<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/net/rds/message.c, branch v4.8</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>RDS: TCP: Enable multipath RDS for TCP</title>
<updated>2016-07-15T18:36:58+00:00</updated>
<author>
<name>Sowmini Varadhan</name>
<email>sowmini.varadhan@oracle.com</email>
</author>
<published>2016-07-14T10:51:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=5916e2c1554f3e36f770401c989c3c7fadf619ca'/>
<id>5916e2c1554f3e36f770401c989c3c7fadf619ca</id>
<content type='text'>
Use RDS probe-ping to compute how many paths may be used with
the peer, and to synchronously start the multiple paths. If mprds is
supported, hash outgoing traffic to one of multiple paths in rds_sendmsg()
when multipath RDS is supported by the transport.

CC: Santosh Shilimkar &lt;santosh.shilimkar@oracle.com&gt;
Signed-off-by: Sowmini Varadhan &lt;sowmini.varadhan@oracle.com&gt;
Acked-by: Santosh Shilimkar &lt;santosh.shilimkar@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use RDS probe-ping to compute how many paths may be used with
the peer, and to synchronously start the multiple paths. If mprds is
supported, hash outgoing traffic to one of multiple paths in rds_sendmsg()
when multipath RDS is supported by the transport.

CC: Santosh Shilimkar &lt;santosh.shilimkar@oracle.com&gt;
Signed-off-by: Sowmini Varadhan &lt;sowmini.varadhan@oracle.com&gt;
Acked-by: Santosh Shilimkar &lt;santosh.shilimkar@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: Make rds_message_copy_from_user() return 0 on success.</title>
<updated>2015-02-08T06:41:56+00:00</updated>
<author>
<name>Sowmini Varadhan</name>
<email>sowmini.varadhan@oracle.com</email>
</author>
<published>2015-02-05T22:41:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=d0a47d32724bf0765b8768086ef1a7a6d074a7a0'/>
<id>d0a47d32724bf0765b8768086ef1a7a6d074a7a0</id>
<content type='text'>
Commit 083735f4b01b ("rds: switch rds_message_copy_from_user() to iov_iter")
breaks rds_message_copy_from_user() semantics on success, and causes it
to return nbytes copied, when it should return 0.  This commit fixes that bug.

Signed-off-by: Sowmini Varadhan &lt;sowmini.varadhan@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit 083735f4b01b ("rds: switch rds_message_copy_from_user() to iov_iter")
breaks rds_message_copy_from_user() semantics on success, and causes it
to return nbytes copied, when it should return 0.  This commit fixes that bug.

Signed-off-by: Sowmini Varadhan &lt;sowmini.varadhan@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: Fix min() warning in rds_message_inc_copy_to_user()</title>
<updated>2014-12-15T16:49:09+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert@linux-m68k.org</email>
</author>
<published>2014-12-15T12:21:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=6ff4a8ad4b6eae5171754fb60418bc81834aa09b'/>
<id>6ff4a8ad4b6eae5171754fb60418bc81834aa09b</id>
<content type='text'>
net/rds/message.c: In function ‘rds_message_inc_copy_to_user’:
net/rds/message.c:328: warning: comparison of distinct pointer types lacks a cast

Use min_t(unsigned long, ...) like is done in
rds_message_copy_from_user().

Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
net/rds/message.c: In function ‘rds_message_inc_copy_to_user’:
net/rds/message.c:328: warning: comparison of distinct pointer types lacks a cast

Use min_t(unsigned long, ...) like is done in
rds_message_copy_from_user().

Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: switch rds_message_copy_from_user() to iov_iter</title>
<updated>2014-11-24T10:16:43+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2014-11-20T14:31:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=083735f4b01b703184c0e11c2e384b2c60a8aea4'/>
<id>083735f4b01b703184c0e11c2e384b2c60a8aea4</id>
<content type='text'>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: switch -&gt;inc_copy_to_user() to passing iov_iter</title>
<updated>2014-11-24T10:16:43+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2014-11-20T14:21:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=c310e72c89926e06138e4881f21e4c8da3e7ef18'/>
<id>c310e72c89926e06138e4881f21e4c8da3e7ef18</id>
<content type='text'>
instances get considerably simpler from that...

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
instances get considerably simpler from that...

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: simplify a warning message</title>
<updated>2013-03-04T19:12:07+00:00</updated>
<author>
<name>Cong Wang</name>
<email>amwang@redhat.com</email>
</author>
<published>2013-03-03T20:57:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=7dac1b514a00817ddb43704068c14ffd8b8fba19'/>
<id>7dac1b514a00817ddb43704068c14ffd8b8fba19</id>
<content type='text'>
Cc: David S. Miller &lt;davem@davemloft.net&gt;
Cc: Venkat Venkatsubra &lt;venkat.x.venkatsubra@oracle.com&gt;
Signed-off-by: Cong Wang &lt;amwang@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Cc: David S. Miller &lt;davem@davemloft.net&gt;
Cc: Venkat Venkatsubra &lt;venkat.x.venkatsubra@oracle.com&gt;
Signed-off-by: Cong Wang &lt;amwang@redhat.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: limit the size allocated by rds_message_alloc()</title>
<updated>2013-03-04T19:12:06+00:00</updated>
<author>
<name>Cong Wang</name>
<email>amwang@redhat.com</email>
</author>
<published>2013-03-03T16:18:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=ece6b0a2b25652d684a7ced4ae680a863af041e0'/>
<id>ece6b0a2b25652d684a7ced4ae680a863af041e0</id>
<content type='text'>
Dave Jones reported the following bug:

"When fed mangled socket data, rds will trust what userspace gives it,
and tries to allocate enormous amounts of memory larger than what
kmalloc can satisfy."

WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()
Hardware name: GA-MA78GM-S2H
Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s
Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65
Call Trace:
 [&lt;ffffffff81044155&gt;] warn_slowpath_common+0x75/0xa0
 [&lt;ffffffff8104419a&gt;] warn_slowpath_null+0x1a/0x20
 [&lt;ffffffff811444ad&gt;] __alloc_pages_nodemask+0xa0d/0xbe0
 [&lt;ffffffff8100a196&gt;] ? native_sched_clock+0x26/0x90
 [&lt;ffffffff810b2128&gt;] ? trace_hardirqs_off_caller+0x28/0xc0
 [&lt;ffffffff810b21cd&gt;] ? trace_hardirqs_off+0xd/0x10
 [&lt;ffffffff811861f8&gt;] alloc_pages_current+0xb8/0x180
 [&lt;ffffffff8113eaaa&gt;] __get_free_pages+0x2a/0x80
 [&lt;ffffffff811934fe&gt;] kmalloc_order_trace+0x3e/0x1a0
 [&lt;ffffffff81193955&gt;] __kmalloc+0x2f5/0x3a0
 [&lt;ffffffff8104df0c&gt;] ? local_bh_enable_ip+0x7c/0xf0
 [&lt;ffffffffa0401ab3&gt;] rds_message_alloc+0x23/0xb0 [rds]
 [&lt;ffffffffa04043a1&gt;] rds_sendmsg+0x2b1/0x990 [rds]
 [&lt;ffffffff810b21cd&gt;] ? trace_hardirqs_off+0xd/0x10
 [&lt;ffffffff81564620&gt;] sock_sendmsg+0xb0/0xe0
 [&lt;ffffffff810b2052&gt;] ? get_lock_stats+0x22/0x70
 [&lt;ffffffff810b24be&gt;] ? put_lock_stats.isra.23+0xe/0x40
 [&lt;ffffffff81567f30&gt;] sys_sendto+0x130/0x180
 [&lt;ffffffff810b872d&gt;] ? trace_hardirqs_on+0xd/0x10
 [&lt;ffffffff816c547b&gt;] ? _raw_spin_unlock_irq+0x3b/0x60
 [&lt;ffffffff816cd767&gt;] ? sysret_check+0x1b/0x56
 [&lt;ffffffff810b8695&gt;] ? trace_hardirqs_on_caller+0x115/0x1a0
 [&lt;ffffffff81341d8e&gt;] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [&lt;ffffffff816cd742&gt;] system_call_fastpath+0x16/0x1b
---[ end trace eed6ae990d018c8b ]---

Reported-by: Dave Jones &lt;davej@redhat.com&gt;
Cc: Dave Jones &lt;davej@redhat.com&gt;
Cc: David S. Miller &lt;davem@davemloft.net&gt;
Cc: Venkat Venkatsubra &lt;venkat.x.venkatsubra@oracle.com&gt;
Signed-off-by: Cong Wang &lt;amwang@redhat.com&gt;
Acked-by: Venkat Venkatsubra &lt;venkat.x.venkatsubra@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Dave Jones reported the following bug:

"When fed mangled socket data, rds will trust what userspace gives it,
and tries to allocate enormous amounts of memory larger than what
kmalloc can satisfy."

WARNING: at mm/page_alloc.c:2393 __alloc_pages_nodemask+0xa0d/0xbe0()
Hardware name: GA-MA78GM-S2H
Modules linked in: vmw_vsock_vmci_transport vmw_vmci vsock fuse bnep dlci bridge 8021q garp stp mrp binfmt_misc l2tp_ppp l2tp_core rfcomm s
Pid: 24652, comm: trinity-child2 Not tainted 3.8.0+ #65
Call Trace:
 [&lt;ffffffff81044155&gt;] warn_slowpath_common+0x75/0xa0
 [&lt;ffffffff8104419a&gt;] warn_slowpath_null+0x1a/0x20
 [&lt;ffffffff811444ad&gt;] __alloc_pages_nodemask+0xa0d/0xbe0
 [&lt;ffffffff8100a196&gt;] ? native_sched_clock+0x26/0x90
 [&lt;ffffffff810b2128&gt;] ? trace_hardirqs_off_caller+0x28/0xc0
 [&lt;ffffffff810b21cd&gt;] ? trace_hardirqs_off+0xd/0x10
 [&lt;ffffffff811861f8&gt;] alloc_pages_current+0xb8/0x180
 [&lt;ffffffff8113eaaa&gt;] __get_free_pages+0x2a/0x80
 [&lt;ffffffff811934fe&gt;] kmalloc_order_trace+0x3e/0x1a0
 [&lt;ffffffff81193955&gt;] __kmalloc+0x2f5/0x3a0
 [&lt;ffffffff8104df0c&gt;] ? local_bh_enable_ip+0x7c/0xf0
 [&lt;ffffffffa0401ab3&gt;] rds_message_alloc+0x23/0xb0 [rds]
 [&lt;ffffffffa04043a1&gt;] rds_sendmsg+0x2b1/0x990 [rds]
 [&lt;ffffffff810b21cd&gt;] ? trace_hardirqs_off+0xd/0x10
 [&lt;ffffffff81564620&gt;] sock_sendmsg+0xb0/0xe0
 [&lt;ffffffff810b2052&gt;] ? get_lock_stats+0x22/0x70
 [&lt;ffffffff810b24be&gt;] ? put_lock_stats.isra.23+0xe/0x40
 [&lt;ffffffff81567f30&gt;] sys_sendto+0x130/0x180
 [&lt;ffffffff810b872d&gt;] ? trace_hardirqs_on+0xd/0x10
 [&lt;ffffffff816c547b&gt;] ? _raw_spin_unlock_irq+0x3b/0x60
 [&lt;ffffffff816cd767&gt;] ? sysret_check+0x1b/0x56
 [&lt;ffffffff810b8695&gt;] ? trace_hardirqs_on_caller+0x115/0x1a0
 [&lt;ffffffff81341d8e&gt;] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [&lt;ffffffff816cd742&gt;] system_call_fastpath+0x16/0x1b
---[ end trace eed6ae990d018c8b ]---

Reported-by: Dave Jones &lt;davej@redhat.com&gt;
Cc: Dave Jones &lt;davej@redhat.com&gt;
Cc: David S. Miller &lt;davem@davemloft.net&gt;
Cc: Venkat Venkatsubra &lt;venkat.x.venkatsubra@oracle.com&gt;
Signed-off-by: Cong Wang &lt;amwang@redhat.com&gt;
Acked-by: Venkat Venkatsubra &lt;venkat.x.venkatsubra@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules</title>
<updated>2011-10-31T23:30:30+00:00</updated>
<author>
<name>Paul Gortmaker</name>
<email>paul.gortmaker@windriver.com</email>
</author>
<published>2011-07-15T15:47:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=bc3b2d7fb9b014d75ebb79ba371a763dbab5e8cf'/>
<id>bc3b2d7fb9b014d75ebb79ba371a763dbab5e8cf</id>
<content type='text'>
These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

Signed-off-by: Paul Gortmaker &lt;paul.gortmaker@windriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

Signed-off-by: Paul Gortmaker &lt;paul.gortmaker@windriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: Fix rds message leak in rds_message_map_pages</title>
<updated>2010-11-08T20:17:09+00:00</updated>
<author>
<name>Pavel Emelyanov</name>
<email>xemul@parallels.com</email>
</author>
<published>2010-11-08T06:20:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=aa58163a76a3aef33c7220931543d45d0fe43753'/>
<id>aa58163a76a3aef33c7220931543d45d0fe43753</id>
<content type='text'>
The sgs allocation error path leaks the allocated message.

Signed-off-by: Pavel Emelyanov &lt;xemul@openvz.org&gt;
Acked-by: Andy Grover &lt;andy.grover@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The sgs allocation error path leaks the allocated message.

Signed-off-by: Pavel Emelyanov &lt;xemul@openvz.org&gt;
Acked-by: Andy Grover &lt;andy.grover@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>RDS: Let rds_message_alloc_sgs() return NULL</title>
<updated>2010-10-30T23:34:18+00:00</updated>
<author>
<name>Andy Grover</name>
<email>andy.grover@oracle.com</email>
</author>
<published>2010-10-28T15:40:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=d139ff0907dac9ef72fb2cf301e345bac3aec42f'/>
<id>d139ff0907dac9ef72fb2cf301e345bac3aec42f</id>
<content type='text'>
Even with the previous fix, we still are reading the iovecs once
to determine SGs needed, and then again later on. Preallocating
space for sg lists as part of rds_message seemed like a good idea
but it might be better to not do this. While working to redo that
code, this patch attempts to protect against userspace rewriting
the rds_iovec array between the first and second accesses.

The consequences of this would be either a too-small or too-large
sg list array. Too large is not an issue. This patch changes all
callers of message_alloc_sgs to handle running out of preallocated
sgs, and fail gracefully.

Signed-off-by: Andy Grover &lt;andy.grover@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Even with the previous fix, we still are reading the iovecs once
to determine SGs needed, and then again later on. Preallocating
space for sg lists as part of rds_message seemed like a good idea
but it might be better to not do this. While working to redo that
code, this patch attempts to protect against userspace rewriting
the rds_iovec array between the first and second accesses.

The consequences of this would be either a too-small or too-large
sg list array. Too large is not an issue. This patch changes all
callers of message_alloc_sgs to handle running out of preallocated
sgs, and fail gracefully.

Signed-off-by: Andy Grover &lt;andy.grover@oracle.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
