- 03 May, 2014 7 commits
-
-
Dan Carpenter authored
The obd_ioctl_getdata() function caps "data->ioc_len" at OBD_MAX_IOCTL_BUFFER and then calls this obd_ioctl_is_invalid() to check that the other values inside data are valid. There are several lengths inside data but when they are added together they must not be larger than "data->ioc_len". The checks against "(data->ioc_inllen1 > (1<<30))" are supposed to ensure that the addition does not have an integer overflow. But "(1<<30) * 4" actually can overflow 32 bits, so the checks are insufficient. I have changed it to "> OBD_MAX_IOCTL_BUFFER" instead. Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Oleg Drokin authored
Pointer 'ni' checked for NULL at line 1569 may be passed to function and may be dereferenced there by passing argument 1 to function 'lnet_ni_notify_locked' at line 1621. found by Klocwork Insight tool Signed-off-by:
Oleg Drokin <oleg.drokin@intel.com> CC: Dmitry Eremin <dmitry.eremin@intel.com> CC: Liang Zhen <liang.zhen@intel.com> Signed-off-by:
-
Dmitry Eremin authored
Null pointer 'cp' that comes from line 2544 may be dereferenced at line 2618. found by Klocwork Insight tool Signed-off-by:
Dmitry Eremin <dmitry.eremin@intel.com> Reviewed-on: http://review.whamcloud.com/9386 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4629Reviewed-by:
John L. Hammond <john.hammond@intel.com> Reviewed-by:
Isaac Huang <he.huang@intel.com> Signed-off-by:
-
Dmitry Eremin authored
Local variable 'hash' is never used found by Klocwork Insight tool Signed-off-by:
-
Oleg Drokin authored
It should never be NULL because our interface list is up to date, and even if it does, we'll just crash anyway so we are no better off. Signed-off-by:
-
Oleg Drokin authored
Insted of meddling directly in process environment variables (which is also not possible on certain platforms due to not exported symbols), create jobid_name proc file to represent this info (to be filled by job scheduler epilogue). Signed-off-by:
-
Vitaly Osipov authored
In ll_ioctl_fiemap(), a user-supplied value is used to calculate a length of a buffer which is later allocated with user data. Signed-off-by:
Vitaly Osipov <vitaly.osipov@gmail.com> Signed-off-by:
-
- 28 Apr, 2014 2 commits
-
-
Greg Kroah-Hartman authored
-
Linus Torvalds authored
-
- 27 Apr, 2014 31 commits
-
-
Will Deacon authored
The asm-generic, big-endian version of zero_bytemask creates a mask of bytes preceding the first zero-byte by left shifting ~0ul based on the position of the first zero byte. Unfortunately, if the first (top) byte is zero, the output of prep_zero_mask has only the top bit set, resulting in undefined C behaviour as we shift left by an amount equal to the width of the type. As it happens, GCC doesn't manage to spot this through the call to fls(), but the issue remains if architectures choose to implement their shift instructions differently. An example would be arch/arm/ (AArch32), where LSL Rd, Rn, #32 results in Rd == 0x0, whilst on arch/arm64 (AArch64) LSL Xd, Xn, #64 results in Xd == Xn. Rather than check explicitly for the problematic shift, this patch adds an extra shift by 1, replacing fls with __fls. Since zero_bytemask is never called with a zero argument (has_zero() is used to check the data first), we don't need to worry about calling __fls(0), which is undefined. Cc: <stable@vger.kernel.org> Cc: Victor Kamensky <victor.kamensky@linaro.org> Signed-off-by:
Will Deacon <will.deacon@arm.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Linus Torvalds authored
This merges the patch to fix possible loss of dirty bit on munmap() or madvice(DONTNEED). If there are concurrent writers on other CPU's that have the unmapped/unneeded page in their TLBs, their writes to the page could possibly get lost if a third CPU raced with the TLB flush and did a page_mkclean() before the page was fully written. Admittedly, if you unmap() or madvice(DONTNEED) an area _while_ another thread is still busy writing to it, you deserve all the lost writes you could get. But we kernel people hold ourselves to higher quality standards than "crazy people deserve to lose", because, well, we've seen people do all kinds of crazy things. So let's get it right, just because we can, and we don't have to worry about it. * safe-dirty-tlb-flush: mm: split 'tlb_flush_mmu()' into tlb flushing and memory freeing parts
-
git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfsLinus Torvalds authored
Pull btrfs fixes from Chris Mason. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: limit the path size in send to PATH_MAX Btrfs: correctly set profile flags on seqlock retry Btrfs: use correct key when repeating search for extent item Btrfs: fix inode caching vs tree log Btrfs: fix possible memory leaks in open_ctree() Btrfs: avoid triggering bug_on() when we fail to start inode caching task Btrfs: move btrfs_{set,clear}_and_info() to ctree.h btrfs: replace error code from btrfs_drop_extents btrfs: Change the hole range to a more accurate value. btrfs: fix use-after-free in mount_subvol()
-
git://ftp.arm.linux.org.uk/~rmk/linux-armLinus Torvalds authored
Pull arm fixes from Russell King: "A number of fixes for the PJ4/iwmmxt changes which arm-soc forced me to take during the merge window. This stuff should have been better tested and sorted out *before* the merge window" * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: ARM: 8042/1: iwmmxt: allow to build iWMMXt on Marvell PJ4B ARM: 8041/1: pj4: fix cpu_is_pj4 check ARM: 8040/1: pj4: properly detect existence of iWMMXt coprocessor ARM: 8039/1: pj4: enable iWMMXt only if CONFIG_IWMMXT is set ARM: 8038/1: iwmmxt: explicitly check for supported architectures
-
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linuxLinus Torvalds authored
Pull arm64 fixes from Catalin Marinas: - compat renameat2 syscall wiring and __NR_compat_syscalls fix - TLB fix for transparent huge pages following switch to generic mmu_gather - spinlock initialisation for init_mm's context - move of_clk_init() earlier - Kconfig duplicate entry fix * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: init: Move of_clk_init to time_init arm64: initialize spinlock for init_mm's context arm64: debug: remove noisy, pointless warning arm64: mm: Add THP TLB entries to general mmu_gather arm64: add renameat2 compat syscall ARM64: Remove duplicated Kconfig entry for "kernel/power/Kconfig" arm64: __NR_compat_syscalls fix
-
Oleg Drokin authored
Quiet the warning below in Lustre code. Actually the warning is invalid since we either always assign the symname in ll_readlink_internal or return an error there and then the following rc check would assign symlink variable explicitly. In file included from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/linux/lustre_compat25.h:41:0, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/linux/lvfs.h:48, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/lvfs.h:45, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/obd_support.h:41, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/obd_class.h:40, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/linux/lustre_lite.h:49, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/../include/lustre_lite.h:45, from /home/green/bk/linux/drivers/staging/lustre/lustre/llite/symlink.c:42: /home/green/bk/linux/drivers/staging/lustre/lustre/llite/symlink.c: In function ‘ll_follow_link’: /home/green/bk/linux/include/linux/namei.h:88:29: warning: ‘symname’ may be used uninitialized in this function [-Wmaybe-uninitialized] nd->saved_names[nd->depth] = path; ^ /home/green/bk/linux/drivers/staging/lustre/lustre/llite/symlink.c:123:8: note: ‘symname’ was declared here char *symname; ^ Signed-off-by: -
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tipLinus Torvalds authored
Pull irq fixes from Thomas Gleixner: "A slighlty large fix for a subtle issue in the CPU hotplug code of certain ARM SoCs, where the not yet online cpu needs to setup the cpu local timer and needs to set the interrupt affinity to itself. Setting interrupt affinity to a not online cpu is prohibited and therefor the timer interrupt ends up on the wrong cpu, which leads to nasty complications. The SoC folks tried to hack around that in the SoC code in some more than nasty ways. The proper solution is to have a way to enforce the affinity setting to a not online cpu. The core patch to the genirq code provides that facility and the follow up patches make use of it in the GIC interrupt controller and the exynos timer driver. The change to the core code has no implications to existing users, except for the rename of the locked function and therefor the necessary fixup in mips/cavium. Aside of that, no runtime impact is possible, as none of the existing interrupt chips implements anything which depends on the force argument of the irq_set_affinity() callback" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Exynos_mct: Register clock event after request_irq() clocksource: Exynos_mct: Use irq_force_affinity() in cpu bringup irqchip: Gic: Support forced affinity setting genirq: Allow forcing cpu affinity of interrupts
-
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/ttyLinus Torvalds authored
Pull tty/serial fixes from Greg KH: "Here are a few tty/serial fixes for 3.15-rc3 that resolve a number of reported issues in the 8250 and samsung serial drivers, as well as a character loss fix for the tty core that was caused by the lock removal patches a release ago" * tag 'tty-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial_core: fix uart PORT_UNKNOWN handling serial: samsung: Change barrier() to cpu_relax() in console output serial: samsung: don't check config for every character serial: samsung: Use the passed in "port", fixing kgdb w/ no console serial: 8250: Fix thread unsafe __dma_tx_complete function 8250_core: Fix unwanted TX chars write tty: Fix race condition between __tty_buffer_request_room and flush_to_ldisc
-
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/stagingLinus Torvalds authored
Pull staging / IIO driver fixes from Greg KH: "Here are some small staging and IIO driver fixes for 3.15-rc3. Nothing major at all, just some assorted issues that people have reported" * tag 'staging-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: comedi: usbdux: bug fix for accessing 'ao_chanlist' in private data iio: adc: mxs-lradc: fix warning when buidling on avr32 iio: cm36651: Fix i2c client leak and possible NULL pointer dereference iio: querying buffer scan_mask should return 0/1 staging:iio:ad2s1200 fix a missing break iio: adc: at91_adc: correct default shtim value ARM: at91: at91sam9260: change at91_adc name ARM: at91: at91sam9g45: change at91_adc name iio: cm32181: Fix read integration time function iio: adc: at91_adc: Repair broken platform_data support
-
Bobi Jam authored
lov_fiemap() does not take consider its @vallen parameter, which is the max buffer size the caller can hold for the fiemap extents. This patch fixes this and limits the max mapped fiemap extent count to fit in the preallocted buffer. This patch also fixes a memory out of bound write issue when the fiemap call is only for detecting the number of existing extent. Signed-off-by:
Bobi Jam <bobijam.xu@intel.com> Reviewed-on: http://review.whamcloud.com/9834 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4619Reviewed-by:
Fan Yong <fan.yong@intel.com> Reviewed-by:
Patrick Farrell <paf@cray.com> Signed-off-by:
-
Oleg Drokin authored
Apparently we are pretty bad about verifying our buffers passed from userspace. Signed-off-by:
James Simmons <uja.ornl@gmail.com> Signed-off-by:
-
Andreas Dilger authored
The Linux VFS and Lustre OST_SYNC RPC are both capable of specifying fsync() on a sub-extent of the file {start, end} instead of the full file. This allows less than the full amount of data to be flushed, reducing or possibly eliminating the work needed before the syscall can return. However, the handling of sub-extent of the file for fsync was lost with the move to CLIO on the client and OSD API on the server. They were ignoring the passed {start, end} and using {0, OBD_OBJECT_EOF} instead. Return the ability to pass a sub-extent for fsync() from the client, to the specific stripes/OSTs that need the sync operation, and pass it down to the OSD. The ZFS OSD doesn't handle this yet, but there is room for improvement in a separate patch. Signed-off-by:Andreas Dilger <andreas.dilger@intel.com> Reviewed-on: http://review.whamcloud.com/8626 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4388Reviewed-by:
Bobi Jam <bobijam@gmail.com> Reviewed-by:
Jinshan Xiong <jinshan.xiong@intel.com> Signed-off-by:
-
Ryan Haasken authored
In libcfs_debug_vmsg2, cdls_delay is only clamped between the minimum and the maximum when it is increased by multiplying by the backoff factor. It is not clamped when it is decreased by dividing by the backoff factor. This allows it to achieve values less than the minimum, which allows a console message to be printed that should have been skipped. This patch moves the clamping outside of the else statement, ensuring that cdls_delay is always between the min and the max after the first time through libcfs_debug_vmsg2. Signed-off-by:
Ryan Haasken <haasken@cray.com> Reviewed-on: http://review.whamcloud.com/9503 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4711Reviewed-by:
Chris Horn <hornc@cray.com> Reviewed-by:
Ann Koehler <amk@cray.com> Reviewed-by:
-
Swapnil Pimpale authored
Removed the checks for oi_lockless from osc_io_read_start() and osc_io_write_start(). This patch also removes the unnecessary call to cl_object_attr_get() in osc_io_write_start() before calling cl_object_attr_set() Signed-off-by:
Swapnil Pimpale <spimpale@ddn.com> Reviewed-on: http://review.whamcloud.com/8797 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3868Reviewed-by:
-
Li Xi authored
spin_is_locked() is always false when the platform is uniprocessor and CONFIG_DEBUG_SPINLOCK is not enabled. This patch replaces its assertion by assert_spin_locked(). Signed-off-by:
Li Xi <lixi@ddn.com> Signed-off-by:
Alexey Lyashkov <alexey_lyashkov@xyratex.com> Reviewed-by:
-
John L. Hammond authored
In llite remove unused declarations, parameters, types, and unused, get-only, or set-only structure members. Add static and const qualifiers to declarations where possible. Signed-off-by:
Lai Siyao <lai.siyao@intel.com> Reviewed-by:
-
wang di authored
In some cases, cl_default_mds_easize might be zero, especially for MDC connected to non-MDT0, then mdc might pack getattr RPC with zero eadatasize. If client is trying to access remote striped directory with zero eadatasize, MDT will not return layout information of the striped direcotry, which will be mis-regarded as non-striped directory. So we should use cl_max_mds_easize if cl_default_mds_easize is zero. Signed-off-by:
wang di <di.wang@intel.com> Reviewed-on: http://review.whamcloud.com/9862 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4847Reviewed-by:
-
Jinshan Xiong authored
It's not atomic to check the last reference and state of cl_lock in cl_lock_put(). This can cause a problem that an using lock is freed, if the process is preempted between atomic_dec_and_test() and (lock->cll_state == CLS_FREEING). This problem can be solved by holding a refcount by coh_locks. In this case, it can be sure that if the lock refcount reaches zero, nobody else can have any chance to use it again. Signed-off-by:
-
Bob Glossman authored
Change the LL_IOC_LLOOP_INFO ioctl in the lustre lloop device driver to return an error instead of causing panics with LASSERT(). Signed-off-by:
Bob Glossman <bob.glossman@intel.com> Reviewed-on: http://review.whamcloud.com/9888 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4863Reviewed-by:
Nathaniel Clark <nathaniel.l.clark@intel.com> Reviewed-by:
-
Ryan Haasken authored
Messages which are printed by ll_dirty_page_discard_warn() should not be rate limited. If they are rate limited, some files which may be corrupted on client eviction will not be reported to the user. This patch changes the CWARN to a CDEBUG to disable console message rate limiting for this message. The dirty page discard warnings are already limited on a per-file basis by the function vvp_vmpage_error which calls ll_dirty_page_discard_warn only if the ccc_object's cob_discard_page_warned == 0. Signed-off-by:
Cory Spitz <spitzcor@cray.com> Reviewed-by:
-
Dmitry Eremin authored
According https://www.kernel.org/doc/Documentation/mutex-design.txt: - the mutex subsystem is slightly faster and has better scalability for contended workloads. In terms of 'ops per CPU cycle', the semaphore kernel performed 551 ops/sec per 1% of CPU time used, while the mutex kernel performed 3825 ops/sec per 1% of CPU time used - it was 6.9 times more efficient. - there are no fastpath tradeoffs, the mutex fastpath is just as tight as the semaphore fastpath. On x86, the locking fastpath is 2 instructions. - 'struct mutex' semantics are well-defined and are enforced if CONFIG_DEBUG_MUTEXES is turned on. Semaphores on the other hand have virtually no debugging code or instrumentation. One more benefit of mutex is optimistic spinning. It try to spin for acquisition when there are no pending waiters and the lock owner is currently running on a (different) CPU. The rationale is that if the lock owner is running, it is likely to release the lock soon. This significantly reduce amount of context switches when locked region is small and we have high contention. Signed-off-by:
-
Dmitry Eremin authored
It's just optimization. The mutex subsystem is slightly faster and has better scalability for contended workloads. Remove the lustre_lock and it's accessor functions l_lock(), l_unlock(), l_lock_init(), and l_has_lock() since they have not been used by the code since Lustre 1.6. Signed-off-by:
Alex Zhuravlev <alexey.zhuravlev@intel.com> Signed-off-by:
-
Li Xi authored
Some CPU table functions for uniprocessor architecture is missing. Signed-off-by:
Liang Zhen <liang.zhen@intel.com> Reviewed-by:
-
Linus Torvalds authored
Merge tag 'driver-core-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are some kernfs fixes for 3.15-rc3 that resolve some reported problems. Nothing huge, but all needed" * tag 'driver-core-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: s390/ccwgroup: Fix memory corruption kernfs: add back missing error check in kernfs_fop_mmap() kernfs: fix a subdir count leak
-
John L. Hammond authored
Remove the nowhere included header lustre/include/ioctl.h. Signed-off-by:
-
Liang Zhen authored
lnet_shutdown_lndnis() may enter endless loop if there is a busy NI, this is injected by LNet SMP improvements. It's fixed in this patch. Signed-off-by:
-
Dmitry Eremin authored
sscanf format specification '%u' expects type 'unsigned int *' for 'u', but parameter 3 has a different type 'int*'. Signed-off-by:
-
Dmitry Eremin authored
Pointer 'mod' checked for NULL at line 160 may be dereferenced at line 208. Signed-off-by:
-
Dmitry Eremin authored
Pointer '*exp' returned from call to function 'class_conn2export' at line 523 may be NULL and may be dereferenced at line 543. Signed-off-by:
-
Andreas Dilger authored
Locate the loh_flags and loh_ref fields together in lu_object_header to avoid holes and shrink the structure by 8 bytes. Signed-off-by:
-
Jinshan Xiong authored
We used to access layout version under the protection of ldlm lock, this introduces extra overhead for dlm lock matching. In this patch, lli_layout_lock is introduced to access the layout version. Also, when a layout lock is losing, we should tear down mmap of the correspoding inode to avoid stale data accessing in the future. This is part of technical verification of replication. Signed-off-by:
-
