Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v3.4.105 2014-07-07T01:49:19+00:00 2014-07-07T01:49:19+00:00 Bart Van Assche bvanassche@acm.org 2014-06-06T16:25:04+00:00 urn:sha1:d0d9888d713c1cc3737d5c4e90dd705e633df55a commit 60e1751cb52cc6d1ae04b6bd3c2b96e770b5823f upstream. Avoid that closing /dev/infiniband/umad<n> or /dev/infiniband/issm<n> triggers a use-after-free. __fput() invokes f_op->release() before it invokes cdev_put(). Make sure that the ib_umad_device structure is freed by the cdev_put() call instead of f_op->release(). This avoids that changing the port mode from IB into Ethernet and back to IB followed by restarting opensmd triggers the following kernel oops: general protection fault: 0000 [#1] PREEMPT SMP RIP: 0010:[<ffffffff810cc65c>] [<ffffffff810cc65c>] module_put+0x2c/0x170 Call Trace: [<ffffffff81190f20>] cdev_put+0x20/0x30 [<ffffffff8118e2ce>] __fput+0x1ae/0x1f0 [<ffffffff8118e35e>] ____fput+0xe/0x10 [<ffffffff810723bc>] task_work_run+0xac/0xe0 [<ffffffff81002a9f>] do_notify_resume+0x9f/0xc0 [<ffffffff814b8398>] int_signal+0x12/0x17 Reference: https://bugzilla.kernel.org/show_bug.cgi?id=75051 Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Yann Droneaud <ydroneaud@opteya.com> Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2014-07-07T01:49:19+00:00 Bart Van Assche bvanassche@acm.org 2014-05-20T08:33:41+00:00 urn:sha1:b6b405ba1650d663665b693ddff520ade3d1cbaa commit 8ec0a0e6b58218bdc1db91dd70ebfcd6ad8dd6cd upstream. Avoid leaking a kref count in ib_umad_open() if port->ib_dev == NULL or if nonseekable_open() fails. Avoid leaking a kref count, that sm_sem is kept down and also that the IB_PORT_SM capability mask is not cleared in ib_umad_sm_open() if nonseekable_open() fails. Since container_of() never returns NULL, remove the code that tests whether container_of() returns NULL. Moving the kref_get() call from the start of ib_umad_*open() to the end is safe since it is the responsibility of the caller of these functions to ensure that the cdev pointer remains valid until at least when these functions return. Signed-off-by: Bart Van Assche <bvanassche@acm.org> [ydroneaud@opteya.com: rework a bit to reduce the amount of code changed] Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> [ nonseekable_open() can't actually fail, but.... - Roland ] Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2012-10-28T17:14:15+00:00 Gao feng gaofeng@cn.fujitsu.com 2012-10-04T20:15:49+00:00 urn:sha1:6114941a295ff186d29ab7462cce6a41a089c354 [ Upstream commit 809d5fc9bf6589276a12bd4fd611e4c7ff9940c3 ] set netlink_dump_control.module to avoid panic. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> Cc: Roland Dreier <roland@kernel.org> Cc: Sean Hefty <sean.hefty@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2012-06-01T07:18:17+00:00 Yishai Hadas yishaih@mellanox.com 2012-05-10T20:28:05+00:00 urn:sha1:b10dfc7a2b20aaf6fad56f7b0725c4aaa9438ad1 commit c4870eb874ac16dccef40e1bc7a002c7e9156adc upstream. Commit bc3e53f682d9 ("mm: distinguish between mlocked and pinned pages") introduced a separate counter for pinned pages and used it in the IB stack. However, in ib_umem_get() the pinned counter is incremented, but ib_umem_release() wrongly decrements the locked counter. Fix this. Signed-off-by: Yishai Hadas <yishaih@mellanox.com> Reviewed-by: Christoph Lameter <cl@linux.com> Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2012-04-26T22:35:35+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-04-26T22:35:35+00:00 urn:sha1:ebcf596d89f9686308db768e527a22165831b473 Pull infiniband fixes from Roland Dreier: "A few fixes for regressions introduced in 3.4-rc1: - fix memory leak in mlx4 - fix two problems with new MAD response generation code" * tag 'ib-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: IB/mlx4: Fix memory leaks in ib_link_query_port() IB/mad: Don't send response for failed MADs IB/mad: Set 'D' bit in response for unhandled MADs 2012-04-24T23:08:57+00:00 Jack Morgenstein jackm@dev.mellanox.co.il 2012-04-24T23:08:57+00:00 urn:sha1:a9e7432319eb26ad90f18a7d215e50341d28ecb2 Commit 0b307043049f ("IB/mad: Return error response for unsupported MADs") does not failed MADs (eg those that return IB_MAD_RESULT_FAILURE) properly -- these MADs should be silently discarded. (We should not force the lower-layer drivers to return SUCCESS | CONSUMED in this case, since the MAD is NOT successful). Unsupported MADs are not failures -- they return SUCCESS, but with an "unsupported error" status value inside the response MAD. Reviewed-by: Hal Rosenstock <hal@mellanox.com> Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Roland Dreier <roland@purestorage.com> 2012-04-24T23:06:50+00:00 Jack Morgenstein jackm@dev.mellanox.co.il 2012-04-24T23:06:50+00:00 urn:sha1:840777de530ae96ee9a3022f7ec1d6c65abb26ac Commit 0b307043049f ("IB/mad: Return error response for unsupported MADs") does not handle directed-route MADs properly -- it fails to set the 'D' bit in the response MAD status field. This is a problem for SmInfo MADs when the receiver does not have an SM running. Reviewed-by: Hal Rosenstock <hal@mellanox.com> Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Roland Dreier <roland@purestorage.com> 2012-04-02T17:57:31+00:00 Roland Dreier roland@purestorage.com 2012-04-02T17:57:31+00:00 urn:sha1:0559d8dc13a1cd68b5e64c0b61659f36c7b5c89f Commit e9319b0cb00d ("IB/core: Fix SDR rates in sysfs") changed our sysfs rate attribute to return EINVAL to userspace if the underlying device driver returns an invalid rate. Apparently some drivers do this when the link is down and some userspace pukes if it gets an error when reading this attribute, so avoid a regression by not return an error to match the old code. Signed-off-by: Roland Dreier <roland@purestorage.com> 2012-03-21T17:33:42+00:00 Linus Torvalds torvalds@linux-foundation.org 2012-03-21T17:33:42+00:00 urn:sha1:0c2fe82a9b106f1c03719783134360586d718a69 Pull InfiniBand/RDMA changes for the 3.4 merge window from Roland Dreier: "Nothing big really stands out; by patch count lots of fixes to the mlx4 driver plus some cleanups and fixes to the core and other drivers." * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (28 commits) mlx4_core: Scale size of MTT table with system RAM mlx4_core: Allow dynamic MTU configuration for IB ports IB/mlx4: Fix info returned when querying IBoE ports IB/mlx4: Fix possible missed completion event mlx4_core: Report thermal error events mlx4_core: Fix one more static exported function IB: Change CQE "csum_ok" field to a bit flag RDMA/iwcm: Reject connect requests if cmid is not in LISTEN state RDMA/cxgb3: Don't pass irq flags to flush_qp() mlx4_core: Get rid of redundant ext_port_cap flags RDMA/ucma: Fix AB-BA deadlock IB/ehca: Fix ilog2() compile failure IB: Use central enum for speed instead of hard-coded values IB/iser: Post initial receive buffers before sending the final login request IB/iser: Free IB connection resources in the proper place IB/srp: Consolidate repetitive sysfs code IB/srp: Use pr_fmt() and pr_err()/pr_warn() IB/core: Fix SDR rates in sysfs mlx4: Enforce device max FMR maps in FMR alloc IB/mlx4: Set bad_wr for invalid send opcode ... 2012-03-19T16:50:33+00:00 Roland Dreier roland@purestorage.com 2012-03-19T16:50:33+00:00 urn:sha1:f0e88aeb19dac00ed2e09fd4d39ee65f32d5e968