10 Mar, 2013

1 commit

  • Pull namespace bugfixes from Eric Biederman:
    "This is three simple fixes against 3.9-rc1. I have tested each of
    these fixes and verified they work correctly.

    The userns oops in key_change_session_keyring and the BUG_ON triggered
    by proc_ns_follow_link were found by Dave Jones.

    I am including the enhancement for mount to only trigger requests of
    filesystem modules here instead of delaying this for the 3.10 merge
    window because it is both trivial and the kind of change that tends to
    bit-rot if left untouched for two months."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
    proc: Use nd_jump_link in proc_ns_follow_link
    fs: Limit sys_mount to only request filesystem modules (Part 2).
    fs: Limit sys_mount to only request filesystem modules.
    userns: Stop oopsing in key_change_session_keyring

    Linus Torvalds
     

09 Mar, 2013

1 commit

  • Commit b67bfe0d42ca ("hlist: drop the node parameter from iterators")
    did a lot of nice changes but also contains two small hunks that seem to
    have slipped in accidentally and have no apparent connection to the
    intent of the patch.

    This reverts the two extraneous changes.

    Signed-off-by: Arnd Bergmann
    Cc: Peter Senna Tschudin
    Cc: Paul E. McKenney
    Cc: Sasha Levin
    Cc: Thomas Gleixner
    Cc: Rusty Russell
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Arnd Bergmann
     

06 Mar, 2013

1 commit

  • Pull networking fixes from David Miller:
    "A moderately sized pile of fixes, some specifically for merge window
    introduced regressions although others are for longer standing items
    and have been queued up for -stable.

    I'm kind of tired of all the RDS protocol bugs over the years, to be
    honest, it's way out of proportion to the number of people who
    actually use it.

    1) Fix missing range initialization in netfilter IPSET, from Jozsef
    Kadlecsik.

    2) ieee80211_local->tim_lock needs to use BH disabling, from Johannes
    Berg.

    3) Fix DMA syncing in SFC driver, from Ben Hutchings.

    4) Fix regression in BOND device MAC address setting, from Jiri
    Pirko.

    5) Missing usb_free_urb in ISDN Hisax driver, from Marina Makienko.

    6) Fix UDP checksumming in bnx2x driver for 57710 and 57711 chips,
    fix from Dmitry Kravkov.

    7) Missing cfgspace_lock initialization in BCMA driver.

    8) Validate parameter size for SCTP assoc stats getsockopt(), from
    Guenter Roeck.

    9) Fix SCTP association hangs, from Lee A Roberts.

    10) Fix jumbo frame handling in r8169, from Francois Romieu.

    11) Fix phy_device memory leak, from Petr Malat.

    12) Omit trailing FCS from frames received in BGMAC driver, from Hauke
    Mehrtens.

    13) Missing socket refcount release in L2TP, from Guillaume Nault.

    14) sctp_endpoint_init should respect passed in gfp_t, rather than use
    GFP_KERNEL unconditionally. From Dan Carpenter.

    15) Add AISX AX88179 USB driver, from Freddy Xin.

    16) Remove MAINTAINERS entries for drivers deleted during the merge
    window, from Cesar Eduardo Barros.

    17) RDS protocol can try to allocate huge amounts of memory, check
    that the user's request length makes sense, from Cong Wang.

    18) SCTP should use the provided KMALLOC_MAX_SIZE instead of it's own,
    bogus, definition. From Cong Wang.

    19) Fix deadlocks in FEC driver by moving TX reclaim into NAPI poll,
    from Frank Li. Also, fix a build error introduced in the merge
    window.

    20) Fix bogus purging of default routes in ipv6, from Lorenzo Colitti.

    21) Don't double count RTT measurements when we leave the TCP receive
    fast path, from Neal Cardwell."

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits)
    tcp: fix double-counted receiver RTT when leaving receiver fast path
    CAIF: fix sparse warning for caif_usb
    rds: simplify a warning message
    net: fec: fix build error in no MXC platform
    net: ipv6: Don't purge default router if accept_ra=2
    net: fec: put tx to napi poll function to fix dead lock
    sctp: use KMALLOC_MAX_SIZE instead of its own MAX_KMALLOC_SIZE
    rds: limit the size allocated by rds_message_alloc()
    MAINTAINERS: remove eexpress
    MAINTAINERS: remove drivers/net/wan/cycx*
    MAINTAINERS: remove 3c505
    caif_dev: fix sparse warnings for caif_flow_cb
    ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver
    sctp: use the passed in gfp flags instead GFP_KERNEL
    ipv[4|6]: correct dropwatch false positive in local_deliver_finish
    l2tp: Restore socket refcount when sendmsg succeeds
    net/phy: micrel: Disable asymmetric pause for KSZ9021
    bgmac: omit the fcs
    phy: Fix phy_device_free memory leak
    bnx2x: Fix KR2 work-around condition
    ...

    Linus Torvalds
     

05 Mar, 2013

6 commits

  • We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both
    before and after going to step5. That wastes CPU and double-counts the
    receiver-side RTT sample.

    Signed-off-by: Neal Cardwell
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Neal Cardwell
     
  • This fixes the following sparse warning:
    net/caif/caif_usb.c:84:16: warning: symbol 'cfusbl_create' was not
    declared. Should it be static?

    Signed-off-by: Silviu-Mihai Popescu
    Signed-off-by: David S. Miller

    Silviu-Mihai Popescu
     
  • Cc: David S. Miller
    Cc: Venkat Venkatsubra
    Signed-off-by: Cong Wang
    Signed-off-by: David S. Miller

    Cong Wang
     
  • Setting net.ipv6.conf..accept_ra=2 causes the kernel
    to accept RAs even when forwarding is enabled. However, enabling
    forwarding purges all default routes on the system, breaking
    connectivity until the next RA is received. Fix this by not
    purging default routes on interfaces that have accept_ra=2.

    Signed-off-by: Lorenzo Colitti
    Acked-by: YOSHIFUJI Hideaki
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Lorenzo Colitti
     
  • Don't definite its own MAX_KMALLOC_SIZE, use the one
    defined in mm.

    Cc: Vlad Yasevich
    Cc: Sridhar Samudrala
    Cc: Neil Horman
    Cc: David S. Miller
    Signed-off-by: Cong Wang
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Cong Wang
     
  • Dave Jones reported the following bug:

    "When fed mangled socket data, rds will trust what userspace gives it,
    and tries to allocate enormous amounts of memory larger than what
    kmalloc can satisfy."

    WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()
    Hardware name: GA-MA78GM-S2H
    Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s
    Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65
    Call Trace:
    [] warn_slowpath_common+0x75/0xa0
    [] warn_slowpath_null+0x1a/0x20
    [] __alloc_pages_nodemask+0xa0d/0xbe0
    [] ? native_sched_clock+0x26/0x90
    [] ? trace_hardirqs_off_caller+0x28/0xc0
    [] ? trace_hardirqs_off+0xd/0x10
    [] alloc_pages_current+0xb8/0x180
    [] __get_free_pages+0x2a/0x80
    [] kmalloc_order_trace+0x3e/0x1a0
    [] __kmalloc+0x2f5/0x3a0
    [] ? local_bh_enable_ip+0x7c/0xf0
    [] rds_message_alloc+0x23/0xb0 [rds]
    [] rds_sendmsg+0x2b1/0x990 [rds]
    [] ? trace_hardirqs_off+0xd/0x10
    [] sock_sendmsg+0xb0/0xe0
    [] ? get_lock_stats+0x22/0x70
    [] ? put_lock_stats.isra.23+0xe/0x40
    [] sys_sendto+0x130/0x180
    [] ? trace_hardirqs_on+0xd/0x10
    [] ? _raw_spin_unlock_irq+0x3b/0x60
    [] ? sysret_check+0x1b/0x56
    [] ? trace_hardirqs_on_caller+0x115/0x1a0
    [] ? trace_hardirqs_on_thunk+0x3a/0x3f
    [] system_call_fastpath+0x16/0x1b
    ---[ end trace eed6ae990d018c8b ]---

    Reported-by: Dave Jones
    Cc: Dave Jones
    Cc: David S. Miller
    Cc: Venkat Venkatsubra
    Signed-off-by: Cong Wang
    Acked-by: Venkat Venkatsubra
    Signed-off-by: David S. Miller

    Cong Wang
     

04 Mar, 2013

1 commit

  • Modify the request_module to prefix the file system type with "fs-"
    and add aliases to all of the filesystems that can be built as modules
    to match.

    A common practice is to build all of the kernel code and leave code
    that is not commonly needed as modules, with the result that many
    users are exposed to any bug anywhere in the kernel.

    Looking for filesystems with a fs- prefix limits the pool of possible
    modules that can be loaded by mount to just filesystems trivially
    making things safer with no real cost.

    Using aliases means user space can control the policy of which
    filesystem modules are auto-loaded by editing /etc/modprobe.d/*.conf
    with blacklist and alias directives. Allowing simple, safe,
    well understood work-arounds to known problematic software.

    This also addresses a rare but unfortunate problem where the filesystem
    name is not the same as it's module name and module auto-loading
    would not work. While writing this patch I saw a handful of such
    cases. The most significant being autofs that lives in the module
    autofs4.

    This is relevant to user namespaces because we can reach the request
    module in get_fs_type() without having any special permissions, and
    people get uncomfortable when a user specified string (in this case
    the filesystem type) goes all of the way to request_module.

    After having looked at this issue I don't think there is any
    particular reason to perform any filtering or permission checks beyond
    making it clear in the module request that we want a filesystem
    module. The common pattern in the kernel is to call request_module()
    without regards to the users permissions. In general all a filesystem
    module does once loaded is call register_filesystem() and go to sleep.
    Which means there is not much attack surface exposed by loading a
    filesytem module unless the filesystem is mounted. In a user
    namespace filesystems are not mounted unless .fs_flags = FS_USERNS_MOUNT,
    which most filesystems do not set today.

    Acked-by: Serge Hallyn
    Acked-by: Kees Cook
    Reported-by: Kees Cook
    Signed-off-by: "Eric W. Biederman"

    Eric W. Biederman
     

03 Mar, 2013

3 commits

  • This fixed the following sparse warning:
    net/caif/caif_dev.c:121:6: warning: symbol 'caif_flow_cb' was not
    declared. Should it be static?

    Signed-off-by: Silviu-Mihai Popescu
    Signed-off-by: David S. Miller

    Silviu-Mihai Popescu
     
  • Pull NFS client bugfixes from Trond Myklebust:
    "We've just concluded another Connectathon interoperability testing
    week, and so here are the fixes for the bugs that were discovered:

    - Don't allow NFS silly-renamed files to be deleted
    - Don't start the retransmission timer when out of socket space
    - Fix a couple of pnfs-related Oopses.
    - Fix one more NFSv4 state recovery deadlock
    - Don't loop forever when LAYOUTGET returns NFS4ERR_LAYOUTTRYLATER"

    * tag 'nfs-for-3.9-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
    SUNRPC: One line comment fix
    NFSv4.1: LAYOUTGET EDELAY loops timeout to the MDS
    SUNRPC: add call to get configured timeout
    PNFS: set the default DS timeout to 60 seconds
    NFSv4: Fix another open/open_recovery deadlock
    nfs: don't allow nfs_find_actor to match inodes of the wrong type
    NFSv4.1: Hold reference to layout hdr in layoutget
    pnfs: fix resend_to_mds for directio
    SUNRPC: Don't start the retransmission timer when out of socket space
    NFS: Don't allow NFS silly-renamed files to be deleted, no signal

    Linus Torvalds
     
  • Reported-by: Weston Andros Adamson
    Signed-off-by: Trond Myklebust

    Trond Myklebust
     

02 Mar, 2013

5 commits

  • This patch doesn't change how the code works because in the current
    kernel gfp is always GFP_KERNEL. But gfp was obviously intended
    instead of GFP_KERNEL.

    Signed-off-by: Dan Carpenter
    Acked-by: Neil Horman
    Signed-off-by: David S. Miller

    Dan Carpenter
     
  • I had a report recently of a user trying to use dropwatch to localise some frame
    loss, and they were getting false positives. Turned out they were using a user
    space SCTP stack that used raw sockets to grab frames. When we don't have a
    registered protocol for a given packet, we record it as a drop, even if a raw
    socket receieves the frame. We should only record the drop in the event a raw
    socket doesnt exist to receive the frames

    Tested by the reported successfully

    Signed-off-by: Neil Horman
    Reported-by: William Reich
    Tested-by: William Reich
    CC: "David S. Miller"
    CC: William Reich
    CC: eric.dumazet@gmail.com
    Acked-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Neil Horman
     
  • John W. Linville says:

    ====================
    This is another flurry of fixes intended for the 3.9 stream...

    A mac80211 pull from Johannes:

    "Seth fixes a stupid bug I introduced into one of his earlier patches,
    Chun-Yeow fixes mesh forwarding and Felix fixes monitor mode. I myself
    fixed a small locking issue and, the biggest change here, removed some
    nl80211 information with which sometimes the per wiphy information was
    getting too large for the typical 4k-minus-overhead. In my -next tree I
    have a patch to allow splitting that and add back the information
    removed now."

    An iwlwifi pull from Johannes:

    "I have a fix for a pretty important bug regarding DMA mapping, that
    could cause the DMA engine to overwrite data we wanted to send to it, so
    that the next time we send it it would be bad. This particularly affects
    calibration results. Other than that, three little fixes for the MVM
    driver."

    But wait, there's more!

    Avinash Patil fixes an incorrectly timed delay in mwifiex.

    Bing Zhao prevents a crash in SD8688 caused by failing to properly
    set a flag before issuing a command.

    Felix Fietkau is the big here this time, providing a trio of minor
    ath9k fixes and correcting the advertised interface combinations for
    rt2x00 when mesh support is disabled.

    Finally, Hauke Mehrtens gives us a patch that correctlin initializes
    a spin lock in the bcma code.

    Please let me know if there are problems!
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     
  • The sendmsg() syscall handler for PPPoL2TP doesn't decrease the socket
    reference counter after successful transmissions. Any successful
    sendmsg() call from userspace will then increase the reference counter
    forever, thus preventing the kernel's session and tunnel data from
    being freed later on.

    The problem only happens when writing directly on L2TP sockets.
    PPP sockets attached to L2TP are unaffected as the PPP subsystem
    uses pppol2tp_xmit() which symmetrically increase/decrease reference
    counters.

    This patch adds the missing call to sock_put() before returning from
    pppol2tp_sendmsg().

    Signed-off-by: Guillaume Nault
    Signed-off-by: David S. Miller

    Guillaume Nault
     
  • …wireless into for-davem

    John W. Linville
     

01 Mar, 2013

8 commits

  • Pull nfsd changes from J Bruce Fields:
    "Miscellaneous bugfixes, plus:

    - An overhaul of the DRC cache by Jeff Layton. The main effect is
    just to make it larger. This decreases the chances of intermittent
    errors especially in the UDP case. But we'll need to watch for any
    reports of performance regressions.

    - Containerized nfsd: with some limitations, we now support
    per-container nfs-service, thanks to extensive work from Stanislav
    Kinsbursky over the last year."

    Some notes about conflicts, since there were *two* non-data semantic
    conflicts here:

    - idr_remove_all() had been added by a memory leak fix, but has since
    become deprecated since idr_destroy() does it for us now.

    - xs_local_connect() had been added by this branch to make AF_LOCAL
    connections be synchronous, but in the meantime Trond had changed the
    calling convention in order to avoid a RCU dereference.

    There were a couple of more obvious actual source-level conflicts due to
    the hlist traversal changes and one just due to code changes next to
    each other, but those were trivial.

    * 'for-3.9' of git://linux-nfs.org/~bfields/linux: (49 commits)
    SUNRPC: make AF_LOCAL connect synchronous
    nfsd: fix compiler warning about ambiguous types in nfsd_cache_csum
    svcrpc: fix rpc server shutdown races
    svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    lockd: nlmclnt_reclaim(): avoid stack overflow
    nfsd: enable NFSv4 state in containers
    nfsd: disable usermode helper client tracker in container
    nfsd: use proper net while reading "exports" file
    nfsd: containerize NFSd filesystem
    nfsd: fix comments on nfsd_cache_lookup
    SUNRPC: move cache_detail->cache_request callback call to cache_read()
    SUNRPC: remove "cache_request" argument in sunrpc_cache_pipe_upcall() function
    SUNRPC: rework cache upcall logic
    SUNRPC: introduce cache_detail->cache_request callback
    NFS: simplify and clean cache library
    NFS: use SUNRPC cache creation and destruction helper for DNS cache
    nfsd4: free_stid can be static
    nfsd: keep a checksum of the first 256 bytes of request
    sunrpc: trim off trailing checksum before returning decrypted or integrity authenticated buffer
    sunrpc: fix comment in struct xdr_buf definition
    ...

    Linus Torvalds
     
  • Pull Ceph updates from Sage Weil:
    "A few groups of patches here. Alex has been hard at work improving
    the RBD code, layout groundwork for understanding the new formats and
    doing layering. Most of the infrastructure is now in place for the
    final bits that will come with the next window.

    There are a few changes to the data layout. Jim Schutt's patch fixes
    some non-ideal CRUSH behavior, and a set of patches from me updates
    the client to speak a newer version of the protocol and implement an
    improved hashing strategy across storage nodes (when the server side
    supports it too).

    A pair of patches from Sam Lang fix the atomicity of open+create
    operations. Several patches from Yan, Zheng fix various mds/client
    issues that turned up during multi-mds torture tests.

    A final set of patches expose file layouts via virtual xattrs, and
    allow the policies to be set on directories via xattrs as well
    (avoiding the awkward ioctl interface and providing a consistent
    interface for both kernel mount and ceph-fuse users)."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: (143 commits)
    libceph: add support for HASHPSPOOL pool flag
    libceph: update osd request/reply encoding
    libceph: calculate placement based on the internal data types
    ceph: update support for PGID64, PGPOOL3, OSDENC protocol features
    ceph: update "ceph_features.h"
    libceph: decode into cpu-native ceph_pg type
    libceph: rename ceph_pg -> ceph_pg_v1
    rbd: pass length, not op for osd completions
    rbd: move rbd_osd_trivial_callback()
    libceph: use a do..while loop in con_work()
    libceph: use a flag to indicate a fault has occurred
    libceph: separate non-locked fault handling
    libceph: encapsulate connection backoff
    libceph: eliminate sparse warnings
    ceph: eliminate sparse warnings in fs code
    rbd: eliminate sparse warnings
    libceph: define connection flag helpers
    rbd: normalize dout() calls
    rbd: barriers are hard
    rbd: ignore zero-length requests
    ...

    Linus Torvalds
     
  • Returns the configured timeout for the xprt of the rpc client.

    Signed-off-by: Weston Andros Adamson
    Signed-off-by: Trond Myklebust

    Weston Andros Adamson
     
  • In sctp_ulpq_tail_data(), use return values 0,1 to indicate whether
    a complete event (with MSG_EOR set) was delivered. A return value
    of -ENOMEM continues to indicate an out-of-memory condition was
    encountered.

    In sctp_ulpq_retrieve_partial() and sctp_ulpq_retrieve_first(),
    correct message reassembly logic for SCTP partial delivery.
    Change logic to ensure that as much data as possible is sent
    with the initial partial delivery and that following partial
    deliveries contain all available data.

    In sctp_ulpq_partial_delivery(), attempt partial delivery only
    if the data on the head of the reassembly queue is at or before
    the cumulative TSN ACK point.

    In sctp_ulpq_renege(), use the modified return values from
    sctp_ulpq_tail_data() to choose whether to attempt partial
    delivery or to attempt to drain the reassembly queue as a
    means to reduce memory pressure. Remove call to
    sctp_tsnmap_mark(), as this is handled correctly in call to
    sctp_ulpq_tail_data().

    Signed-off-by: Lee A. Roberts
    Acked-by: Vlad Yasevich
    Acked-by: Neil Horman

    Lee A. Roberts
     
  • In sctp_ulpq_renege_list(), events being reneged from the
    ordering queue may correspond to multiple TSNs. Identify
    all affected packets; sum freed space and renege from the
    tsnmap.

    Signed-off-by: Lee A. Roberts
    Acked-by: Vlad Yasevich
    Acked-by: Neil Horman

    Lee A. Roberts
     
  • In sctp_ulpq_renege_list(), do not renege packets below the
    cumulative TSN ACK point.

    Signed-off-by: Lee A. Roberts
    Acked-by: Vlad Yasevich
    Acked-by: Neil Horman

    Lee A. Roberts
     
  • In sctp_tsnmap_mark(), correct off-by-one error when calculating
    size value for sctp_tsnmap_grow().

    In sctp_tsnmap_grow(), correct off-by-one error when copying
    and resizing the tsnmap. If max_tsn_seen is in the LSB of the
    word, this bit can be lost, causing the corresponding packet
    to be transmitted again and to be entered as a duplicate into
    the SCTP reassembly/ordering queues. Change parameter name
    from "gap" (zero-based index) to "size" (one-based) to enhance
    code readability.

    Signed-off-by: Lee A. Roberts
    Acked-by: Vlad Yasevich
    Acked-by: Neil Horman

    Lee A. Roberts
     
  • It doesn't appear that anyone actually needs to connect asynchronously.

    Also, using a workqueue for the connect means we lose the namespace
    information from the original process. This is a problem since there's
    no way to explicitly pass in a filesystem namespace for resolution of an
    AF_LOCAL address.

    Acked-by: Trond Myklebust
    Signed-off-by: J. Bruce Fields

    J. Bruce Fields
     

28 Feb, 2013

6 commits

  • I'm not sure why, but the hlist for each entry iterators were conceived

    list_for_each_entry(pos, head, member)

    The hlist ones were greedy and wanted an extra parameter:

    hlist_for_each_entry(tpos, pos, head, member)

    Why did they need an extra pos parameter? I'm not quite sure. Not only
    they don't really need it, it also prevents the iterator from looking
    exactly like the list iterator, which is unfortunate.

    Besides the semantic patch, there was some manual work required:

    - Fix up the actual hlist iterators in linux/list.h
    - Fix up the declaration of other iterators based on the hlist ones.
    - A very small amount of places were using the 'node' parameter, this
    was modified to use 'obj->member' instead.
    - Coccinelle didn't handle the hlist_for_each_entry_safe iterator
    properly, so those had to be fixed up manually.

    The semantic patch which is mostly the work of Peter Senna Tschudin is here:

    @@
    iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;

    type T;
    expression a,c,d,e;
    identifier b;
    statement S;
    @@

    -T b;

    [akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
    [akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
    [akpm@linux-foundation.org: checkpatch fixes]
    [akpm@linux-foundation.org: fix warnings]
    [akpm@linux-foudnation.org: redo intrusive kvm changes]
    Tested-by: Peter Senna Tschudin
    Acked-by: Paul E. McKenney
    Signed-off-by: Sasha Levin
    Cc: Wu Fengguang
    Cc: Marcelo Tosatti
    Cc: Gleb Natapov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sasha Levin
     
  • Convert to the much saner new idr interface.

    Signed-off-by: Tejun Heo
    Acked-by: Neil Horman
    Acked-by: Vlad Yasevich
    Cc: Sridhar Samudrala
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tejun Heo
     
  • Convert to the much saner new idr interface.

    Signed-off-by: Tejun Heo
    Acked-by: Johannes Berg
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tejun Heo
     
  • Convert to the much saner new idr interface.

    Signed-off-by: Tejun Heo
    Cc: Eric Van Hensbergen
    Cc: Ron Minnich
    Cc: Latchesar Ionkov
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Tejun Heo
     
  • Building sctp may fail with:

    In function ‘copy_from_user’,
    inlined from ‘sctp_getsockopt_assoc_stats’ at
    net/sctp/socket.c:5656:20:
    arch/x86/include/asm/uaccess_32.h:211:26: error: call to
    ‘copy_from_user_overflow’ declared with attribute error: copy_from_user()
    buffer size is not provably correct

    if built with W=1 due to a missing parameter size validation
    before the call to copy_from_user.

    Signed-off-by: Guenter Roeck
    Acked-by: Vlad Yasevich
    Signed-off-by: David S. Miller

    Guenter Roeck
     
  • charset comes from skb->data. It's a number in the 0-255 range.
    If we have debugging turned on then this could cause a read beyond
    the end of the array.

    Signed-off-by: Dan Carpenter
    Signed-off-by: David S. Miller

    Dan Carpenter
     

27 Feb, 2013

8 commits

  • Pull vfs pile (part one) from Al Viro:
    "Assorted stuff - cleaning namei.c up a bit, fixing ->d_name/->d_parent
    locking violations, etc.

    The most visible changes here are death of FS_REVAL_DOT (replaced with
    "has ->d_weak_revalidate()") and a new helper getting from struct file
    to inode. Some bits of preparation to xattr method interface changes.

    Misc patches by various people sent this cycle *and* ocfs2 fixes from
    several cycles ago that should've been upstream right then.

    PS: the next vfs pile will be xattr stuff."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (46 commits)
    saner proc_get_inode() calling conventions
    proc: avoid extra pde_put() in proc_fill_super()
    fs: change return values from -EACCES to -EPERM
    fs/exec.c: make bprm_mm_init() static
    ocfs2/dlm: use GFP_ATOMIC inside a spin_lock
    ocfs2: fix possible use-after-free with AIO
    ocfs2: Fix oops in ocfs2_fast_symlink_readpage() code path
    get_empty_filp()/alloc_file() leave both ->f_pos and ->f_version zero
    target: writev() on single-element vector is pointless
    export kernel_write(), convert open-coded instances
    fs: encode_fh: return FILEID_INVALID if invalid fid_type
    kill f_vfsmnt
    vfs: kill FS_REVAL_DOT by adding a d_weak_revalidate dentry op
    nfsd: handle vfs_getattr errors in acl protocol
    switch vfs_getattr() to struct path
    default SET_PERSONALITY() in linux/elf.h
    ceph: prepopulate inodes only when request is aborted
    d_hash_and_lookup(): export, switch open-coded instances
    9p: switch v9fs_set_create_acl() to inode+fid, do it before d_instantiate()
    9p: split dropping the acls from v9fs_set_create_acl()
    ...

    Linus Torvalds
     
  • The legacy behavior adds the pgid seed and pool together as the input for
    CRUSH. That is problematic because each pool's PGs end up mapping to the
    same OSDs: 1.5 == 2.4 == 3.3 == ...

    Instead, if the HASHPSPOOL flag is set, we has the ps and pool together and
    feed that into CRUSH. This ensures that two adjacent pools will map to
    an independent pseudorandom set of OSDs.

    Advertise our support for this via a protocol feature flag.

    Signed-off-by: Sage Weil
    Reviewed-by: Alex Elder

    Sage Weil
     
  • Use the new version of the encoding for osd requests and replies. In the
    process, update the way we are tracking request ops and reply lengths and
    results in the struct ceph_osd_request. Update the rbd and fs/ceph users
    appropriately.

    The main changes are:
    - we keep pointers into the request memory for fields we need to update
    each time the request is sent out over the wire
    - we keep information about the result in an array in the request struct
    where the users can easily get at it.

    Signed-off-by: Sage Weil
    Reviewed-by: Alex Elder

    Sage Weil
     
  • Instead of using the old ceph_object_layout struct, update our internal
    ceph_calc_object_layout method to use the ceph_pg type. This allows us to
    pass the full 32-bit precision of the pgid.seed to the callers. It also
    allows some callers to avoid reaching into the request structures for the
    struct ceph_object_layout fields.

    Signed-off-by: Sage Weil
    Reviewed-by: Alex Elder

    Sage Weil
     
  • Support (and require) the PGID64, PGPOOL3, and OSDENC protocol features.
    These have been present in ceph.git since v0.42, Feb 2012. Require these
    features to simplify support; nobody is running older userspace.

    Note that the new request and reply encoding is still not in place, so the new
    code is not yet functional.

    Signed-off-by: Sage Weil
    Reviewed-by: Alex Elder

    Sage Weil
     
  • Always decode data into our cpu-native ceph_pg type that has the correct
    field widths. Limit any remaining uses of ceph_pg_v1 to dealing with the
    legacy protocol.

    Signed-off-by: Sage Weil
    Reviewed-by: Alex Elder

    Sage Weil
     
  • Rename the old version this type to distinguish it from the new version.

    Signed-off-by: Sage Weil
    Reviewed-by: Alex Elder

    Sage Weil
     
  • Pablo Neira Ayuso says:

    ====================
    The following patchset contains two bugfixes for netfilter/ipset via
    Jozsef Kadlecsik, they are:

    * Fix timeout corruption if sets are resized, by Josh Hunt.

    * Fix bogus error report if the flag nomatch is set, from Jozsef.
    ====================

    Signed-off-by: David S. Miller

    David S. Miller