From: Greg Kroah-Hartman Date: Wed, 18 Dec 2013 19:34:42 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.4.75~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a67c98326f222fdbd827b6fd476df47f57716965;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: dm-bufio-initialize-read-only-module-parameters.patch dm-delay-fix-a-possible-deadlock-due-to-shared-workqueue.patch dm-table-fail-dm_table_create-on-dm_round_up-overflow.patch --- diff --git a/queue-3.4/dm-bufio-initialize-read-only-module-parameters.patch b/queue-3.4/dm-bufio-initialize-read-only-module-parameters.patch new file mode 100644 index 00000000000..cdae69eb6d7 --- /dev/null +++ b/queue-3.4/dm-bufio-initialize-read-only-module-parameters.patch @@ -0,0 +1,45 @@ +From 4cb57ab4a2e61978f3a9b7d4f53988f30d61c27f Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 5 Dec 2013 17:33:29 -0500 +Subject: dm bufio: initialize read-only module parameters + +From: Mikulas Patocka + +commit 4cb57ab4a2e61978f3a9b7d4f53988f30d61c27f upstream. + +Some module parameters in dm-bufio are read-only. These parameters +inform the user about memory consumption. They are not supposed to be +changed by the user. + +However, despite being read-only, these parameters can be set on +modprobe or insmod command line, for example: +modprobe dm-bufio current_allocated_bytes=12345 + +The kernel doesn't expect that these variables can be non-zero at module +initialization and if the user sets them, it results in BUG. + +This patch initializes the variables in the module init routine, so that +user-supplied values are ignored. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-bufio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -1642,6 +1642,11 @@ static int __init dm_bufio_init(void) + { + __u64 mem; + ++ dm_bufio_allocated_kmem_cache = 0; ++ dm_bufio_allocated_get_free_pages = 0; ++ dm_bufio_allocated_vmalloc = 0; ++ dm_bufio_current_allocated = 0; ++ + memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches); + memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names); + diff --git a/queue-3.4/dm-delay-fix-a-possible-deadlock-due-to-shared-workqueue.patch b/queue-3.4/dm-delay-fix-a-possible-deadlock-due-to-shared-workqueue.patch new file mode 100644 index 00000000000..a1eefe6cf50 --- /dev/null +++ b/queue-3.4/dm-delay-fix-a-possible-deadlock-due-to-shared-workqueue.patch @@ -0,0 +1,110 @@ +From 718822c1c112dc99e0c72c8968ee1db9d9d910f0 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 15 Nov 2013 16:12:20 -0500 +Subject: dm delay: fix a possible deadlock due to shared workqueue + +From: Mikulas Patocka + +commit 718822c1c112dc99e0c72c8968ee1db9d9d910f0 upstream. + +The dm-delay target uses a shared workqueue for multiple instances. This +can cause deadlock if two or more dm-delay targets are stacked on the top +of each other. + +This patch changes dm-delay to use a per-instance workqueue. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-delay.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/drivers/md/dm-delay.c ++++ b/drivers/md/dm-delay.c +@@ -20,6 +20,7 @@ + struct delay_c { + struct timer_list delay_timer; + struct mutex timer_lock; ++ struct workqueue_struct *kdelayd_wq; + struct work_struct flush_expired_bios; + struct list_head delayed_bios; + atomic_t may_delay; +@@ -45,14 +46,13 @@ struct dm_delay_info { + + static DEFINE_MUTEX(delayed_bios_lock); + +-static struct workqueue_struct *kdelayd_wq; + static struct kmem_cache *delayed_cache; + + static void handle_delayed_timer(unsigned long data) + { + struct delay_c *dc = (struct delay_c *)data; + +- queue_work(kdelayd_wq, &dc->flush_expired_bios); ++ queue_work(dc->kdelayd_wq, &dc->flush_expired_bios); + } + + static void queue_timeout(struct delay_c *dc, unsigned long expires) +@@ -191,6 +191,12 @@ out: + goto bad_dev_write; + } + ++ dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0); ++ if (!dc->kdelayd_wq) { ++ DMERR("Couldn't start kdelayd"); ++ goto bad_queue; ++ } ++ + setup_timer(&dc->delay_timer, handle_delayed_timer, (unsigned long)dc); + + INIT_WORK(&dc->flush_expired_bios, flush_expired_bios); +@@ -203,6 +209,8 @@ out: + ti->private = dc; + return 0; + ++bad_queue: ++ mempool_destroy(dc->delayed_pool); + bad_dev_write: + if (dc->dev_write) + dm_put_device(ti, dc->dev_write); +@@ -217,7 +225,7 @@ static void delay_dtr(struct dm_target * + { + struct delay_c *dc = ti->private; + +- flush_workqueue(kdelayd_wq); ++ destroy_workqueue(dc->kdelayd_wq); + + dm_put_device(ti, dc->dev_read); + +@@ -351,12 +359,6 @@ static int __init dm_delay_init(void) + { + int r = -ENOMEM; + +- kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0); +- if (!kdelayd_wq) { +- DMERR("Couldn't start kdelayd"); +- goto bad_queue; +- } +- + delayed_cache = KMEM_CACHE(dm_delay_info, 0); + if (!delayed_cache) { + DMERR("Couldn't create delayed bio cache."); +@@ -374,8 +376,6 @@ static int __init dm_delay_init(void) + bad_register: + kmem_cache_destroy(delayed_cache); + bad_memcache: +- destroy_workqueue(kdelayd_wq); +-bad_queue: + return r; + } + +@@ -383,7 +383,6 @@ static void __exit dm_delay_exit(void) + { + dm_unregister_target(&delay_target); + kmem_cache_destroy(delayed_cache); +- destroy_workqueue(kdelayd_wq); + } + + /* Module hooks */ diff --git a/queue-3.4/dm-table-fail-dm_table_create-on-dm_round_up-overflow.patch b/queue-3.4/dm-table-fail-dm_table_create-on-dm_round_up-overflow.patch new file mode 100644 index 00000000000..d569322a558 --- /dev/null +++ b/queue-3.4/dm-table-fail-dm_table_create-on-dm_round_up-overflow.patch @@ -0,0 +1,38 @@ +From 5b2d06576c5410c10d95adfd5c4d8b24de861d87 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 22 Nov 2013 19:52:06 -0500 +Subject: dm table: fail dm_table_create on dm_round_up overflow + +From: Mikulas Patocka + +commit 5b2d06576c5410c10d95adfd5c4d8b24de861d87 upstream. + +The dm_round_up function may overflow to zero. In this case, +dm_table_create() must fail rather than go on to allocate an empty array +with alloc_targets(). + +This fixes a possible memory corruption that could be caused by passing +too large a number in "param->target_count". + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-table.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -215,6 +215,11 @@ int dm_table_create(struct dm_table **re + + num_targets = dm_round_up(num_targets, KEYS_PER_NODE); + ++ if (!num_targets) { ++ kfree(t); ++ return -ENOMEM; ++ } ++ + if (alloc_targets(t, num_targets)) { + kfree(t); + t = NULL; diff --git a/queue-3.4/series b/queue-3.4/series index 1cb943f856e..391ca598ad0 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -20,3 +20,6 @@ selinux-handle-tcp-syn-ack-packets-correctly-in-selinux_ip_postroute.patch mac80211-don-t-attempt-to-reorder-multicast-frames.patch drm-radeon-fixup-bad-vram-size-on-si.patch x86-efi-don-t-use-u-efi-time-services-on-32-bit.patch +dm-bufio-initialize-read-only-module-parameters.patch +dm-delay-fix-a-possible-deadlock-due-to-shared-workqueue.patch +dm-table-fail-dm_table_create-on-dm_round_up-overflow.patch