Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2018-10-15 14:10:42 +0200
committerTakashi Iwai <tiwai@suse.de>2018-10-15 14:10:42 +0200
commit7e43e5a16bd8cb82d176de3e0d9cb1980803d9ca (patch)
tree36fcbb92dd9b16c9217363290c15437bcf5a3e26
parent6cf1086fd9e09934b30525e56c6f0a15f4748048 (diff)
parentc82ee64b16b06e7b27c1ffc679c61a8219062319 (diff)
Merge branch 'users/jthumshirn/SLE15/for-next' into SLE15
Pull block fixes from Johannes Thumshirn
-rw-r--r--patches.drivers/scsi-qla2xxx-fix-memory-leak-for-allocating-abort-iocb.patch101
-rw-r--r--patches.fixes/blkdev_report_zones_ioctl-use-vmalloc-to-allocate-large-buffers.patch69
-rw-r--r--patches.fixes/block-bvec_nr_vecs-returns-value-for-wrong-slab.patch37
-rw-r--r--patches.fixes/mm-fix-bug_on-in-vmf_insert_pfn_pud-from-vm_mixedmap-removal.patch51
-rw-r--r--series.conf4
5 files changed, 262 insertions, 0 deletions
diff --git a/patches.drivers/scsi-qla2xxx-fix-memory-leak-for-allocating-abort-iocb.patch b/patches.drivers/scsi-qla2xxx-fix-memory-leak-for-allocating-abort-iocb.patch
new file mode 100644
index 0000000000..3d52e46954
--- /dev/null
+++ b/patches.drivers/scsi-qla2xxx-fix-memory-leak-for-allocating-abort-iocb.patch
@@ -0,0 +1,101 @@
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Thu, 26 Jul 2018 16:34:44 -0700
+Subject: scsi: qla2xxx: Fix memory leak for allocating abort IOCB
+Git-commit: 5e53be8e476a3397ed5383c23376f299555a2b43
+Patch-mainline: v4.18
+References: bsc#1111830
+
+In the case of IOCB QFull, Initiator code can leave behind a stale pointer
+to an SRB structure on the outstanding command array.
+
+Fixes: 82de802ad46e ("scsi: qla2xxx: Preparation for Target MQ.")
+Cc: stable@vger.kernel.org #v4.16+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/scsi/qla2xxx/qla_iocb.c | 53 +++++++++++++++++++++--------------------
+ 1 file changed, 27 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index a91cca52b5d5..dd93a22fe843 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -2130,34 +2130,11 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
+ req_cnt = 1;
+ handle = 0;
+
+- if (!sp)
+- goto skip_cmd_array;
+-
+- /* Check for room in outstanding command list. */
+- handle = req->current_outstanding_cmd;
+- for (index = 1; index < req->num_outstanding_cmds; index++) {
+- handle++;
+- if (handle == req->num_outstanding_cmds)
+- handle = 1;
+- if (!req->outstanding_cmds[handle])
+- break;
+- }
+- if (index == req->num_outstanding_cmds) {
+- ql_log(ql_log_warn, vha, 0x700b,
+- "No room on outstanding cmd array.\n");
+- goto queuing_error;
+- }
+-
+- /* Prep command array. */
+- req->current_outstanding_cmd = handle;
+- req->outstanding_cmds[handle] = sp;
+- sp->handle = handle;
+-
+- /* Adjust entry-counts as needed. */
+- if (sp->type != SRB_SCSI_CMD)
++ if (sp && (sp->type != SRB_SCSI_CMD)) {
++ /* Adjust entry-counts as needed. */
+ req_cnt = sp->iocbs;
++ }
+
+-skip_cmd_array:
+ /* Check for room on request queue. */
+ if (req->cnt < req_cnt + 2) {
+ if (qpair->use_shadow_reg)
+@@ -2183,6 +2160,28 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
+ if (req->cnt < req_cnt + 2)
+ goto queuing_error;
+
++ if (sp) {
++ /* Check for room in outstanding command list. */
++ handle = req->current_outstanding_cmd;
++ for (index = 1; index < req->num_outstanding_cmds; index++) {
++ handle++;
++ if (handle == req->num_outstanding_cmds)
++ handle = 1;
++ if (!req->outstanding_cmds[handle])
++ break;
++ }
++ if (index == req->num_outstanding_cmds) {
++ ql_log(ql_log_warn, vha, 0x700b,
++ "No room on outstanding cmd array.\n");
++ goto queuing_error;
++ }
++
++ /* Prep command array. */
++ req->current_outstanding_cmd = handle;
++ req->outstanding_cmds[handle] = sp;
++ sp->handle = handle;
++ }
++
+ /* Prep packet */
+ req->cnt -= req_cnt;
+ pkt = req->ring_ptr;
+@@ -2195,6 +2194,8 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
+ pkt->handle = handle;
+ }
+
++ return pkt;
++
+ queuing_error:
+ qpair->tgt_counters.num_alloc_iocb_failed++;
+ return pkt;
+
diff --git a/patches.fixes/blkdev_report_zones_ioctl-use-vmalloc-to-allocate-large-buffers.patch b/patches.fixes/blkdev_report_zones_ioctl-use-vmalloc-to-allocate-large-buffers.patch
new file mode 100644
index 0000000000..fe1e1b5bde
--- /dev/null
+++ b/patches.fixes/blkdev_report_zones_ioctl-use-vmalloc-to-allocate-large-buffers.patch
@@ -0,0 +1,69 @@
+From: Bart Van Assche <bart.vanassche@wdc.com>
+Date: Tue, 22 May 2018 08:27:22 -0700
+Subject: blkdev_report_zones_ioctl(): Use vmalloc() to allocate large buffers
+Git-commit: 327ea4adcfa37194739f1ec7c70568944d292281
+Patch-mainline: v4.18-rc1
+References: bsc#1111819
+
+Avoid that complaints similar to the following appear in the kernel log
+if the number of zones is sufficiently large:
+
+ fio: page allocation failure: order:9, mode:0x140c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null)
+ Call Trace:
+ dump_stack+0x63/0x88
+ warn_alloc+0xf5/0x190
+ __alloc_pages_slowpath+0x8f0/0xb0d
+ __alloc_pages_nodemask+0x242/0x260
+ alloc_pages_current+0x6a/0xb0
+ kmalloc_order+0x18/0x50
+ kmalloc_order_trace+0x26/0xb0
+ __kmalloc+0x20e/0x220
+ blkdev_report_zones_ioctl+0xa5/0x1a0
+ blkdev_ioctl+0x1ba/0x930
+ block_ioctl+0x41/0x50
+ do_vfs_ioctl+0xaa/0x610
+ SyS_ioctl+0x79/0x90
+ do_syscall_64+0x79/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+
+Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls")
+Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: Shaun Tancheff <shaun.tancheff@seagate.com>
+Cc: Damien Le Moal <damien.lemoal@hgst.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ block/blk-zoned.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index 08e84ef2bc05..3d08dc84db16 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -328,7 +328,11 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode,
+ if (!rep.nr_zones)
+ return -EINVAL;
+
+- zones = kcalloc(rep.nr_zones, sizeof(struct blk_zone), GFP_KERNEL);
++ if (rep.nr_zones > INT_MAX / sizeof(struct blk_zone))
++ return -ERANGE;
++
++ zones = kvmalloc(rep.nr_zones * sizeof(struct blk_zone),
++ GFP_KERNEL | __GFP_ZERO);
+ if (!zones)
+ return -ENOMEM;
+
+@@ -350,7 +354,7 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode,
+ }
+
+ out:
+- kfree(zones);
++ kvfree(zones);
+
+ return ret;
+ }
+
diff --git a/patches.fixes/block-bvec_nr_vecs-returns-value-for-wrong-slab.patch b/patches.fixes/block-bvec_nr_vecs-returns-value-for-wrong-slab.patch
new file mode 100644
index 0000000000..bab14b368e
--- /dev/null
+++ b/patches.fixes/block-bvec_nr_vecs-returns-value-for-wrong-slab.patch
@@ -0,0 +1,37 @@
+From: Greg Edwards <gedwards@ddn.com>
+Date: Wed, 8 Aug 2018 13:27:53 -0600
+Subject: block: bvec_nr_vecs() returns value for wrong slab
+Git-commit: d6c02a9beb67f13d5f14f23e72fa9981e8b84477
+Patch-mainline: v4.19-rc1
+References: bsc#1111834
+
+In commit ed996a52c868 ("block: simplify and cleanup bvec pool
+handling"), the value of the slab index is incremented by one in
+bvec_alloc() after the allocation is done to indicate an index value of
+0 does not need to be later freed.
+
+bvec_nr_vecs() was not updated accordingly, and thus returns the wrong
+value. Decrement idx before performing the lookup.
+
+Fixes: ed996a52c868 ("block: simplify and cleanup bvec pool handling")
+Signed-off-by: Greg Edwards <gedwards@ddn.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ block/bio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index b832151cd0bf..04969b392c72 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -158,7 +158,7 @@ static void bio_put_slab(struct bio_set *bs)
+
+ unsigned int bvec_nr_vecs(unsigned short idx)
+ {
+- return bvec_slabs[idx].nr_vecs;
++ return bvec_slabs[--idx].nr_vecs;
+ }
+
+ void bvec_free(mempool_t *pool, struct bio_vec *bv, unsigned int idx)
+
diff --git a/patches.fixes/mm-fix-bug_on-in-vmf_insert_pfn_pud-from-vm_mixedmap-removal.patch b/patches.fixes/mm-fix-bug_on-in-vmf_insert_pfn_pud-from-vm_mixedmap-removal.patch
new file mode 100644
index 0000000000..956c406175
--- /dev/null
+++ b/patches.fixes/mm-fix-bug_on-in-vmf_insert_pfn_pud-from-vm_mixedmap-removal.patch
@@ -0,0 +1,51 @@
+From: Dave Jiang <dave.jiang@intel.com>
+Date: Tue, 4 Sep 2018 15:46:16 -0700
+Subject: mm: fix BUG_ON() in vmf_insert_pfn_pud() from VM_MIXEDMAP removal
+Git-commit: 62ec0d8c4f332dedf19d6fad15ddea639044d5fe
+Patch-mainline: v4.19-rc3
+References: bsc#1111841
+
+It looks like I missed the PUD path when doing VM_MIXEDMAP removal.
+This can be triggered by:
+1. Boot with memmap=4G!8G
+2. build ndctl with destructive flag on
+3. make TESTS=device-dax check
+
+[ +0.000675] kernel BUG at mm/huge_memory.c:824!
+
+Applying the same change that was applied to vmf_insert_pfn_pmd() in the
+original patch.
+
+Link: http://lkml.kernel.org/r/153565957352.35524.1005746906902065126.stgit@djiang5-desk3.ch.intel.com
+Fixes: e1fb4a08649 ("dax: remove VM_MIXEDMAP for fsdax and device dax")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Reported-by: Vishal Verma <vishal.l.verma@intel.com>
+Tested-by: Vishal Verma <vishal.l.verma@intel.com>
+Acked-by: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ mm/huge_memory.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index c3bc7e9c9a2a..533f9b00147d 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -821,11 +821,11 @@ vm_fault_t vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
+ * but we need to be consistent with PTEs and architectures that
+ * can't support a 'special' bit.
+ */
+- BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
++ BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) &&
++ !pfn_t_devmap(pfn));
+ BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
+ (VM_PFNMAP|VM_MIXEDMAP));
+ BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
+- BUG_ON(!pfn_t_devmap(pfn));
+
+ if (addr < vma->vm_start || addr >= vma->vm_end)
+ return VM_FAULT_SIGBUS;
+
diff --git a/series.conf b/series.conf
index 759dcba424..d35181c048 100644
--- a/series.conf
+++ b/series.conf
@@ -15668,6 +15668,7 @@
patches.suse/net-usb-cdc_mbim-add-flag-FLAG_SEND_ZLP.patch
patches.fixes/fix-io_destroy-aio_complete-race.patch
patches.suse/0001-nbd-fix-nbd-device-deletion.patch
+ patches.fixes/blkdev_report_zones_ioctl-use-vmalloc-to-allocate-large-buffers.patch
patches.fixes/bdi-Move-cgroup-bdi_writeback-to-a-dedicated-low-con.patch
patches.fixes/block-don-t-print-a-message-when-the-device-went-awa.patch
patches.drivers/nvme-fix-lockdep-warning-in-nvme_mpath_clear_current_path.patch
@@ -17036,6 +17037,7 @@
patches.fixes/fix-mntputmntput-race.patch
patches.fixes/fix-__legitimize_mntmntput-race.patch
patches.fixes/init-rename-and-re-order-boot_cpu_state_init.patch
+ patches.drivers/scsi-qla2xxx-fix-memory-leak-for-allocating-abort-iocb.patch
patches.fixes/genirq-Fix-editing-error-in-a-comment.patch
patches.suse/sched-numa-Remove-redundant-field.patch
patches.suse/sched-numa-Simplify-load_too_imbalanced.patch
@@ -17100,6 +17102,7 @@
patches.suse/0237-bcache-make-the-pr_err-statement-used-for-ENOENT-onl.patch
patches.fixes/nvme-fixup-crash-on-failed-discovery.patch
patches.fixes/nvme.h-fixup-ANA-group-descriptor-format.patch
+ patches.fixes/block-bvec_nr_vecs-returns-value-for-wrong-slab.patch
patches.suse/0236-bcache-fix-error-setting-writeback_rate-through-sysf.patch
patches.suse/0001-md-cluster-clear-another-node-s-suspend_area-after-t.patch
patches.suse/0002-md-cluster-show-array-s-status-more-accurate.patch
@@ -17675,6 +17678,7 @@
patches.fixes/mac80211-don-t-Tx-a-deauth-frame-if-the-AP-forbade-T.patch
patches.fixes/mac80211-shorten-the-IBSS-debug-messages.patch
patches.fixes/mm-hugetlb-filter-out-hugetlb-pages-if-hugepage-migration-is-not-supported.patch
+ patches.fixes/mm-fix-bug_on-in-vmf_insert_pfn_pud-from-vm_mixedmap-removal.patch
patches.fixes/scsi-lpfc-Correct-MDS-diag-and-nvmet-configuration.patch
patches.drivers/scsi-hpsa-limit-transfer-length-to-1mb-not-512kb.patch
patches.drivers/gpio-adp5588-Fix-sleep-in-atomic-context-bug.patch