From pirkko-liisa.iivari at omnia.fi  Tue Feb  1 19:28:47 2011
From: pirkko-liisa.iivari at omnia.fi (pirkko-liisa.iivari at omnia.fi)
Date: Wed, 2 Feb 2011 01:28:47 +0100
Subject: Hi
Message-ID: <01cbc270.787c2280@localhost>



http://hudoctor.com

 
Sincerely Your, Eimear Dunkerk.


From anton at au1.ibm.com  Mon Feb 14 23:38:56 2011
From: anton at au1.ibm.com (Anton Blanchard)
Date: Tue, 15 Feb 2011 15:38:56 +1100
Subject: RxRPC: Fix v1 keys
Message-ID: <20110215153856.10e19fbf@kryten>


commit 339412841d7 (RxRPC: Allow key payloads to be passed in XDR form)
broke klog for me. I notice the v1 key struct had a kif_version field
added:

-struct rxkad_key {
-       u16     security_index;         /* RxRPC header security index */
-       u16     ticket_len;             /* length of ticket[] */
-       u32     expiry;                 /* time at which expires */
-       u32     kvno;                   /* key version number */
-       u8      session_key[8];         /* DES session key */
-       u8      ticket[0];              /* the encrypted ticket */
-};

+struct rxrpc_key_data_v1 {
+       u32             kif_version;            /* 1 */
+       u16             security_index;
+       u16             ticket_length;
+       u32             expiry;                 /* time_t */
+       u32             kvno;
+       u8              session_key[8];
+       u8              ticket[0];
+};

However the code in rxrpc_instantiate strips it away:

	data += sizeof(kver);
	datalen -= sizeof(kver);

Removing kif_version fixes my problem.

Signed-off-by: Anton Blanchard <anton at samba.org>
---

Index: linux-2.6/include/keys/rxrpc-type.h
===================================================================
--- linux-2.6.orig/include/keys/rxrpc-type.h	2011-02-14 12:12:21.874546332 +1100
+++ linux-2.6/include/keys/rxrpc-type.h	2011-02-14 12:12:26.615010317 +1100
@@ -99,7 +99,6 @@ struct rxrpc_key_token {
  * structure of raw payloads passed to add_key() or instantiate key
  */
 struct rxrpc_key_data_v1 {
-	u32		kif_version;		/* 1 */
 	u16		security_index;
 	u16		ticket_length;
 	u32		expiry;			/* time_t */


From anton at au1.ibm.com  Mon Feb 14 23:42:09 2011
From: anton at au1.ibm.com (Anton Blanchard)
Date: Tue, 15 Feb 2011 15:42:09 +1100
Subject: afs: Fix oops in afs_unlink_writeback
In-Reply-To: <20110215153856.10e19fbf@kryten>
References: <20110215153856.10e19fbf@kryten>
Message-ID: <20110215154209.31471f05@kryten>

To: David Howells <dhowells at redhat.com>
Cc: linux-afs at lists.infradead.org, linux-kernel at vger.kernel.org 
Subject: afs: Fix oops in afs_unlink_writeback

I'm seeing the following oops when testing afs:

Unable to handle kernel paging request for data at address 0x00000008
...
NIP [c0000000003393b0] .afs_unlink_writeback+0x38/0xc0
LR [c00000000033987c] .afs_put_writeback+0x98/0xec
Call Trace:
[c00000000345f600] [c00000000033987c] .afs_put_writeback+0x98/0xec
[c00000000345f690] [c00000000033ae80] .afs_write_begin+0x6a4/0x75c
[c00000000345f790] [c00000000012b77c] .generic_file_buffered_write+0x148/0x320
[c00000000345f8d0] [c00000000012e1b8] .__generic_file_aio_write+0x37c/0x3e4
[c00000000345f9d0] [c00000000012e2a8] .generic_file_aio_write+0x88/0xfc
[c00000000345fa90] [c0000000003390a8] .afs_file_write+0x10c/0x178
[c00000000345fb40] [c000000000188788] .do_sync_write+0xc4/0x128
[c00000000345fcc0] [c000000000189658] .vfs_write+0xe8/0x1d8
[c00000000345fd70] [c000000000189884] .SyS_write+0x68/0xb0
[c00000000345fe30] [c000000000008564] syscall_exit+0x0/0x40

afs_write_begin hits an error and calls afs_unlink_writeback. In there
we do list_del_init on an uninitialised list.

The patch below initialises ->link when creating the afs_writeback struct.

Signed-off-by: Anton Blanchard <anton at samba.org>
---

Index: linux-2.6/fs/afs/write.c
===================================================================
--- linux-2.6.orig/fs/afs/write.c	2011-02-15 08:57:38.941571526 +1100
+++ linux-2.6/fs/afs/write.c	2011-02-15 13:50:34.793404142 +1100
@@ -144,6 +144,7 @@ int afs_write_begin(struct file *file, s
 	candidate->first = candidate->last = index;
 	candidate->offset_first = from;
 	candidate->to_last = to;
+	INIT_LIST_HEAD(&candidate->link);
 	candidate->usage = 1;
 	candidate->state = AFS_WBACK_PENDING;
 	init_waitqueue_head(&candidate->waitq);


From anton at samba.org  Tue Feb 15 01:16:55 2011
From: anton at samba.org (Anton Blanchard)
Date: Tue, 15 Feb 2011 17:16:55 +1100
Subject: RxRPC: Allocate tokens with kzalloc to avoid oops in rxrpc_destroy
Message-ID: <20110215171655.11538899@kryten>


With slab poisoning enabled, I see the following oops:

Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6b73
...
NIP [c0000000006bc61c] .rxrpc_destroy+0x44/0x104
LR [c0000000006bc618] .rxrpc_destroy+0x40/0x104
Call Trace:
[c0000000feb2bc00] [c0000000006bc618] .rxrpc_destroy+0x40/0x104 (unreliable)
[c0000000feb2bc90] [c000000000349b2c] .key_cleanup+0x1a8/0x20c
[c0000000feb2bd40] [c0000000000a2920] .process_one_work+0x2f4/0x4d0
[c0000000feb2be00] [c0000000000a2d50] .worker_thread+0x254/0x468
[c0000000feb2bec0] [c0000000000a868c] .kthread+0xbc/0xc8
[c0000000feb2bf90] [c000000000020e00] .kernel_thread+0x54/0x70

We aren't initialising token->next, but the code in destroy_context relies
on the list being NULL terminated. Use kzalloc to zero out all the fields.

Signed-off-by: Anton Blanchard <anton at samba.org>
---

Index: linux-2.6/net/rxrpc/ar-key.c
===================================================================
--- linux-2.6.orig/net/rxrpc/ar-key.c	2011-02-15 17:06:15.254289163 +1100
+++ linux-2.6/net/rxrpc/ar-key.c	2011-02-15 17:07:37.032349273 +1100
@@ -89,11 +89,11 @@ static int rxrpc_instantiate_xdr_rxkad(s
 		return ret;
 
 	plen -= sizeof(*token);
-	token = kmalloc(sizeof(*token), GFP_KERNEL);
+	token = kzalloc(sizeof(*token), GFP_KERNEL);
 	if (!token)
 		return -ENOMEM;
 
-	token->kad = kmalloc(plen, GFP_KERNEL);
+	token->kad = kzalloc(plen, GFP_KERNEL);
 	if (!token->kad) {
 		kfree(token);
 		return -ENOMEM;
@@ -731,10 +731,10 @@ static int rxrpc_instantiate(struct key
 		goto error;
 
 	ret = -ENOMEM;
-	token = kmalloc(sizeof(*token), GFP_KERNEL);
+	token = kzalloc(sizeof(*token), GFP_KERNEL);
 	if (!token)
 		goto error;
-	token->kad = kmalloc(plen, GFP_KERNEL);
+	token->kad = kzalloc(plen, GFP_KERNEL);
 	if (!token->kad)
 		goto error_free;
 


From dhowells at redhat.com  Fri Feb 25 10:33:02 2011
From: dhowells at redhat.com (David Howells)
Date: Fri, 25 Feb 2011 15:33:02 +0000
Subject: [PATCH] afs: Fix oops in afs_unlink_writeback
Message-ID: <20110225153301.27864.14291.stgit@warthog.procyon.org.uk>

From: Anton Blanchard <anton at au1.ibm.com>

I'm seeing the following oops when testing afs:

Unable to handle kernel paging request for data at address 0x00000008
...
NIP [c0000000003393b0] .afs_unlink_writeback+0x38/0xc0
LR [c00000000033987c] .afs_put_writeback+0x98/0xec
Call Trace:
[c00000000345f600] [c00000000033987c] .afs_put_writeback+0x98/0xec
[c00000000345f690] [c00000000033ae80] .afs_write_begin+0x6a4/0x75c
[c00000000345f790] [c00000000012b77c] .generic_file_buffered_write+0x148/0x320
[c00000000345f8d0] [c00000000012e1b8] .__generic_file_aio_write+0x37c/0x3e4
[c00000000345f9d0] [c00000000012e2a8] .generic_file_aio_write+0x88/0xfc
[c00000000345fa90] [c0000000003390a8] .afs_file_write+0x10c/0x178
[c00000000345fb40] [c000000000188788] .do_sync_write+0xc4/0x128
[c00000000345fcc0] [c000000000189658] .vfs_write+0xe8/0x1d8
[c00000000345fd70] [c000000000189884] .SyS_write+0x68/0xb0
[c00000000345fe30] [c000000000008564] syscall_exit+0x0/0x40

afs_write_begin hits an error and calls afs_unlink_writeback. In there
we do list_del_init on an uninitialised list.

The patch below initialises ->link when creating the afs_writeback struct.

Signed-off-by: Anton Blanchard <anton at samba.org>
Signed-off-by: David Howells <dhowells at redhat.com>
---

 fs/afs/write.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/fs/afs/write.c b/fs/afs/write.c
index 15690bb..789b3af 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -140,6 +140,7 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
 	candidate->first = candidate->last = index;
 	candidate->offset_first = from;
 	candidate->to_last = to;
+	INIT_LIST_HEAD(&candidate->link);
 	candidate->usage = 1;
 	candidate->state = AFS_WBACK_PENDING;
 	init_waitqueue_head(&candidate->waitq);



From dhowells at redhat.com  Fri Feb 25 10:33:17 2011
From: dhowells at redhat.com (David Howells)
Date: Fri, 25 Feb 2011 15:33:17 +0000
Subject: [PATCH] RxRPC: Allocate tokens with kzalloc to avoid oops in
	rxrpc_destroy
Message-ID: <20110225153317.27901.95278.stgit@warthog.procyon.org.uk>

From: Anton Blanchard <anton at samba.org>

With slab poisoning enabled, I see the following oops:

Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6b73
...
NIP [c0000000006bc61c] .rxrpc_destroy+0x44/0x104
LR [c0000000006bc618] .rxrpc_destroy+0x40/0x104
Call Trace:
[c0000000feb2bc00] [c0000000006bc618] .rxrpc_destroy+0x40/0x104 (unreliable)
[c0000000feb2bc90] [c000000000349b2c] .key_cleanup+0x1a8/0x20c
[c0000000feb2bd40] [c0000000000a2920] .process_one_work+0x2f4/0x4d0
[c0000000feb2be00] [c0000000000a2d50] .worker_thread+0x254/0x468
[c0000000feb2bec0] [c0000000000a868c] .kthread+0xbc/0xc8
[c0000000feb2bf90] [c000000000020e00] .kernel_thread+0x54/0x70

We aren't initialising token->next, but the code in destroy_context relies
on the list being NULL terminated. Use kzalloc to zero out all the fields.

Signed-off-by: Anton Blanchard <anton at samba.org>
Signed-off-by: David Howells <dhowells at redhat.com>
---

 net/rxrpc/ar-key.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index aa6afdc..43ea7de 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -108,11 +108,11 @@ static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
 		return ret;
 
 	plen -= sizeof(*token);
-	token = kmalloc(sizeof(*token), GFP_KERNEL);
+	token = kzalloc(sizeof(*token), GFP_KERNEL);
 	if (!token)
 		return -ENOMEM;
 
-	token->kad = kmalloc(plen, GFP_KERNEL);
+	token->kad = kzalloc(plen, GFP_KERNEL);
 	if (!token->kad) {
 		kfree(token);
 		return -ENOMEM;
@@ -750,10 +750,10 @@ static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen)
 		goto error;
 
 	ret = -ENOMEM;
-	token = kmalloc(sizeof(*token), GFP_KERNEL);
+	token = kzalloc(sizeof(*token), GFP_KERNEL);
 	if (!token)
 		goto error;
-	token->kad = kmalloc(plen, GFP_KERNEL);
+	token->kad = kzalloc(plen, GFP_KERNEL);
 	if (!token->kad)
 		goto error_free;
 



From dhowells at redhat.com  Fri Feb 25 10:49:39 2011
From: dhowells at redhat.com (David Howells)
Date: Fri, 25 Feb 2011 15:49:39 +0000
Subject: RxRPC: Fix v1 keys
In-Reply-To: <20110215153856.10e19fbf@kryten>
References: <20110215153856.10e19fbf@kryten>
Message-ID: <28535.1298648979@redhat.com>

Anton Blanchard <anton at au1.ibm.com> wrote:

> commit 339412841d7 (RxRPC: Allow key payloads to be passed in XDR form)
> broke klog for me. I notice the v1 key struct had a kif_version field
> added:

Hmmm...  I published a new version of klog at the same time, so just removing
kif_version will break that:-/

I'll have to come up with a way of detecting which you're doing.  But first, I
need to attempt to resuscitate my OpenAFS server.

David


From dhowells at redhat.com  Mon Feb 28 09:19:35 2011
From: dhowells at redhat.com (David Howells)
Date: Mon, 28 Feb 2011 14:19:35 +0000
Subject: RxRPC: Fix v1 keys
In-Reply-To: <28535.1298648979@redhat.com>
References: <28535.1298648979@redhat.com> <20110215153856.10e19fbf@kryten>
Message-ID: <31510.1298902775@redhat.com>

David Howells <dhowells at redhat.com> wrote:

> Anton Blanchard <anton at au1.ibm.com> wrote:
> 
> > commit 339412841d7 (RxRPC: Allow key payloads to be passed in XDR form)
> > broke klog for me. I notice the v1 key struct had a kif_version field
> > added:
> 
> Hmmm...  I published a new version of klog at the same time, so just removing
> kif_version will break that:-/
> 
> I'll have to come up with a way of detecting which you're doing.  But first,
> I need to attempt to resuscitate my OpenAFS server.

You're right.  Patch signed off and sent on.

David


