/* * (C) 2001 Clemson University and The University of Chicago * * See COPYING in top-level directory. */ #include "protocol.h" #include "orangefs-kernel.h" #include "orangefs-bufmap.h" #include #include struct posix_acl *orangefs_get_acl(struct inode *inode, int type) { struct posix_acl *acl; int ret; char *key = NULL, *value = NULL; switch (type) { case ACL_TYPE_ACCESS: key = XATTR_NAME_POSIX_ACL_ACCESS; break; case ACL_TYPE_DEFAULT: key = XATTR_NAME_POSIX_ACL_DEFAULT; break; default: gossip_err("orangefs_get_acl: bogus value of type %d\n", type); return ERR_PTR(-EINVAL); } /* * Rather than incurring a network call just to determine the exact * length of the attribute, I just allocate a max length to save on * the network call. Conceivably, we could pass NULL to * orangefs_inode_getxattr() to probe the length of the value, but * I don't do that for now. */ value = kmalloc(ORANGEFS_MAX_XATTR_VALUELEN, GFP_KERNEL); if (value == NULL) return ERR_PTR(-ENOMEM); gossip_debug(GOSSIP_ACL_DEBUG, "inode %pU, key %s, type %d\n", get_khandle_from_ino(inode), key, type); ret = orangefs_inode_getxattr(inode, key, value, ORANGEFS_MAX_XATTR_VALUELEN); /* if the key exists, convert it to an in-memory rep */ if (ret > 0) { acl = posix_acl_from_xattr(&init_user_ns, value, ret); } else if (ret == -ENODATA || ret == -ENOSYS) { acl = NULL; } else { gossip_err("inode %pU retrieving acl's failed with error %d\n", get_khandle_from_ino(inode), ret); acl = ERR_PTR(ret); } /* kfree(NULL) is safe, so don't worry if value ever got used */ kfree(value); return acl; } int orangefs_set_acl(struct inode *inode, struct posix_acl *acl, int type) { struct orangefs_inode_s *orangefs_inode = ORANGEFS_I(inode); int error = 0; void *value = NULL; size_t size = 0; const char *name = NULL; switch (type) { case ACL_TYPE_ACCESS: name = XATTR_NAME_POSIX_ACL_ACCESS; if (acl) { umode_t mode; error = posix_acl_update_mode(inode, &mode, &acl); if (error) { gossip_err("%s: posix_acl_update_mode err: %d\n", __func__, error); return error; } if (inode->i_mode != mode) SetModeFlag(orangefs_inode); inode->i_mode = mode; mark_inode_dirty_sync(inode); } break; case ACL_TYPE_DEFAULT: name = XATTR_NAME_POSIX_ACL_DEFAULT; break; default: gossip_err("%s: invalid type %d!\n", __func__, type); return -EINVAL; } gossip_debug(GOSSIP_ACL_DEBUG, "%s: inode %pU, key %s type %d\n", __func__, get_khandle_from_ino(inode), name, type); if (acl) { size = posix_acl_xattr_size(acl->a_count); value = kmalloc(size, GFP_KERNEL); if (!value) return -ENOMEM; error = posix_acl_to_xattr(&init_user_ns, acl, value, size); if (error < 0) goto out; } gossip_debug(GOSSIP_ACL_DEBUG, "%s: name %s, value %p, size %zd, acl %p\n", __func__, name, value, size, acl); /* * Go ahead and set the extended attribute now. NOTE: Suppose acl * was NULL, then value will be NULL and size will be 0 and that * will xlate to a removexattr. However, we don't want removexattr * complain if attributes does not exist. */ error = orangefs_inode_setxattr(inode, name, value, size, 0); out: kfree(value); if (!error) set_cached_acl(inode, type, acl); return error; } int orangefs_init_acl(struct inode *inode, struct inode *dir) { struct orangefs_inode_s *orangefs_inode = ORANGEFS_I(inode); struct posix_acl *default_acl, *acl; umode_t mode = inode->i_mode; int error = 0; ClearModeFlag(orangefs_inode); error = posix_acl_create(dir, &mode, &default_acl, &acl); if (error) return error; if (default_acl) { error = orangefs_set_acl(inode, default_acl, ACL_TYPE_DEFAULT); posix_acl_release(default_acl); } if (acl) { if (!error) error = orangefs_set_acl(inode, acl, ACL_TYPE_ACCESS); posix_acl_release(acl); } /* If mode of the inode was changed, then do a forcible ->setattr */ if (mode != inode->i_mode) { SetModeFlag(orangefs_inode); inode->i_mode = mode; orangefs_flush_inode(inode); } return error; } >commit02a9e08d7374f1bb680cd44a2f124793f4e7d6e7 (patch) treea2da5f107811cdcab36e0878e4d5d24baa937305 parent5c4607ebaabed2e9b414593a83c0ff97c6966f12 (diff)
ath10k: Avoid potential page alloc BUG_ON in tx free path
'ath10k_htt_tx_free_cont_txbuf' and 'ath10k_htt_tx_free_cont_frag_desc' have NULL pointer checks to avoid crash if they are called twice but this is as of now not sufficient as these pointers are not assigned to NULL once the contiguous DMA memory allocation is freed, fix this. Though this may not be hit with the explicity check of state variable 'tx_mem_allocated' check, good to have this addressed as well. Below BUG_ON is hit when the above scenario is simulated with kernel debugging enabled page:f6d09a00 count:0 mapcount:-127 mapping: (null) index:0x0 flags: 0x40000000() page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:445! invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC EIP is at put_page_testzero.part.88+0xd/0xf Call Trace: [<c118a2cc>] __free_pages+0x3c/0x40 [<c118a30e>] free_pages+0x3e/0x50 [<c10222b4>] dma_generic_free_coherent+0x24/0x30 [<f8c1d9a8>] ath10k_htt_tx_free_cont_txbuf+0xf8/0x140 [<f8c1e2a9>] ath10k_htt_tx_destroy+0x29/0xa0 [<f8c143e0>] ath10k_core_destroy+0x60/0x80 [ath10k_core] [<f8acd7e9>] ath10k_pci_remove+0x79/0xa0 [ath10k_pci] [<c13ed7a8>] pci_device_remove+0x38/0xb0 [<c14d3492>] __device_release_driver+0x72/0x100 [<c14d36b7>] driver_detach+0x97/0xa0 [<c14d29c0>] bus_remove_driver+0x40/0x80 [<c14d427a>] driver_unregister+0x2a/0x60 [<c13ec768>] pci_unregister_driver+0x18/0x70 [<f8aced4f>] ath10k_pci_exit+0xd/0x2be [ath10k_pci] [<c1101e78>] SyS_delete_module+0x158/0x210 [<c11b34f1>] ? __might_fault+0x41/0xa0 [<c11b353b>] ? __might_fault+0x8b/0xa0 [<c1001a4b>] do_fast_syscall_32+0x9b/0x1c0 [<c178da34>] sysenter_past_esp+0x45/0x74 Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat