Skip to content

Commit 890a2fb

Browse files
axboeaxboe
committed
Merge tag 'nvme-6.3-2022-03-16' of git://git.infradead.org/nvme into block-6.3
Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.3 - avoid potential UAF in nvmet_req_complete (Damien Le Moal) - more quirks (Elmer Miroslav Mosher Golovin, Philipp Geulen) - fix a memory leak in the nvme-pci probe teardown path (Irvin Cote) - repair the MAINTAINERS entry (Lukas Bulwahn) - fix handling single range discard request (Ming Lei) - show more opcode names in trace events (Minwoo Im) - fix nvme-tcp timeout reporting (Sagi Grimberg)" * tag 'nvme-6.3-2022-03-16' of git://git.infradead.org/nvme: nvmet: avoid potential UAF in nvmet_req_complete() nvme-trace: show more opcode names nvme-tcp: add nvme-tcp pdu size build protection nvme-tcp: fix opcode reporting in the timeout handler nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 nvme-pci: fixing memory leak in probe teardown path nvme: fix handling single range discard request MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS
2 parents 23e5b93 + 6173a77 commit 890a2fb

File tree

6 files changed

+63
-20
lines changed

6 files changed

+63
-20
lines changed

‎MAINTAINERS

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14872,12 +14872,12 @@ M: Sagi Grimberg <sagi@grimberg.me>
1487214872
L: linux-nvme@lists.infradead.org
1487314873
S: Supported
1487414874
W: http://git.infradead.org/nvme.git
14875-
T: git://git.infradead.org/nvme.git
14875+
T: git git://git.infradead.org/nvme.git
1487614876
F: Documentation/nvme/
14877-
F: drivers/nvme/host/
1487814877
F: drivers/nvme/common/
14879-
F: include/linux/nvme.h
14878+
F: drivers/nvme/host/
1488014879
F: include/linux/nvme-*.h
14880+
F: include/linux/nvme.h
1488114881
F: include/uapi/linux/nvme_ioctl.h
1488214882

1488314883
NVM EXPRESS FABRICS AUTHENTICATION
@@ -14912,7 +14912,7 @@ M: Chaitanya Kulkarni <kch@nvidia.com>
1491214912
L: linux-nvme@lists.infradead.org
1491314913
S: Supported
1491414914
W: http://git.infradead.org/nvme.git
14915-
T: git://git.infradead.org/nvme.git
14915+
T: git git://git.infradead.org/nvme.git
1491614916
F: drivers/nvme/target/
1491714917

1491814918
NVMEM FRAMEWORK

‎drivers/nvme/host/core.c

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -781,16 +781,26 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
781781
range = page_address(ns->ctrl->discard_page);
782782
}
783783

784-
__rq_for_each_bio(bio, req) {
785-
u64 slba = nvme_sect_to_lba(ns, bio->bi_iter.bi_sector);
786-
u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
787-
788-
if (n < segments) {
789-
range[n].cattr = cpu_to_le32(0);
790-
range[n].nlb = cpu_to_le32(nlb);
791-
range[n].slba = cpu_to_le64(slba);
784+
if (queue_max_discard_segments(req->q) == 1) {
785+
u64 slba = nvme_sect_to_lba(ns, blk_rq_pos(req));
786+
u32 nlb = blk_rq_sectors(req) >> (ns->lba_shift - 9);
787+
788+
range[0].cattr = cpu_to_le32(0);
789+
range[0].nlb = cpu_to_le32(nlb);
790+
range[0].slba = cpu_to_le64(slba);
791+
n = 1;
792+
} else {
793+
__rq_for_each_bio(bio, req) {
794+
u64 slba = nvme_sect_to_lba(ns, bio->bi_iter.bi_sector);
795+
u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift;
796+
797+
if (n < segments) {
798+
range[n].cattr = cpu_to_le32(0);
799+
range[n].nlb = cpu_to_le32(nlb);
800+
range[n].slba = cpu_to_le64(slba);
801+
}
802+
n++;
792803
}
793-
n++;
794804
}
795805

796806
if (WARN_ON_ONCE(n != segments)) {

‎drivers/nvme/host/pci.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3073,6 +3073,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
30733073
nvme_dev_unmap(dev);
30743074
out_uninit_ctrl:
30753075
nvme_uninit_ctrl(&dev->ctrl);
3076+
nvme_put_ctrl(&dev->ctrl);
30763077
return result;
30773078
}
30783079

@@ -3415,6 +3416,8 @@ static const struct pci_device_id nvme_id_table[] = {
34153416
.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
34163417
{ PCI_DEVICE(0x2646, 0x501E), /* KINGSTON OM3PGP4xxxxQ OS21011 NVMe SSD */
34173418
.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
3419+
{ PCI_DEVICE(0x1f40, 0x1202), /* Netac Technologies Co. NV3000 NVMe SSD */
3420+
.driver_data = NVME_QUIRK_BOGUS_NID, },
34183421
{ PCI_DEVICE(0x1f40, 0x5236), /* Netac Technologies Co. NV7000 NVMe SSD */
34193422
.driver_data = NVME_QUIRK_BOGUS_NID, },
34203423
{ PCI_DEVICE(0x1e4B, 0x1001), /* MAXIO MAP1001 */
@@ -3435,6 +3438,8 @@ static const struct pci_device_id nvme_id_table[] = {
34353438
.driver_data = NVME_QUIRK_BOGUS_NID, },
34363439
{ PCI_DEVICE(0x1d97, 0x2263), /* Lexar NM610 */
34373440
.driver_data = NVME_QUIRK_BOGUS_NID, },
3441+
{ PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */
3442+
.driver_data = NVME_QUIRK_BOGUS_NID, },
34383443
{ PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */
34393444
.driver_data = NVME_QUIRK_BOGUS_NID, },
34403445
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),

‎drivers/nvme/host/tcp.c

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,18 @@ static inline u8 nvme_tcp_ddgst_len(struct nvme_tcp_queue *queue)
208208
return queue->data_digest ? NVME_TCP_DIGEST_LENGTH : 0;
209209
}
210210

211+
static inline void *nvme_tcp_req_cmd_pdu(struct nvme_tcp_request *req)
212+
{
213+
return req->pdu;
214+
}
215+
216+
static inline void *nvme_tcp_req_data_pdu(struct nvme_tcp_request *req)
217+
{
218+
/* use the pdu space in the back for the data pdu */
219+
return req->pdu + sizeof(struct nvme_tcp_cmd_pdu) -
220+
sizeof(struct nvme_tcp_data_pdu);
221+
}
222+
211223
static inline size_t nvme_tcp_inline_data_size(struct nvme_tcp_request *req)
212224
{
213225
if (nvme_is_fabrics(req->req.cmd))
@@ -614,7 +626,7 @@ static int nvme_tcp_handle_comp(struct nvme_tcp_queue *queue,
614626

615627
static void nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req)
616628
{
617-
struct nvme_tcp_data_pdu *data = req->pdu;
629+
struct nvme_tcp_data_pdu *data = nvme_tcp_req_data_pdu(req);
618630
struct nvme_tcp_queue *queue = req->queue;
619631
struct request *rq = blk_mq_rq_from_pdu(req);
620632
u32 h2cdata_sent = req->pdu_len;
@@ -1038,7 +1050,7 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
10381050
static int nvme_tcp_try_send_cmd_pdu(struct nvme_tcp_request *req)
10391051
{
10401052
struct nvme_tcp_queue *queue = req->queue;
1041-
struct nvme_tcp_cmd_pdu *pdu = req->pdu;
1053+
struct nvme_tcp_cmd_pdu *pdu = nvme_tcp_req_cmd_pdu(req);
10421054
bool inline_data = nvme_tcp_has_inline_data(req);
10431055
u8 hdgst = nvme_tcp_hdgst_len(queue);
10441056
int len = sizeof(*pdu) + hdgst - req->offset;
@@ -1077,7 +1089,7 @@ static int nvme_tcp_try_send_cmd_pdu(struct nvme_tcp_request *req)
10771089
static int nvme_tcp_try_send_data_pdu(struct nvme_tcp_request *req)
10781090
{
10791091
struct nvme_tcp_queue *queue = req->queue;
1080-
struct nvme_tcp_data_pdu *pdu = req->pdu;
1092+
struct nvme_tcp_data_pdu *pdu = nvme_tcp_req_data_pdu(req);
10811093
u8 hdgst = nvme_tcp_hdgst_len(queue);
10821094
int len = sizeof(*pdu) - req->offset + hdgst;
10831095
int ret;
@@ -2284,7 +2296,7 @@ static enum blk_eh_timer_return nvme_tcp_timeout(struct request *rq)
22842296
{
22852297
struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
22862298
struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
2287-
struct nvme_tcp_cmd_pdu *pdu = req->pdu;
2299+
struct nvme_tcp_cmd_pdu *pdu = nvme_tcp_req_cmd_pdu(req);
22882300
u8 opc = pdu->cmd.common.opcode, fctype = pdu->cmd.fabrics.fctype;
22892301
int qid = nvme_tcp_queue_id(req->queue);
22902302

@@ -2323,7 +2335,7 @@ static blk_status_t nvme_tcp_map_data(struct nvme_tcp_queue *queue,
23232335
struct request *rq)
23242336
{
23252337
struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
2326-
struct nvme_tcp_cmd_pdu *pdu = req->pdu;
2338+
struct nvme_tcp_cmd_pdu *pdu = nvme_tcp_req_cmd_pdu(req);
23272339
struct nvme_command *c = &pdu->cmd;
23282340

23292341
c->common.flags |= NVME_CMD_SGL_METABUF;
@@ -2343,7 +2355,7 @@ static blk_status_t nvme_tcp_setup_cmd_pdu(struct nvme_ns *ns,
23432355
struct request *rq)
23442356
{
23452357
struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
2346-
struct nvme_tcp_cmd_pdu *pdu = req->pdu;
2358+
struct nvme_tcp_cmd_pdu *pdu = nvme_tcp_req_cmd_pdu(req);
23472359
struct nvme_tcp_queue *queue = req->queue;
23482360
u8 hdgst = nvme_tcp_hdgst_len(queue), ddgst = 0;
23492361
blk_status_t ret;
@@ -2682,6 +2694,15 @@ static struct nvmf_transport_ops nvme_tcp_transport = {
26822694

26832695
static int __init nvme_tcp_init_module(void)
26842696
{
2697+
BUILD_BUG_ON(sizeof(struct nvme_tcp_hdr) != 8);
2698+
BUILD_BUG_ON(sizeof(struct nvme_tcp_cmd_pdu) != 72);
2699+
BUILD_BUG_ON(sizeof(struct nvme_tcp_data_pdu) != 24);
2700+
BUILD_BUG_ON(sizeof(struct nvme_tcp_rsp_pdu) != 24);
2701+
BUILD_BUG_ON(sizeof(struct nvme_tcp_r2t_pdu) != 24);
2702+
BUILD_BUG_ON(sizeof(struct nvme_tcp_icreq_pdu) != 128);
2703+
BUILD_BUG_ON(sizeof(struct nvme_tcp_icresp_pdu) != 128);
2704+
BUILD_BUG_ON(sizeof(struct nvme_tcp_term_pdu) != 24);
2705+
26852706
nvme_tcp_wq = alloc_workqueue("nvme_tcp_wq",
26862707
WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
26872708
if (!nvme_tcp_wq)

‎drivers/nvme/target/core.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -756,8 +756,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
756756

757757
void nvmet_req_complete(struct nvmet_req *req, u16 status)
758758
{
759+
struct nvmet_sq *sq = req->sq;
760+
759761
__nvmet_req_complete(req, status);
760-
percpu_ref_put(&req->sq->ref);
762+
percpu_ref_put(&sq->ref);
761763
}
762764
EXPORT_SYMBOL_GPL(nvmet_req_complete);
763765

‎include/linux/nvme.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -812,6 +812,7 @@ enum nvme_opcode {
812812
nvme_opcode_name(nvme_cmd_compare), \
813813
nvme_opcode_name(nvme_cmd_write_zeroes), \
814814
nvme_opcode_name(nvme_cmd_dsm), \
815+
nvme_opcode_name(nvme_cmd_verify), \
815816
nvme_opcode_name(nvme_cmd_resv_register), \
816817
nvme_opcode_name(nvme_cmd_resv_report), \
817818
nvme_opcode_name(nvme_cmd_resv_acquire), \
@@ -1144,10 +1145,14 @@ enum nvme_admin_opcode {
11441145
nvme_admin_opcode_name(nvme_admin_ns_mgmt), \
11451146
nvme_admin_opcode_name(nvme_admin_activate_fw), \
11461147
nvme_admin_opcode_name(nvme_admin_download_fw), \
1148+
nvme_admin_opcode_name(nvme_admin_dev_self_test), \
11471149
nvme_admin_opcode_name(nvme_admin_ns_attach), \
11481150
nvme_admin_opcode_name(nvme_admin_keep_alive), \
11491151
nvme_admin_opcode_name(nvme_admin_directive_send), \
11501152
nvme_admin_opcode_name(nvme_admin_directive_recv), \
1153+
nvme_admin_opcode_name(nvme_admin_virtual_mgmt), \
1154+
nvme_admin_opcode_name(nvme_admin_nvme_mi_send), \
1155+
nvme_admin_opcode_name(nvme_admin_nvme_mi_recv), \
11511156
nvme_admin_opcode_name(nvme_admin_dbbuf), \
11521157
nvme_admin_opcode_name(nvme_admin_format_nvm), \
11531158
nvme_admin_opcode_name(nvme_admin_security_send), \

0 commit comments

Comments
 (0)