1. 24 Jun, 2011 2 commits
  2. 23 Jun, 2011 3 commits
    • Roland Dreier's avatar
      target: Convert transport_deregister_session_configfs nacl_sess_lock to save irq state · 23388864
      Roland Dreier authored
      This patch converts transport_deregister_session_configfs() to save/restore
      spinlock IRQ state for struct se_node_acl->nacl_sess_lock access as tcm_qla2xxx
      logic expects to call transport_deregister_session_configfs() code with
      irq save already held for struct qla_hw_data.
      Reported-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      23388864
    • Nicholas Bellinger's avatar
      target: Fix transport_get_lun_for_tmr failure cases · 7fd29aa9
      Nicholas Bellinger authored
      This patch fixes two possible NULL pointer dereferences in target v4.0
      code where se_tmr release path in core_tmr_release_req() can OOPs upon
      transport_get_lun_for_tmr() failure by attempting to access se_device or
      se_tmr->tmr_list without a valid member of se_device->tmr_list during
      transport_free_se_cmd() release.  This patch moves the se_tmr->tmr_dev
      pointer assignment in transport_get_lun_for_tmr() until after possible
      -ENODEV failures during unpacked_lun lookup.
      
      This addresses an OOPs originally reported with LIO v4.1 upstream on
      .39 code here:
      
          TARGET_CORE[qla2xxx]: Detected NON_EXISTENT_LUN Access for 0x00000000
          BUG: unable to handle kernel NULL pointer dereference at 0000000000000550
          IP: [<ffffffff81035ec4>] __ticket_spin_trylock+0x4/0x20
          PGD 0
          Oops: 0000 [#1] SMP
          last sysfs file: /sys/devices/system/cpu/cpu23/cache/index2/shared_cpu_map
          CPU 1
          Modules linked in: netconsole target_core_pscsi target_core_file
      tcm_qla2xxx target_core_iblock tcm_loop target_core_mod configfs
      ipmi_devintf ipmi_si ipmi_msghandler serio_raw i7core_edac ioatdma dca
      edac_core ps_bdrv ses enclosure usbhid usb_storage ahci qla2xxx hid
      uas e1000e mpt2sas libahci mlx4_core scsi_transport_fc
      scsi_transport_sas raid_class scsi_tgt [last unloaded: netconsole]
      
          Pid: 0, comm: kworker/0:0 Tainted: G        W   2.6.39+ #1 Xyratex Storage Server
          RIP: 0010:[<ffffffff81035ec4>] [<ffffffff81035ec4>]__ticket_spin_trylock+0x4/0x20
          RSP: 0018:ffff88063e803c08  EFLAGS: 00010286
          RAX: ffff880619ab45e0 RBX: 0000000000000550 RCX: 0000000000000000
          RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000550
          RBP: ffff88063e803c08 R08: 0000000000000002 R09: 0000000000000000
          R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000568
          R13: 0000000000000001 R14: 0000000000000000 R15: ffff88060cd96a20
          FS:  0000000000000000(0000) GS:ffff88063e800000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
          CR2: 0000000000000550 CR3: 0000000001a03000 CR4: 00000000000006e0
          DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
          DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
          Process kworker/0:0 (pid: 0, threadinfo ffff880619ab8000, task ffff880619ab45e0)
          Stack:
           ffff88063e803c28 ffffffff812cf039 0000000000000550 0000000000000568
           ffff88063e803c58 ffffffff8157071e ffffffffa028a1dc ffff88060f7e4600
           0000000000000550 ffff880616961480 ffff88063e803c78 ffffffffa028a1dc
          Call Trace:
      <IRQ>
           [<ffffffff812cf039>] do_raw_spin_trylock+0x19/0x50
           [<ffffffff8157071e>] _raw_spin_lock+0x3e/0x70
           [<ffffffffa028a1dc>] ? core_tmr_release_req+0x2c/0x60 [target_core_mod]
           [<ffffffffa028a1dc>] core_tmr_release_req+0x2c/0x60 [target_core_mod]
           [<ffffffffa028d0d2>] transport_free_se_cmd+0x22/0x50 [target_core_mod]
           [<ffffffffa028d120>] transport_release_cmd_to_pool+0x20/0x40 [target_core_mod]
           [<ffffffffa028e525>] transport_generic_free_cmd+0xa5/0xb0 [target_core_mod]
           [<ffffffffa0147cc4>] tcm_qla2xxx_handle_tmr+0xc4/0xd0 [tcm_qla2xxx]
           [<ffffffffa0191ba3>] __qla24xx_handle_abts+0xd3/0x150 [qla2xxx]
           [<ffffffffa0197651>] qla_tgt_response_pkt+0x171/0x520 [qla2xxx]
           [<ffffffffa0197a2d>] qla_tgt_response_pkt_all_vps+0x2d/0x220 [qla2xxx]
           [<ffffffffa0171dd3>] qla24xx_process_response_queue+0x1a3/0x670 [qla2xxx]
           [<ffffffffa0196281>] ? qla24xx_atio_pkt+0x81/0x120 [qla2xxx]
           [<ffffffffa0174025>] ? qla24xx_msix_default+0x45/0x2a0 [qla2xxx]
           [<ffffffffa0174198>] qla24xx_msix_default+0x1b8/0x2a0 [qla2xxx]
           [<ffffffff810dadb4>] handle_irq_event_percpu+0x54/0x210
           [<ffffffff810dafb8>] handle_irq_event+0x48/0x70
           [<ffffffff810dd5ee>] ? handle_edge_irq+0x1e/0x110
           [<ffffffff810dd647>] handle_edge_irq+0x77/0x110
           [<ffffffff8100d362>] handle_irq+0x22/0x40
           [<ffffffff8157b28d>] do_IRQ+0x5d/0xe0
           [<ffffffff81571413>] common_interrupt+0x13/0x13
      <EOI>
           [<ffffffff813003f7>] ? intel_idle+0xd7/0x130
           [<ffffffff813003f0>] ? intel_idle+0xd0/0x130
           [<ffffffff8144832b>] cpuidle_idle_call+0xab/0x1c0
           [<ffffffff8100a26b>] cpu_idle+0xab/0xf0
           [<ffffffff81566c59>] start_secondary+0x1cb/0x1d2
      Reported-by: default avatarRoland Dreier <roland@purestorage.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      7fd29aa9
    • Nicholas Bellinger's avatar
  3. 21 Jun, 2011 7 commits
    • Linus Torvalds's avatar
      Linux 3.0-rc4 · 56299378
      Linus Torvalds authored
      56299378
    • Linus Torvalds's avatar
      vfs: i_state needs to be 'unsigned long' for now · 79568f5b
      Linus Torvalds authored
      Commit 13e12d14 ("vfs: reorganize 'struct inode' layout a bit")
      moved things around a bit changed i_state to be unsigned int instead of
      unsigned long.  That was to help structure layout for the 64-bit case,
      and shrink 'struct inode' a bit (admittedly that only happened when
      spinlock debugging was on and i_flags didn't pack with i_lock).
      
      However, Meelis Roos reports that this results in unaligned exceptions
      on sprc, and it turns out that the bit-locking primitives that we use
      for the I_NEW bit want to use the bitops.  Which want 'unsigned long',
      not 'unsigned int'.
      
      We really should fix the bit locking code to not have that kind of
      requirement, but that's a much bigger change.  So for now, revert that
      field back to 'unsigned long' (but keep the other re-ordering changes
      from the commit that caused this).
      
      Andi points out that we have played games with this in 'struct page', so
      it's solvable with other hacks too, but since right now the struct inode
      size advantage only happens with some rare config options, it's not
      worth fighting.
      
      It _would_ be worth fixing the bitlocking code, though.  Especially
      since there is no type safety in the bitlocking code (this never caused
      any warnings, and worked fine on x86-64, because the bitlocks take a
      'void *' and x86-64 doesn't care that deeply about alignment).  So it's
      currently a very easy problem to trigger by mistake and never notice.
      Reported-by: default avatarMeelis Roos <mroos@linux.ee>
      Cc: Andi Kleen <andi@firstfloor.org>
      Cc: David Miller <davem@davemloft.net>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      79568f5b
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 · f5fc5567
      Linus Torvalds authored
      * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
        drm/radeon/kms/r6xx+: voltage fixes
        drm/nouveau: drop leftover debugging
        drm/radeon: avoid warnings from r600/eg irq handlers on powered off card.
        drm/radeon/kms: add missing param for dce3.2 DP transmitter setup
        drm/radeon/kms/atom: fix duallink on some early DCE3.2 cards
        drm/nouveau: fix assumption that semaphore dmaobj is valid in x-chan sync
        drm/nv50/disp: fix gamma with page flipping overlay turned on
        drm/nouveau/pm: Prevent overflow in nouveau_perf_init()
        drm/nouveau: fix big-endian switch
      f5fc5567
    • Linus Torvalds's avatar
      Merge branch 'msm-fix' of git://codeaurora.org/quic/kernel/davidb/linux-msm · 85d45ade
      Linus Torvalds authored
      * 'msm-fix' of git://codeaurora.org/quic/kernel/davidb/linux-msm:
        msm: timer: Fix DGT rate on 8960 and 8660
        msm: timer: compensate for timer shift in msm_read_timer_count
        msm: timer: Fix SMP build error
      85d45ade
    • Linus Torvalds's avatar
      Merge branch 'for-2.6.40' of git://linux-nfs.org/~bfields/linux · eda08410
      Linus Torvalds authored
      * 'for-2.6.40' of git://linux-nfs.org/~bfields/linux:
        nfsd4: fix break_lease flags on nfsd open
        nfsd: link returns nfserr_delay when breaking lease
        nfsd: v4 support requires CRYPTO
        nfsd: fix dependency of nfsd on auth_rpcgss
      eda08410
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 · 6e158d21
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (40 commits)
        pxa168_eth: fix race in transmit path.
        ipv4, ping: Remove duplicate icmp.h include
        netxen: fix race in skb->len access
        sgi-xp: fix a use after free
        hp100: fix an skb->len race
        netpoll: copy dev name of slaves to struct netpoll
        ipv4: fix multicast losses
        r8169: fix static initializers.
        inet_diag: fix inet_diag_bc_audit()
        gigaset: call module_put before restart of if_open()
        farsync: add module_put to error path in fst_open()
        net: rfs: enable RFS before first data packet is received
        fs_enet: fix freescale FCC ethernet dp buffer alignment
        netdev: bfin_mac: fix memory leak when freeing dma descriptors
        vlan: don't call ndo_vlan_rx_register on hardware that doesn't have vlan support
        caif: Bugfix - XOFF removed channel from caif-mux
        tun: teach the tun/tap driver to support netpoll
        dp83640: drop PHY status frames in the driver.
        dp83640: fix phy status frame event parsing
        phylib: Allow BCM63XX PHY to be selected only on BCM63XX.
        ...
      6e158d21
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 · 36698206
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
        devcgroup_inode_permission: take "is it a device node" checks to inlined wrapper
        fix comment in generic_permission()
        kill obsolete comment for follow_down()
        proc_sys_permission() is OK in RCU mode
        reiserfs_permission() doesn't need to bail out in RCU mode
        proc_fd_permission() is doesn't need to bail out in RCU mode
        nilfs2_permission() doesn't need to bail out in RCU mode
        logfs doesn't need ->permission() at all
        coda_ioctl_permission() is safe in RCU mode
        cifs_permission() doesn't need to bail out in RCU mode
        bad_inode_permission() is safe from RCU mode
        ubifs: dereferencing an ERR_PTR in ubifs_mount()
      36698206
  4. 20 Jun, 2011 25 commits
  5. 19 Jun, 2011 3 commits