Eric Lee / smarc-fsl-linux-kernel

15 Dec, 2011

4 commits

14 Dec, 2011

6 commits

  • a878185c3   [SCSI] bnx2i: Fixed kernel panic caused by unprotected task->sc->request deref ... Browse Code »

    During session recovery, the conn_stop call will trigger a flush
    to all outstanding SCSI cmds in the xmit queue. This will set
    all outstanding task->sc to NULL prior to the session_teardown
    call which frees the task memory.

    In the bnx2i SCSI response processing path, only the task was being checked
    for NULL under the session lock before the task->sc->request dereferencing.
    If there are outstanding SCSI cmd responses pending for process, the
    following kernel panic can be exposed where task->sc was found to be NULL.

    Call Trace:
    [ 69.720205] [] bnx2i_process_new_cqes+0x290/0x3c0 [bnx2i]
    [ 69.804289] [] bnx2i_fastpath_notification+0x33/0xa0 [bnx2
    i]
    [ 69.891490] [] bnx2i_indicate_kcqe+0xdb/0x330 [bnx2i]
    [ 69.971427] [] service_kcqes+0x16e/0x1d0 [cnic]
    [ 70.045132] [] cnic_service_bnx2x_kcq+0x2a/0x50 [cnic]
    [ 70.126105] [] cnic_service_bnx2x_bh+0x43/0x140 [cnic]
    [ 70.207081] [] tasklet_action+0x66/0x110
    [ 70.273521] [] __do_softirq+0xef/0x220
    [ 70.337887] [] call_softirq+0x1c/0x30

    This patch adds the !task->sc check and also protects the sc dereferencing
    under the session lock.

    Signed-off-by: Eddie Wai
    Signed-off-by: James Bottomley

    Eddie Wai
     
  • ff1d0319a   [SCSI] qla4xxx: check for failed conn setup ... Browse Code »

    iscsi_conn_setup can fail so we must check for NULL being
    returned.

    Signed-off-by: Mike Christie
    Signed-off-by: James Bottomley

    Mike Christie
     
  • e1cd89c50   [SCSI] qla4xxx: a small loop fix ... Browse Code »

    When the qla4xxx_get_fwddb_entry returns QLA_ERROR
    the nex_idx is not updated,
    for (idx = 0; idx < max_ddbs; idx = next_idx) {
    ret = qla4xxx_get_fwddb_entry(ha, idx, NULL, 0, NULL,
    &next_idx, &state, &conn_err,
    NULL, NULL);
    if (ret == QLA_ERROR)
    continue;

    This means there is a risk that the 'idx < max_ddbs' condition will never
    met and the loop will loop forever.
    Fix this by explicitly increasing the next_idx in the error condition.

    Maybe a break instead of continue is more appropriate, leaving the decision
    on the qlogic maintainer.

    Signed-off-by: Tomas Henzl
    Signed-off-by: Mike Christie
    Signed-off-by: James Bottomley

    Tomas Henzl
     
  • 13483730a   [SCSI] qla4xxx: fix flash/ddb support ... Browse Code »

    With open-iscsi support, target entries persisted in the FLASH were not
    login. Added support in the qla4xxx driver to do the login on probe
    time to the target entries saved in the FLASH by user.
    With this changes upgrade to the new kernel with open-iscsi support in
    qla4xxx will ensure users original target entries login on driver load

    Signed-off-by: Manish Rangankar
    Signed-off-by: Ravi Anand
    Signed-off-by: Mike Christie
    Signed-off-by: James Bottomley

    Mike Christie
     
  • 44f747fff   [SCSI] zfcp: return early from slave_destroy if slave_alloc returned early ... Browse Code »
    1

    zfcp_scsi_slave_destroy erroneously always tried to finish its task
    even if the corresponding previous zfcp_scsi_slave_alloc returned
    early. This can lead to kernel page faults on accessing uninitialized
    fields of struct zfcp_scsi_dev in zfcp_erp_lun_shutdown_wait. Take the
    port field of the struct to determine if slave_alloc returned early.

    This zfcp bug is exposed by 4e6c82b (in turn fixing f7c9c6b to be
    compatible with 21208ae) which can call slave_destroy for a
    corresponding previous slave_alloc that did not finish.

    This patch is based on James Bottomley's fix suggestion in
    http://www.spinics.net/lists/linux-scsi/msg55449.html.

    Signed-off-by: Steffen Maier
    Cc: #2.6.38+
    Signed-off-by: James Bottomley

    Steffen Maier
     
  • 7e1e7ead8   [SCSI] fcoe: Fix preempt count leak in fcoe_filter_frames() ... Browse Code »
    1

    The error exit path leaks preempt count. Add the missing put_cpu().

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Yi Zou
    Cc: stable@kernel.org
    Signed-off-by: James Bottomley

    Thomas Gleixner
     

12 Dec, 2011

15 commits

10 Dec, 2011

9 commits

09 Dec, 2011

6 commits

  • 031af165b   sys_getppid: add missing rcu_dereference ... Browse Code »

    In order to safely dereference current->real_parent inside an
    rcu_read_lock, we need an rcu_dereference.

    Signed-off-by: Mandeep Singh Baines
    Cc: Thomas Gleixner
    Cc: Pavel Emelyanov
    Cc: Oleg Nesterov
    Cc: Kees Cook
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mandeep Singh Baines
     
  • 1cee22b7f   rapidio/tsi721: modify PCIe capability settings ... Browse Code »

    Modify initialization of PCIe capability registers in Tsi721 mport driver:
    - change Completion Timeout value to avoid unexpected data transfer
    aborts during intensive traffic.
    - replace hardcoded offset of PCIe capability block by making it use the
    common function.

    This patch is applicable to kernel versions starting from 3.2-rc1.

    Signed-off-by: Alexandre Bounine
    Cc: Matt Porter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexandre Bounine
     
  • b439e66f0   rapidio/tsi721: fix mailbox resource reporting ... Browse Code »

    Bug fix for Tsi721 RapidIO mport driver: Tsi721 supports four RapidIO
    mailboxes (MBOX0 - MBOX3) as defined by RapidIO specification. Mailbox
    resources has to be properly reported to allow use of all available
    mailboxes (initial version reports only MBOX0).

    This patch is applicable to kernel versions staring from 3.2-rc1.

    Signed-off-by: Alexandre Bounine
    Cc: Matt Porter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexandre Bounine
     
  • ceb963981   rapidio/tsi721: switch to dma_zalloc_coherent ... Browse Code »

    Replace the pair dma_alloc_coherent()+memset() with the new
    dma_zalloc_coherent() added by Andrew Morton for kernel version 3.2

    Signed-off-by: Alexandre Bounine
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexandre Bounine
     
  • 2a95ea6c0   procfs: do not overflow get_{idle,iowait}_time for nohz ... Browse Code »

    Since commit a25cac5198d4 ("proc: Consider NO_HZ when printing idle and
    iowait times") we are reporting idle/io_wait time also while a CPU is
    tickless. We rely on get_{idle,iowait}_time functions to retrieve
    proper data.

    These functions, however, use usecs_to_cputime to translate micro
    seconds time to cputime64_t. This is just an alias to usecs_to_jiffies
    which reduces the data type from u64 to unsigned int and also checks
    whether the given parameter overflows jiffies_to_usecs(MAX_JIFFY_OFFSET)
    and returns MAX_JIFFY_OFFSET in that case.

    When we overflow depends on CONFIG_HZ but especially for CONFIG_HZ_300
    it is quite low (1431649781) so we are getting MAX_JIFFY_OFFSET for
    >3000s! until we overflow unsigned int. Just for reference
    CONFIG_HZ_100 has an overflow window around 20s, CONFIG_HZ_250 ~8s and
    CONFIG_HZ_1000 ~2s.

    This results in a bug when people saw [h]top going mad reporting 100%
    CPU usage even though there was basically no CPU load. The reason was
    simply that /proc/stat stopped reporting idle/io_wait changes (and
    reported MAX_JIFFY_OFFSET) and so the only change happening was for user
    system time.

    Let's use nsecs_to_jiffies64 instead which doesn't reduce the precision
    to 32b type and it is much more appropriate for cumulative time values
    (unlike usecs_to_jiffies which intended for timeout calculations).

    Signed-off-by: Michal Hocko
    Tested-by: Artem S. Tashkinov
    Cc: Dave Jones
    Cc: Arnd Bergmann
    Cc: Alexey Dobriyan
    Cc: Thomas Gleixner
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Michal Hocko
     
  • 1368edf06   mm: vmalloc: check for page allocation failure before vmlist insertion ... Browse Code »
    1

    Commit f5252e00 ("mm: avoid null pointer access in vm_struct via
    /proc/vmallocinfo") adds newly allocated vm_structs to the vmlist after
    it is fully initialised. Unfortunately, it did not check that
    __vmalloc_area_node() successfully populated the area. In the event of
    allocation failure, the vmalloc area is freed but the pointer to freed
    memory is inserted into the vmlist leading to a a crash later in
    get_vmalloc_info().

    This patch adds a check for ____vmalloc_area_node() failure within
    __vmalloc_node_range. It does not use "goto fail" as in the previous
    error path as a warning was already displayed by __vmalloc_area_node()
    before it called vfree in its failure path.

    Credit goes to Luciano Chavez for doing all the real work of identifying
    exactly where the problem was.

    Signed-off-by: Mel Gorman
    Reported-by: Luciano Chavez
    Tested-by: Luciano Chavez
    Reviewed-by: Rik van Riel
    Acked-by: David Rientjes
    Cc: [3.1.x+]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mel Gorman