Skip to content
  1. Jul 19, 2017
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-4.13-rc2' of git://github.com/ceph/ceph-client · a90c6ac2
      Linus Torvalds authored 
      Pull ceph fixes from Ilya Dryomov:
 "A number of small fixes for -rc1 Luminous changes plus a readdir race
  fix, marked for stable"

* tag 'ceph-for-4.13-rc2' of git://github.com/ceph/ceph-client:
  libceph: potential NULL dereference in ceph_msg_data_create()
  ceph: fix race in concurrent readdir
  libceph: don't call encode_request_finish() on MOSDBackoff messages
  libceph: use alloc_pg_mapping() in __decode_pg_upmap_items()
  libceph: set -EINVAL in one place in crush_decode()
  libceph: NULL deref on osdmap_apply_incremental() error path
  libceph: fix old style declaration warnings
      a90c6ac2
    • Linus Torvalds's avatar
      Merge tag 'md/4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 74cbd96b
      Linus Torvalds authored 
      Pull MD fixes from Shaohua Li:

 - raid5-ppl fix by Artur. This one is introduced in this release cycle.

 - raid5 reshape fix by Xiao. This is an old bug and will be added to
   stable.

 - bitmap fix by Guoqing.

* tag 'md/4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
  raid5-ppl: use BIOSET_NEED_BVECS when creating bioset
  Raid5 should update rdev->sectors after reshape
  md/bitmap: don't read page from device with Bitmap_sync
      74cbd96b
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · bef85bd7
      Linus Torvalds authored 
      Pull rdma fixes from Doug Ledford:
 "First set of -rc fixes for 4.13 cycle:

   - misc iSER fixes

   - namespace fixups

   - fix the fact that IPoIB didn't use the proper API for noio mem allocs

   - rxe driver fixes

   - hns_roce fixes

   - misc core fixes

   - misc IPoIB fixes"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (27 commits)
  IB/core: Allow QP state transition from reset to error
  IB/hns: Fix for checkpatch.pl comment style warnings
  IB/hns: Fix the bug with modifying the MAC address without removing the driver
  IB/hns: Fix the bug with rdma operation
  IB/hns: Fix the bug with wild pointer when destroy rc qp
  IB/hns: Fix the bug of polling cq failed for loopback Qps
  IB/rxe: Set dma_mask and coherent_dma_mask
  IB/rxe: Fix kernel panic from skb destructor
  IB/ipoib: Let lower driver handle get_stats64 call
  IB/core: Add ordered workqueue for RoCE GID management
  IB/mlx5: Clean mr_cache debugfs in case of failure
  IB/core: Remove NOIO QP create flag
  {net, IB}/mlx4: Remove gfp flags argument
  IB/{rdmavt, qib, hfi1}: Remove gfp flags argument
  IB/IPoIB: Convert IPoIB to memalloc_noio_* calls
  IB/IPoIB: Forward MTU change to driver below
  IB: Convert msleep below 20ms to usleep_range
  IB/uverbs: Make use of ib_modify_qp variant to avoid resolving DMAC
  IB/core: Introduce modify QP operation with udata
  IB/core: Don't resolve IP address to the loopback device
  ...
      bef85bd7
    • Linus Torvalds's avatar
      Merge tag 'nfsd-4.13-1' of git://linux-nfs.org/~bfields/linux · 15b0a8d1
      Linus Torvalds authored 
      Pull nfsd fix from Bruce Fields:
 "One fix for a problem introduced in the most recent merge window and
  found by Dave Jones and KASAN"

* tag 'nfsd-4.13-1' of git://linux-nfs.org/~bfields/linux:
  nfsd: Fix a memory scribble in the callback channel
      15b0a8d1
  3. Jul 18, 2017
  5. Jul 17, 2017
    • Moni Shoua's avatar
      IB/core: Don't resolve IP address to the loopback device · cbd09aeb
      Moni Shoua authored 
      When resolving an IP address that is on the host of the caller the
result from querying the routing table is the loopback device. This is
not a valid response, because it doesn't represent the RDMA device and
the port.

Therefore, callers need to check the resolved device and if it is a
loopback device find an alternative way to resolve it. To avoid this we
make sure that the response from rdma_resolve_ip() will not be the
loopback device.

While that, we fix an static checker warning about dereferencing an
unintitialized pointer using the same solution as in commit abeffce9


("net/mlx5e: Fix a -Wmaybe-uninitialized warning") as a reference.

Signed-off-by: default avatarMoni Shoua <monis@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      cbd09aeb
    • Moni Shoua's avatar
      IB/core: Namespace is mandatory input for address resolution · bebb2a47
      Moni Shoua authored 
      In function addr_resolve() the namespace is a required input parameter
and not an output. It is passed later for searching the routing table
and device addresses. Also, it shouldn't be copied back to the caller.

Fixes: 565edd1d

 ('IB/addr: Pass network namespace as a parameter')
Cc: <stable@vger.kernel.org> # v4.3+
Signed-off-by: default avatarMoni Shoua <monis@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      bebb2a47
    • Vladimir Neyelov's avatar
      IB/iser: Fix connection teardown race condition · c8c16d3b
      Vladimir Neyelov authored 
      Under heavy iser target(scst) start/stop stress during login/logout
on iser intitiator side happened trace call provided below.

The function iscsi_iser_slave_alloc iser_conn pointer could be NULL,
due to the fact that function iscsi_iser_conn_stop can be called before
and free iser connection. Let's protect that flow by introducing global mutex.

BUG: unable to handle kernel paging request at 0000000000001018
IP: [<ffffffffc0426f7e>] iscsi_iser_slave_alloc+0x1e/0x50 [ib_iser]
Call Trace:
? scsi_alloc_sdev+0x242/0x300
scsi_probe_and_add_lun+0x9e1/0xea0
? kfree_const+0x21/0x30
? kobject_set_name_vargs+0x76/0x90
? __pm_runtime_resume+0x5b/0x70
__scsi_scan_target+0xf6/0x250
scsi_scan_target+0xea/0x100
iscsi_user_scan_session.part.13+0x101/0x130 [scsi_transport_iscsi]
? iscsi_user_scan_session.part.13+0x130/0x130 [scsi_transport_iscsi]
iscsi_user_scan_session+0x1e/0x30 [scsi_transport_iscsi]
device_for_each_child+0x50/0x90
iscsi_user_scan+0x44/0x60 [scsi_transport_iscsi]
store_scan+0xa8/0x100
? common_file_perm+0x5d/0x1c0
dev_attr_store+0x18/0x30
sysfs_kf_write+0x37/0x40
kernfs_fop_write+0x12c/0x1c0
__vfs_write+0x18/0x40
vfs_write+0xb5/0x1a0
SyS_write+0x55/0xc0

Fixes: 318d311e

 ("iser: Accept arbitrary sg lists mapping if the device supports it")
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: default avatarVladimir Neyelov <vladimirn@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Reviewed-by: default avatarSagi Grimberg <sagi@grimbeg.me>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      c8c16d3b
    • Gustavo A. R. Silva's avatar
      RDMA/core: Document confusing code · 28b5b3a2
      Gustavo A. R. Silva authored 
      

While looking into Coverity ID 1351047 I ran into the following
piece of code at
drivers/infiniband/core/verbs.c:496:

ret = rdma_addr_find_l2_eth_by_grh(&dgid, &sgid,
                                   ah_attr->dmac,
                                   wc->wc_flags & IB_WC_WITH_VLAN ?
                                   NULL : &vlan_id,
                                   &if_index, &hoplimit);

The issue here is that the position of arguments in the call to
rdma_addr_find_l2_eth_by_grh() function do not match the order of
the parameters:

&dgid is passed to sgid
&sgid is passed to dgid

This is the function prototype:

int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
 				 const union ib_gid *dgid,
 				 u8 *dmac, u16 *vlan_id, int *if_index,
 				 int *hoplimit)

My question here is if this is intentional?

Answer:
Yes. ib_init_ah_from_wc() creates ah from the incoming packet.
Incoming packet has dgid of the receiver node on which this code is
getting executed and sgid contains the GID of the sender.

When resolving mac address of destination, you use arrived dgid as
sgid and use sgid as dgid because sgid contains destinations GID whom to
respond to.

Signed-off-by: default avatarGustavo A. R. Silva <garsilva@embeddedor.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      28b5b3a2
    • Bart Van Assche's avatar
      mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array · 99975cd4
      Bart Van Assche authored 
      ib_map_mr_sg() can pass an SG-list to .map_mr_sg() that is larger
than what fits into a single MR. .map_mr_sg() must not attempt to
map more SG-list elements than what fits into a single MR.
Hence make sure that mlx5_ib_sg_to_klms() does not write outside
the MR klms[] array.

Fixes: b005d316

 ("mlx5: Add arbitrary sg list support")
Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: default avatarMax Gurtovoy <maxg@mellanox.com>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: Leon Romanovsky <leonro@mellanox.com>
Cc: Israel Rukshin <israelr@mellanox.com>
Cc: <stable@vger.kernel.org>
Acked-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      99975cd4
    • Dennis Dalessandro's avatar
      IB/hfi1: Ensure dd->gi_mask can not be overflowed · 91647f4c
      Dennis Dalessandro authored 
      

As the code stands today the array access in remap_intr() is OK. To
future proof the code though we should explicitly check to ensure the
index value is not outside of the valid range. This is not a straight
forward calculation so err on the side of caution.

Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      91647f4c
    • Doug Ledford's avatar
      Merge tag 'v4.13-rc1' into k.o/for-4.13-rc · 3d886aa3
      Doug Ledford authored 
      Linux v4.13-rc1
      3d886aa3
    • minimumlaw@rambler.ru's avatar
      regmap: regmap-w1: Fix build troubles · 5b20a436
      minimumlaw@rambler.ru authored 
      Fixes: cc5d0db3 ("regmap: Add 1-Wire bus support")
Commit de0d6dbd

 ("w1: Add subsystem kernel public interface")
Fix place off w1.h header file

Cosmetic: Fix company name (local to international)
Signed-off-by: default avatarAlex A. Mihaylov <minimumlaw@rambler.ru>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
      5b20a436
    • Dan Carpenter's avatar
      libceph: potential NULL dereference in ceph_msg_data_create() · 7c40b22f
      Dan Carpenter authored 
      If kmem_cache_zalloc() returns NULL then the INIT_LIST_HEAD(&data->links);
will Oops.  The callers aren't really prepared for NULL returns so it
doesn't make a lot of difference in real life.

Fixes: 5240d9f9

 ("libceph: replace message data pointer with list")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      7c40b22f
    • Yan, Zheng's avatar
      ceph: fix race in concurrent readdir · 84583cfb
      Yan, Zheng authored 
      

For a large directory, program needs to issue multiple readdir
syscalls to get all dentries. When there are multiple programs
read the directory concurrently. Following sequence of events
can happen.

 - program calls readdir with pos = 2. ceph sends readdir request
   to mds. The reply contains N1 entries. ceph adds these N1 entries
   to readdir cache.
 - program calls readdir with pos = N1+2. The readdir is satisfied
   by the readdir cache, N2 entries are returned. (Other program
   calls readdir in the middle, which fills the cache)
 - program calls readdir with pos = N1+N2+2. ceph sends readdir
   request to mds. The reply contains N3 entries and it reaches
   directory end. ceph adds these N3 entries to the readdir cache
   and marks directory complete.

The second readdir call does not update fi->readdir_cache_idx.
ceph add the last N3 entries to wrong places.

Cc: stable@vger.kernel.org # v4.3+
Signed-off-by: default avatar"Yan, Zheng" <zyan@redhat.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      84583cfb