_core.c | 16 +-
net/netfilter/ipvs/ip_vs_ctl.c | 78 +++++---
net/netfilter/ipvs/ip_vs_sched.c | 12 +-
net/netfilter/ipvs/ip_vs_sync.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 1 -
net/netfilter/nf_conntrack_expect.c | 3 +-
net/netfilter/nf_conntrack_netlink.c | 5 -
net/netlink/af_netlink.c | 79 +++++---
net/packet/af_packet.c | 11 +-
net/rds/info.c | 2 +-
net/sched/act_api.c | 11 +-
net/sched/act_pedit.c | 5 +-
net/tipc/socket.c | 1 +
scripts/kconfig/streamline_config.pl | 2 +-
security/inode.c | 10 +-
security/integrity/ima/ima_policy.c | 47 ++++-
security/selinux/selinuxfs.c | 11 +-
security/smack/smackfs.c | 8 +-
sound/firewire/amdtp.c | 5 +-
sound/firewire/amdtp.h | 2 +
sound/firewire/fireworks/fireworks.c | 8 +
sound/firewire/fireworks/fireworks.h | 1 +
sound/firewire/fireworks/fireworks_stream.c | 9 +
sound/pci/hda/patch_cirrus.c | 4 +-
sound/pci/hda/patch_realtek.c | 3 +-
sound/pci/hda/patch_sigmatel.c | 3 +-
sound/soc/codecs/pcm1681.c | 2 +-
sound/usb/card.c | 2 +-
sound/usb/mixer_maps.c | 24 +++
159 files changed, 1606 insertions(+), 900 deletions(-)
Alan Stern (1):
SCSI: Fix NULL pointer dereference in runtime PM
Alex Deucher (2):
drm/radeon/combios: add some validation of lvds values
drm/radeon: add new OLAND pci id
Alexander Drozdov (1):
packet: tpacket_snd(): fix signed/unsigned comparison
Alexei Potashnik (1):
target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT
Amanieu d'Antras (3):
signalfd: fix information leak in signalfd_copyinfo
signal: fix information leak in copy_siginfo_to_user
signal: fix information leak in copy_siginfo_from_user32
Andy Lutomirski (3):
x86/xen: Probe target addresses in set_aliased_prot() before the hypercall
x86/ldt: Make modify_ldt synchronous
x86/ldt: Further fix FPU emulation
Andy Shevchenko (1):
avr32: handle NULL as a valid clock object
Ard Biesheuvel (1):
arm64/efi: map the entire UEFI vendor string before reading it
Axel Lin (1):
ASoC: pcm1681: Fix setting de-emphasis sampling rate selection
Bart Van Assche (2):
libfc: Fix fc_exch_recv_req() error path
libfc: Fix fc_fcp_cleanup_each_cmd()
Benjamin Randazzo (1):
md: use kzalloc() when bitmap is disabled
Bob Liu (2):
xen-blkfront: don't add indirect pages to list when !feature_persistent
xen-blkback: replace work_pending with work_busy in purge_persistent_gnt()
Brian King (3):
ipr: Fix locking for unit attention handling
ipr: Fix incorrect trace indexing
ipr: Fix invalid array indexing for HRRQ
Chad Dupuis (1):
qla2xxx: Mark port lost when we receive an RSCN for it.
Charles Keepax (1):
mfd: arizona: Fix initialisation of the PM runtime
Chris Wilson (1):
drm/i915: Replace WARN inside I915_READ64_2x32 with retry loop
Christoph Hellwig (1):
megaraid_sas: use raw_smp_processor_id()
Dan Carpenter (2):
ALSA: hda - fix cs4210_spdif_automute()
rds: fix an integer overflow test in rds_info_getsockopt()
Daniel Borkmann (2):
net: sched: fix refcount imbalance in actions
rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver
Dave Airlie (1):
drm/radeon: fix hotplug race at startup
Dave Chinner (2):
xfs: remote attribute headers contain an invalid LSN
xfs: remote attributes need to be considered data
David Ahern (1):
net: Fix RCU splat in af_key
David Daney (1):
MIPS: Make set_pte() SMP safe.
David S. Miller (1):
sparc64: Fix userspace FPU register corruptions.
David Vrabel (1):
xen/gntdev: convert priv->lock to a mutex
Denis Carikli (1):
ARM: dts: i.MX35: Fix can support.
Dirk Behme (1):
USB: sierra: add 1199:68AB device ID
Dmitry Skorodumov (1):
x86/efi: Use all 64 bit of efi_memmap in setup_e820()
Eric Dumazet (2):
ipv6: lock socket in ip6_datagram_connect()
udp: fix dst races with multicast early demux
Eric W. Biederman (1):
sysfs: Create mountpoints with sysfs_create_mount_point
Felix Fietkau (1):
MIPS: Fix sched_getaffinity with MT FPAFF enabled
Florian Westphal (2):
netlink: don't hold mutex in rcu callback when releasing mmapd ring
net: gso: use feature flag argument in all protocol gso handlers
Gavin Shan (1):
drivers/usb: Delete XHCI command timer if necessary
Gioh Kim (1):
fs/buffer.c: support buffer cache allocations with gfp modifiers
Guenter Roeck (1):
regmap: regcache-rbtree: Clean new present bits on present bitmap resize
Guillermo A. Amaral (1):
Add factory recertified Crucial M500s to blacklist
Haozhong Zhang (1):
KVM: x86: Use adjustment in guest cycles when handling MSR_IA32_TSC_ADJUST
Herbert Xu (4):
crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer
net: Clone skb before setting peeked flag
net: Fix skb csum races when peeking
net: Fix skb_set_peeked use-after-free bug
Herton R. Krzesinski (2):
HID: usbhid: add Chicony/Pixart usb optical mouse that needs QUIRK_ALWAYS_POLL
ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits
Horia Geant? (1):
crypto: caam - fix memory corruption in ahash_final_ctx
Ilya Dryomov (1):
rbd: fix copyup completion race
Ivan Vecera (1):
bna: fix interrupts storm caused by erroneous packets
Jack Morgenstein (1):
net/mlx4_core: Fix wrong index in propagating port change event to VFs
James Hogan (4):
MIPS: Malta: Don't reinitialise RTC
MIPS: do_mcheck: Fix kernel code dump with EVA
MIPS: show_stack: Fix stack trace with EVA
MIPS: Flush RPS on kernel entry with EVA
Jan Kara (1):
fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()
Jiri Pirko (1):
niu: don't count tx error twice in case of headroom realloc fails
Joe Stringer (1):
netfilter: nf_conntrack: Support expectations in different zones
Joe Thornber (2):
dm thin metadata: delete btrees when releasing metadata snapshot
dm btree: add ref counting ops for the leaves of top level btrees
John Soni Jose (1):
libiscsi: Fix host busy blocking during connection teardown
Joseph Qi (1):
ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()
Juergen Gross (2):
x86/ldt: Correct LDT access in single stepping logic
x86/ldt: Correct FPU emulation access to LDT
Julian Anastasov (4):
ipvs: do not use random local source address for tunnels
ipvs: fix crash if scheduler is changed
ipvs: fix crash with sync protocol v0 and FTP
net: call rcu_read_lock early in process_backlog
Kinglong Mee (1):
nfsd: Drop BUG_ON and ignore SECLABEL on absent filesystem
Krzysztof Kozlowski (1):
thermal: exynos: Disable the regulator on probe failure
Lars Westerhoff (1):
packet: missing dev_put() in packet_do_bind()
Linus Torvalds (1):
Fix firmware loader uevent buffer NULL pointer dereference
Manfred Spraul (2):
ipc/sem.c: change memory barrier in sem_lock() to smp_rmb()
ipc/sem.c: update/correct memory barriers
Marc Zyngier (1):
arm64: KVM: Fix host crash when injecting a fault into a 32bit guest
Marc-André Lureau (1):
vhost: actually track log eventfd file
Marcus Gelderie (1):
ipc: modify message queue accounting to not take kernel data structures into account
Marek Lindner (2):
batman-adv: fix kernel crash due to missing NULL checks
batman-adv: protect tt_local_entry from concurrent delete events
Marek Marczykowski-Górecki (1):
xen/gntdevt: Fix race condition in gntdev_release()
Markos Chandras (1):
MIPS: Fix seccomp syscall argument for MIPS64
Mathias Nyman (1):
xhci: fix off by one error in TRB DMA address boundary check
Michael S. Tsirkin (1):
PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition
Michael Walle (1):
EDAC, ppc4xx: Access mci->csrows array elements properly
Michal Hocko (1):
mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations
Mimi Zohar (2):
ima: add support for new "euid" policy condition
ima: extend "mask" policy matching support
NeilBrown (2):
md/bitmap: return an error when bitmap superblock is corrupt.
md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies
Nicholas Bellinger (3):
iscsi-target: Fix use-after-free during TPG session shutdown
iscsi-target: Fix iscsit_start_kthreads failure OOPs
iscsi-target: Fix iser explicit logout TX kthread leak
Nikolay Aleksandrov (1):
bridge: mdb: fix delmdb state in the notification
Nikolay Borisov (2):
bufferhead: Add _gfp version for sb_getblk()
ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp
Oleg Nesterov (1):
net: pktgen: fix race between pktgen_thread_worker() and kthread_stop()
Pablo Neira Ayuso (1):
netfilter: ctnetlink: put back references to master ct and expect objects
Paul E. McKenney (1):
rcu: Provide counterpart to rcu_dereference() for non-RCU situations
Peter Zijlstra (3):
perf: Fix fasync handling on inherited events
rcu: Move lockless_dereference() out of rcupdate.h
perf: Fix PERF_EVENT_IOC_PERIOD migration race
Pieter Hollants (1):
USB: qcserial: Add support for Dell Wireless 5809e 4G Modem
Reinhard Speyerer (1):
USB: qcserial/option: make AT URCs work for Sierra Wireless MC7305/MC7355
Richard Weinberger (1):
localmodconfig: Use Kbuild files too
Roger Quadros (1):
ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc
Roland Dreier (1):
target: REPORT LUNS should return LUN 0 even for dynamic ACLs
Sebastian Ott (1):
s390/sclp: fix compile error
Stephen Smalley (1):
net/tipc: initialize security state for new connection socket
Takashi Iwai (4):
ALSA: hda - Apply fixup for another Toshiba Satellite S50D
ALSA: hda - Apply a fixup to Dell Vostro 5480
ALSA: hda - Fix MacBook Pro 5,2 quirk
ALSA: usb-audio: Fix runtime PM unbalance
Takashi Sakamoto (1):
ALSA: fireworks/firewire-lib: add support for recent firmware quirk
Thomas Hellstrom (1):
drm/vmwgfx: Fix execbuf locking issues
Trond Myklebust (1):
NFS: Don't revalidate the mapping if both size and change attr are up to date
WANG Cong (1):
act_pedit: check binding before calling tcf_hash_release()
Wanpeng Li (1):
mm/hwpoison: fix page refcount of unknown non LRU page
Yao-Wen Mao (1):
ALSA: usb-audio: add dB range mapping for some devices
dingtianhong (1):
bonding: correct the MAC address for "follow" fail_over_mac policy
huaibin Wang (1):
ip6_gre: release cached dst on tunnel removal
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 006/130] iscsi-target: Fix use-after-free during TPG session shutdown |
| Message-ID | <q4ZH6-3Ud-63@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 417c20a9bdd1e876384127cf096d8ae8b559066c upstream.
This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.
The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.
To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.
As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.
Reported-by: Sunilkumar Nadumuttlu <sjn@datera.io>
Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/target/iscsi/iscsi_target.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 8932cb2e9165..d19559fd6d45 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4736,6 +4736,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
struct iscsi_session *sess;
struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
struct se_session *se_sess, *se_sess_tmp;
+ LIST_HEAD(free_list);
int session_count = 0;
spin_lock_bh(&se_tpg->session_lock);
@@ -4757,14 +4758,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
}
atomic_set(&sess->session_reinstatement, 1);
spin_unlock(&sess->conn_lock);
- spin_unlock_bh(&se_tpg->session_lock);
- iscsit_free_session(sess);
- spin_lock_bh(&se_tpg->session_lock);
+ list_move_tail(&se_sess->sess_list, &free_list);
+ }
+ spin_unlock_bh(&se_tpg->session_lock);
+ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
+ iscsit_free_session(sess);
session_count++;
}
- spin_unlock_bh(&se_tpg->session_lock);
pr_debug("Released %d iSCSI Session(s) from Target Portal"
" Group: %hu\n", session_count, tpg->tpgt);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 025/130] netfilter: ctnetlink: put back references to master ct and expect objects |
| Message-ID | <q4ZH6-3Ud-55@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 95dd8653de658143770cb0e55a58d2aab97c79d2 upstream.
We have to put back the references to the master conntrack and the expectation
that we just created, otherwise we'll leak them.
Fixes: 0ef71ee1a5b9 ("netfilter: ctnetlink: refactor ctnetlink_create_expect")
Reported-by: Tim Wiess <Tim.Wiess@watchguard.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/netfilter/nf_conntrack_netlink.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 300ed1eec729..3f96dbd25389 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2957,11 +2957,6 @@ ctnetlink_create_expect(struct net *net, u16 zone,
}
err = nf_ct_expect_related_report(exp, portid, report);
- if (err < 0)
- goto err_exp;
-
- return 0;
-err_exp:
nf_ct_expect_put(exp);
err_ct:
nf_ct_put(ct);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 013/130] xfs: remote attribute headers contain an invalid LSN |
| Message-ID | <q4ZH6-3Ud-69@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit e3c32ee9e3e747fec01eb38e6610a9157d44c3ea upstream.
In recent testing, a system that crashed failed log recovery on
restart with a bad symlink buffer magic number:
XFS (vda): Starting recovery (logdev: internal)
XFS (vda): Bad symlink block magic!
XFS: Assertion failed: 0, file: fs/xfs/xfs_log_recover.c, line: 2060
On examination of the log via xfs_logprint, none of the symlink
buffers in the log had a bad magic number, nor were any other types
of buffer log format headers mis-identified as symlink buffers.
Tracing was used to find the buffer the kernel was tripping over,
and xfs_db identified it's contents as:
000: 5841524d 00000000 00000346 64d82b48 8983e692 d71e4680 a5f49e2c b317576e
020: 00000000 00602038 00000000 006034ce d0020000 00000000 4d4d4d4d 4d4d4d4d
040: 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
060: 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d 4d4d4d4d
.....
This is a remote attribute buffer, which are notable in that they
are not logged but are instead written synchronously by the remote
attribute code so that they exist on disk before the attribute
transactions are committed to the journal.
The above remote attribute block has an invalid LSN in it - cycle
0xd002000, block 0 - which means when log recovery comes along to
determine if the transaction that writes to the underlying block
should be replayed, it sees a block that has a future LSN and so
does not replay the buffer data in the transaction. Instead, it
validates the buffer magic number and attaches the buffer verifier
to it. It is this buffer magic number check that is failing in the
above assert, indicating that we skipped replay due to the LSN of
the underlying buffer.
The problem here is that the remote attribute buffers cannot have a
valid LSN placed into them, because the transaction that contains
the attribute tree pointer changes and the block allocation that the
attribute data is being written to hasn't yet been committed. Hence
the LSN field in the attribute block is completely unwritten,
thereby leaving the underlying contents of the block in the LSN
field. It could have any value, and hence a future overwrite of the
block by log recovery may or may not work correctly.
Fix this by always writing an invalid LSN to the remote attribute
block, as any buffer in log recovery that needs to write over the
remote attribute should occur. We are protected from having old data
written over the attribute by the fact that freeing the block before
the remote attribute is written will result in the buffer being
marked stale in the log and so all changes prior to the buffer stale
transaction will be cancelled by log recovery.
Hence it is safe to ignore the LSN in the case or synchronously
written, unlogged metadata such as remote attribute blocks, and to
ensure we do that correctly, we need to write an invalid LSN to all
remote attribute blocks to trigger immediate recovery of metadata
that is written over the top.
As a further protection for filesystems that may already have remote
attribute blocks with bad LSNs on disk, change the log recovery code
to always trigger immediate recovery of metadata over remote
attribute blocks.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
[ luis: backported to 3.16:
- use 'EFSCORRUPTED' instead of '-EFSCORRUPTED' in xfs_buf_ioerror() ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/xfs/xfs_attr_remote.c | 29 +++++++++++++++++++++++------
fs/xfs/xfs_log_recover.c | 11 ++++++++---
2 files changed, 31 insertions(+), 9 deletions(-)
diff --git a/fs/xfs/xfs_attr_remote.c b/fs/xfs/xfs_attr_remote.c
index b5adfecbb8ee..6a837e4a35f0 100644
--- a/fs/xfs/xfs_attr_remote.c
+++ b/fs/xfs/xfs_attr_remote.c
@@ -161,11 +161,10 @@ xfs_attr3_rmt_write_verify(
struct xfs_buf *bp)
{
struct xfs_mount *mp = bp->b_target->bt_mount;
- struct xfs_buf_log_item *bip = bp->b_fspriv;
+ int blksize = mp->m_attr_geo->blksize;
char *ptr;
int len;
xfs_daddr_t bno;
- int blksize = mp->m_attr_geo->blksize;
/* no verification of non-crc buffers */
if (!xfs_sb_version_hascrc(&mp->m_sb))
@@ -177,16 +176,22 @@ xfs_attr3_rmt_write_verify(
ASSERT(len >= blksize);
while (len > 0) {
+ struct xfs_attr3_rmt_hdr *rmt = (struct xfs_attr3_rmt_hdr *)ptr;
+
if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
xfs_buf_ioerror(bp, EFSCORRUPTED);
xfs_verifier_error(bp);
return;
}
- if (bip) {
- struct xfs_attr3_rmt_hdr *rmt;
- rmt = (struct xfs_attr3_rmt_hdr *)ptr;
- rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
+ /*
+ * Ensure we aren't writing bogus LSNs to disk. See
+ * xfs_attr3_rmt_hdr_set() for the explanation.
+ */
+ if (rmt->rm_lsn != cpu_to_be64(NULLCOMMITLSN)) {
+ xfs_buf_ioerror(bp, EFSCORRUPTED);
+ xfs_verifier_error(bp);
+ return;
}
xfs_update_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF);
@@ -223,6 +228,18 @@ xfs_attr3_rmt_hdr_set(
rmt->rm_owner = cpu_to_be64(ino);
rmt->rm_blkno = cpu_to_be64(bno);
+ /*
+ * Remote attribute blocks are written synchronously, so we don't
+ * have an LSN that we can stamp in them that makes any sense to log
+ * recovery. To ensure that log recovery handles overwrites of these
+ * blocks sanely (i.e. once they've been freed and reallocated as some
+ * other type of metadata) we need to ensure that the LSN has a value
+ * that tells log recovery to ignore the LSN and overwrite the buffer
+ * with whatever is in it's log. To do this, we use the magic
+ * NULLCOMMITLSN to indicate that the LSN is invalid.
+ */
+ rmt->rm_lsn = cpu_to_be64(NULLCOMMITLSN);
+
return sizeof(struct xfs_attr3_rmt_hdr);
}
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 8c962890fe17..dae4723a02bf 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -2044,9 +2044,14 @@ xlog_recover_get_buf_lsn(
uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
break;
case XFS_ATTR3_RMT_MAGIC:
- lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
- uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
- break;
+ /*
+ * Remote attr blocks are written synchronously, rather than
+ * being logged. That means they do not contain a valid LSN
+ * (i.e. transactionally ordered) in them, and hence any time we
+ * see a buffer to replay over the top of a remote attribute
+ * block we should simply do so.
+ */
+ goto recover_immediately;
case XFS_SB_MAGIC:
lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
uuid = &((struct xfs_dsb *)blk)->sb_uuid;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 004/130] ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc |
| Message-ID | <q4ZH6-3Ud-71@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@ti.com>
commit 9a258afa928b45e6dd2efcac46ccf7eea705d35a upstream.
For hwmods without sysc, _init_mpu_rt_base(oh) won't be called and so
_find_mpu_rt_port(oh) will return NULL thus preventing ready state check
on those modules after the module is enabled.
This can potentially cause a bus access error if the module is accessed
before the module is ready.
Fix this by unconditionally calling _init_mpu_rt_base() during hwmod
_init(). Do ioremap only if we need SYSC access.
Eventhough _wait_target_ready() check doesn't really need MPU RT port but
just the PRCM registers, we still mandate that the hwmod must have an
MPU RT port if ready state check needs to be done. Else it would mean that
the module is not accessible by MPU so there is no point in waiting
for target to be ready.
e.g. this fixes the below DCAN bus access error on AM437x-gp-evm.
[ 16.672978] ------------[ cut here ]------------
[ 16.677885] WARNING: CPU: 0 PID: 1580 at drivers/bus/omap_l3_noc.c:147 l3_interrupt_handler+0x234/0x35c()
[ 16.687946] 44000000.ocp:L3 Custom Error: MASTER M2 (64-bit) TARGET L4_PER_0 (Read): Data Access in User mode during Functional access
[ 16.700654] Modules linked in: xhci_hcd btwilink ti_vpfe dwc3 videobuf2_core ov2659 bluetooth v4l2_common videodev ti_am335x_adc kfifo_buf industrialio c_can_platform videobuf2_dma_contig media snd_soc_tlv320aic3x pixcir_i2c_ts c_can dc
[ 16.731144] CPU: 0 PID: 1580 Comm: rpc.statd Not tainted 3.14.26-02561-gf733aa036398 #180
[ 16.739747] Backtrace:
[ 16.742336] [<c0011108>] (dump_backtrace) from [<c00112a4>] (show_stack+0x18/0x1c)
[ 16.750285] r6:00000093 r5:00000009 r4:eab5b8a8 r3:00000000
[ 16.756252] [<c001128c>] (show_stack) from [<c05a4418>] (dump_stack+0x20/0x28)
[ 16.763870] [<c05a43f8>] (dump_stack) from [<c0037120>] (warn_slowpath_common+0x6c/0x8c)
[ 16.772408] [<c00370b4>] (warn_slowpath_common) from [<c00371e4>] (warn_slowpath_fmt+0x38/0x40)
[ 16.781550] r8:c05d1f90 r7:c0730844 r6:c0730448 r5:80080003 r4:ed0cd210
[ 16.788626] [<c00371b0>] (warn_slowpath_fmt) from [<c027fa94>] (l3_interrupt_handler+0x234/0x35c)
[ 16.797968] r3:ed0cd480 r2:c0730508
[ 16.801747] [<c027f860>] (l3_interrupt_handler) from [<c0063758>] (handle_irq_event_percpu+0x54/0x1bc)
[ 16.811533] r10:ed005600 r9:c084855b r8:0000002a r7:00000000 r6:00000000 r5:0000002a
[ 16.819780] r4:ed0e6d80
[ 16.822453] [<c0063704>] (handle_irq_event_percpu) from [<c00638f0>] (handle_irq_event+0x30/0x40)
[ 16.831789] r10:eb2b6938 r9:eb2b6960 r8:bf011420 r7:fa240100 r6:00000000 r5:0000002a
[ 16.840052] r4:ed005600
[ 16.842744] [<c00638c0>] (handle_irq_event) from [<c00661d8>] (handle_fasteoi_irq+0x74/0x128)
[ 16.851702] r4:ed005600 r3:00000000
[ 16.855479] [<c0066164>] (handle_fasteoi_irq) from [<c0063068>] (generic_handle_irq+0x28/0x38)
[ 16.864523] r4:0000002a r3:c0066164
[ 16.868294] [<c0063040>] (generic_handle_irq) from [<c000ef60>] (handle_IRQ+0x38/0x8c)
[ 16.876612] r4:c081c640 r3:00000202
[ 16.880380] [<c000ef28>] (handle_IRQ) from [<c00084f0>] (gic_handle_irq+0x30/0x5c)
[ 16.888328] r6:eab5ba38 r5:c0804460 r4:fa24010c r3:00000100
[ 16.894303] [<c00084c0>] (gic_handle_irq) from [<c05a8d80>] (__irq_svc+0x40/0x50)
[ 16.902193] Exception stack(0xeab5ba38 to 0xeab5ba80)
[ 16.907499] ba20: 00000000 00000006
[ 16.916108] ba40: fa1d0000 fa1d0008 ed3d3000 eab5bab4 ed3d3460 c0842af4 bf011420 eb2b6960
[ 16.924716] ba60: eb2b6938 eab5ba8c eab5ba90 eab5ba80 bf035220 bf07702c 600f0013 ffffffff
[ 16.933317] r7:eab5ba6c r6:ffffffff r5:600f0013 r4:bf07702c
[ 16.939317] [<bf077000>] (c_can_plat_read_reg_aligned_to_16bit [c_can_platform]) from [<bf035220>] (c_can_get_berr_counter+0x38/0x64 [c_can])
[ 16.952696] [<bf0351e8>] (c_can_get_berr_counter [c_can]) from [<bf010294>] (can_fill_info+0x124/0x15c [can_dev])
[ 16.963480] r5:ec8c9740 r4:ed3d3000
[ 16.967253] [<bf010170>] (can_fill_info [can_dev]) from [<c0502fa8>] (rtnl_fill_ifinfo+0x58c/0x8fc)
[ 16.976749] r6:ec8c9740 r5:ed3d3000 r4:eb2b6780
[ 16.981613] [<c0502a1c>] (rtnl_fill_ifinfo) from [<c0503408>] (rtnl_dump_ifinfo+0xf0/0x1dc)
[ 16.990401] r10:ec8c9740 r9:00000000 r8:00000000 r7:00000000 r6:ebd4d1b4 r5:ed3d3000
[ 16.998671] r4:00000000
[ 17.001342] [<c0503318>] (rtnl_dump_ifinfo) from [<c050e6e4>] (netlink_dump+0xa8/0x1e0)
[ 17.009772] r10:00000000 r9:00000000 r8:c0503318 r7:ebf3e6c0 r6:ebd4d1b4 r5:ec8c9740
[ 17.018050] r4:ebd4d000
[ 17.020714] [<c050e63c>] (netlink_dump) from [<c050ec10>] (__netlink_dump_start+0x104/0x154)
[ 17.029591] r6:eab5bd34 r5:ec8c9980 r4:ebd4d000
[ 17.034454] [<c050eb0c>] (__netlink_dump_start) from [<c0505604>] (rtnetlink_rcv_msg+0x110/0x1f4)
[ 17.043778] r7:00000000 r6:ec8c9980 r5:00000f40 r4:ebf3e6c0
[ 17.049743] [<c05054f4>] (rtnetlink_rcv_msg) from [<c05108e8>] (netlink_rcv_skb+0xb4/0xc8)
[ 17.058449] r8:eab5bdac r7:ec8c9980 r6:c05054f4 r5:ec8c9980 r4:ebf3e6c0
[ 17.065534] [<c0510834>] (netlink_rcv_skb) from [<c0504134>] (rtnetlink_rcv+0x24/0x2c)
[ 17.073854] r6:ebd4d000 r5:00000014 r4:ec8c9980 r3:c0504110
[ 17.079846] [<c0504110>] (rtnetlink_rcv) from [<c05102ac>] (netlink_unicast+0x180/0x1ec)
[ 17.088363] r4:ed0c6800 r3:c0504110
[ 17.092113] [<c051012c>] (netlink_unicast) from [<c0510670>] (netlink_sendmsg+0x2ac/0x380)
[ 17.100813] r10:00000000 r8:00000008 r7:ec8c9980 r6:ebd4d000 r5:eab5be70 r4:eab5bee4
[ 17.109083] [<c05103c4>] (netlink_sendmsg) from [<c04dfdb4>] (sock_sendmsg+0x90/0xb0)
[ 17.117305] r10:00000000 r9:eab5a000 r8:becdda3c r7:0000000c r6:ea978400 r5:eab5be70
[ 17.125563] r4:c05103c4
[ 17.128225] [<c04dfd24>] (sock_sendmsg) from [<c04e1c28>] (SyS_sendto+0xb8/0xdc)
[ 17.136001] r6:becdda5c r5:00000014 r4:ecd37040
[ 17.140876] [<c04e1b70>] (SyS_sendto) from [<c000e680>] (ret_fast_syscall+0x0/0x30)
[ 17.148923] r10:00000000 r8:c000e804 r7:00000122 r6:becdda5c r5:0000000c r4:becdda5c
[ 17.157169] ---[ end trace 2b71e15b38f58bad ]---
Fixes: 6423d6df1440 ("ARM: OMAP2+: hwmod: check for module address space during init")
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/arm/mach-omap2/omap_hwmod.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 8fd87a3055bf..4711dd06d7b5 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2452,6 +2452,9 @@ static int of_dev_hwmod_lookup(struct device_node *np,
* registers. This address is needed early so the OCP registers that
* are part of the device's address space can be ioremapped properly.
*
+ * If SYSC access is not needed, the registers will not be remapped
+ * and non-availability of MPU access is not treated as an error.
+ *
* Returns 0 on success, -EINVAL if an invalid hwmod is passed, and
* -ENXIO on absent or invalid register target address space.
*/
@@ -2466,6 +2469,11 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
_save_mpu_port_index(oh);
+ /* if we don't need sysc access we don't need to ioremap */
+ if (!oh->class->sysc)
+ return 0;
+
+ /* we can't continue without MPU PORT if we need sysc access */
if (oh->_int_flags & _HWMOD_NO_MPU_PORT)
return -ENXIO;
@@ -2475,8 +2483,10 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data,
oh->name);
/* Extract the IO space from device tree blob */
- if (!np)
+ if (!np) {
+ pr_err("omap_hwmod: %s: no dt node\n", oh->name);
return -ENXIO;
+ }
va_start = of_iomap(np, index + oh->mpu_rt_idx);
} else {
@@ -2535,13 +2545,11 @@ static int __init _init(struct omap_hwmod *oh, void *data)
oh->name, np->name);
}
- if (oh->class->sysc) {
- r = _init_mpu_rt_base(oh, NULL, index, np);
- if (r < 0) {
- WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
- oh->name);
- return 0;
- }
+ r = _init_mpu_rt_base(oh, NULL, index, np);
+ if (r < 0) {
+ WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n",
+ oh->name);
+ return 0;
}
r = _init_clocks(oh, NULL);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 032/130] net/mlx4_core: Fix wrong index in propagating port change event to VFs |
| Message-ID | <q4ZH6-3Ud-73@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
commit 1c1bf34951e8d17941bf708d1901c47e81b15d55 upstream.
The port-change event processing in procedure mlx4_eq_int() uses "slave"
as the vf_oper array index. Since the value of "slave" is the PF function
index, the result is that the PF link state is used for deciding to
propagate the event for all the VFs. The VF link state should be used,
so the VF function index should be used here.
Fixes: 948e306d7d64 ('net/mlx4: Add VF link state support')
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/net/ethernet/mellanox/mlx4/eq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 2a004b347e1d..1a4df2ff2b6a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -564,7 +564,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
continue;
mlx4_dbg(dev, "%s: Sending MLX4_PORT_CHANGE_SUBTYPE_DOWN to slave: %d, port:%d\n",
__func__, i, port);
- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state;
+ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state;
if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) {
eqe->event.port_change.port =
cpu_to_be32(
@@ -597,7 +597,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq)
continue;
if (i == mlx4_master_func_num(dev))
continue;
- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state;
+ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state;
if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) {
eqe->event.port_change.port =
cpu_to_be32(
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 003/130] sysfs: Create mountpoints with sysfs_create_mount_point |
| Message-ID | <q4ZH7-3Ud-79@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit f9bb48825a6b5d02f4cabcc78967c75db903dcdc upstream.
This allows for better documentation in the code and
it allows for a simpler and fully correct version of
fs_fully_visible to be written.
The mount points converted and their filesystems are:
/sys/hypervisor/s390/ s390_hypfs
/sys/kernel/config/ configfs
/sys/kernel/debug/ debugfs
/sys/firmware/efi/efivars/ efivarfs
/sys/fs/fuse/connections/ fusectl
/sys/fs/pstore/ pstore
/sys/kernel/tracing/ tracefs
/sys/fs/cgroup/ cgroup
/sys/kernel/security/ securityfs
/sys/fs/selinux/ selinuxfs
/sys/fs/smackfs/ smackfs
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
arch/s390/hypfs/inode.c | 12 ++++--------
drivers/firmware/efi/efi.c | 6 ++----
fs/configfs/mount.c | 10 ++++------
fs/debugfs/inode.c | 11 ++++-------
fs/fuse/inode.c | 9 +++------
fs/pstore/inode.c | 12 ++++--------
kernel/cgroup.c | 10 ++++------
security/inode.c | 10 ++++------
security/selinux/selinuxfs.c | 11 +++++------
security/smack/smackfs.c | 8 ++++----
10 files changed, 38 insertions(+), 61 deletions(-)
diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
index c952b981e4f2..e86bbf105bdb 100644
--- a/arch/s390/hypfs/inode.c
+++ b/arch/s390/hypfs/inode.c
@@ -461,8 +461,6 @@ static const struct super_operations hypfs_s_ops = {
.show_options = hypfs_show_options,
};
-static struct kobject *s390_kobj;
-
static int __init hypfs_init(void)
{
int rc;
@@ -482,18 +480,16 @@ static int __init hypfs_init(void)
rc = -ENODATA;
goto fail_hypfs_vm_exit;
}
- s390_kobj = kobject_create_and_add("s390", hypervisor_kobj);
- if (!s390_kobj) {
- rc = -ENOMEM;
+ rc = sysfs_create_mount_point(hypervisor_kobj, "s390");
+ if (rc)
goto fail_hypfs_sprp_exit;
- }
rc = register_filesystem(&hypfs_type);
if (rc)
goto fail_filesystem;
return 0;
fail_filesystem:
- kobject_put(s390_kobj);
+ sysfs_remove_mount_point(hypervisor_kobj, "s390");
fail_hypfs_sprp_exit:
hypfs_sprp_exit();
fail_hypfs_vm_exit:
@@ -509,7 +505,7 @@ fail_dbfs_exit:
static void __exit hypfs_exit(void)
{
unregister_filesystem(&hypfs_type);
- kobject_put(s390_kobj);
+ sysfs_remove_mount_point(hypervisor_kobj, "s390");
hypfs_sprp_exit();
hypfs_vm_exit();
hypfs_diag_exit();
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index dc79346689e6..583ef8d17e07 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -41,7 +41,6 @@ struct efi __read_mostly efi = {
EXPORT_SYMBOL(efi);
static struct kobject *efi_kobj;
-static struct kobject *efivars_kobj;
/*
* Let's not leave out systab information that snuck into
@@ -174,10 +173,9 @@ static int __init efisubsys_init(void)
goto err_remove_group;
/* and the standard mountpoint for efivarfs */
- efivars_kobj = kobject_create_and_add("efivars", efi_kobj);
- if (!efivars_kobj) {
+ error = sysfs_create_mount_point(efi_kobj, "efivars");
+ if (error) {
pr_err("efivars: Subsystem registration failed.\n");
- error = -ENOMEM;
goto err_remove_group;
}
diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index f6c285833390..e9aa82098c39 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -129,8 +129,6 @@ void configfs_release_fs(void)
}
-static struct kobject *config_kobj;
-
static int __init configfs_init(void)
{
int err = -ENOMEM;
@@ -141,8 +139,8 @@ static int __init configfs_init(void)
if (!configfs_dir_cachep)
goto out;
- config_kobj = kobject_create_and_add("config", kernel_kobj);
- if (!config_kobj)
+ err = sysfs_create_mount_point(kernel_kobj, "config");
+ if (err)
goto out2;
err = configfs_inode_init();
@@ -158,7 +156,7 @@ out4:
pr_err("Unable to register filesystem!\n");
configfs_inode_exit();
out3:
- kobject_put(config_kobj);
+ sysfs_remove_mount_point(kernel_kobj, "config");
out2:
kmem_cache_destroy(configfs_dir_cachep);
configfs_dir_cachep = NULL;
@@ -169,7 +167,7 @@ out:
static void __exit configfs_exit(void)
{
unregister_filesystem(&configfs_fs_type);
- kobject_put(config_kobj);
+ sysfs_remove_mount_point(kernel_kobj, "config");
kmem_cache_destroy(configfs_dir_cachep);
configfs_dir_cachep = NULL;
configfs_inode_exit();
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 0c6ba4ef00a0..75c865bd376d 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -668,20 +668,17 @@ bool debugfs_initialized(void)
}
EXPORT_SYMBOL_GPL(debugfs_initialized);
-
-static struct kobject *debug_kobj;
-
static int __init debugfs_init(void)
{
int retval;
- debug_kobj = kobject_create_and_add("debug", kernel_kobj);
- if (!debug_kobj)
- return -EINVAL;
+ retval = sysfs_create_mount_point(kernel_kobj, "debug");
+ if (retval)
+ return retval;
retval = register_filesystem(&debug_fs_type);
if (retval)
- kobject_put(debug_kobj);
+ sysfs_remove_mount_point(kernel_kobj, "debug");
else
debugfs_registered = true;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 9e3f6cfee2fb..6abafb11f214 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1261,7 +1261,6 @@ static void fuse_fs_cleanup(void)
}
static struct kobject *fuse_kobj;
-static struct kobject *connections_kobj;
static int fuse_sysfs_init(void)
{
@@ -1273,11 +1272,9 @@ static int fuse_sysfs_init(void)
goto out_err;
}
- connections_kobj = kobject_create_and_add("connections", fuse_kobj);
- if (!connections_kobj) {
- err = -ENOMEM;
+ err = sysfs_create_mount_point(fuse_kobj, "connections");
+ if (err)
goto out_fuse_unregister;
- }
return 0;
@@ -1289,7 +1286,7 @@ static int fuse_sysfs_init(void)
static void fuse_sysfs_cleanup(void)
{
- kobject_put(connections_kobj);
+ sysfs_remove_mount_point(fuse_kobj, "connections");
kobject_put(fuse_kobj);
}
diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
index fafb7a02a5d6..3b172f651894 100644
--- a/fs/pstore/inode.c
+++ b/fs/pstore/inode.c
@@ -430,22 +430,18 @@ static struct file_system_type pstore_fs_type = {
.kill_sb = pstore_kill_sb,
};
-static struct kobject *pstore_kobj;
-
static int __init init_pstore_fs(void)
{
- int err = 0;
+ int err;
/* Create a convenient mount point for people to access pstore */
- pstore_kobj = kobject_create_and_add("pstore", fs_kobj);
- if (!pstore_kobj) {
- err = -ENOMEM;
+ err = sysfs_create_mount_point(fs_kobj, "pstore");
+ if (err)
goto out;
- }
err = register_filesystem(&pstore_fs_type);
if (err < 0)
- kobject_put(pstore_kobj);
+ sysfs_remove_mount_point(fs_kobj, "pstore");
out:
return err;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 0a46b2aa9dfb..44fadfb287bf 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1848,8 +1848,6 @@ static struct file_system_type cgroup_fs_type = {
.kill_sb = cgroup_kill_sb,
};
-static struct kobject *cgroup_kobj;
-
/**
* task_cgroup_path - cgroup path of a task in the first cgroup hierarchy
* @task: target task
@@ -4822,13 +4820,13 @@ int __init cgroup_init(void)
}
}
- cgroup_kobj = kobject_create_and_add("cgroup", fs_kobj);
- if (!cgroup_kobj)
- return -ENOMEM;
+ err = sysfs_create_mount_point(fs_kobj, "cgroup");
+ if (err)
+ return err;
err = register_filesystem(&cgroup_fs_type);
if (err < 0) {
- kobject_put(cgroup_kobj);
+ sysfs_remove_mount_point(fs_kobj, "cgroup");
return err;
}
diff --git a/security/inode.c b/security/inode.c
index 43ce6e19015f..617c7ce219e8 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -215,19 +215,17 @@ void securityfs_remove(struct dentry *dentry)
}
EXPORT_SYMBOL_GPL(securityfs_remove);
-static struct kobject *security_kobj;
-
static int __init securityfs_init(void)
{
int retval;
- security_kobj = kobject_create_and_add("security", kernel_kobj);
- if (!security_kobj)
- return -EINVAL;
+ retval = sysfs_create_mount_point(kernel_kobj, "security");
+ if (retval)
+ return retval;
retval = register_filesystem(&fs_type);
if (retval)
- kobject_put(security_kobj);
+ sysfs_remove_mount_point(kernel_kobj, "security");
return retval;
}
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 138949a31eab..181fcd3994a8 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -1899,7 +1899,6 @@ static struct file_system_type sel_fs_type = {
};
struct vfsmount *selinuxfs_mount;
-static struct kobject *selinuxfs_kobj;
static int __init init_sel_fs(void)
{
@@ -1908,13 +1907,13 @@ static int __init init_sel_fs(void)
if (!selinux_enabled)
return 0;
- selinuxfs_kobj = kobject_create_and_add("selinux", fs_kobj);
- if (!selinuxfs_kobj)
- return -ENOMEM;
+ err = sysfs_create_mount_point(fs_kobj, "selinux");
+ if (err)
+ return err;
err = register_filesystem(&sel_fs_type);
if (err) {
- kobject_put(selinuxfs_kobj);
+ sysfs_remove_mount_point(fs_kobj, "selinux");
return err;
}
@@ -1933,7 +1932,7 @@ __initcall(init_sel_fs);
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
void exit_sel_fs(void)
{
- kobject_put(selinuxfs_kobj);
+ sysfs_remove_mount_point(fs_kobj, "selinux");
kern_unmount(selinuxfs_mount);
unregister_filesystem(&sel_fs_type);
}
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 32b248820840..8608fd72580a 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -2136,16 +2136,16 @@ static const struct file_operations smk_revoke_subj_ops = {
.llseek = generic_file_llseek,
};
-static struct kset *smackfs_kset;
/**
* smk_init_sysfs - initialize /sys/fs/smackfs
*
*/
static int smk_init_sysfs(void)
{
- smackfs_kset = kset_create_and_add("smackfs", NULL, fs_kobj);
- if (!smackfs_kset)
- return -ENOMEM;
+ int err;
+ err = sysfs_create_mount_point(fs_kobj, "smackfs");
+ if (err)
+ return err;
return 0;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 005/130] ASoC: pcm1681: Fix setting de-emphasis sampling rate selection |
| Message-ID | <q4ZH7-3Ud-83@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <axel.lin@ingics.com>
commit fa8173a3ef0570affde7da352de202190b3786c2 upstream.
The de-emphasis sampling rate selection is controlled by BIT[3:4] of
PCM1681_DEEMPH_CONTROL register. Do proper left shift to set it.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Marek Belisko <marek.belisko@streamunlimited.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/soc/codecs/pcm1681.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index 477e13d30971..e7ba557979cb 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -102,7 +102,7 @@ static int pcm1681_set_deemph(struct snd_soc_codec *codec)
if (val != -1) {
regmap_update_bits(priv->regmap, PCM1681_DEEMPH_CONTROL,
- PCM1681_DEEMPH_RATE_MASK, val);
+ PCM1681_DEEMPH_RATE_MASK, val << 3);
enable = 1;
} else
enable = 0;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 014/130] xfs: remote attributes need to be considered data |
| Message-ID | <q4ZH6-3Ud-75@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
commit df150ed102baa0e78c06e08e975dfb47147dd677 upstream.
We don't log remote attribute contents, and instead write them
synchronously before we commit the block allocation and attribute
tree update transaction. As a result we are writing to the allocated
space before the allcoation has been made permanent.
As a result, we cannot consider this allocation to be a metadata
allocation. Metadata allocation can take blocks from the free list
and so reuse them before the transaction that freed the block is
committed to disk. This behaviour is perfectly fine for journalled
metadata changes as log recovery will ensure the free operation is
replayed before the overwrite, but for remote attribute writes this
is not the case.
Hence we have to consider the remote attribute blocks to contain
data and allocate accordingly. We do this by dropping the
XFS_BMAPI_METADATA flag from the block allocation. This means the
allocation will not use blocks that are on the busy list without
first ensuring that the freeing transaction has been committed to
disk and the blocks removed from the busy list. This ensures we will
never overwrite a freed block without first ensuring that it is
really free.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
[ luis: backported to 3.16:
- file rename: fs/xfs/libxfs/xfs_attr_remote.c -> fs/xfs/xfs_attr_remote.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
fs/xfs/xfs_attr_remote.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/fs/xfs/xfs_attr_remote.c b/fs/xfs/xfs_attr_remote.c
index 6a837e4a35f0..a46b19e2b4ce 100644
--- a/fs/xfs/xfs_attr_remote.c
+++ b/fs/xfs/xfs_attr_remote.c
@@ -453,14 +453,21 @@ xfs_attr_rmtval_set(
/*
* Allocate a single extent, up to the size of the value.
+ *
+ * Note that we have to consider this a data allocation as we
+ * write the remote attribute without logging the contents.
+ * Hence we must ensure that we aren't using blocks that are on
+ * the busy list so that we don't overwrite blocks which have
+ * recently been freed but their transactions are not yet
+ * committed to disk. If we overwrite the contents of a busy
+ * extent and then crash then the block may not contain the
+ * correct metadata after log recovery occurs.
*/
xfs_bmap_init(args->flist, args->firstblock);
nmap = 1;
error = xfs_bmapi_write(args->trans, dp, (xfs_fileoff_t)lblkno,
- blkcnt,
- XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA,
- args->firstblock, args->total, &map, &nmap,
- args->flist);
+ blkcnt, XFS_BMAPI_ATTRFORK, args->firstblock,
+ args->total, &map, &nmap, args->flist);
if (!error) {
error = xfs_bmap_finish(&args->trans, args->flist,
&committed);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 026/130] ipvs: do not use random local source address for tunnels |
| Message-ID | <q4ZH7-3Ud-77@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 4754957f04f5f368792a0eb7dab0ae89fb93dcfd upstream.
Michael Vallaly reports about wrong source address used
in rare cases for tunneled traffic. Looks like
__ip_vs_get_out_rt in 3.10+ is providing uninitialized
dest_dst->dst_saddr.ip because ip_vs_dest_dst_alloc uses
kmalloc. While we retry after seeing EINVAL from routing
for data that does not look like valid local address, it
still succeeded when this memory was previously used from
other dests and with different local addresses. As result,
we can use valid local address that is not suitable for
our real server.
Fix it by providing 0.0.0.0 every time our cache is refreshed.
By this way we will get preferred source address from routing.
Reported-by: Michael Vallaly <lvs@nolatency.com>
Fixes: 026ace060dfe ("ipvs: optimize dst usage for real server")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
net/netfilter/ipvs/ip_vs_xmit.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 6f70bdd3a90a..180f7624bcd4 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -129,7 +129,6 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr,
memset(&fl4, 0, sizeof(fl4));
fl4.daddr = daddr;
- fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
FLOWI_FLAG_KNOWN_NH : 0;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 021/130] ipr: Fix incorrect trace indexing |
| Message-ID | <q4ZH7-3Ud-85@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit bb7c54339e6a10ecce5c4961adf5e75b3cf0af30 upstream.
When ipr's internal driver trace was changed to an atomic, a signed/unsigned
bug slipped in which results in us indexing backwards in our memory buffer
writing on memory that does not belong to us. This patch fixes this by removing
the modulo and instead just mask off the low bits.
Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/ipr.c | 5 +++--
drivers/scsi/ipr.h | 1 +
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index debc569ab26c..2f49d7b01485 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -592,9 +592,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd,
{
struct ipr_trace_entry *trace_entry;
struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg;
+ unsigned int trace_index;
- trace_entry = &ioa_cfg->trace[atomic_add_return
- (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES];
+ trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK;
+ trace_entry = &ioa_cfg->trace[trace_index];
trace_entry->time = jiffies;
trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0];
trace_entry->type = type;
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index b22b23586f93..2459391105fc 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -1480,6 +1480,7 @@ struct ipr_ioa_cfg {
#define IPR_NUM_TRACE_INDEX_BITS 8
#define IPR_NUM_TRACE_ENTRIES (1 << IPR_NUM_TRACE_INDEX_BITS)
+#define IPR_TRACE_INDEX_MASK (IPR_NUM_TRACE_ENTRIES - 1)
#define IPR_TRACE_SIZE (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES)
char trace_start[8];
#define IPR_TRACE_START_LABEL "trace"
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 022/130] ipr: Fix invalid array indexing for HRRQ |
| Message-ID | <q4ZH7-3Ud-89@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 3f1c0581310d5d94bd72740231507e763a6252a4 upstream.
Fixes another signed / unsigned array indexing bug in the ipr driver.
Currently, when hrrq_index wraps, it becomes a negative number. We
do the modulo, but still have a negative number, so we end up indexing
backwards in the array. Given where the hrrq array is located in memory,
we probably won't actually reference memory we don't own, but nonetheless
ipr is still looking at data within struct ipr_ioa_cfg and interpreting it as
struct ipr_hrr_queue data, so bad things could certainly happen.
Each ipr adapter has anywhere from 1 to 16 HRRQs. By default, we use 2 on new
adapters. Let's take an example:
Assume ioa_cfg->hrrq_index=0x7fffffffe and ioa_cfg->hrrq_num=4:
The atomic_add_return will then return -1. We mod this with 3 and get -2, add
one and get -1 for an array index.
On adapters which support more than a single HRRQ, we dedicate HRRQ to adapter
initialization and error interrupts so that we can optimize the other queues
for fast path I/O. So all normal I/O uses HRRQ 1-15. So we want to spread the
I/O requests across those HRRQs.
With the default module parameter settings, this bug won't hit, only when
someone sets the ipr.number_of_msix parameter to a value larger than 3 is when
bad things start to happen.
Tested-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Wen Xiong <wenxiong@linux.vnet.ibm.com>
Reviewed-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/scsi/ipr.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 2f49d7b01485..d2c3fdcf90ba 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -1045,10 +1045,15 @@ static void ipr_send_blocking_cmd(struct ipr_cmnd *ipr_cmd,
static int ipr_get_hrrq_index(struct ipr_ioa_cfg *ioa_cfg)
{
+ unsigned int hrrq;
+
if (ioa_cfg->hrrq_num == 1)
- return 0;
- else
- return (atomic_add_return(1, &ioa_cfg->hrrq_index) % (ioa_cfg->hrrq_num - 1)) + 1;
+ hrrq = 0;
+ else {
+ hrrq = atomic_add_return(1, &ioa_cfg->hrrq_index);
+ hrrq = (hrrq % (ioa_cfg->hrrq_num - 1)) + 1;
+ }
+ return hrrq;
}
/**
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Date | 2015-09-04 16:00 +0200 |
| Subject | [PATCH 3.16.y-ckt 016/130] ALSA: usb-audio: add dB range mapping for some devices |
| Message-ID | <q4ZH7-3Ud-87@gated-at.bofh.it> |
| In reply to | #1219064 |
3.16.7-ckt17 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao-Wen Mao <yaowen@google.com>
commit 2d1cb7f658fb9c3ba8f9dab8aca297d4dfdec835 upstream.
Add the correct dB ranges of Bose Companion 5 and Drangonfly DAC 1.2.
Signed-off-by: Yao-Wen Mao <yaowen@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
sound/usb/mixer_maps.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index b16be3944213..9a3e1076a5b1 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
{ 0 }
};
+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+static struct usbmix_name_map bose_companion5_map[] = {
+ { 3, NULL, .dB = &bose_companion5_dB },
+ { 0 } /* terminator */
+};
+
+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+static struct usbmix_name_map dragonfly_1_2_map[] = {
+ { 7, NULL, .dB = &dragonfly_1_2_dB },
+ { 0 } /* terminator */
+};
+
/*
* Control map entries
*/
@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
.id = USB_ID(0x25c4, 0x0003),
.map = scms_usb3318_map,
},
+ {
+ /* Bose Companion 5 */
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
+ {
+ /* Dragonfly DAC 1.2 */
+ .id = USB_ID(0x21b4, 0x0081),
+ .map = dragonfly_1_2_map,
+ },
{ 0 } /* terminator */
};
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web