linux-toradex.git/include/net/9p, branch v4.4-rc6

9p: switch p9_client_read() to passing struct iov_iter *

2015-04-12T02:28:27+00:00

... and make it loop

Signed-off-by: Al Viro

9p: switch p9_client_write() to passing it struct iov_iter *

2015-04-12T02:28:25+00:00

... and make it loop until it's done

Signed-off-by: Al Viro

net/9p: switch the guts of p9_client_{read,write}() to iov_iter

2015-04-12T02:28:25+00:00

... and have get_user_pages_fast() mapping fewer pages than requested
to generate a short read/write.

Signed-off-by: Al Viro

net/9p: remove a comment about pref member which doesn't exist

2014-11-06T19:59:19+00:00

Signed-off-by: Ryo Munakata 
Signed-off-by: David S. Miller

9pnet: p9_client->conn field is unused. Remove it.

2014-03-25T21:38:16+00:00

Signed-off-by: Simon Derr 
Signed-off-by: Eric Van Hensbergen

9P: Get rid of REQ_STATUS_FLSH

2014-03-25T21:38:15+00:00

This request state is mostly useless, and properly implementing it
for RDMA would require an extra lock to be taken in handle_recv()
and in rdma_cancel() to avoid this race:

    handle_recv()           rdma_cancel()
        .                     .
        .                   if req->state == SENT
    req->state = RCVD         .
        .                           req->state = FLSH

So just get rid of it.

Signed-off-by: Simon Derr 
Signed-off-by: Eric Van Hensbergen

9P: Add cancelled() to the transport functions.

2014-03-25T21:38:11+00:00

And move transport-specific code out of net/9p/client.c

Signed-off-by: Simon Derr 
Signed-off-by: Eric Van Hensbergen

9P: Add memory barriers to protect request fields over cb/rpc threads handoff

2014-03-25T21:37:59+00:00

We need barriers to guarantee this pattern works as intended:
[w] req->rc, 1		[r] req->status, 1
wmb			rmb
[w] req->status, 1	[r] req->rc

Where the wmb ensures that rc gets written before status,
and the rmb ensures that if you observe status == 1, rc is the new value.

Signed-off-by: Dominique Martinet 
Signed-off-by: Eric Van Hensbergen

Merge tag 'for-linus-3.12-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs

2013-09-11T19:34:13+00:00

Pull 9p updates from Eric Van Hensbergen:
 "Minor 9p fixes and tweaks for 3.12 merge window

  The first fixes namespace issues which causes a kernel NULL pointer
  dereference, the second fixes uevent handling to work better with
  udev, and the third switches some code to use srlcpy instead of
  strncpy in order to be safer.

  All changes have been baking in for-next for at least 2 weeks"

* tag 'for-linus-3.12-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  fs/9p: avoid accessing utsname after namespace has been torn down
  9p: send uevent after adding/removing mount_tag attribute
  fs: 9p: use strlcpy instead of strncpy

fs/9p: avoid accessing utsname after namespace has been torn down

2013-08-26T15:28:46+00:00

During trinity fuzzing in a kvmtool guest, I stumbled across the
following:

Unable to handle kernel NULL pointer dereference at virtual address 00000004
PC is at v9fs_file_do_lock+0xc8/0x1a0
LR is at v9fs_file_do_lock+0x48/0x1a0
[] (v9fs_file_do_lock+0xc8/0x1a0) from [] (locks_remove_flock+0x8c/0x124)
[] (locks_remove_flock+0x8c/0x124) from [] (__fput+0x58/0x1e4)
[] (__fput+0x58/0x1e4) from [] (task_work_run+0xac/0xe8)
[] (task_work_run+0xac/0xe8) from [] (do_exit+0x6bc/0x8d8)
[] (do_exit+0x6bc/0x8d8) from [] (do_group_exit+0x3c/0xb0)
[] (do_group_exit+0x3c/0xb0) from [] (__wake_up_parent+0x0/0x18)

I believe this is due to an attempt to access utsname()->nodename, after
exit_task_namespaces() has been called, leaving current->nsproxy->uts_ns
as NULL and causing the above dereference.

A similar issue was fixed for lockd in 9a1b6bf818e7 ("LOCKD: Don't call
utsname()->nodename from nlmclnt_setlockargs"), so this patch attempts
something similar for 9pfs.

Cc: Eric Van Hensbergen 
Cc: Ron Minnich 
Cc: Latchesar Ionkov 
Cc: Trond Myklebust 
Signed-off-by: Will Deacon 
Signed-off-by: Eric Van Hensbergen