summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* iscsi-target: fix extract_param to handle buffer length corner caseEric Seppanen2013-11-201-1/+1
| | | | | | | | | | | extract_param() is called with max_length set to the total size of the output buffer. It's not safe to allow a parameter length equal to the buffer size as the terminating null would be written one byte past the end of the output buffer. Signed-off-by: Eric Seppanen <eric@purestorage.com> Cc: <stable@vger.kernel.org> #3.1+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Expose default_erl as TPG attributeNicholas Bellinger2013-11-206-7/+36
| | | | | | | | | This patch exposes default_erl as a TPG attribute so that it may be set TPG wide in demo-mode, but still allow the existing NodeACL attribute to be overridden on a per initiator basis. Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target_core_configfs: split up ALUA supported statesHannes Reinecke2013-11-201-43/+84
| | | | | | | | | | Split up the various ALUA states into individual attributes to make parsing easier and adhere to the one value per attribute sysfs principle. (nab: Convert strict_strtoul -> kstrtoul usage) Signed-off-by: Hannes Reinecke <hare@suse.de>
* target_core_alua: Make supported states configurableHannes Reinecke2013-11-201-0/+50
| | | | Signed-off-by: Hannes Reinecke <hare@suse.de>
* target_core_alua: Store supported ALUA statesHannes Reinecke2013-11-203-6/+20
| | | | | | | | | | The supported ALUA states might be different for individual devices, so store it in a separate field. (nab: Remove unnecessary line continuation) Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target_core_alua: Rename ALUA_ACCESS_STATE_OPTIMIZEDHannes Reinecke2013-11-202-6/+6
| | | | | | | | Rename ALUA_ACCESS_STATE_OPTMIZED to ALUA_ACCESS_STATE_OPTIMIZED. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target_core_alua: spellcheckHannes Reinecke2013-11-201-9/+9
| | | | | Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target core: rename (ex,im)plict -> (ex,im)plicitHannes Reinecke2013-11-2010-101/+101
| | | | | Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* percpu-refcount: Add percpu-refcount.o to obj-yRandy Dunlap2013-11-191-2/+2
| | | | | | | | | | | | | | | Drop percpu_ida.o from lib-y since it is also listed in obj-y and it doesn't need to be listed in both places. Move percpu-refcount.o from lib-y to obj-y to fix build errors in target_core_mod: ERROR: "percpu_ref_cancel_init" [drivers/target/target_core_mod.ko] undefined! ERROR: "percpu_ref_kill_and_confirm" [drivers/target/target_core_mod.ko] undefined! ERROR: "percpu_ref_init" [drivers/target/target_core_mod.ko] undefined! Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Do not reject non-immediate CmdSNs exceeding MaxCmdSNNicholas Bellinger2013-11-192-8/+11
| | | | | | | | | | | | | | | | This patch changes iscsit_sequence_cmd() logic to no longer reject non-immediate CmdSNs that exceed MaxCmdSN with a protocol error, but instead silently ignore them. This is done to correctly follow RFC-3720 Section 3.2.2.1: For non-immediate commands, the CmdSN field can take any value from ExpCmdSN to MaxCmdSN inclusive. The target MUST silently ignore any non-immediate command outside of this range or non- immediate duplicates within the range. Reported-by: Santosh Kulkarni <santosh.kulkarni@calsoftinc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Convert iscsi_session statistics to atomic_long_tNicholas Bellinger2013-11-196-50/+25
| | | | | | | | | | | | | | | This patch converts a handful of iscsi_session statistics to type atomic_long_t, instead of using iscsi_session->session_stats_lock when incrementing these values. More importantly, go ahead and drop the spinlock usage within iscsit_setup_scsi_cmd(), iscsit_check_dataout_hdr(), iscsit_send_datain(), and iscsit_build_rsp_pdu() fast-path code. (Squash in Roland's target: Remove write-only stats fields and lock from struct se_node_acl) Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Convert se_device statistics to atomic_long_tNicholas Bellinger2013-11-134-21/+17
| | | | | | | | | | | This patch converts the handful of se_device statistics to type atomic_long_t, instead of using se_device->stats_lock when incrementing these values. More importantly, go ahead and drop the spinlock usage within transport_lookup_cmd_lun() fast-path code. Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Fix delayed Task Aborted Status (TAS) handling bugNicholas Bellinger2013-11-131-0/+2
| | | | | | | | | | | | | | | | This patch fixes a bug in delayed Task Aborted Status (TAS) handling, where transport_send_task_abort() was not returning for the case when the se_tfo->write_pending() callback indicated that last fabric specific WRITE PDU had not yet been received. It also adds an explicit cmd->scsi_status = SAM_STAT_TASK_ABORTED assignment within transport_check_aborted_status() to avoid the case where se_tfo->queue_status() is called when the SAM_STAT_TASK_ABORTED assignment + ->queue_status() in transport_send_task_abort() does not occur once SCF_SENT_DELAYED_TAS has been set. Cc: <stable@vger.kernel.org> #3.2+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Reject unsupported multi PDU text command sequenceNicholas Bellinger2013-11-131-0/+7
| | | | | | | | | | | | | This patch adds a check to reject text commands with F_BIT=0 || C_BIT=1, as multi PDU text command sequences are currently unsupported. This avoids the case where a text command received with F_BIT=0, was generating a text response with F_BIT=1 which is a protocol error according to RFC-3720 Section 10.11.1. Reported-by: Arshad Hussain <arshad.hussain@calsoftinc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* ib_isert: Avoid duplicate iscsit_increment_maxcmdsn callNicholas Bellinger2013-11-121-5/+1
| | | | | | | | | | | | | | | This patch avoids a duplicate iscsit_increment_maxcmdsn() call for ISER_IB_RDMA_WRITE within isert_map_rdma() + isert_reg_rdma_frwr(), which will already be occuring once during isert_put_datain() -> iscsit_build_rsp_pdu() operation. It also removes the local conn->stat_sn assignment + increment, and changes the third parameter to iscsit_build_rsp_pdu() to signal this should be done by iscsi_target_mode code. Tested-by: Moussa Ba <moussaba@micron.com> Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Fix mutex_trylock usage in iscsit_increment_maxcmdsnNicholas Bellinger2013-11-122-5/+6
| | | | | | | | | | | | | | | | | | | | | | | This patch fixes a >= v3.10 regression bug with mutex_trylock() usage within iscsit_increment_maxcmdsn(), that was originally added to allow for a special case where ->cmdsn_mutex was already held from the iscsit_execute_cmd() exception path for ib_isert. When !mutex_trylock() was occuring under contention during normal RX/TX process context codepaths, the bug was manifesting itself as the following protocol error: Received CmdSN: 0x000fcbb7 is greater than MaxCmdSN: 0x000fcbb6, protocol error. Received CmdSN: 0x000fcbb8 is greater than MaxCmdSN: 0x000fcbb6, protocol error. This patch simply avoids the direct ib_isert callback in lio_queue_status() for the special iscsi_execute_cmd() exception cases, that allows the problematic mutex_trylock() usage in iscsit_increment_maxcmdsn() to go away. Reported-by: Moussa Ba <moussaba@micron.com> Tested-by: Moussa Ba <moussaba@micron.com> Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Core does not need blkdev.hAndy Grover2013-11-123-3/+0
| | | | | | | | Target core does not depend on the block layer, only backstores that use the block layer do. Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Pass through I/O topology for block backstoresAndy Grover2013-11-124-3/+68
| | | | | | | | | | | | | | | | | In addition to block size (already implemented), passing through alignment offset, logical-to-phys block exponent, I/O granularity and optimal I/O length will allow initiators to properly handle layout on LUNs with 4K block sizes. Tested with various weird values via scsi_debug module. One thing to look at with this patch is the new block limits values -- instead of granularity 1 optimal 8192, Lio will now be returning whatever the block device says, which may affect performance. Signed-off-by: Andy Grover <agrover@redhat.com> Acked-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iser-target: Avoid using FRMR for single dma entry requestsVu Pham2013-11-121-12/+20
| | | | | | | | | | | | | This patch changes isert_reg_rdma_frwr() to not use FRMR for single dma entry requests from small I/Os, in order to avoid the associated memory registration overhead. Using DMA MR is sufficient here for the single dma entry requests, and addresses a >= v3.12 performance regression. Signed-off-by: Vu Pham <vu@mellanox.com> Cc: <stable@vger.kernel.org> # v3.12+ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Add per device xcopy_lun for copy offload I/ONicholas Bellinger2013-11-083-45/+39
| | | | | | | | | | | This patch adds a se_device->xcopy_lun that is used for local copy offload I/O, instead of allocating + initializing a pseudo se_lun for each received EXTENDED_COPY operation. Also, move declaration of struct se_lun + struct se_port_stat_grps ahead of struct se_device. Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Drop left-over se_lun->lun_cmd_list shutdown codeNicholas Bellinger2013-11-075-252/+7
| | | | | | | | | | | | Now with percpu refcounting for se_lun in place, go ahead and drop the legacy per se_cmd accounting for se_lun shutdown. This includes __transport_clear_lun_from_sessions(), the associated transport_lun_wait_for_tasks() logic, along with a handful of now unused se_cmd structure members and ->transport_state bits. Cc: Kent Overstreet <kmo@daterainc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Add percpu refcounting for se_lun accessNicholas Bellinger2013-11-076-18/+45
| | | | | | | | | | | | | | | | This patch adds percpu refcounting for se_lun access that allows the association of an se_lun + se_cmd in transport_lookup_cmd_lun() to occur without an extra list_head for tracking outstanding I/O during se_lun shutdown. This effectively changes se_lun shutdown logic to wait for outstanding I/O percpu references to complete in transport_lun_remove_cmd() using se_lun->lun_ref_comp, instead of explicitly draining the per se_lun command list and waiting for individual se_cmd descriptor processing to complete. Cc: Kent Overstreet <kmo@daterainc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* percpu-refcount: Add EXPORT_SYMBOL to use percpu_ref from modulesNicholas Bellinger2013-11-071-0/+3
| | | | | | | | | This patch adds EXPORT_SYMBOL() for percpu_ref_init(), percpu_ref_cancel_init() and percpu_ref_kill_and_confirm() so that percpu refcounting can be used by external modules. Cc: Kent Overstreet <kmo@daterainc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Do not generate REJECTs for zero-length DataOUTNicholas Bellinger2013-11-071-4/+3
| | | | | | | | | | | | | | | This patch changes iscsit_check_dataout_hdr() to no longer generate REJECTs for zero-length DataOUTs, and instead simply ignore these requests. This follows RFC-3720, Section 10.7.7. DataSegmentLength "This is the data payload length of a SCSI Data-In or SCSI Data-Out PDU. The sending of 0 length data segments should be avoided, but initiators and targets MUST be able to properly receive 0 length data segments." Reported-by: Santosh Kulkarni <santosh.kulkarni@calsoftinc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* ib_isert: Add support for completion interrupt coalescingNicholas Bellinger2013-11-062-12/+57
| | | | | | | | | | | | | | | | | | | | | This patch adds support for completion interrupt coalescing that allows only every ISERT_COMP_BATCH_COUNT (8) to set IB_SEND_SIGNALED, thus avoiding completion interrupts for every posted iser_tx_desc. The batch processing is done using a per isert_conn llist that once IB_SEND_SIGNALED has been set is saved to tx_desc->comp_llnode_batch, and completion processing of previously posted iser_tx_descs is done in a single shot from within isert_send_completion() code. Note this is only done for response PDUs from ISCSI_OP_SCSI_CMD, and all other control type of PDU responses will force an implicit batch drain to occur. Cc: Or Gerlitz <ogerlitz@mellanox.com> Cc: Sagi Grimberg <sagig@mellanox.com> Cc: Kent Overstreet <kmo@daterainc.com> Cc: Roland Dreier <roland@purestorage.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Implement demo_mode_discovery logicThomas Glanzmann2013-10-231-9/+30
| | | | | | | | If demo_mode_discovery=0 and generate_node_acls=0 (demo mode dislabed) do not return TargetName+TargetAddress unless a NodeACL exists. Signed-off-by: Thomas Glanzmann <thomas@glanzmann.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Export symbol core_tpg_check_initiator_node_aclThomas Glanzmann2013-10-233-2/+3
| | | | | | | | | Export symbol core_tpg_check_initiator_node_acl and move prototype from the private drivers/target/target_core_internal.h to the public include/target/target_core_fabric.h Signed-off-by: Thomas Glanzmann <thomas@glanzmann.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* iscsi-target: Add new TPG attributeThomas Glanzmann2013-10-234-0/+29
| | | | | | | Add a new TPG attribute demo_mode_discovery which is enabled by default. Signed-off-by: Thomas Glanzmann <thomas@glanzmann.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* tcm_loop: Implement target resetHannes Reinecke2013-10-161-0/+26
| | | | | | | | | Implement target reset by resetting the transport status. (nab: Remove unused ret in tcm_loop_target_reset) Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* tcm_loop: TCQ and command abort supportHannes Reinecke2013-10-162-4/+69
| | | | | | | | Implement TCQ support, which enables us to do proper command abort, too. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* tcm_loop: separate out tcm_loop_issue_tmrHannes Reinecke2013-10-162-33/+51
| | | | | | | No functional change. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* tcm_loop: Implement transport offlineHannes Reinecke2013-10-162-1/+56
| | | | | | | Add attribute 'transport_status' to simulate link failure. Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* tcm_loop: Check for valid hba in tcm_loop_drop_nexus()Hannes Reinecke2013-10-161-1/+4
| | | | | Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target/qla2xxx: Remove QLA_TPG_ATTRIB macroAndy Grover2013-10-162-12/+10
| | | | | | | | Just a dereference, don't need a macro. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target/iscsi: Remove macros that contain typecastsAndy Grover2013-10-166-22/+18
| | | | | | | | | | | These just want to return a pointer instead of a value, but are otherwise the same. ISCSI_TPG_LUN macro was unused. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target/iscsi: Remove iscsi dereferencing macrosAndy Grover2013-10-164-36/+27
| | | | | | | | These are all straightforward. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* target: Remove TF_CIT_TMPL macroAndy Grover2013-10-1611-102/+101
| | | | | | | | Remove a lingering macro that just hid a dereference. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* percpu_ida: Removing unused arguement from alloc_local_tagNick Swenson2013-10-031-3/+2
| | | | | | | | | | Removing unused struct percpu_ida *pool from arguements of alloc_local_tag, changed it's one use in percpu_ida.c (nab: Fixed reference of idr.c -> percpu_ida.c) Signed-Off-By: Nick Swenson <nks@daterainc.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
* tcm_fc: Convert to per-cpu command map pre-allocation of ft_cmdNicholas Bellinger2013-10-013-5/+17
| | | | | | | | | | | | | | | | | | | | | | | This patch converts tcm_fc to use transport_init_session_tags() pre-allocation logic for struct ft_cmd descriptors using per-cpu session tag pooling in order to effectively avoid memory allocation + release for each received I/O. It adds percpu_ida_alloc() in ft_recv_cmd() to obtain an tag and locate ft_cmd from se_sess->sess_cmd_map[], and percpu_ida_free() in ft_free_cmd() to release the tag based upon se_cmd->map_tag id. It also uses a TCM_FC_DEFAULT_TAGS value of 512, that puts the per se_sess->sess_cmd_map allocation at ~360K on 64-bit. v2 changes: - Handle possible tag < 0 failure with GFP_ATOMIC Cc: Mark Rustad <mark.d.rustad@intel.com> Cc: Robert Love <robert.w.love@intel.com> Cc: Kent Overstreet <kmo@daterainc.com> Signed-off-by: Nicholas Bellinger <nab@daterainc.com>
* Linux 3.12-rc3v3.12-rc3Linus Torvalds2013-09-291-1/+1
|
* Merge tag 'usb-3.12-rc3' of ↵Linus Torvalds2013-09-2921-107/+201
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of USB driver fixes for 3.12-rc3. These are all for host controller issues that have been reported, and there's a fix for an annoying error message that gets printed every time you remove a USB 3 device from the system that's been bugging me for a while" * tag 'usb-3.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: dwc3: add support for Merrifield USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitialization USB: Fix breakage in ffs_fs_mount() fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phy usb/core/devio.c: Don't reject control message to endpoint with wrong direction bit usb: chipidea: USB_CHIPIDEA should depend on HAS_DMA usb: chipidea: udc: free pending TD at removal procedure usb: chipidea: imx: Add usb_phy_shutdown at probe's error path usb: chipidea: Fix memleak for ci->hw_bank.regmap when removal usb: chipidea: udc: fix the oops after rmmod gadget USB: fix PM config symbol in uhci-hcd, ehci-hcd, and xhci-hcd USB: OHCI: accept very late isochronous URBs USB: UHCI: accept very late isochronous URBs USB: iMX21: accept very late isochronous URBs usbcore: check usb device's state before sending a Set SEL control transfer xhci: Fix race between ep halt and URB cancellation usb: Fix xHCI host issues on remote wakeup. xhci: Ensure a command structure points to the correct trb on the command ring xhci: Fix oops happening after address device timeout
| * usb: dwc3: add support for MerrifieldDavid Cohen2013-09-261-0/+2
| | | | | | | | | | | | | | | | Add PCI id for Intel Merrifield Signed-off-by: David Cohen <david.a.cohen@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * USB: fsl/ehci: fix failure of checking PHY_CLK_VALID during reinitializationShengzhou Liu2013-09-261-2/+3
| | | | | | | | | | | | | | | | | | | | | | In case of usb phy reinitialization: e.g. insmod usb-module(usb works well) -> rmmod usb-module -> insmod usb-module It found the PHY_CLK_VALID bit didn't work if it's not with the power-on reset. So we just check PHY_CLK_VALID bit during the stage with POR, this can be met by the tricky of checking FSL_SOC_USB_PRICTRL register. Signed-off-by: Shengzhou Liu <Shengzhou.Liu@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * USB: Fix breakage in ffs_fs_mount()Al Viro2013-09-261-34/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There's a bunch of failure exits in ffs_fs_mount() with seriously broken recovery logics. Most of that appears to stem from misunderstanding of the ->kill_sb() semantics; unlike ->put_super() it is called for *all* superblocks of given type, no matter how (in)complete the setup had been. ->put_super() is called only if ->s_root is not NULL; any failure prior to setting ->s_root will have the call of ->put_super() skipped. ->kill_sb(), OTOH, awaits every superblock that has come from sget(). Current behaviour of ffs_fs_mount(): We have struct ffs_sb_fill_data data on stack there. We do ffs_dev = functionfs_acquire_dev_callback(dev_name); and store that in data.private_data. Then we call mount_nodev(), passing it ffs_sb_fill() as a callback. That will either fail outright, or manage to call ffs_sb_fill(). There we allocate an instance of struct ffs_data, slap the value of ffs_dev (picked from data.private_data) into ffs->private_data and overwrite data.private_data by storing ffs into an overlapping member (data.ffs_data). Then we store ffs into sb->s_fs_info and attempt to set the rest of the things up (root inode, root dentry, then create /ep0 there). Any of those might fail. Should that happen, we get ffs_fs_kill_sb() called before mount_nodev() returns. If mount_nodev() fails for any reason whatsoever, we proceed to functionfs_release_dev_callback(data.ffs_data); That's broken in a lot of ways. Suppose the thing has failed in allocation of e.g. root inode or dentry. We have functionfs_release_dev_callback(ffs); ffs_data_put(ffs); done by ffs_fs_kill_sb() (ffs accessed via sb->s_fs_info), followed by functionfs_release_dev_callback(ffs); from ffs_fs_mount() (via data.ffs_data). Note that the second functionfs_release_dev_callback() has every chance to be done to freed memory. Suppose we fail *before* root inode allocation. What happens then? ffs_fs_kill_sb() doesn't do anything to ffs (it's either not called at all, or it doesn't have a pointer to ffs stored in sb->s_fs_info). And functionfs_release_dev_callback(data.ffs_data); is called by ffs_fs_mount(), but here we are in nasal daemon country - we are reading from a member of union we'd never stored into. In practice, we'll get what we used to store into the overlapping field, i.e. ffs_dev. And then we get screwed, since we treat it (struct gfs_ffs_obj * in disguise, returned by functionfs_acquire_dev_callback()) as struct ffs_data *, pick what would've been ffs_data ->private_data from it (*well* past the actual end of the struct gfs_ffs_obj - struct ffs_data is much bigger) and poke in whatever it points to. FWIW, there's a minor leak on top of all that in case if ffs_sb_fill() fails on kstrdup() - ffs is obviously forgotten. The thing is, there is no point in playing all those games with union. Just allocate and initialize ffs_data *before* calling mount_nodev() and pass a pointer to it via data.ffs_data. And once it's stored in sb->s_fs_info, clear data.ffs_data, so that ffs_fs_mount() knows that it doesn't need to kill the sucker manually - from that point on we'll have it done by ->kill_sb(). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Acked-by: Michal Nazarewicz <mina86@mina86.com> Cc: stable <stable@vger.kernel.org> # 3.3+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * fsl/usb: Resolve PHY_CLK_VLD instability issue for ULPI phyRamneek Mehresh2013-09-261-9/+3
| | | | | | | | | | | | | | | | | | | | | | For controller versions greater than 1.6, setting ULPI_PHY_CLK_SEL bit when USB_EN bit is already set causes instability issues with PHY_CLK_VLD bit. So USB_EN is set only for IP controller version below 1.6 before setting ULPI_PHY_CLK_SEL bit Signed-off-by: Ramneek Mehresh <ramneek.mehresh@freescale.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb/core/devio.c: Don't reject control message to endpoint with wrong ↵Kurt Garloff2013-09-251-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | direction bit Trying to read data from the Pegasus Technologies NoteTaker (0e20:0101) [1] with the Windows App (EasyNote) works natively but fails when Windows is running under KVM (and the USB device handed to KVM). The reason is a USB control message usb 4-2.2: control urb: bRequestType=22 bRequest=09 wValue=0200 wIndex=0001 wLength=0008 This goes to endpoint address 0x01 (wIndex); however, endpoint address 0x01 does not exist. There is an endpoint 0x81 though (same number, but other direction); the app may have meant that endpoint instead. The kernel thus rejects the IO and thus we see the failure. Apparently, Linux is more strict here than Windows ... we can't change the Win app easily, so that's a problem. It seems that the Win app/driver is buggy here and the driver does not behave fully according to the USB HID class spec that it claims to belong to. The device seems to happily deal with that though (and seems to not really care about this value much). So the question is whether the Linux kernel should filter here. Rejecting has the risk that somewhat non-compliant userspace apps/ drivers (most likely in a virtual machine) are prevented from working. Not rejecting has the risk of confusing an overly sensitive device with such a transfer. Given the fact that Windows does not filter it makes this risk rather small though. The patch makes the kernel more tolerant: If the endpoint address in wIndex does not exist, but an endpoint with toggled direction bit does, it will let the transfer through. (It does NOT change the message.) With attached patch, the app in Windows in KVM works. usb 4-2.2: check_ctrlrecip: process 13073 (qemu-kvm) requesting ep 01 but needs 81 I suspect this will mostly affect apps in virtual environments; as on Linux the apps would have been adapted to the stricter handling of the kernel. I have done that for mine[2]. [1] http://www.pegatech.com/ [2] https://sourceforge.net/projects/notetakerpen/ Signed-off-by: Kurt Garloff <kurt@garloff.de> Acked-by: Alan Stern <stern@rowland.harvard.edu> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: chipidea: USB_CHIPIDEA should depend on HAS_DMAGeert Uytterhoeven2013-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | If NO_DMA=y: drivers/built-in.o: In function `dma_set_coherent_mask': include/linux/dma-mapping.h:93: undefined reference to `dma_supported' Reviewed-and-tested-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: chipidea: udc: free pending TD at removal procedurePeter Chen2013-09-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a pending TD which is not freed after request finishes, we do this due to a controller bug. This TD needs to be freed when the driver is removed. It prints below error message when unload chipidea driver at current code: "ci_hdrc ci_hdrc.0: dma_pool_destroy ci_hw_td, b0001000 busy" It indicates the buffer at dma pool are still in use. This commit will free the pending TD at driver's removal procedure, it can fix the problem described above. Acked-by: Michael Grzeschik <m.grzeschik@pengutronix.de> Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: chipidea: imx: Add usb_phy_shutdown at probe's error pathPeter Chen2013-09-251-2/+5
| | | | | | | | | | | | | | | | | | If not, the PHY will be active even the controller is not in use. We find this issue due to the PHY's clock refcount is not correct due to -EPROBE_DEFER return after phy's init. Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * usb: chipidea: Fix memleak for ci->hw_bank.regmap when removalPeter Chen2013-09-251-0/+1
| | | | | | | | | | | | | | | | It needs to free ci->hw_bank.regmap explicitly since it is not managed resource. Signed-off-by: Peter Chen <peter.chen@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
OpenPOWER on IntegriCloud