Skip to content

Commit 7c4a945

Browse files
committed
Merge tag 'block-5.17-2022-02-04' of git://git.kernel.dk/linux-block
Pull block fixes from Jens Axboe: - NVMe pull request - fix use-after-free in rdma and tcp controller reset (Sagi Grimberg) - fix the state check in nvmf_ctlr_matches_baseopts (Uday Shankar) - MD nowait null pointer fix (Song) - blk-integrity seed advance fix (Martin) - Fix a dio regression in this merge window (Ilya) * tag 'block-5.17-2022-02-04' of git://git.kernel.dk/linux-block: block: bio-integrity: Advance seed correctly for larger interval sizes nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() md: fix NULL pointer deref with nowait but no mddev->queue block: fix DIO handling regressions in blkdev_read_iter() nvme-rdma: fix possible use-after-free in transport error_recovery work nvme-tcp: fix possible use-after-free in transport error_recovery work nvme: fix a possible use-after-free in controller reset during load
2 parents 494a2c2 + b13e0c7 commit 7c4a945

File tree

7 files changed

+35
-20
lines changed

7 files changed

+35
-20
lines changed

block/bio-integrity.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,7 @@ void bio_integrity_advance(struct bio *bio, unsigned int bytes_done)
373373
struct blk_integrity *bi = blk_get_integrity(bio->bi_bdev->bd_disk);
374374
unsigned bytes = bio_integrity_bytes(bi, bytes_done >> 9);
375375

376-
bip->bip_iter.bi_sector += bytes_done >> 9;
376+
bip->bip_iter.bi_sector += bio_integrity_intervals(bi, bytes_done >> 9);
377377
bvec_iter_advance(bip->bip_vec, &bip->bip_iter, bytes);
378378
}
379379

block/fops.c

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -566,34 +566,37 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
566566
{
567567
struct block_device *bdev = iocb->ki_filp->private_data;
568568
loff_t size = bdev_nr_bytes(bdev);
569-
size_t count = iov_iter_count(to);
570569
loff_t pos = iocb->ki_pos;
571570
size_t shorted = 0;
572571
ssize_t ret = 0;
572+
size_t count;
573573

574-
if (unlikely(pos + count > size)) {
574+
if (unlikely(pos + iov_iter_count(to) > size)) {
575575
if (pos >= size)
576576
return 0;
577577
size -= pos;
578-
if (count > size) {
579-
shorted = count - size;
580-
iov_iter_truncate(to, size);
581-
}
578+
shorted = iov_iter_count(to) - size;
579+
iov_iter_truncate(to, size);
582580
}
583581

582+
count = iov_iter_count(to);
583+
if (!count)
584+
goto reexpand; /* skip atime */
585+
584586
if (iocb->ki_flags & IOCB_DIRECT) {
585587
struct address_space *mapping = iocb->ki_filp->f_mapping;
586588

587589
if (iocb->ki_flags & IOCB_NOWAIT) {
588-
if (filemap_range_needs_writeback(mapping, iocb->ki_pos,
589-
iocb->ki_pos + count - 1))
590-
return -EAGAIN;
590+
if (filemap_range_needs_writeback(mapping, pos,
591+
pos + count - 1)) {
592+
ret = -EAGAIN;
593+
goto reexpand;
594+
}
591595
} else {
592-
ret = filemap_write_and_wait_range(mapping,
593-
iocb->ki_pos,
594-
iocb->ki_pos + count - 1);
596+
ret = filemap_write_and_wait_range(mapping, pos,
597+
pos + count - 1);
595598
if (ret < 0)
596-
return ret;
599+
goto reexpand;
597600
}
598601

599602
file_accessed(iocb->ki_filp);
@@ -603,12 +606,14 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
603606
iocb->ki_pos += ret;
604607
count -= ret;
605608
}
609+
iov_iter_revert(to, count - iov_iter_count(to));
606610
if (ret < 0 || !count)
607-
return ret;
611+
goto reexpand;
608612
}
609613

610614
ret = filemap_read(iocb, to, ret);
611615

616+
reexpand:
612617
if (unlikely(shorted))
613618
iov_iter_reexpand(to, iov_iter_count(to) + shorted);
614619
return ret;

drivers/md/md.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5869,10 +5869,6 @@ int md_run(struct mddev *mddev)
58695869
nowait = nowait && blk_queue_nowait(bdev_get_queue(rdev->bdev));
58705870
}
58715871

5872-
/* Set the NOWAIT flags if all underlying devices support it */
5873-
if (nowait)
5874-
blk_queue_flag_set(QUEUE_FLAG_NOWAIT, mddev->queue);
5875-
58765872
if (!bioset_initialized(&mddev->bio_set)) {
58775873
err = bioset_init(&mddev->bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
58785874
if (err)
@@ -6010,6 +6006,10 @@ int md_run(struct mddev *mddev)
60106006
else
60116007
blk_queue_flag_clear(QUEUE_FLAG_NONROT, mddev->queue);
60126008
blk_queue_flag_set(QUEUE_FLAG_IO_STAT, mddev->queue);
6009+
6010+
/* Set the NOWAIT flags if all underlying devices support it */
6011+
if (nowait)
6012+
blk_queue_flag_set(QUEUE_FLAG_NOWAIT, mddev->queue);
60136013
}
60146014
if (pers->sync_request) {
60156015
if (mddev->kobj.sd &&

drivers/nvme/host/core.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4253,7 +4253,14 @@ static void nvme_async_event_work(struct work_struct *work)
42534253
container_of(work, struct nvme_ctrl, async_event_work);
42544254

42554255
nvme_aen_uevent(ctrl);
4256-
ctrl->ops->submit_async_event(ctrl);
4256+
4257+
/*
4258+
* The transport drivers must guarantee AER submission here is safe by
4259+
* flushing ctrl async_event_work after changing the controller state
4260+
* from LIVE and before freeing the admin queue.
4261+
*/
4262+
if (ctrl->state == NVME_CTRL_LIVE)
4263+
ctrl->ops->submit_async_event(ctrl);
42574264
}
42584265

42594266
static bool nvme_ctrl_pp_status(struct nvme_ctrl *ctrl)

drivers/nvme/host/fabrics.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ nvmf_ctlr_matches_baseopts(struct nvme_ctrl *ctrl,
170170
struct nvmf_ctrl_options *opts)
171171
{
172172
if (ctrl->state == NVME_CTRL_DELETING ||
173+
ctrl->state == NVME_CTRL_DELETING_NOIO ||
173174
ctrl->state == NVME_CTRL_DEAD ||
174175
strcmp(opts->subsysnqn, ctrl->opts->subsysnqn) ||
175176
strcmp(opts->host->nqn, ctrl->opts->host->nqn) ||

drivers/nvme/host/rdma.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1200,6 +1200,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
12001200
struct nvme_rdma_ctrl, err_work);
12011201

12021202
nvme_stop_keep_alive(&ctrl->ctrl);
1203+
flush_work(&ctrl->ctrl.async_event_work);
12031204
nvme_rdma_teardown_io_queues(ctrl, false);
12041205
nvme_start_queues(&ctrl->ctrl);
12051206
nvme_rdma_teardown_admin_queue(ctrl, false);

drivers/nvme/host/tcp.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2096,6 +2096,7 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work)
20962096
struct nvme_ctrl *ctrl = &tcp_ctrl->ctrl;
20972097

20982098
nvme_stop_keep_alive(ctrl);
2099+
flush_work(&ctrl->async_event_work);
20992100
nvme_tcp_teardown_io_queues(ctrl, false);
21002101
/* unquiesce to fail fast pending requests */
21012102
nvme_start_queues(ctrl);

0 commit comments

Comments
 (0)