linux/drivers/infiniband/ulp, branch v3.4.33

IB/srp: Avoid having aborted requests hang

2012-10-07T15:32:29Z

commit d8536670916a685df116b5c2cb256573fd25e4e3 upstream. We need to call scsi_done() for commands after we abort them. Signed-off-by: Bart Van Assche Acked-by: David Dillow Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman

IB/srp: Fix use-after-free in srp_reset_req()

2012-10-07T15:32:29Z

commit 9b796d06d5d1b1e85ae2316a283ea11dd739ef96 upstream. srp_free_req() uses the scsi_cmnd structure contents to unmap buffers, so we must invoke srp_free_req() before we release ownership of that structure. Signed-off-by: Bart Van Assche Acked-by: David Dillow Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman

IPoIB: Fix use-after-free of multicast object

2012-10-07T15:32:28Z

commit bea1e22df494a729978e7f2c54f7bda328f74bc3 upstream. Fix a crash in ipoib_mcast_join_task(). (with help from Or Gerlitz) Commit c8c2afe360b7 ("IPoIB: Use rtnl lock/unlock when changing device flags") added a call to rtnl_lock() in ipoib_mcast_join_task(), which is run from the ipoib_workqueue, and hence the workqueue can't be flushed from the context of ipoib_stop(). In the current code, ipoib_stop() (which doesn't flush the workqueue) calls ipoib_mcast_dev_flush(), which goes and deletes all the multicast entries. This takes place without any synchronization with a possible running instance of ipoib_mcast_join_task() for the same ipoib device, leading to a crash due to NULL pointer dereference. Fix this by making sure that the workqueue is flushed before ipoib_mcast_dev_flush() is called. To make that possible, we move the RTNL-lock wrapped code to ipoib_mcast_join_finish(). Signed-off-by: Patrick McHardy Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman

IB/srp: Fix a race condition

2012-08-26T22:00:44Z

commit 220329916c72ee3d54ae7262b215a050f04a18fc upstream. Avoid a crash caused by the scmnd->scsi_done(scmnd) call in srp_process_rsp() being invoked with scsi_done == NULL. This can happen if a reply is received during or after a command abort. Reported-by: Joseph Glanville Reference: http://marc.info/?l=linux-rdma&m=134314367801595 Acked-by: David Dillow Signed-off-by: Bart Van Assche Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman

IB/srpt: Set srq_type to IB_SRQT_BASIC

2012-04-12T14:56:57Z

Since commit 96104eda0169 ("RDMA/core: Add SRQ type field"), kernel users of SRQs need to specify srq_type = IB_SRQT_BASIC in struct ib_srq_init_attr, or else most low-level drivers will fail in when srpt_add_one() calls ib_create_srq() and gets -ENOSYS. (mlx4_ib works OK nearly all of the time, because it just needs srq_type != IB_SRQT_XRC. And apparently nearly everyone using ib_srpt is using mlx4 hardware) Reported-by: Alexey Shvetsov Cc: Signed-off-by: Roland Dreier

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending

2012-03-22T19:38:04Z

Pull SCSI target updates from Nicholas Bellinger: "This contains the usual set of updates and bugfixes to target-core + existing fabric module code, along with a handful of the patches destined for v3.3 stable. It also contains the necessary target-core infrastructure pieces required to run using tcm_qla2xxx.ko WWPNs with the new Qlogic Fibre Channel fabric module currently queued in target-pending/for-next-merge, and coming for round 2. The highlights for this series include: - Add target_submit_tmr() helper function for fabric task management (andy) - Convert tcm_fc to use target_submit_tmr() (andy) - Replace target core various cmd flags with a transport state (hch) - Convert loopback to use workqueue submission (hch) - Convert target core to use array_zalloc for tpg_lun_list (joern) - Convert target core to use array_zalloc for device_list (joern) - Add target core support for TMR_ABORT_TASK (nab) - Add target core se_sess->sess_kref + get/put helpers (nab) - Add target core se_node_acl->acl_kref for ->acl_free_comp usage (nab) - Convert iscsi-target to use target_put_session + sess_kref (nab) - Fix tcm_fc fc_exch memory leak in ft_send_resp_status (nab) - Fix ib_srpt srpt_handle_cmd send_ioctx->ioctx_kref leak on exception (nab) - Fix target core up handling of short INQUIRY buffers (roland) - Untangle target-core front-end and back-end meanings of max_sectors attribute (roland) - Set loopback residual field for SCSI commands (roland) - Fix target-core 16-bit target ports for SET TARGET PORT GROUPS emulation (roland) Thanks again to Andy, Christoph, Joern, Roland, and everyone who has contributed this round!" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (64 commits) ib_srpt: Fix srpt_handle_cmd send_ioctx->ioctx_kref leak on exception loopback: Fix transport_generic_allocate_tasks error handling iscsi-target: remove improper externs iscsi-target: Remove unused variables in iscsi_target_parameters.c target: remove obvious warnings target: Use array_zalloc for device_list target: Use array_zalloc for tpg_lun_list target: Fix sense code for unsupported SERVICE ACTION IN target: Remove hack to make READ CAPACITY(10) lie if thin provisioning is enabled target: Bump core version to v4.1.0-rc2-ml + fabric versions tcm_fc: Fix fc_exch memory leak in ft_send_resp_status target: Drop unused legacy target_core_fabric_ops API callers iscsi-target: Convert to use target_put_session + sess_kref target: Convert se_node_acl->acl_group removal to use ->acl_kref target: Add se_node_acl->acl_kref for ->acl_free_comp usage target: Add se_node_acl->acl_free_comp for NodeACL release path target: Add se_sess->sess_kref + get/put helpers target: Convert session_lock to irqsave target: Fix typo in drivers/target iscsi-target: Fix dynamic -> explict NodeACL pointer reference ...

Merge tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband

2012-03-21T17:33:42Z

Pull InfiniBand/RDMA changes for the 3.4 merge window from Roland Dreier: "Nothing big really stands out; by patch count lots of fixes to the mlx4 driver plus some cleanups and fixes to the core and other drivers." * tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (28 commits) mlx4_core: Scale size of MTT table with system RAM mlx4_core: Allow dynamic MTU configuration for IB ports IB/mlx4: Fix info returned when querying IBoE ports IB/mlx4: Fix possible missed completion event mlx4_core: Report thermal error events mlx4_core: Fix one more static exported function IB: Change CQE "csum_ok" field to a bit flag RDMA/iwcm: Reject connect requests if cmid is not in LISTEN state RDMA/cxgb3: Don't pass irq flags to flush_qp() mlx4_core: Get rid of redundant ext_port_cap flags RDMA/ucma: Fix AB-BA deadlock IB/ehca: Fix ilog2() compile failure IB: Use central enum for speed instead of hard-coded values IB/iser: Post initial receive buffers before sending the final login request IB/iser: Free IB connection resources in the proper place IB/srp: Consolidate repetitive sysfs code IB/srp: Use pr_fmt() and pr_err()/pr_warn() IB/core: Fix SDR rates in sysfs mlx4: Enforce device max FMR maps in FMR alloc IB/mlx4: Set bad_wr for invalid send opcode ...

Merge branch 'kmap_atomic' of git://github.com/congwang/linux

2012-03-21T16:40:26Z

Pull kmap_atomic cleanup from Cong Wang. It's been in -next for a long time, and it gets rid of the (no longer used) second argument to k[un]map_atomic(). Fix up a few trivial conflicts in various drivers, and do an "evil merge" to catch some new uses that have come in since Cong's tree. * 'kmap_atomic' of git://github.com/congwang/linux: (59 commits) feature-removal-schedule.txt: schedule the deprecated form of kmap_atomic() for removal highmem: kill all __kmap_atomic() [swarren@nvidia.com: highmem: Fix ARM build break due to __kmap_atomic rename] drbd: remove the second argument of k[un]map_atomic() zcache: remove the second argument of k[un]map_atomic() gma500: remove the second argument of k[un]map_atomic() dm: remove the second argument of k[un]map_atomic() tomoyo: remove the second argument of k[un]map_atomic() sunrpc: remove the second argument of k[un]map_atomic() rds: remove the second argument of k[un]map_atomic() net: remove the second argument of k[un]map_atomic() mm: remove the second argument of k[un]map_atomic() lib: remove the second argument of k[un]map_atomic() power: remove the second argument of k[un]map_atomic() kdb: remove the second argument of k[un]map_atomic() udf: remove the second argument of k[un]map_atomic() ubifs: remove the second argument of k[un]map_atomic() squashfs: remove the second argument of k[un]map_atomic() reiserfs: remove the second argument of k[un]map_atomic() ocfs2: remove the second argument of k[un]map_atomic() ntfs: remove the second argument of k[un]map_atomic() ...

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2012-03-21T04:12:50Z

Pull trivial tree from Jiri Kosina: "It's indeed trivial -- mostly documentation updates and a bunch of typo fixes from Masanari. There are also several linux/version.h include removals from Jesper." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (101 commits) kcore: fix spelling in read_kcore() comment constify struct pci_dev * in obvious cases Revert "char: Fix typo in viotape.c" init: fix wording error in mm_init comment usb: gadget: Kconfig: fix typo for 'different' Revert "power, max8998: Include linux/module.h just once in drivers/power/max8998_charger.c" writeback: fix fn name in writeback_inodes_sb_nr_if_idle() comment header writeback: fix typo in the writeback_control comment Documentation: Fix multiple typo in Documentation tpm_tis: fix tis_lock with respect to RCU Revert "media: Fix typo in mixer_drv.c and hdmi_drv.c" Doc: Update numastat.txt qla4xxx: Add missing spaces to error messages compiler.h: Fix typo security: struct security_operations kerneldoc fix Documentation: broken URL in libata.tmpl Documentation: broken URL in filesystems.tmpl mtd: simplify return logic in do_map_probe() mm: fix comment typo of truncate_inode_pages_range power: bq27x00: Fix typos in comment ...

infiniband: remove the second argument of k[un]map_atomic()

2012-03-20T13:48:18Z

Acked-by: Roland Dreier Signed-off-by: Cong Wang