- 11 10月, 2013 1 次提交
-
-
由 Theodore Ts'o 提交于
Allow architectures which have a disabled get_cycles() function to provide a random_get_entropy() function which provides a fine-grained, rapidly changing counter that can be used by the /dev/random driver. For example, an architecture might have a rapidly changing register used to control random TLB cache eviction, or DRAM refresh that doesn't meet the requirements of get_cycles(), but which is good enough for the needs of the random driver. Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu> Cc: stable@vger.kernel.org
-
- 10 10月, 2013 1 次提交
-
-
由 Rob Herring 提交于
xen-tpmfront fails to build on arm64 with the following error: drivers/char/tpm/xen-tpmfront.c: In function ‘xen_tpmfront_init’: drivers/char/tpm/xen-tpmfront.c:422:2: error: implicit declaration of function ‘xen_domain’ [-Werror=implicit-function-declaration] Add include of xen/xen.h to fix this. Signed-off-by: NRob Herring <rob.herring@calxeda.com> Signed-off-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com> Reviewed-by: NAshley Lai <adlai@linux.vnet.ibm.com> Acked-by: NAshley Lai <adlai@linux.vnet.ibm.com> Cc: Leonidas Da Silva Barbosa <leosilva@linux.vnet.ibm.com> Cc: Rajiv Andrade <mail@srajiv.net> Cc: Marcel Selhorst <tpmdd@selhorst.net> Cc: Sirrix AG <tpmdd@sirrix.com> Cc: tpmdd-devel@lists.sourceforge.net
-
- 25 9月, 2013 2 次提交
-
-
由 Jason Gunthorpe 提交于
Upon deeper review it was agreed to remove the driver-unique 'locality' sysfs attribute before it is present in a released kernel. The attribute was introduced in e2683957 during the 3.12 merge window, so this patch needs to go in before 3.12 is released. The hope is to have a well defined locality API that all the other locality aware drivers can use, perhaps in 3.13. Signed-off-by: NJason Gunthorpe <jgunthorpe@obsidianresearch.com> Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: NDaniel De Graaf <dgdegra@tycho.nsa.gov>
-
由 Jason Gunthorpe 提交于
All the default durations were being set to 10 minutes which is way too long for the timeouts. Normal values for the longest duration are around 5 mins, and short duration ar around .5s. Further, these are just the default, tpm_get_timeouts will set them to values from the TPM (or throw an error). Just remove them. Acked-by: NDaniel De Graaf <dgdegra@tycho.nsa.gov> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Signed-off-by: NJason Gunthorpe <jgunthorpe@obsidianresearch.com> Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-
- 23 9月, 2013 1 次提交
-
-
由 Theodore Ts'o 提交于
The some platforms (e.g., ARM) initializes their clocks as late_initcalls for some unknown reason. So make sure random_int_secret_init() is run after all of the late_initcalls are run. Cc: stable@vger.kernel.org Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
-
- 13 9月, 2013 1 次提交
-
-
由 Martin Schwidefsky 提交于
After the last architecture switched to generic hard irqs the config options HAVE_GENERIC_HARDIRQS & GENERIC_HARDIRQS and the related code for !CONFIG_GENERIC_HARDIRQS can be removed. Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>
-
- 12 9月, 2013 1 次提交
-
-
由 Shuah Khan 提交于
Convert drivers/char/tpm/tpm_tis.c to use dev_pm_ops instead of legacy pm_ops. This patch depends on pnp driver bus ops change to invoke pnp_driver dev_pm_ops. Signed-off-by: NShuah Khan <shuah.kh@samsung.com> Cc: Matthew Garrett <matthew.garrett@nebula.com> Cc: Leonidas Da Silva Barbosa <leosilva@linux.vnet.ibm.com> Cc: Ashley Lai <ashley@ashleylai.com> Cc: Rajiv Andrade <mail@srajiv.net> Cc: Marcel Selhorst <tpmdd@selhorst.net> Cc: Sirrix AG <tpmdd@sirrix.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> Cc: Bjorn Helgaas <bhelgaas@google.com> Cc: Grant Likely <grant.likely@linaro.org> Cc: Rob Herring <rob.herring@calxeda.com> Cc: Peter Hüwe <PeterHuewe@gmx.de> Signed-off-by: NAndrew Morton <akpm@linux-foundation.org> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 05 9月, 2013 4 次提交
-
-
由 Thomas Bogendoerfer 提交于
The last line of PARISC machines (C8000, RP34x0, etc.) have a BMC for controlling temperature, fan speed and other stuff. The BMC is connected via a special bus and listed in the firmware device tree. This change adds support for these BMCs to the IPMI driver. Signed-off-by: NThomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: NCorey Minyard <cminyard@mvista.com> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Jordan_Hargrave@Dell.com 提交于
I'd submitted this about a year ago but it never made it upstream. The latest versions of the kernel drivers for ipmi can use ACPI to determine the type of BMC device used in the system. The following patch adds a module alias so that udev will autoload the ipmi_si driver. Signed-off-by: NJordan Hargrave <jordan_hargrave@dell.com> Signed-off-by: NCorey Minyard <cminyard@mvista.com> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Corey Minyard 提交于
A couple of variables were getting warnings about being uninitialized. It was a false warning, but initialize them, anyway. Signed-off-by: NCorey Minyard <cminyard@mvista.com> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
由 Dan Carpenter 提交于
On x86_64 there is a 4 byte hole between ->recv_type and ->addr. Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com> Signed-off-by: NCorey Minyard <cminyard@mvista.com> Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
-
- 02 9月, 2013 1 次提交
-
-
由 Ben Hutchings 提交于
via-rng currently isn't auto-loaded if built as a module. Signed-off-by: NBen Hutchings <ben@decadent.org.uk> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
- 31 8月, 2013 1 次提交
-
-
由 Konrad Rzeszutek Wilk 提交于
Randy reports: x86_64: drivers/built-in.o: In function `xen_tpmfront_init': xen-tpmfront.c:(.init.text+0x257c): undefined reference to `xenbus_register_frontend' This is nicely fixed by selecting the XenBus frontend module. Reported-by: NRandy Dunlap <rdunlap@infradead.org> Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-
- 21 8月, 2013 1 次提交
-
-
由 Olof Johansson 提交于
The newly added omap4 support in the driver was added without consideration for building older configs. When building omap1_defconfig, it resulted in: drivers/char/hw_random/omap-rng.c:190:12: warning: 'omap4_rng_init' defined but not used [-Wunused-function] drivers/char/hw_random/omap-rng.c:215:13: warning: 'omap4_rng_cleanup' defined but not used [-Wunused-function] drivers/char/hw_random/omap-rng.c:251:20: warning: 'omap4_rng_irq' defined but not used [-Wunused-function] Move the code around so it is grouped with its operations struct, which for the omap4 case means also under the #ifdef CONFIG_OF, where it needs to be. Signed-off-by: NOlof Johansson <olof@lixom.net> Reviewed-by: NLokesh Vutla <lokeshvutla@ti.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
- 14 8月, 2013 1 次提交
-
-
由 Julia Lawall 提交于
Remove unneeded error handling on the result of a call to platform_get_resource when the value is passed to devm_ioremap_resource. Move the call to platform_get_resource adjacent to the call to devm_ioremap_resource to make the connection between them more clear. A simplified version of the semantic patch that makes this change is as follows: (http://coccinelle.lip6.fr/) // <smpl> @@ expression pdev,res,n,e,e1; expression ret != 0; identifier l; @@ - res = platform_get_resource(pdev, IORESOURCE_MEM, n); ... when != res - if (res == NULL) { ... \(goto l;\|return ret;\) } ... when != res + res = platform_get_resource(pdev, IORESOURCE_MEM, n); e = devm_ioremap_resource(e1, res); // </smpl> Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
- 09 8月, 2013 8 次提交
-
-
由 Daniel De Graaf 提交于
This is a complete rewrite of the Xen TPM frontend driver, taking advantage of a simplified frontend/backend interface and adding support for cancellation and timeouts. The backend for this driver is provided by a vTPM stub domain using the interface in Xen 4.3. Signed-off-by: NDaniel De Graaf <dgdegra@tycho.nsa.gov> Acked-by: NMatthew Fioravante <matthew.fioravante@jhuapl.edu> Reviewed-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com> Acked-by: NPeter Huewe <peterhuewe@gmx.de> Reviewed-by: NPeter Huewe <peterhuewe@gmx.de> Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-
由 Jingoo Han 提交于
'rng_dev' is used only in this file. Fix the following sparse warning: drivers/char/hw_random/picoxcell-rng.c:36:15: warning: symbol 'rng_dev' was not declared. Should it be static? Signed-off-by: NJingoo Han <jg1.han@samsung.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Lokesh Vutla 提交于
Add support for OMAP4 version of TRNG module that is present on OMAP4, AM33xx and OMAP5 SoCs. The modules have several differences including register offsets, output size, triggering rng and how configuring FROs. To handle these differences, a platform_data structure is defined and contains routine pointers, register offsets. OMAP2 specific routines are prefixed with 'omap2_' and OMAP4 specific routines are prefixed with 'omap4_'. Note: Few Hard coded values are from the TI AM33xx SDK. Signed-off-by: NLokesh Vutla <lokeshvutla@ti.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Lokesh Vutla 提交于
Add Device Tree suport to the omap-rng driver. Currently, only support for OMAP2 and OMAP3 is being added but support for OMAP4 and OMAP5 will be added in a subsequent patch. Signed-off-by: NLokesh Vutla <lokeshvutla@ti.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Lokesh Vutla 提交于
platform_set_drvdata() is called twice in driver probe. Removing the duplicated call. Signed-off-by: NLokesh Vutla <lokeshvutla@ti.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Lokesh Vutla 提交于
Use devm_kzalloc() to make cleanup paths simpler. Signed-off-by: NLokesh Vutla <lokeshvutla@ti.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Lokesh Vutla 提交于
module_platform_driver() makes the code simpler. Using the macro in the driver. Signed-off-by: NLokesh Vutla <lokeshvutla@ti.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Amit Shah 提交于
Remove the debugfs path before freeing port->name, to prevent a possible use-after-free. Reported-by: NJason Wang <jasowang@redhat.com> Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
- 01 8月, 2013 2 次提交
-
-
由 Fabio Estevam 提交于
clk_prepare_enable() may fail, so let's check its return value and propagate it in the case of error. Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com> Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
-
由 Alex Ivanov 提交于
Allow binding of user memory to the AGP GART on systems with HP Quicksilver AGP bus. This resolves 'bind memory failed' error seen in dmesg: [29.365973] [TTM] AGP Bind memory failed. … [29.367030] [drm] Forcing AGP to PCI mode The system doesn't more fail to bind the memory, and hence not falling back to the PCI mode (if other failures aren't detected). This is just a simple write down from the following patches: agp/amd-k7: Allow binding user memory to the AGP GART agp/hp-agp: Allow binding user memory to the AGP GART Signed-off-by: NAlex Ivanov <gnidorah@p0n4ik.tk> Cc: <stable@vger.kernel.org> # 3.10 Signed-off-by: NHelge Deller <deller@gmx.de>
-
- 30 7月, 2013 1 次提交
-
-
由 Dan Carpenter 提交于
The PTR_ERR(NULL) here is not useful. Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com> Reviewed-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
- 29 7月, 2013 8 次提交
-
-
由 Amit Shah 提交于
send_sigio_to_port() checks the value of guest_connected, which we always modify under the inbuf_lock; make sure invocations of send_sigio_to_port() have take the inbuf_lock around the call. Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
Port unplug can race with close() in port_fops_release(). port_fops_release() already takes the necessary locks, ensure unplug_port() does that too. Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
The removal functions act on the vqs, and the vq operations need to be locked. Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
If a port gets unplugged while a user is blocked on read(), -ENODEV is returned. However, subsequent read()s returned 0, indicating there's no host-side connection (but not indicating the device went away). This also happened when a port was unplugged and the user didn't have any blocking operation pending. If the user didn't monitor the SIGIO signal, they won't have a chance to find out if the port went away. Fix by returning -ENODEV on all read()s after the port gets unplugged. write() already behaves this way. CC: <stable@vger.kernel.org> Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
SIGIO should be sent when a port gets unplugged. It should only be sent to prcesses that have the port opened, and have asked for SIGIO to be delivered. We were clearing out guest_connected before calling send_sigio_to_port(), resulting in a sigio not getting sent to processes. Fix by setting guest_connected to false after invoking the sigio function. CC: <stable@vger.kernel.org> Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
We used to keep the port's char device structs and the /sys entries around till the last reference to the port was dropped. This is actually unnecessary, and resulted in buggy behaviour: 1. Open port in guest 2. Hot-unplug port 3. Hot-plug a port with the same 'name' property as the unplugged one This resulted in hot-plug being unsuccessful, as a port with the same name already exists (even though it was unplugged). This behaviour resulted in a warning message like this one: -------------------8<--------------------------------------- WARNING: at fs/sysfs/dir.c:512 sysfs_add_one+0xc9/0x130() (Not tainted) Hardware name: KVM sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:04.0/virtio0/virtio-ports/vport0p1' Call Trace: [<ffffffff8106b607>] ? warn_slowpath_common+0x87/0xc0 [<ffffffff8106b6f6>] ? warn_slowpath_fmt+0x46/0x50 [<ffffffff811f2319>] ? sysfs_add_one+0xc9/0x130 [<ffffffff811f23e8>] ? create_dir+0x68/0xb0 [<ffffffff811f2469>] ? sysfs_create_dir+0x39/0x50 [<ffffffff81273129>] ? kobject_add_internal+0xb9/0x260 [<ffffffff812733d8>] ? kobject_add_varg+0x38/0x60 [<ffffffff812734b4>] ? kobject_add+0x44/0x70 [<ffffffff81349de4>] ? get_device_parent+0xf4/0x1d0 [<ffffffff8134b389>] ? device_add+0xc9/0x650 -------------------8<--------------------------------------- Instead of relying on guest applications to release all references to the ports, we should go ahead and unregister the port from all the core layers. Any open/read calls on the port will then just return errors, and an unplug/plug operation on the host will succeed as expected. This also caused buggy behaviour in case of the device removal (not just a port): when the device was removed (which means all ports on that device are removed automatically as well), the ports with active users would clean up only when the last references were dropped -- and it would be too late then to be referencing char device pointers, resulting in oopses: -------------------8<--------------------------------------- PID: 6162 TASK: ffff8801147ad500 CPU: 0 COMMAND: "cat" #0 [ffff88011b9d5a90] machine_kexec at ffffffff8103232b #1 [ffff88011b9d5af0] crash_kexec at ffffffff810b9322 #2 [ffff88011b9d5bc0] oops_end at ffffffff814f4a50 #3 [ffff88011b9d5bf0] die at ffffffff8100f26b #4 [ffff88011b9d5c20] do_general_protection at ffffffff814f45e2 #5 [ffff88011b9d5c50] general_protection at ffffffff814f3db5 [exception RIP: strlen+2] RIP: ffffffff81272ae2 RSP: ffff88011b9d5d00 RFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff880118901c18 RCX: 0000000000000000 RDX: ffff88011799982c RSI: 00000000000000d0 RDI: 3a303030302f3030 RBP: ffff88011b9d5d38 R8: 0000000000000006 R9: ffffffffa0134500 R10: 0000000000001000 R11: 0000000000001000 R12: ffff880117a1cc10 R13: 00000000000000d0 R14: 0000000000000017 R15: ffffffff81aff700 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #6 [ffff88011b9d5d00] kobject_get_path at ffffffff8126dc5d #7 [ffff88011b9d5d40] kobject_uevent_env at ffffffff8126e551 #8 [ffff88011b9d5dd0] kobject_uevent at ffffffff8126e9eb #9 [ffff88011b9d5de0] device_del at ffffffff813440c7 -------------------8<--------------------------------------- So clean up when we have all the context, and all that's left to do when the references to the port have dropped is to free up the port struct itself. CC: <stable@vger.kernel.org> Reported-by: Nchayang <chayang@redhat.com> Reported-by: NYOGANANTH SUBRAMANIAN <anantyog@in.ibm.com> Reported-by: NFuXiangChun <xfu@redhat.com> Reported-by: NQunfang Zhang <qzhang@redhat.com> Reported-by: NSibiao Luo <sluo@redhat.com> Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
Between open() being called and processed, the port can be unplugged. Check if this happened, and bail out. A simple test script to reproduce this is: while true; do for i in $(seq 1 100); do echo $i > /dev/vport0p3; done; done; This opens and closes the port a lot of times; unplugging the port while this is happening triggers the bug. CC: <stable@vger.kernel.org> Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Amit Shah 提交于
There's a window between find_port_by_devt() returning a port and us taking a kref on the port, where the port could get unplugged. Fix it by taking the reference in find_port_by_devt() itself. Problem reported and analyzed by Mateusz Guzik. CC: <stable@vger.kernel.org> Reported-by: NMateusz Guzik <mguzik@redhat.com> Signed-off-by: NAmit Shah <amit.shah@redhat.com> Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
- 27 7月, 2013 1 次提交
-
-
由 Alexandru Juncu 提交于
Suggested by coccinelle and manually verified. Signed-off-by: NAlexandru Juncu <alexj@rosedu.org> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 26 7月, 2013 1 次提交
-
-
由 Greg Kroah-Hartman 提交于
This fixes the build error: drivers/char/tile-srom.c:307:2: warning: missing braces around initializer [-Wmissing-braces] and the resulting fallout for the missing '*' character, sorry, my fault... Reported-by: Nkbuild test robot <fengguang.wu@intel.com> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 25 7月, 2013 2 次提交
-
-
由 Greg Kroah-Hartman 提交于
The dev_attrs field of struct class is going away soon, dev_groups should be used instead. This converts the tile srom_class code to use the correct field. Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
由 Greg Kroah-Hartman 提交于
The dev_attrs field of struct class is going away soon, dev_groups should be used instead. This converts the bsr bsr_class code to use the correct field. Cc: Arnd Bergmann <arnd@arndb.de> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 23 7月, 2013 2 次提交
-
-
由 Yoshihiro YUNOMAE 提交于
Add pipe_lock/unlock for splice_write to avoid oops by following competition: (1) An application gets fds of a trace buffer, virtio-serial, pipe. (2) The application does fork() (3) The processes execute splice_read(trace buffer) and splice_write(virtio-serial) via same pipe. <parent> <child> get fds of a trace buffer, virtio-serial, pipe | fork()----------create--------+ | | splice(read) | ---+ splice(write) | +-- no competition | splice(read) | | splice(write) ---+ | | splice(read) | splice(write) splice(read) ------ competition | splice(write) Two processes share a pipe_inode_info structure. If the child execute splice(read) when the parent tries to execute splice(write), the structure can be broken. Existing virtio-serial driver does not get lock for the structure in splice_write, so this competition will induce oops. <oops messages> BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130 PGD 7223e067 PUD 72391067 PMD 0 Oops: 0000 [#1] SMP Modules linked in: lockd bnep bluetooth rfkill sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_timer snd soundcore pcspkr virtio_net virtio_balloon i2c_piix4 i2c_core microcode uinput floppy CPU: 0 PID: 1072 Comm: compete-test Not tainted 3.10.0ws+ #55 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 task: ffff880071b98000 ti: ffff88007b55e000 task.ti: ffff88007b55e000 RIP: 0010:[<ffffffff811a6b5f>] [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130 RSP: 0018:ffff88007b55fd78 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffff88007b55fe20 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffff88007a95ba30 RDI: ffff880036f9e6c0 RBP: ffff88007b55fda8 R08: 00000000000006ec R09: ffff880077626708 R10: 0000000000000003 R11: ffffffff8139ca59 R12: ffff88007a95ba30 R13: 0000000000000000 R14: ffffffff8139dd00 R15: ffff880036f9e6c0 FS: 00007f2e2e3a0740(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000018 CR3: 0000000071bd1000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffffffff8139ca59 ffff88007b55fe20 ffff880036f9e6c0 ffffffff8139dd00 ffff8800776266c0 ffff880077626708 ffff88007b55fde8 ffffffff811a6e8e ffff88007b55fde8 ffffffff8139ca59 ffff880036f9e6c0 ffff88007b55fe20 Call Trace: [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0 [<ffffffff8139dd00>] ? virtcons_restore+0x100/0x100 [<ffffffff811a6e8e>] __splice_from_pipe+0x7e/0x90 [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0 [<ffffffff8139d739>] port_fops_splice_write+0xe9/0x140 [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120 [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0 [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110 [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0 [<ffffffff8161facf>] tracesys+0xdd/0xe2 Code: 49 8b 87 80 00 00 00 4c 8d 24 d0 8b 53 04 41 8b 44 24 0c 4d 8b 6c 24 10 39 d0 89 03 76 02 89 13 49 8b 44 24 10 4c 89 e6 4c 89 ff <ff> 50 18 85 c0 0f 85 aa 00 00 00 48 89 da 4c 89 e6 4c 89 ff 41 RIP [<ffffffff811a6b5f>] splice_from_pipe_feed+0x6f/0x130 RSP <ffff88007b55fd78> CR2: 0000000000000018 ---[ end trace 24572beb7764de59 ]--- V2: Fix a locking problem for error V3: Add Reviewed-by lines and stable@ line in sign-off area Signed-off-by: NYoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com> Reviewed-by: NAmit Shah <amit.shah@redhat.com> Reviewed-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com> Cc: Amit Shah <amit.shah@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: stable@vger.kernel.org Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-
由 Yoshihiro YUNOMAE 提交于
Quit from splice_write if pipe->nrbufs is 0 for avoiding oops in virtio-serial. When an application was doing splice from a kernel buffer to virtio-serial on a guest, the application received signal(SIGINT). This situation will normally happen, but the kernel executed a kernel panic by oops as follows: BUG: unable to handle kernel paging request at ffff882071c8ef28 IP: [<ffffffff812de48f>] sg_init_table+0x2f/0x50 PGD 1fac067 PUD 0 Oops: 0000 [#1] SMP Modules linked in: lockd sunrpc bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_page_alloc snd_timer snd microcode virtio_balloon virtio_net pcspkr soundcore i2c_piix4 i2c_core uinput floppy CPU: 1 PID: 908 Comm: trace-cmd Not tainted 3.10.0+ #49 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 task: ffff880071c64650 ti: ffff88007bf24000 task.ti: ffff88007bf24000 RIP: 0010:[<ffffffff812de48f>] [<ffffffff812de48f>] sg_init_table+0x2f/0x50 RSP: 0018:ffff88007bf25dd8 EFLAGS: 00010286 RAX: 0000001fffffffe0 RBX: ffff882071c8ef28 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880071c8ef48 RBP: ffff88007bf25de8 R08: ffff88007fd15d40 R09: ffff880071c8ef48 R10: ffffea0001c71040 R11: ffffffff8139c555 R12: 0000000000000000 R13: ffff88007506a3c0 R14: ffff88007c862500 R15: ffff880071c8ef00 FS: 00007f0a3646c740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff882071c8ef28 CR3: 000000007acbb000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Stack: ffff880071c8ef48 ffff88007bf25e20 ffff88007bf25e88 ffffffff8139d6fa ffff88007bf25e28 ffffffff8127a3f4 0000000000000000 0000000000000000 ffff880071c8ef48 0000100000000000 0000000000000003 ffff88007bf25e08 Call Trace: [<ffffffff8139d6fa>] port_fops_splice_write+0xaa/0x130 [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120 [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0 [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110 [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0 [<ffffffff8161f8c2>] system_call_fastpath+0x16/0x1b Code: c1 e2 05 48 89 e5 48 83 ec 10 4c 89 65 f8 41 89 f4 31 f6 48 89 5d f0 48 89 fb e8 8d ce ff ff 41 8d 44 24 ff 48 c1 e0 05 48 01 c3 <48> 8b 03 48 83 e0 fe 48 83 c8 02 48 89 03 48 8b 5d f0 4c 8b 65 RIP [<ffffffff812de48f>] sg_init_table+0x2f/0x50 RSP <ffff88007bf25dd8> CR2: ffff882071c8ef28 ---[ end trace 86323505eb42ea8f ]--- It seems to induce pagefault in sg_init_tabel() when pipe->nrbufs is equal to zero. This may happen in a following situation: (1) The application normally does splice(read) from a kernel buffer, then does splice(write) to virtio-serial. (2) The application receives SIGINT when is doing splice(read), so splice(read) is failed by EINTR. However, the application does not finish the operation. (3) The application tries to do splice(write) without pipe->nrbufs. (4) The virtio-console driver tries to touch scatterlist structure sgl in sg_init_table(), but the region is out of bound. To avoid the case, a kernel should check whether pipe->nrbufs is empty or not when splice_write is executed in the virtio-console driver. V3: Add Reviewed-by lines and stable@ line in sign-off area. Signed-off-by: NYoshihiro YUNOMAE <yoshihiro.yunomae.ez@hitachi.com> Reviewed-by: NAmit Shah <amit.shah@redhat.com> Reviewed-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com> Cc: Amit Shah <amit.shah@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: stable@vger.kernel.org Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>
-