- 10 10月, 2018 2 次提交
-
-
由 Dominique Martinet 提交于
p9_read_work/p9_write_work might still hold references to a req after having been cancelled; make sure we put any of these to avoid potential request leak on disconnect. Fixes: 728356de ("9p: Add refcount to p9_req_t") Link: http://lkml.kernel.org/r/1539057956-23741-2-git-send-email-asmadeus@codewreck.orgSigned-off-by: NDominique Martinet <dominique.martinet@cea.fr> Cc: Eric Van Hensbergen <ericvh@gmail.com> Cc: Latchesar Ionkov <lucho@ionkov.net> Reviewed-by: NTomas Bortoli <tomasbortoli@gmail.com>
-
由 Dominique Martinet 提交于
p9_read_work would try to handle an errored req even if it got put to error state by another thread between the lookup (that worked) and the time it had been fully read. The request itself is safe to use because we hold a ref to it from the lookup (for m->rreq, so it was safe to read into the request data buffer until this point), but the req_list has been deleted at the same time status changed, and client_cb already has been called as well, so we should not do either. Link: http://lkml.kernel.org/r/1539057956-23741-1-git-send-email-asmadeus@codewreck.orgSigned-off-by: NDominique Martinet <dominique.martinet@cea.fr> Reported-by: syzbot+2222c34dc40b515f30dc@syzkaller.appspotmail.com Cc: Eric Van Hensbergen <ericvh@gmail.com> Cc: Latchesar Ionkov <lucho@ionkov.net>
-
- 08 9月, 2018 3 次提交
-
-
由 Tomas Bortoli 提交于
In struct p9_conn, rename req to rreq as it is used by the read routine. Link: http://lkml.kernel.org/r/20180903160321.2181-1-tomasbortoli@gmail.comSigned-off-by: NTomas Bortoli <tomasbortoli@gmail.com> Suggested-by: NJun Piao <piaojun@huawei.com> Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr>
-
由 Tomas Bortoli 提交于
To avoid use-after-free(s), use a refcount to keep track of the usable references to any instantiated struct p9_req_t. This commit adds p9_req_put(), p9_req_get() and p9_req_try_get() as wrappers to kref_put(), kref_get() and kref_get_unless_zero(). These are used by the client and the transports to keep track of valid requests' references. p9_free_req() is added back and used as callback by kref_put(). Add SLAB_TYPESAFE_BY_RCU as it ensures that the memory freed by kmem_cache_free() will not be reused for another type until the rcu synchronisation period is over, so an address gotten under rcu read lock is safe to inc_ref() without corrupting random memory while the lock is held. Link: http://lkml.kernel.org/r/1535626341-20693-1-git-send-email-asmadeus@codewreck.orgCo-developed-by: NDominique Martinet <dominique.martinet@cea.fr> Signed-off-by: NTomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+467050c1ce275af2a5b8@syzkaller.appspotmail.com Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr>
-
由 Dominique Martinet 提交于
'msize' is often a power of two, or at least page-aligned, so avoiding an overhead of two dozen bytes for each allocation will help the allocator do its work and reduce memory fragmentation. Link: http://lkml.kernel.org/r/1533825236-22896-1-git-send-email-asmadeus@codewreck.orgSuggested-by: NMatthew Wilcox <willy@infradead.org> Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr> Reviewed-by: NGreg Kurz <groug@kaod.org> Acked-by: NJun Piao <piaojun@huawei.com> Cc: Matthew Wilcox <willy@infradead.org>
-
- 13 8月, 2018 4 次提交
-
-
由 Tomas Bortoli 提交于
Added checks to prevent GPFs from raising. Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbortoli@gmail.comSigned-off-by: NTomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+1a262da37d3bead15c39@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr>
-
由 Tomas Bortoli 提交于
This commit adds length check for the PDU size. The size contained in the header has to match the actual size, except for TCP (trans_fd.c) where actual length is not known ahead and the header's length will be checked only against the validity range. Link: http://lkml.kernel.org/r/20180723154404.2406-1-tomasbortoli@gmail.comSigned-off-by: NTomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+65c6b72f284a39d416b4@syzkaller.appspotmail.com To: Eric Van Hensbergen <ericvh@gmail.com> To: Ron Minnich <rminnich@sandia.gov> To: Latchesar Ionkov <lucho@ionkov.net> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr>
-
由 Tomas Bortoli 提交于
It may be possible to run p9_fd_cancel() with a deleted req->req_list and incur in a double del. To fix hold the client->lock while changing the status, so the other threads will be synchronized. Link: http://lkml.kernel.org/r/20180723184253.6682-1-tomasbortoli@gmail.comSigned-off-by: NTomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+735d926e9d1317c3310c@syzkaller.appspotmail.com To: Eric Van Hensbergen <ericvh@gmail.com> To: Ron Minnich <rminnich@sandia.gov> To: Latchesar Ionkov <lucho@ionkov.net> Cc: Yiwen Jiang <jiangyiwen@huwei.com> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr>
-
由 Tomas Bortoli 提交于
The patch adds the flush in p9_mux_poll_stop() as it the function used by p9_conn_destroy(), in turn called by p9_fd_close() to stop the async polling associated with the data regarding the connection. Link: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@gmail.comSigned-off-by: NTomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+39749ed7d9ef6dfb23f6@syzkaller.appspotmail.com To: Eric Van Hensbergen <ericvh@gmail.com> To: Ron Minnich <rminnich@sandia.gov> To: Latchesar Ionkov <lucho@ionkov.net> Cc: Yiwen Jiang <jiangyiwen@huwei.com> Cc: stable@vger.kernel.org Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr>
-
- 26 5月, 2018 1 次提交
-
-
由 Christoph Hellwig 提交于
These abstract out calls to the poll method in preparation for changes in how we poll. Signed-off-by: NChristoph Hellwig <hch@lst.de> Reviewed-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: NDarrick J. Wong <darrick.wong@oracle.com>
-
- 10 5月, 2018 1 次提交
-
-
由 Sun Lianwen 提交于
There are follow comment errors: 1 The function name is wrong in p9_release_pages() comment. 2 The function name and variable name is wrong in p9_poll_workfn() comment. 3 There is no variable dm_mr and lkey in struct p9_trans_rdma. 4 The function name is wrong in rdma_create_trans() comment. 5 There is no variable initialized in struct virtio_chan. 6 The variable name is wrong in p9_virtio_zc_request() comment. Signed-off-by: NSun Lianwen <sunlw.fnst@cn.fujitsu.com> Reviewed-by: NRandy Dunlap <rdunlap@infradead.org> Reviewed-by: NRandy Dunlap <rdunlap@infradead.org> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 12 2月, 2018 1 次提交
-
-
由 Linus Torvalds 提交于
This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: NAl Viro <viro@zeniv.linux.org.uk> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 06 12月, 2017 1 次提交
-
-
由 Al Viro 提交于
This changes calling conventions (and simplifies the hell out the callers). New rules: once struct socket had been passed to sock_alloc_file(), it's been consumed either by struct file or by sock_release() done by sock_alloc_file(). Either way the caller should not do sock_release() after that point. Reviewed-by: NEric Dumazet <edumazet@google.com> Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 29 11月, 2017 1 次提交
-
-
由 Al Viro 提交于
First of all, NULL ->poll() means "always POLLIN, always POLLOUT", not an error. Furthermore, mixing -EREMOTEIO with POLL... masks and expecting it to do anything good is insane - both are arch-dependent, to start with. Pass a pointer to store the error value separately and make it return POLLERR in such case. And ->poll() calling conventions do *not* include "return -Esomething". Never had. Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
- 20 11月, 2017 1 次提交
-
-
由 Tuomas Tynkkynen 提交于
Since commit c4fac910 ("9p: Implement show_options"), the mount options of 9p filesystems are printed out with some missing commas between the individual options: p9-scratch on /mnt/scratch type 9p (rw,dirsync,loose,access=clienttrans=virtio) Add them back. Cc: stable@vger.kernel.org # 4.13+ Fixes: c4fac910 ("9p: Implement show_options") Signed-off-by: NTuomas Tynkkynen <tuomas@tuxera.com> Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
- 05 9月, 2017 2 次提交
-
-
由 Christoph Hellwig 提交于
Instead of playing with the addressing limits. Signed-off-by: NChristoph Hellwig <hch@lst.de> Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
由 Christoph Hellwig 提交于
Use proper ssize_t and size_t types for the return value and count argument, move the offset last and make it an in/out argument like all other read/write helpers, and make the buf argument a void pointer to get rid of lots of casts in the callers. Signed-off-by: NChristoph Hellwig <hch@lst.de> Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
- 11 7月, 2017 1 次提交
-
-
由 David Howells 提交于
Implement the show_options superblock op for 9p as part of a bid to get rid of s_options and generic_show_options() to make it easier to implement a context-based mount where the mount options can be passed individually over a file descriptor. Signed-off-by: NDavid Howells <dhowells@redhat.com> cc: Eric Van Hensbergen <ericvh@gmail.com> cc: Ron Minnich <rminnich@sandia.gov> cc: Latchesar Ionkov <lucho@ionkov.net> cc: v9fs-developer@lists.sourceforge.net Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
- 20 6月, 2017 1 次提交
-
-
由 Ingo Molnar 提交于
Rename: wait_queue_t => wait_queue_entry_t 'wait_queue_t' was always a slight misnomer: its name implies that it's a "queue", but in reality it's a queue *entry*. The 'real' queue is the wait queue head, which had to carry the name. Start sorting this out by renaming it to 'wait_queue_entry_t'. This also allows the real structure name 'struct __wait_queue' to lose its double underscore and become 'struct wait_queue_entry', which is the more canonical nomenclature for such data types. Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-kernel@vger.kernel.org Signed-off-by: NIngo Molnar <mingo@kernel.org>
-
- 14 11月, 2015 2 次提交
-
-
由 Dominique Martinet 提交于
req->rc is pre-allocated early on with p9_tag_alloc and shouldn't be missing Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
由 Dominique Martinet 提交于
Most of the changes here are no-op and just renaming to use a fcall struct, needed for p9_parse_header It fixes the unaligned memory access to read the tag and defers to common functions for part of the protocol knowledge (although header length is still hard-coded...) Reported-By: NRob Landley <rob@landley.net> Signed-Off-By: NDominique Martinet <dominique.martinet@cea.fr> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 22 3月, 2015 1 次提交
-
-
由 Dominique Martinet 提交于
We're currently using an uninitialized value if option privport is not set, thus (almost) always using a privileged port. Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 20 3月, 2015 1 次提交
-
-
由 Fabian Frederick 提交于
p is initialized but unused. Signed-off-by: NFabian Frederick <fabf@skynet.be> Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 13 3月, 2015 1 次提交
-
-
由 Eric W. Biederman 提交于
Having to say > #ifdef CONFIG_NET_NS > struct net *net; > #endif in structures is a little bit wordy and a little bit error prone. Instead it is possible to say: > typedef struct { > #ifdef CONFIG_NET_NS > struct net *net; > #endif > } possible_net_t; And then in a header say: > possible_net_t net; Which is cleaner and easier to use and easier to test, as the possible_net_t is always there no matter what the compile options. Further this allows read_pnet and write_pnet to be functions in all cases which is better at catching typos. This change adds possible_net_t, updates the definitions of read_pnet and write_pnet, updates optional struct net * variables that write_pnet uses on to have the type possible_net_t, and finally fixes up the b0rked users of read_pnet and write_pnet. Signed-off-by: N"Eric W. Biederman" <ebiederm@xmission.com> Acked-by: NEric Dumazet <edumazet@google.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 26 3月, 2014 4 次提交
-
-
由 Simon Derr 提交于
There is no point in allocating these structs separately. Changing this makes the code a little simpler and saves a few bytes of memory. Reported-by: Herve Vico Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
由 Simon Derr 提交于
This request state is mostly useless, and properly implementing it for RDMA would require an extra lock to be taken in handle_recv() and in rdma_cancel() to avoid this race: handle_recv() rdma_cancel() . . . if req->state == SENT req->state = RCVD . . req->state = FLSH So just get rid of it. Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
由 Simon Derr 提交于
And move transport-specific code out of net/9p/client.c Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
由 Dominique Martinet 提交于
We need barriers to guarantee this pattern works as intended: [w] req->rc, 1 [r] req->status, 1 wmb rmb [w] req->status, 1 [r] req->rc Where the wmb ensures that rc gets written before status, and the rmb ensures that if you observe status == 1, rc is the new value. Signed-off-by: NDominique Martinet <dominique.martinet@cea.fr> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 24 11月, 2013 1 次提交
-
-
由 Eric Van Hensbergen 提交于
A few releases back a patch made virtio the default transport, however it was done in a way which side-stepped the mechanism put in place to allow for this selection. This patch cleans that up while maintaining virtio as the default transport. Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 25 10月, 2013 1 次提交
-
-
由 Al Viro 提交于
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
- 08 7月, 2013 1 次提交
-
-
由 Jim Garlick 提交于
If the privport option is specified, the tcp transport binds local address to a reserved port before connecting to the 9p server. In some cases when 9P AUTH cannot be implemented, this is better than nothing. Signed-off-by: NJim Garlick <garlick@llnl.gov> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 12 10月, 2012 1 次提交
-
-
由 Simon Derr 提交于
Race scenario: thread A thread B p9_write_work() p9_fd_request() if (list_empty (&m->unsent_req_list)) ... spin_lock(&client->lock); req->status = REQ_STATUS_UNSENT; list_add_tail(..., &m->unsent_req_list); spin_unlock(&client->lock); .... if (n & POLLOUT && !test_and_set_bit(Wworksched, &m->wsched) schedule_work(&m->wq); --> not done because Wworksched is set clear_bit(Wworksched, &m->wsched); return; --> nobody will take care of sending the new request. This is not very likely to happen though, because p9_write_work() being called with an empty unsent_req_list is not frequent. But this also means that taking the lock earlier will not be costly. Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 27 9月, 2012 1 次提交
-
-
由 Al Viro 提交于
Both modular callers of sock_map_fd() had been buggy; sctp one leaks descriptor and file if copy_to_user() fails, 9p one shouldn't be exposing file in the descriptor table at all. Switch both to sock_alloc_file(), export it, unexport sock_map_fd() and make it static. Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
-
- 18 9月, 2012 3 次提交
-
-
由 Simon Derr 提交于
See previous commit about p9_read_work() for details. This fixes a similar race between p9_write_work() and p9_poll_mux() Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
由 Simon Derr 提交于
At the end of p9_write_work() we want to test if there is still data to send. This means: - either the current request still has data to send (wsize != 0) - or there are requests in the unsent queue Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
由 Simon Derr 提交于
Race scenario between p9_read_work() and p9_poll_mux() Data arrive, Rworksched is set, p9_read_work() is called. thread A thread B p9_read_work() . reads data . checks if new data ready. No. . gets preempted . More data arrive, p9_poll_mux() is called. . . . p9_poll_mux() . . if (!test_and_set_bit(Rworksched, . &m->wsched)) { . schedule_work(&m->rq); . } . . -> does not schedule work because . Rworksched is set . . clear_bit(Rworksched, &m->wsched); return; No work has been scheduled, and yet data are waiting. Currently p9_read_work() checks if there is data to read, and if not, it clears Rworksched. I think it should clear Rworksched first, and then check if there is data to read. Signed-off-by: NSimon Derr <simon.derr@bull.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 21 8月, 2012 1 次提交
-
-
由 Tejun Heo 提交于
flush[_delayed]_work_sync() are now spurious. Mark them deprecated and convert all users to flush[_delayed]_work(). If you're cc'd and wondering what's going on: Now all workqueues are non-reentrant and the regular flushes guarantee that the work item is not pending or running on any CPU on return, so there's no reason to use the sync flushes at all and they're going away. This patch doesn't make any functional difference. Signed-off-by: NTejun Heo <tj@kernel.org> Cc: Russell King <linux@arm.linux.org.uk> Cc: Paul Mundt <lethal@linux-sh.org> Cc: Ian Campbell <ian.campbell@citrix.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Mattia Dongili <malattia@linux.it> Cc: Kent Yoder <key@linux.vnet.ibm.com> Cc: David Airlie <airlied@linux.ie> Cc: Jiri Kosina <jkosina@suse.cz> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: Bryan Wu <bryan.wu@canonical.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Alasdair Kergon <agk@redhat.com> Cc: Mauro Carvalho Chehab <mchehab@infradead.org> Cc: Florian Tobias Schandinat <FlorianSchandinat@gmx.de> Cc: David Woodhouse <dwmw2@infradead.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: linux-wireless@vger.kernel.org Cc: Anton Vorontsov <cbou@mail.ru> Cc: Sangbeom Kim <sbkim73@samsung.com> Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Eric Van Hensbergen <ericvh@gmail.com> Cc: Takashi Iwai <tiwai@suse.de> Cc: Steven Whitehouse <swhiteho@redhat.com> Cc: Petr Vandrovec <petr@vandrovec.name> Cc: Mark Fasheh <mfasheh@suse.com> Cc: Christoph Hellwig <hch@infradead.org> Cc: Avi Kivity <avi@redhat.com>
-
- 16 4月, 2012 1 次提交
-
-
由 Eric Dumazet 提交于
Use of "unsigned int" is preferred to bare "unsigned" in net tree. Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com> Signed-off-by: NDavid S. Miller <davem@davemloft.net>
-
- 06 1月, 2012 1 次提交
-
-
由 Joe Perches 提交于
Reduce object size by deduplicating formats. Use vsprintf extension %pV. Rename P9_DPRINTK uses to p9_debug, align arguments. Add function for _p9_debug and macro to add __func__. Add missing "\n"s to p9_debug uses. Remove embedded function names as p9_debug adds it. Remove P9_EPRINTK macro and convert use to pr_<level>. Add and use pr_fmt and pr_<level>. $ size fs/9p/built-in.o* text data bss dec hex filename 62133 984 16000 79117 1350d fs/9p/built-in.o.new 67342 984 16928 85254 14d06 fs/9p/built-in.o.old $ size net/9p/built-in.o* text data bss dec hex filename 88792 4148 22024 114964 1c114 net/9p/built-in.o.new 94072 4148 23232 121452 1da6c net/9p/built-in.o.old Signed-off-by: NJoe Perches <joe@perches.com> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-
- 25 5月, 2011 1 次提交
-
-
由 Rob Landley 提交于
Teach 9p filesystem to work in container with non-default network namespace. (Note: I also patched the unix domain socket code but don't have a test case for that. It's the same fix, I just don't have a server for it...) To test, run diod server (http://code.google.com/p/diod): diod -n -f -L stderr -l 172.23.255.1:9999 -c /dev/null -e /root and then mount like so: mount -t 9p -o port=9999,aname=/root,version=9p2000.L 172.23.255.1 /mnt A container test environment is described at http://landley.net/lxcSigned-off-by: NRob Landley <rob@landley.net> Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
-