Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6
* git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6:
[SCSI] 3w-9xxx: fix iommu_iova leak
[SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereference
[SCSI] scsi: qla4xxx needs libiscsi.o
[SCSI] libsas: fix failure to revalidate domain for anything but the first expander child.
[SCSI] aacraid: reset should disable MSI interrupt
+54
-20
+5
-5
drivers/infiniband/hw/cxgb3/iwch_cm.c
+5
-5
drivers/infiniband/hw/cxgb3/iwch_cm.c
···
287
287
if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
288
288
cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
289
289
dst_release(ep->dst);
290
-
l2t_release(L2DATA(ep->com.tdev), ep->l2t);
290
+
l2t_release(ep->com.tdev, ep->l2t);
291
291
}
292
292
kfree(ep);
293
293
}
···
1178
1178
release_tid(ep->com.tdev, GET_TID(rpl), NULL);
1179
1179
cxgb3_free_atid(ep->com.tdev, ep->atid);
1180
1180
dst_release(ep->dst);
1181
-
l2t_release(L2DATA(ep->com.tdev), ep->l2t);
1181
+
l2t_release(ep->com.tdev, ep->l2t);
1182
1182
put_ep(&ep->com);
1183
1183
return CPL_RET_BUF_DONE;
1184
1184
}
···
1377
1377
if (!child_ep) {
1378
1378
printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
1379
1379
__func__);
1380
-
l2t_release(L2DATA(tdev), l2t);
1380
+
l2t_release(tdev, l2t);
1381
1381
dst_release(dst);
1382
1382
goto reject;
1383
1383
}
···
1956
1956
if (!err)
1957
1957
goto out;
1958
1958
1959
-
l2t_release(L2DATA(h->rdev.t3cdev_p), ep->l2t);
1959
+
l2t_release(h->rdev.t3cdev_p, ep->l2t);
1960
1960
fail4:
1961
1961
dst_release(ep->dst);
1962
1962
fail3:
···
2127
2127
PDBG("%s ep %p redirect to dst %p l2t %p\n", __func__, ep, new,
2128
2128
l2t);
2129
2129
dst_hold(new);
2130
-
l2t_release(L2DATA(ep->com.tdev), ep->l2t);
2130
+
l2t_release(ep->com.tdev, ep->l2t);
2131
2131
ep->l2t = l2t;
2132
2132
dst_release(old);
2133
2133
ep->dst = new;
+18
-5
drivers/net/cxgb3/cxgb3_offload.c
+18
-5
drivers/net/cxgb3/cxgb3_offload.c
···
1146
1146
if (te && te->ctx && te->client && te->client->redirect) {
1147
1147
update_tcb = te->client->redirect(te->ctx, old, new, e);
1148
1148
if (update_tcb) {
1149
+
rcu_read_lock();
1149
1150
l2t_hold(L2DATA(tdev), e);
1151
+
rcu_read_unlock();
1150
1152
set_l2t_ix(tdev, tid, e);
1151
1153
}
1152
1154
}
1153
1155
}
1154
-
l2t_release(L2DATA(tdev), e);
1156
+
l2t_release(tdev, e);
1155
1157
}
1156
1158
1157
1159
/*
···
1266
1264
goto out_free;
1267
1265
1268
1266
err = -ENOMEM;
1269
-
L2DATA(dev) = t3_init_l2t(l2t_capacity);
1267
+
RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
1270
1268
if (!L2DATA(dev))
1271
1269
goto out_free;
1272
1270
···
1300
1298
1301
1299
out_free_l2t:
1302
1300
t3_free_l2t(L2DATA(dev));
1303
-
L2DATA(dev) = NULL;
1301
+
rcu_assign_pointer(dev->l2opt, NULL);
1304
1302
out_free:
1305
1303
kfree(t);
1306
1304
return err;
1307
1305
}
1308
1306
1307
+
static void clean_l2_data(struct rcu_head *head)
1308
+
{
1309
+
struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
1310
+
t3_free_l2t(d);
1311
+
}
1312
+
1313
+
1309
1314
void cxgb3_offload_deactivate(struct adapter *adapter)
1310
1315
{
1311
1316
struct t3cdev *tdev = &adapter->tdev;
1312
1317
struct t3c_data *t = T3C_DATA(tdev);
1318
+
struct l2t_data *d;
1313
1319
1314
1320
remove_adapter(adapter);
1315
1321
if (list_empty(&adapter_list))
···
1325
1315
1326
1316
free_tid_maps(&t->tid_maps);
1327
1317
T3C_DATA(tdev) = NULL;
1328
-
t3_free_l2t(L2DATA(tdev));
1329
-
L2DATA(tdev) = NULL;
1318
+
rcu_read_lock();
1319
+
d = L2DATA(tdev);
1320
+
rcu_read_unlock();
1321
+
rcu_assign_pointer(tdev->l2opt, NULL);
1322
+
call_rcu(&d->rcu_head, clean_l2_data);
1330
1323
if (t->nofail_skb)
1331
1324
kfree_skb(t->nofail_skb);
1332
1325
kfree(t);
+12
-3
drivers/net/cxgb3/l2t.c
+12
-3
drivers/net/cxgb3/l2t.c
···
300
300
struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
301
301
struct net_device *dev)
302
302
{
303
-
struct l2t_entry *e;
304
-
struct l2t_data *d = L2DATA(cdev);
303
+
struct l2t_entry *e = NULL;
304
+
struct l2t_data *d;
305
+
int hash;
305
306
u32 addr = *(u32 *) neigh->primary_key;
306
307
int ifidx = neigh->dev->ifindex;
307
-
int hash = arp_hash(addr, ifidx, d);
308
308
struct port_info *p = netdev_priv(dev);
309
309
int smt_idx = p->port_id;
310
+
311
+
rcu_read_lock();
312
+
d = L2DATA(cdev);
313
+
if (!d)
314
+
goto done_rcu;
315
+
316
+
hash = arp_hash(addr, ifidx, d);
310
317
311
318
write_lock_bh(&d->lock);
312
319
for (e = d->l2tab[hash].first; e; e = e->next)
···
345
338
}
346
339
done:
347
340
write_unlock_bh(&d->lock);
341
+
done_rcu:
342
+
rcu_read_unlock();
348
343
return e;
349
344
}
350
345
+12
-4
drivers/net/cxgb3/l2t.h
+12
-4
drivers/net/cxgb3/l2t.h
···
76
76
atomic_t nfree; /* number of free entries */
77
77
rwlock_t lock;
78
78
struct l2t_entry l2tab[0];
79
+
struct rcu_head rcu_head; /* to handle rcu cleanup */
79
80
};
80
81
81
82
typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
···
100
99
/*
101
100
* Getting to the L2 data from an offload device.
102
101
*/
103
-
#define L2DATA(dev) ((dev)->l2opt)
102
+
#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
104
103
105
104
#define W_TCB_L2T_IX 0
106
105
#define S_TCB_L2T_IX 7
···
127
126
return t3_l2t_send_slow(dev, skb, e);
128
127
}
129
128
130
-
static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
129
+
static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
131
130
{
132
-
if (atomic_dec_and_test(&e->refcnt))
131
+
struct l2t_data *d;
132
+
133
+
rcu_read_lock();
134
+
d = L2DATA(t);
135
+
136
+
if (atomic_dec_and_test(&e->refcnt) && d)
133
137
t3_l2e_free(d, e);
138
+
139
+
rcu_read_unlock();
134
140
}
135
141
136
142
static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
137
143
{
138
-
if (atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
144
+
if (d && atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
139
145
atomic_dec(&d->nfree);
140
146
}
141
147
+2
drivers/scsi/3w-9xxx.c
+2
drivers/scsi/3w-9xxx.c
···
1800
1800
switch (retval) {
1801
1801
case SCSI_MLQUEUE_HOST_BUSY:
1802
1802
twa_free_request_id(tw_dev, request_id);
1803
+
twa_unmap_scsi_data(tw_dev, request_id);
1803
1804
break;
1804
1805
case 1:
1805
1806
tw_dev->state[request_id] = TW_S_COMPLETED;
1806
1807
twa_free_request_id(tw_dev, request_id);
1808
+
twa_unmap_scsi_data(tw_dev, request_id);
1807
1809
SCpnt->result = (DID_ERROR << 16);
1808
1810
done(SCpnt);
1809
1811
retval = 0;
+1
-1
drivers/scsi/Makefile
+1
-1
drivers/scsi/Makefile
···
88
88
obj-$(CONFIG_PCMCIA_QLOGIC) += qlogicfas408.o
89
89
obj-$(CONFIG_SCSI_QLOGIC_1280) += qla1280.o
90
90
obj-$(CONFIG_SCSI_QLA_FC) += qla2xxx/
91
-
obj-$(CONFIG_SCSI_QLA_ISCSI) += qla4xxx/
91
+
obj-$(CONFIG_SCSI_QLA_ISCSI) += libiscsi.o qla4xxx/
92
92
obj-$(CONFIG_SCSI_LPFC) += lpfc/
93
93
obj-$(CONFIG_SCSI_BFA_FC) += bfa/
94
94
obj-$(CONFIG_SCSI_PAS16) += pas16.o
+2
drivers/scsi/aacraid/commsup.c
+2
drivers/scsi/aacraid/commsup.c
+1
-1
drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+1
-1
drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+1
-1
drivers/scsi/libsas/sas_expander.c
+1
-1
drivers/scsi/libsas/sas_expander.c