1. 11 Apr, 2014 2 commits
    • Andy Grover's avatar
      target/tcm_fc: Fix use-after-free of ft_tpg · 2c42be2d
      Andy Grover authored
      ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
      tport when the tpg is being removed. Set this pointer in ft_tport_create,
      or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
      a deleted object.
      
      This patch sets tpg->tport in ft_tport_create, because that's what
      ft_del_tpg checks, and is the only way to get back to the tport to
      clear tport->tpg.
      
      The bug was occuring when:
      
      - lport created, tport (our per-lport, per-provider context) is
        allocated.
        tport->tpg = NULL
      - tpg created
      - a PRLI is received. ft_tport_create is called, tpg is found and
        tport->tpg is set
      - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
        set, tport->tpg is not cleared and points at freed memory
      - Future calls to ft_tport_create return tport via first conditional,
        instead of searching for new tpg by calling ft_lport_find_tpg.
        tport->tpg is still invalid, and will access freed memory.
      
      see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
      
      Cc: stable@vger.kernel.org # 3.0+
      Signed-off-by: default avatarAndy Grover <agrover@redhat.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      2c42be2d
    • Alex Leung's avatar
      target: Add check to prevent Abort Task from aborting itself · 47b1584c
      Alex Leung authored
      This patch addresses an issue that occurs when an ABTS is received
      for an se_cmd that completes just before the sess_cmd_list is searched
      in core_tmr_abort_task(). When the sess_cmd_list is searched, since
      the ABTS and the FCP_CMND being aborted (that just completed) both
      have the same OXID, TFO->get_task_tag(TMR) returns a value that
      matches tmr->ref_task_tag (from TFO->get_task_tag(FCP_CMND)), and
      the Abort Task tries to abort itself. When this occurs,
      transport_wait_for_tasks() hangs forever since the TMR is waiting
      for itself to finish.
      
      This patch adds a check to core_tmr_abort_task() to make sure the
      TMR does not attempt to abort itself.
      Signed-off-by: default avatarAlex Leung <alex.leung@emulex.com>
      Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
      47b1584c
  2. 07 Apr, 2014 32 commits
  3. 13 Mar, 2014 4 commits
  4. 10 Mar, 2014 2 commits
    • Linus Torvalds's avatar
      Linux 3.14-rc6 · fa389e22
      Linus Torvalds authored
      fa389e22
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 79e61542
      Linus Torvalds authored
      Pull ARM SoC fixes from from Olof Johansson:
       "A collection of fixes for ARM platforms.  A little large due to us
        missing to do one last week, but there's nothing in particular here
        that is in itself large and scary.
      
        Mostly a handful of smaller fixes all over the place.  The majority is
        made up of fixes for OMAP, but there are a few for others as well.  In
        particular, there was a decision to rename a binding for the Broadcom
        pinctrl block that we need to go in before the final release since we
        then treat it as ABI"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: omap3-gta04: Add ti,omap36xx to compatible property to avoid problems with booting
        ARM: tegra: add LED options back into tegra_defconfig
        ARM: dts: omap3-igep: fix boot fail due wrong compatible match
        ARM: OMAP3: Fix pinctrl interrupts for core2
        pinctrl: Rename Broadcom Capri pinctrl binding
        pinctrl: refer to updated dt binding string.
        Update dtsi with new pinctrl compatible string
        ARM: OMAP: Kill warning in CPUIDLE code with !CONFIG_SMP
        ARM: OMAP2+: Add support for thumb mode on DT booted N900
        ARM: OMAP2+: clock: fix clkoutx2 with CLK_SET_RATE_PARENT
        ARM: OMAP4: hwmod: Fix SOFTRESET logic for OMAP4
        ARM: DRA7: hwmod data: correct the sysc data for spinlock
        ARM: OMAP5: PRM: Fix reboot handling
        ARM: sunxi: dt: Change the touchscreen compatibles
        ARM: sun7i: dt: Fix interrupt trigger types
      79e61542