Commit Graph

13 Commits

Author SHA1 Message Date
Douglas Gilbert
1c8e71d720 [SCSI] sg: do not set VM_IO flag on mmap-ed pages
Further to the problem discussed in this post:
http://marc.theaimsgroup.com/?l=linux-scsi&m=112540053711489&w=2

It seems that the sg driver does not need to set the VM_IO flag
on pages that it memory maps to the user space since they are
not from the IO space. Ahmed Teirelbar <ahmed.teirelbar@adic.com>
wants the facility and has tested this patch as I have without
adverse effects.

The oops protection is still important. Some users really did
try and use dio transfers from the sg driver to memory mapped
IO space (on a video capture card if my memory serves) during the
lk 2.4 series. I'm not sure how successful it was but that will
now be politely refused in lk 2.6.13+ .

Changelog:
   - set the page flags for sg's reserved buffer mmap-ed
     to the user space to VM_RESERVED (rather than
     VM_RESERVED | VM_IO )

Signed-off-by: Douglas Gilbert <dougg@torque.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-09-09 16:37:05 -05:00
James Bottomley
17fa53da12 Merge by hand (conflicts in sd.c) 2005-09-06 17:52:54 -05:00
Douglas Gilbert
deb92b7ee9 [SCSI] sg direct io/mmap oops, st sync
This patch adopts the same solution as proposed by Kai M. in
a post titled: "[PATCH] SCSI tape signed/unsigned fix".
The fix is in a function that the sg driver borrowed from
the st driver so its maintenance is a little easier if
the functions remain the same after the fix.

   - change nr_pages type from unsigned to signed so errors
     from get_user_pages() call are properly handled

Signed-off-by: Douglas Gilbert <dougg@torque.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-09-04 19:46:03 -05:00
James Bottomley
7a93aef7fb Merge HEAD from ../scsi-misc-2.6-tmp 2005-08-28 11:18:35 -05:00
Jan Blunck
729d70f5df [PATCH] sg.c: fix a memory leak in devices seq_file implementation
I know that scsi procfs is legacy code but this is a fix for a memory leak.

While reading through sg.c I realized that the implementation of
/proc/scsi/sg/devices with seq_file is leaking memory due to freeing the
pointer returned by the next() iterator method.  Since next() might return
NULL or an error this is wrong.  This patch fixes it through using the
seq_files private field for holding the reference to the iterator object.

Here is a small bash script to trigger the leak. Use slabtop to watch
the size-32 usage grow and grow.

#!/bin/sh

while true; do
	cat /proc/scsi/sg/devices > /dev/null
done

Signed-off-by: Jan Blunck <j.blunck@tu-harburg.de>
Acked-by: James Bottomley <James.Bottomley@steeleye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-08-27 11:22:27 -07:00
Mike Anderson
d330187408 [SCSI] host state model update: replace old host bitmap state
Migrate the current SCSI host state model to a model like SCSI
device is using.

Signed-off-by: Mike Anderson <andmike@us.ibm.com>

Rejections fixed up and

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-07-30 11:10:24 -05:00
gregkh@suse.de
d253878b3d [PATCH] class: convert drivers/scsi/* to use the new class api instead of class_simple
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-06-20 15:15:08 -07:00
brking@us.ibm.com
521314c122 [SCSI] sg: Command completion after remove oops
A problem exists todayin the sg driver that if an SG_IO request is
outstanding to a device when it is removed from the system. The
system may oops if that command completes later in time.

1. sg_remove gets called
2. sg_remove calls sg_finish_req_req on all pending requests
   This removes the Sg_request's from the headrp list in the Sg_fd
3. The sleeping SG_IO ioctl is woken. It does nothing and returns.
4. The caller closes the fd, which invokes sg_release
5. sg_release calls sg_remove_sfp. It finds no outstanding commands
   since the headrp list is empty, so it calls __sg_remove_sfp,
   which frees the sfp.
6. Now when sg_cmd_done gets called, sg uses upper_private_data in
   the Scsi_Request, which should point to the srp, which has been
   freed, so it points to freed memory.
7. sg then dereferences the srp pointer to get the sfp, and we oops.

The fix is to NULL out the upper_private_data field in this path,
which sg_cmd_done already checks for, which will prevent the oops
from occurring.

cpu 0x1: Vector: 300 (Data Access) at [c00000000fff7aa0]
    pc: d0000000002bbea8: .sg_cmd_done+0x70/0x394 [sg]
    lr: d000000000073304: .scsi_finish_command+0x10c/0x130 [scsi_mod]
    sp: c00000000fff7d20
   msr: 8000000000009032
   dar: 2f70726f63202f78
 dsisr: 40000000
  current = 0xc0000000024589b0
  paca    = 0xc0000000003da800
    pid   = 7, comm = events/1
[c00000000fff7dc0] d000000000073304 .scsi_finish_command+0x10c/0x130 [scsi_mod]
[c00000000fff7e50] d00000000007317c .scsi_softirq+0x140/0x168 [scsi_mod]
[c00000000fff7ef0] c0000000000634dc .__do_softirq+0xa0/0x17c
[c00000000fff7f90] c000000000018430 .call_do_softirq+0x14/0x24
[c00000000ed472e0] c0000000000142e0 .do_softirq+0x74/0x9c
[c00000000ed47370] c000000000013c9c .do_IRQ+0xe8/0x100
[c00000000ed473f0] c00000000000ae34 HardwareInterrupt_entry+0x8/0x54

c00000000003df28 .smp_call_function+0
x100/0x1d0
[c00000000ed47780] c0000000000ba99c .invalidate_bh_lrus+0x30/0x70
[c00000000ed47810] c0000000000b91a0 .invalidate_bdev+0x18/0x3c
[c00000000ed478a0] c0000000000da7b8 .__invalidate_device+0x70/0x94
[c00000000ed47930] c0000000001d40bc .invalidate_partition+0x4c/0x7c
[c00000000ed479c0] c00000000010a944 .del_gendisk+0x48/0x15c
[c00000000ed47a50] d00000000003d55c .sd_remove+0x34/0xe4 [sd_mod]
[c00000000ed47ae0] c0000000001c5d30 .device_release_driver+0x90/0xb4
[c00000000ed47b70] c0000000001c6130 .bus_remove_device+0xb0/0x12c
[c00000000ed47c00] c0000000001c4378 .device_del+0x120/0x198
[c00000000ed47ca0] d00000000007dcdc .scsi_remove_device+0xb4/0x194 [scsi_mod]
[c00000000ed47d30] d0000000000a5864 .ipr_worker_thread+0x1d4/0x27c [ipr]
[c00000000ed47dd0] c0000000000734c4 .worker_thread+0x238/0x2f4
[c00000000ed47ee0] c0000000000796c0 .kthread+0xcc/0x11c
[c00000000ed47f90] c000000000018ad0 .kernel_thread+0x4c/0x6c

Signed-off-by: Brian King <brking@us.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-06-03 12:25:35 -05:00
be7db055dd [PATCH] remove old scsi data direction macros
these have been wrappers for the generic dma direction bits since 2.5.x.
This patch converts the few remaining drivers and removes the macros.

Arjan noticed there's some hunk in here that shouldn't.  Updated patch
below:

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-04-18 13:49:58 -05:00
James Bottomley
c46f2ffb9e merge by hand (scsi_device.h) 2005-04-18 13:45:00 -05:00
db9dff366b [PATCH] remove outdated print_* functions
We have the scsi_print_* functions in the proper namespace for a long
time now and there weren't a lot users left.

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-04-18 12:32:20 -05:00
cb59e84083 [PATCH] sg.c: update
The attachment combines the most recent patch from
Yum Rayan <yum.rayan@gmail.com> (to reduce sg stack
usage), Adrian Bunk <bunk@stusta.de> (to fix check
after use) and me (fix elapsed time calculation
(duration) on ia64 machines).

I have modified the patch from Yum Rayan so kmalloc()
in sg_read() is only called for the (rare) code paths
that need them.

Changelog:
   - reduce stack usage in sg_ioctl() and sg_read()
   - fix check after use in sg_mmap()
   - hold duration internally in milliseconds and
     check current time later than held time

Signed-off-by: Douglas Gilbert <dougg@torque.net>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>
2005-04-16 20:08:52 -05:00
Linus Torvalds
1da177e4c3 Linux-2.6.12-rc2
Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!
2005-04-16 15:20:36 -07:00