Skip to content

Commit 8d3c682

Browse files
torvaldstorvalds
committed
Merge tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe: "A bit bigger than usual, as the NVMe pull request missed last weeks submission. In detail: - NVMe pull request via Christoph: - Avoid potential UAF in nvmet_req_complete (Damien Le Moal) - More quirks (Elmer Miroslav Mosher Golovin, Philipp Geulen) - Fix a memory leak in the nvme-pci probe teardown path (Irvin Cote) - Repair the MAINTAINERS entry (Lukas Bulwahn) - Fix handling single range discard request (Ming Lei) - Show more opcode names in trace events (Minwoo Im) - Fix nvme-tcp timeout reporting (Sagi Grimberg) - MD pull request via Song: - Two fixes for old issues (Neil) - Resource leak in device stopping (Xiao) - Bio based device stats fix (Yu) - Kill unused CONFIG_BLOCK_COMPAT (Lukas) - sunvdc missing mdesc_grab() failure check (Liang) - Fix for reversal of request ordering upon issue for certain cases (Jan) - null_blk timeout fixes (Damien) - Loop use-after-free fix (Bart) - blk-mq SRCU fix for BLK_MQ_F_BLOCKING devices (Chris)" * tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linux: block: remove obsolete config BLOCK_COMPAT md: select BLOCK_LEGACY_AUTOLOAD block: count 'ios' and 'sectors' when io is done for bio-based device block: sunvdc: add check for mdesc_grab() returning NULL nvmet: avoid potential UAF in nvmet_req_complete() nvme-trace: show more opcode names nvme-tcp: add nvme-tcp pdu size build protection nvme-tcp: fix opcode reporting in the timeout handler nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 nvme-pci: fixing memory leak in probe teardown path nvme: fix handling single range discard request MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS block: null_blk: cleanup null_queue_rq() block: null_blk: Fix handling of fake timeout request blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops loop: Fix use-after-free issues block: do not reverse request order when flushing plug list md: avoid signed overflow in slot_store() md: Free resources in __md_stop
2 parents b7966a5 + 8f0d196 commit 8d3c682

File tree

19 files changed

+136
-80
lines changed

19 files changed

+136
-80
lines changed

‎MAINTAINERS

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14872,12 +14872,12 @@ M: Sagi Grimberg <sagi@grimberg.me>
1487214872
L: linux-nvme@lists.infradead.org
1487314873
S: Supported
1487414874
W: http://git.infradead.org/nvme.git
14875-
T: git://git.infradead.org/nvme.git
14875+
T: git git://git.infradead.org/nvme.git
1487614876
F: Documentation/nvme/
14877-
F: drivers/nvme/host/
1487814877
F: drivers/nvme/common/
14879-
F: include/linux/nvme.h
14878+
F: drivers/nvme/host/
1488014879
F: include/linux/nvme-*.h
14880+
F: include/linux/nvme.h
1488114881
F: include/uapi/linux/nvme_ioctl.h
1488214882

1488314883
NVM EXPRESS FABRICS AUTHENTICATION
@@ -14912,7 +14912,7 @@ M: Chaitanya Kulkarni <kch@nvidia.com>
1491214912
L: linux-nvme@lists.infradead.org
1491314913
S: Supported
1491414914
W: http://git.infradead.org/nvme.git
14915-
T: git://git.infradead.org/nvme.git
14915+
T: git git://git.infradead.org/nvme.git
1491614916
F: drivers/nvme/target/
1491714917

1491814918
NVMEM FRAMEWORK

‎block/Kconfig

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -204,9 +204,6 @@ config BLK_INLINE_ENCRYPTION_FALLBACK
204204

205205
source "block/partitions/Kconfig"
206206

207-
config BLOCK_COMPAT
208-
def_bool COMPAT
209-
210207
config BLK_MQ_PCI
211208
def_bool PCI
212209

‎block/blk-core.c

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -959,16 +959,11 @@ void update_io_ticks(struct block_device *part, unsigned long now, bool end)
959959
}
960960
}
961961

962-
unsigned long bdev_start_io_acct(struct block_device *bdev,
963-
unsigned int sectors, enum req_op op,
962+
unsigned long bdev_start_io_acct(struct block_device *bdev, enum req_op op,
964963
unsigned long start_time)
965964
{
966-
const int sgrp = op_stat_group(op);
967-
968965
part_stat_lock();
969966
update_io_ticks(bdev, start_time, false);
970-
part_stat_inc(bdev, ios[sgrp]);
971-
part_stat_add(bdev, sectors[sgrp], sectors);
972967
part_stat_local_inc(bdev, in_flight[op_is_write(op)]);
973968
part_stat_unlock();
974969

@@ -984,20 +979,21 @@ EXPORT_SYMBOL(bdev_start_io_acct);
984979
*/
985980
unsigned long bio_start_io_acct(struct bio *bio)
986981
{
987-
return bdev_start_io_acct(bio->bi_bdev, bio_sectors(bio),
988-
bio_op(bio), jiffies);
982+
return bdev_start_io_acct(bio->bi_bdev, bio_op(bio), jiffies);
989983
}
990984
EXPORT_SYMBOL_GPL(bio_start_io_acct);
991985

992986
void bdev_end_io_acct(struct block_device *bdev, enum req_op op,
993-
unsigned long start_time)
987+
unsigned int sectors, unsigned long start_time)
994988
{
995989
const int sgrp = op_stat_group(op);
996990
unsigned long now = READ_ONCE(jiffies);
997991
unsigned long duration = now - start_time;
998992

999993
part_stat_lock();
1000994
update_io_ticks(bdev, now, true);
995+
part_stat_inc(bdev, ios[sgrp]);
996+
part_stat_add(bdev, sectors[sgrp], sectors);
1001997
part_stat_add(bdev, nsecs[sgrp], jiffies_to_nsecs(duration));
1002998
part_stat_local_dec(bdev, in_flight[op_is_write(op)]);
1003999
part_stat_unlock();
@@ -1007,7 +1003,7 @@ EXPORT_SYMBOL(bdev_end_io_acct);
10071003
void bio_end_io_acct_remapped(struct bio *bio, unsigned long start_time,
10081004
struct block_device *orig_bdev)
10091005
{
1010-
bdev_end_io_acct(orig_bdev, bio_op(bio), start_time);
1006+
bdev_end_io_acct(orig_bdev, bio_op(bio), bio_sectors(bio), start_time);
10111007
}
10121008
EXPORT_SYMBOL_GPL(bio_end_io_acct_remapped);
10131009

‎block/blk-mq.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2725,6 +2725,7 @@ static void blk_mq_dispatch_plug_list(struct blk_plug *plug, bool from_sched)
27252725
struct blk_mq_hw_ctx *this_hctx = NULL;
27262726
struct blk_mq_ctx *this_ctx = NULL;
27272727
struct request *requeue_list = NULL;
2728+
struct request **requeue_lastp = &requeue_list;
27282729
unsigned int depth = 0;
27292730
LIST_HEAD(list);
27302731

@@ -2735,10 +2736,10 @@ static void blk_mq_dispatch_plug_list(struct blk_plug *plug, bool from_sched)
27352736
this_hctx = rq->mq_hctx;
27362737
this_ctx = rq->mq_ctx;
27372738
} else if (this_hctx != rq->mq_hctx || this_ctx != rq->mq_ctx) {
2738-
rq_list_add(&requeue_list, rq);
2739+
rq_list_add_tail(&requeue_lastp, rq);
27392740
continue;
27402741
}
2741-
list_add_tail(&rq->queuelist, &list);
2742+
list_add(&rq->queuelist, &list);
27422743
depth++;
27432744
} while (!rq_list_empty(plug->mq_list));
27442745

‎block/blk-mq.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -378,12 +378,13 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,
378378
#define __blk_mq_run_dispatch_ops(q, check_sleep, dispatch_ops) \
379379
do { \
380380
if ((q)->tag_set->flags & BLK_MQ_F_BLOCKING) { \
381+
struct blk_mq_tag_set *__tag_set = (q)->tag_set; \
381382
int srcu_idx; \
382383
\
383384
might_sleep_if(check_sleep); \
384-
srcu_idx = srcu_read_lock((q)->tag_set->srcu); \
385+
srcu_idx = srcu_read_lock(__tag_set->srcu); \
385386
(dispatch_ops); \
386-
srcu_read_unlock((q)->tag_set->srcu, srcu_idx); \
387+
srcu_read_unlock(__tag_set->srcu, srcu_idx); \
387388
} else { \
388389
rcu_read_lock(); \
389390
(dispatch_ops); \

‎drivers/block/loop.c

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1859,35 +1859,44 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,
18591859

18601860
static void loop_handle_cmd(struct loop_cmd *cmd)
18611861
{
1862+
struct cgroup_subsys_state *cmd_blkcg_css = cmd->blkcg_css;
1863+
struct cgroup_subsys_state *cmd_memcg_css = cmd->memcg_css;
18621864
struct request *rq = blk_mq_rq_from_pdu(cmd);
18631865
const bool write = op_is_write(req_op(rq));
18641866
struct loop_device *lo = rq->q->queuedata;
18651867
int ret = 0;
18661868
struct mem_cgroup *old_memcg = NULL;
1869+
const bool use_aio = cmd->use_aio;
18671870

18681871
if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY)) {
18691872
ret = -EIO;
18701873
goto failed;
18711874
}
18721875

1873-
if (cmd->blkcg_css)
1874-
kthread_associate_blkcg(cmd->blkcg_css);
1875-
if (cmd->memcg_css)
1876+
if (cmd_blkcg_css)
1877+
kthread_associate_blkcg(cmd_blkcg_css);
1878+
if (cmd_memcg_css)
18761879
old_memcg = set_active_memcg(
1877-
mem_cgroup_from_css(cmd->memcg_css));
1880+
mem_cgroup_from_css(cmd_memcg_css));
18781881

1882+
/*
1883+
* do_req_filebacked() may call blk_mq_complete_request() synchronously
1884+
* or asynchronously if using aio. Hence, do not touch 'cmd' after
1885+
* do_req_filebacked() has returned unless we are sure that 'cmd' has
1886+
* not yet been completed.
1887+
*/
18791888
ret = do_req_filebacked(lo, rq);
18801889

1881-
if (cmd->blkcg_css)
1890+
if (cmd_blkcg_css)
18821891
kthread_associate_blkcg(NULL);
18831892

1884-
if (cmd->memcg_css) {
1893+
if (cmd_memcg_css) {
18851894
set_active_memcg(old_memcg);
1886-
css_put(cmd->memcg_css);
1895+
css_put(cmd_memcg_css);
18871896
}
18881897
failed:
18891898
/* complete non-aio request */
1890-
if (!cmd->use_aio || ret) {
1899+
if (!use_aio || ret) {
18911900
if (ret == -EOPNOTSUPP)
18921901
cmd->ret = ret;
18931902
else

‎drivers/block/null_blk/main.c

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1413,8 +1413,7 @@ static inline void nullb_complete_cmd(struct nullb_cmd *cmd)
14131413
case NULL_IRQ_SOFTIRQ:
14141414
switch (cmd->nq->dev->queue_mode) {
14151415
case NULL_Q_MQ:
1416-
if (likely(!blk_should_fake_timeout(cmd->rq->q)))
1417-
blk_mq_complete_request(cmd->rq);
1416+
blk_mq_complete_request(cmd->rq);
14181417
break;
14191418
case NULL_Q_BIO:
14201419
/*
@@ -1658,12 +1657,13 @@ static enum blk_eh_timer_return null_timeout_rq(struct request *rq)
16581657
}
16591658

16601659
static blk_status_t null_queue_rq(struct blk_mq_hw_ctx *hctx,
1661-
const struct blk_mq_queue_data *bd)
1660+
const struct blk_mq_queue_data *bd)
16621661
{
1663-
struct nullb_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
1662+
struct request *rq = bd->rq;
1663+
struct nullb_cmd *cmd = blk_mq_rq_to_pdu(rq);
16641664
struct nullb_queue *nq = hctx->driver_data;
1665-
sector_t nr_sectors = blk_rq_sectors(bd->rq);
1666-
sector_t sector = blk_rq_pos(bd->rq);
1665+
sector_t nr_sectors = blk_rq_sectors(rq);
1666+
sector_t sector = blk_rq_pos(rq);
16671667
const bool is_poll = hctx->type == HCTX_TYPE_POLL;
16681668

16691669
might_sleep_if(hctx->flags & BLK_MQ_F_BLOCKING);
@@ -1672,37 +1672,36 @@ static blk_status_t null_queue_rq(struct blk_mq_hw_ctx *hctx,
16721672
hrtimer_init(&cmd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
16731673
cmd->timer.function = null_cmd_timer_expired;
16741674
}
1675-
cmd->rq = bd->rq;
1675+
cmd->rq = rq;
16761676
cmd->error = BLK_STS_OK;
16771677
cmd->nq = nq;
1678-
cmd->fake_timeout = should_timeout_request(bd->rq);
1678+
cmd->fake_timeout = should_timeout_request(rq) ||
1679+
blk_should_fake_timeout(rq->q);
16791680

1680-
blk_mq_start_request(bd->rq);
1681+
blk_mq_start_request(rq);
16811682

1682-
if (should_requeue_request(bd->rq)) {
1683+
if (should_requeue_request(rq)) {
16831684
/*
16841685
* Alternate between hitting the core BUSY path, and the
16851686
* driver driven requeue path
16861687
*/
16871688
nq->requeue_selection++;
16881689
if (nq->requeue_selection & 1)
16891690
return BLK_STS_RESOURCE;
1690-
else {
1691-
blk_mq_requeue_request(bd->rq, true);
1692-
return BLK_STS_OK;
1693-
}
1691+
blk_mq_requeue_request(rq, true);
1692+
return BLK_STS_OK;
16941693
}
16951694

16961695
if (is_poll) {
16971696
spin_lock(&nq->poll_lock);
1698-
list_add_tail(&bd->rq->queuelist, &nq->poll_list);
1697+
list_add_tail(&rq->queuelist, &nq->poll_list);
16991698
spin_unlock(&nq->poll_lock);
17001699
return BLK_STS_OK;
17011700
}
17021701
if (cmd->fake_timeout)
17031702
return BLK_STS_OK;
17041703

1705-
return null_handle_cmd(cmd, sector, nr_sectors, req_op(bd->rq));
1704+
return null_handle_cmd(cmd, sector, nr_sectors, req_op(rq));
17061705
}
17071706

17081707
static void cleanup_queue(struct nullb_queue *nq)

‎drivers/block/sunvdc.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -972,6 +972,8 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
972972
print_version();
973973

974974
hp = mdesc_grab();
975+
if (!hp)
976+
return -ENODEV;
975977

976978
err = -ENODEV;
977979
if ((vdev->dev_no << PARTITION_SHIFT) & ~(u64)MINORMASK) {

‎drivers/md/Kconfig

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ if MD
1515
config BLK_DEV_MD
1616
tristate "RAID support"
1717
select BLOCK_HOLDER_DEPRECATED if SYSFS
18+
# BLOCK_LEGACY_AUTOLOAD requirement should be removed
19+
# after relevant mdadm enhancements - to make "names=yes"
20+
# the default - are widely available.
21+
select BLOCK_LEGACY_AUTOLOAD
1822
help
1923
This driver lets you combine several hard disk partitions into one
2024
logical block device. This can be used to simply append one

‎drivers/md/dm.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -512,10 +512,10 @@ static void dm_io_acct(struct dm_io *io, bool end)
512512
sectors = io->sectors;
513513

514514
if (!end)
515-
bdev_start_io_acct(bio->bi_bdev, sectors, bio_op(bio),
516-
start_time);
515+
bdev_start_io_acct(bio->bi_bdev, bio_op(bio), start_time);
517516
else
518-
bdev_end_io_acct(bio->bi_bdev, bio_op(bio), start_time);
517+
bdev_end_io_acct(bio->bi_bdev, bio_op(bio), sectors,
518+
start_time);
519519

520520
if (static_branch_unlikely(&stats_enabled) &&
521521
unlikely(dm_stats_used(&md->stats))) {

0 commit comments

Comments
 (0)