renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-19 02:34:01 +08:00
Code

A patch for a NULL dereference bug introduced in 4.8-rc1 and a handful

Browse Source 
of static checker fixes.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQEcBAABCAAGBQJXrHadAAoJEEp/3jgCEfOLY18H/0c13lLrwfOD2GWdtZ4Hxt8A
 JmLJtplRxnRd1ZpeXPsIXFhQVs0L8COK1diq51rV7xBYzlYzwQ4y3aRapi2YX9Lq
 5Ap8Cl91eVwvTETDp7uS7pFwPju7pnLgHEBstNG56H8sD9drjgIPanhdwDeg04iG
 3hl9NLHPwdMfBQhKMh8y6/ggBX6ErtIZIPY07zUlRvm9YiEb+aTyUHQF6K4BMWO7
 DZSrRJFfjgMk3Unc/KvKtir93PTA8J2sJxKsLKY5y79dFX/ulO724fMmIhUr6iB9
 serReW0WEfv7y3f4wiR87HuKwEkRadeq9Xzqe5TTByIbryJG+DaBAoCzedWMaWE=
 =09j2
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A patch for a NULL dereference bug introduced in 4.8-rc1 and a handful
  of static checker fixes"

* tag 'ceph-for-4.8-rc2' of https://github.com/ceph/ceph-client:
  ceph: initialize pathbase in the !dentry case in encode_caps_cb()
  rbd: nuke the 32-bit pool id check
  rbd: destroy header_oloc in rbd_dev_release()
  ceph: fix null pointer dereference in ceph_flush_snaps()
  libceph: using kfree_rcu() to simplify the code
  libceph: make cancel_generic_request() static
  libceph: fix return value check in alloc_msg_with_page_vector()
This commit is contained in:
Linus Torvalds 2016-08-11 13:53:34 -07:00
commit 3b3ce01a57
6 changed files with 9 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/block/rbd.c
View File

@ -3950,6 +3950,7 @@ static void rbd_dev_release(struct device *dev)
bool need_put = !!rbd_dev->opts; bool need_put = !!rbd_dev->opts;
ceph_oid_destroy(&rbd_dev->header_oid); ceph_oid_destroy(&rbd_dev->header_oid);
ceph_oloc_destroy(&rbd_dev->header_oloc);
rbd_put_client(rbd_dev->rbd_client); rbd_put_client(rbd_dev->rbd_client);
rbd_spec_put(rbd_dev->spec); rbd_spec_put(rbd_dev->spec);
@ -5336,15 +5337,6 @@ static ssize_t do_rbd_add(struct bus_type *bus,
} }
spec->pool_id = (u64)rc; spec->pool_id = (u64)rc;
/* The ceph file layout needs to fit pool id in 32 bits */
if (spec->pool_id > (u64)U32_MAX) {
rbd_warn(NULL, "pool id too large (%llu > %u)",
(unsigned long long)spec->pool_id, U32_MAX);
rc = -EIO;
goto err_out_client;
}
rbd_dev = rbd_dev_create(rbdc, spec, rbd_opts); rbd_dev = rbd_dev_create(rbdc, spec, rbd_opts);
if (!rbd_dev) { if (!rbd_dev) {
rc = -ENOMEM; rc = -ENOMEM;

5
fs/ceph/caps.c
View File

@ -1347,9 +1347,12 @@ void ceph_flush_snaps(struct ceph_inode_info *ci,
{ {
struct inode *inode = &ci->vfs_inode; struct inode *inode = &ci->vfs_inode;
struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc; struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc;
struct ceph_mds_session *session = *psession; struct ceph_mds_session *session = NULL;
int mds; int mds;
dout("ceph_flush_snaps %p\n", inode); dout("ceph_flush_snaps %p\n", inode);
if (psession)
session = *psession;
retry: retry:
spin_lock(&ci->i_ceph_lock); spin_lock(&ci->i_ceph_lock);
if (!(ci->i_ceph_flags & CEPH_I_FLUSH_SNAPS)) { if (!(ci->i_ceph_flags & CEPH_I_FLUSH_SNAPS)) {

1
fs/ceph/mds_client.c
View File

@ -2759,6 +2759,7 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
} else { } else {
path = NULL; path = NULL;
pathlen = 0; pathlen = 0;
pathbase = 0;
} }
spin_lock(&ci->i_ceph_lock); spin_lock(&ci->i_ceph_lock);

2
net/ceph/mon_client.c
View File

@ -574,7 +574,7 @@ static void complete_generic_request(struct ceph_mon_generic_request *req)
put_generic_request(req); put_generic_request(req);
} }
void cancel_generic_request(struct ceph_mon_generic_request *req) static void cancel_generic_request(struct ceph_mon_generic_request *req)
{ {
struct ceph_mon_client *monc = req->monc; struct ceph_mon_client *monc = req->monc;
struct ceph_mon_generic_request *lookup_req; struct ceph_mon_generic_request *lookup_req;

2
net/ceph/osd_client.c
View File

@ -4220,7 +4220,7 @@ static struct ceph_msg *alloc_msg_with_page_vector(struct ceph_msg_header *hdr)
pages = ceph_alloc_page_vector(calc_pages_for(0, data_len), pages = ceph_alloc_page_vector(calc_pages_for(0, data_len),
GFP_NOIO); GFP_NOIO);
if (!pages) { if (IS_ERR(pages)) {
ceph_msg_put(m); ceph_msg_put(m);
return NULL; return NULL;
} }

8
net/ceph/string_table.c
View File

@ -84,12 +84,6 @@ retry:
} }
EXPORT_SYMBOL(ceph_find_or_create_string); EXPORT_SYMBOL(ceph_find_or_create_string);
static void ceph_free_string(struct rcu_head *head)
{
struct ceph_string *cs = container_of(head, struct ceph_string, rcu);
kfree(cs);
}
void ceph_release_string(struct kref *ref) void ceph_release_string(struct kref *ref)
{ {
struct ceph_string *cs = container_of(ref, struct ceph_string, kref); struct ceph_string *cs = container_of(ref, struct ceph_string, kref);
@ -101,7 +95,7 @@ void ceph_release_string(struct kref *ref)
} }
spin_unlock(&string_tree_lock); spin_unlock(&string_tree_lock);
call_rcu(&cs->rcu, ceph_free_string); kfree_rcu(cs, rcu);
} }
EXPORT_SYMBOL(ceph_release_string); EXPORT_SYMBOL(ceph_release_string);