1. 23 9月, 2009 20 次提交
  2. 22 9月, 2009 8 次提交
  3. 18 9月, 2009 5 次提交
  4. 17 9月, 2009 7 次提交
    • H
      af_iucv: fix race when queueing skbs on the backlog queue · bf95d20f
      Hendrik Brueckner 提交于
      iucv_sock_recvmsg() and iucv_process_message()/iucv_fragment_skb race
      for dequeuing an skb from the backlog queue.
      
      If iucv_sock_recvmsg() dequeues first, iucv_process_message() calls
      sock_queue_rcv_skb() with an skb that is NULL.
      
      This results in the following kernel panic:
      
      <1>Unable to handle kernel pointer dereference at virtual kernel address (null)
      <4>Oops: 0004 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      <4>Modules linked in: af_iucv sunrpc qeth_l3 dm_multipath dm_mod vmur qeth ccwgroup
      <4>CPU: 0 Not tainted 2.6.30 #4
      <4>Process client-iucv (pid: 4787, task: 0000000034e75940, ksp: 00000000353e3710)
      <4>Krnl PSW : 0704000180000000 000000000043ebca (sock_queue_rcv_skb+0x7a/0x138)
      <4>           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:0 PM:0 EA:3
      <4>Krnl GPRS: 0052900000000000 000003e0016e0fe8 0000000000000000 0000000000000000
      <4>           000000000043eba8 0000000000000002 0000000000000001 00000000341aa7f0
      <4>           0000000000000000 0000000000007800 0000000000000000 0000000000000000
      <4>           00000000341aa7f0 0000000000594650 000000000043eba8 000000003fc2fb28
      <4>Krnl Code: 000000000043ebbe: a7840006            brc     8,43ebca
      <4>           000000000043ebc2: 5930c23c            c       %r3,572(%r12)
      <4>           000000000043ebc6: a724004c            brc     2,43ec5e
      <4>          >000000000043ebca: e3c0b0100024        stg     %r12,16(%r11)
      <4>           000000000043ebd0: a7190000            lghi    %r1,0
      <4>           000000000043ebd4: e310b0200024        stg     %r1,32(%r11)
      <4>           000000000043ebda: c010ffffdce9        larl    %r1,43a5ac
      <4>           000000000043ebe0: e310b0800024        stg     %r1,128(%r11)
      <4>Call Trace:
      <4>([<000000000043eba8>] sock_queue_rcv_skb+0x58/0x138)
      <4> [<000003e0016bcf2a>] iucv_process_message+0x112/0x3cc [af_iucv]
      <4> [<000003e0016bd3d4>] iucv_callback_rx+0x1f0/0x274 [af_iucv]
      <4> [<000000000053a21a>] iucv_message_pending+0xa2/0x120
      <4> [<000000000053b5a6>] iucv_tasklet_fn+0x176/0x1b8
      <4> [<000000000014fa82>] tasklet_action+0xfe/0x1f4
      <4> [<0000000000150a56>] __do_softirq+0x116/0x284
      <4> [<0000000000111058>] do_softirq+0xe4/0xe8
      <4> [<00000000001504ba>] irq_exit+0xba/0xd8
      <4> [<000000000010e0b2>] do_extint+0x146/0x190
      <4> [<00000000001184b6>] ext_no_vtime+0x1e/0x22
      <4> [<00000000001fbf4e>] kfree+0x202/0x28c
      <4>([<00000000001fbf44>] kfree+0x1f8/0x28c)
      <4> [<000000000044205a>] __kfree_skb+0x32/0x124
      <4> [<000003e0016bd8b2>] iucv_sock_recvmsg+0x236/0x41c [af_iucv]
      <4> [<0000000000437042>] sock_aio_read+0x136/0x160
      <4> [<0000000000205e50>] do_sync_read+0xe4/0x13c
      <4> [<0000000000206dce>] vfs_read+0x152/0x15c
      <4> [<0000000000206ed0>] SyS_read+0x54/0xac
      <4> [<0000000000117c8e>] sysc_noemu+0x10/0x16
      <4> [<00000042ff8def3c>] 0x42ff8def3c
      Signed-off-by: NHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      bf95d20f
    • H
      af_iucv: do not call iucv_sock_kill() twice · 7514bab0
      Hendrik Brueckner 提交于
      For non-accepted sockets on the accept queue, iucv_sock_kill()
      is called twice (in iucv_sock_close() and iucv_sock_cleanup_listen()).
      This typically results in a kernel oops as shown below.
      
      Remove the duplicate call to iucv_sock_kill() and set the SOCK_ZAPPED
      flag in iucv_sock_close() only.
      
      The iucv_sock_kill() function frees a socket only if the socket is zapped
      and orphaned (sk->sk_socket == NULL):
        - Non-accepted sockets are always orphaned and, thus, iucv_sock_kill()
          frees the socket twice.
        - For accepted sockets or sockets created with iucv_sock_create(),
          sk->sk_socket is initialized. This caused the first call to
          iucv_sock_kill() to return immediately. To free these sockets,
          iucv_sock_release() uses sock_orphan() before calling iucv_sock_kill().
      
      <1>Unable to handle kernel pointer dereference at virtual kernel address 000000003edd3000
      <4>Oops: 0011 [#1] PREEMPT SMP DEBUG_PAGEALLOC
      <4>Modules linked in: af_iucv sunrpc qeth_l3 dm_multipath dm_mod qeth vmur ccwgroup
      <4>CPU: 0 Not tainted 2.6.30 #4
      <4>Process iucv_sock_close (pid: 2486, task: 000000003aea4340, ksp: 000000003b75bc68)
      <4>Krnl PSW : 0704200180000000 000003e00168e23a (iucv_sock_kill+0x2e/0xcc [af_iucv])
      <4>           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3
      <4>Krnl GPRS: 0000000000000000 000000003b75c000 000000003edd37f0 0000000000000001
      <4>           000003e00168ec62 000000003988d960 0000000000000000 000003e0016b0608
      <4>           000000003fe81b20 000000003839bb58 00000000399977f0 000000003edd37f0
      <4>           000003e00168b000 000003e00168f138 000000003b75bcd0 000000003b75bc98
      <4>Krnl Code: 000003e00168e22a: c0c0ffffe6eb	larl	%r12,3e00168b000
      <4>           000003e00168e230: b90400b2		lgr	%r11,%r2
      <4>           000003e00168e234: e3e0f0980024	stg	%r14,152(%r15)
      <4>          >000003e00168e23a: e310225e0090	llgc	%r1,606(%r2)
      <4>           000003e00168e240: a7110001		tmll	%r1,1
      <4>           000003e00168e244: a7840007		brc	8,3e00168e252
      <4>           000003e00168e248: d507d00023c8	clc	0(8,%r13),968(%r2)
      <4>           000003e00168e24e: a7840009		brc	8,3e00168e260
      <4>Call Trace:
      <4>([<000003e0016b0608>] afiucv_dbf+0x0/0xfffffffffffdea20 [af_iucv])
      <4> [<000003e00168ec6c>] iucv_sock_close+0x130/0x368 [af_iucv]
      <4> [<000003e00168ef02>] iucv_sock_release+0x5e/0xe4 [af_iucv]
      <4> [<0000000000438e6c>] sock_release+0x44/0x104
      <4> [<0000000000438f5e>] sock_close+0x32/0x50
      <4> [<0000000000207898>] __fput+0xf4/0x250
      <4> [<00000000002038aa>] filp_close+0x7a/0xa8
      <4> [<00000000002039ba>] SyS_close+0xe2/0x148
      <4> [<0000000000117c8e>] sysc_noemu+0x10/0x16
      <4> [<00000042ff8deeac>] 0x42ff8deeac
      Signed-off-by: NHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      7514bab0
    • H
      af_iucv: handle non-accepted sockets after resuming from suspend · 56a73de3
      Hendrik Brueckner 提交于
      After resuming from suspend, all af_iucv sockets are disconnected.
      Ensure that iucv_accept_dequeue() can handle disconnected sockets
      which are not yet accepted.
      Signed-off-by: NHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      56a73de3
    • H
      af_iucv: fix race in __iucv_sock_wait() · d9973179
      Hendrik Brueckner 提交于
      Moving prepare_to_wait before the condition to avoid a race between
      schedule_timeout and wake up.
      The race can appear during iucv_sock_connect() and iucv_callback_connack().
      Signed-off-by: NHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d9973179
    • H
      iucv: use correct output register in iucv_query_maxconn() · b29e4da4
      Hendrik Brueckner 提交于
      The iucv_query_maxconn() function uses the wrong output register and
      stores the size of the interrupt buffer instead of the maximum number
      of connections.
      
      According to the QUERY IUCV function, general register 1 contains the
      maximum number of connections.
      
      If the maximum number of connections is not set properly, the following
      warning is displayed:
      
      Badness at /usr/src/kernel-source/2.6.30-39.x.20090806/net/iucv/iucv.c:1808
      Modules linked in: netiucv fsm af_iucv sunrpc qeth_l3 dm_multipath dm_mod vmur qeth ccwgroup
      CPU: 0 Tainted: G        W  2.6.30 #4
      Process seq (pid: 16925, task: 0000000030e24a40, ksp: 000000003033bd98)
      Krnl PSW : 0404200180000000 000000000053b270 (iucv_external_interrupt+0x64/0x224)
                 R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:0 CC:2 PM:0 EA:3
      Krnl GPRS: 00000000011279c2 00000000014bdb70 0029000000000000 0000000000000029
                 000000000053b236 000000000001dba4 0000000000000000 0000000000859210
                 0000000000a67f68 00000000008a6100 000000003f83fb90 0000000000004000
                 000000003f8c7bc8 00000000005a2250 000000000053b236 000000003fc2fe08
      Krnl Code: 000000000053b262: e33010000021	clg	%r3,0(%r1)
                 000000000053b268: a7440010		brc	4,53b288
                 000000000053b26c: a7f40001		brc	15,53b26e
                >000000000053b270: c03000184134	larl	%r3,8434d8
                 000000000053b276: eb220030000c	srlg	%r2,%r2,48
                 000000000053b27c: eb6ff0a00004	lmg	%r6,%r15,160(%r15)
                 000000000053b282: c0f4fffff6a7	brcl	15,539fd0
                 000000000053b288: 4310a003		ic	%r1,3(%r10)
      Call Trace:
      ([<000000000053b236>] iucv_external_interrupt+0x2a/0x224)
       [<000000000010e09e>] do_extint+0x132/0x190
       [<00000000001184b6>] ext_no_vtime+0x1e/0x22
       [<0000000000549f7a>] _spin_unlock_irqrestore+0x96/0xa4
      ([<0000000000549f70>] _spin_unlock_irqrestore+0x8c/0xa4)
       [<00000000002101d6>] pipe_write+0x3da/0x5bc
       [<0000000000205d14>] do_sync_write+0xe4/0x13c
       [<0000000000206a7e>] vfs_write+0xae/0x15c
       [<0000000000206c24>] SyS_write+0x54/0xac
       [<0000000000117c8e>] sysc_noemu+0x10/0x16
       [<00000042ff8defcc>] 0x42ff8defcc
      Signed-off-by: NHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      b29e4da4
    • H
      iucv: fix iucv_buffer_cpumask check when calling IUCV functions · d28ecab0
      Hendrik Brueckner 提交于
      Prior to calling IUCV functions, the DECLARE BUFFER function must have been
      called for at least one CPU to receive IUCV interrupts.
      
      With commit "iucv: establish reboot notifier" (6c005961), a check has been
      introduced to avoid calling IUCV functions if the current CPU does not have
      an interrupt buffer declared.
      Because one interrupt buffer is sufficient, change the condition to ensure
      that one interrupt buffer is available.
      
      In addition, checking the buffer on the current CPU creates a race with
      CPU up/down notifications: before checking the buffer, the IUCV function
      might be interrupted by an smp_call_function() that retrieves the interrupt
      buffer for the current CPU.
      When the IUCV function continues, the check fails and -EIO is returned. If a
      buffer is available on any other CPU, the IUCV function call must be invoked
      (instead of failing with -EIO).
      Signed-off-by: NHendrik Brueckner <brueckner@linux.vnet.ibm.com>
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d28ecab0
    • U
      iucv: suspend/resume error msg for left over pathes · 4c89d86b
      Ursula Braun 提交于
      During suspend IUCV exploiters have to close their IUCV connections.
      When restoring an image, it can be checked if all IUCV pathes had
      been closed before the Linux instance was suspended. If not, an
      error message is issued to indicate a problem in one of the
      used programs exploiting IUCV communication.
      Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4c89d86b