Skip to content

Commit 81409e5

Browse files
torvaldstorvalds
committed
Merge tag 'block-6.3-2023-03-30' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - Mark Lexar NM760 as IGNORE_DEV_SUBNQN (Juraj Pecigos) - Fix a possible UAF when failing to allocate an TCP io queue (Sagi Grimberg) - MD pull request via Song: - Fix a null pointer deference in 6.3-rc (Yu Kuai) - uevent partition fix (Alyssa) * tag 'block-6.3-2023-03-30' of git://git.kernel.dk/linux: nvme-tcp: fix a possible UAF when failing to allocate an io queue md: fix regression for null-ptr-deference in __md_stop() nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN loop: LOOP_CONFIGURE: send uevents for partitions
2 parents f3fa7f0 + 24ab70d commit 81409e5

4 files changed

Lines changed: 39 additions & 31 deletions

File tree

‎drivers/block/loop.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1010,9 +1010,6 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
10101010
/* This is safe, since we have a reference from open(). */
10111011
__module_get(THIS_MODULE);
10121012

1013-
/* suppress uevents while reconfiguring the device */
1014-
dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
1015-
10161013
/*
10171014
* If we don't hold exclusive handle for the device, upgrade to it
10181015
* here to avoid changing device under exclusive owner.
@@ -1067,6 +1064,9 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
10671064
}
10681065
}
10691066

1067+
/* suppress uevents while reconfiguring the device */
1068+
dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
1069+
10701070
disk_force_media_change(lo->lo_disk, DISK_EVENT_MEDIA_CHANGE);
10711071
set_disk_ro(lo->lo_disk, (lo->lo_flags & LO_FLAGS_READ_ONLY) != 0);
10721072

@@ -1109,17 +1109,17 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
11091109
if (partscan)
11101110
clear_bit(GD_SUPPRESS_PART_SCAN, &lo->lo_disk->state);
11111111

1112+
/* enable and uncork uevent now that we are done */
1113+
dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
1114+
11121115
loop_global_unlock(lo, is_loop);
11131116
if (partscan)
11141117
loop_reread_partitions(lo);
1118+
11151119
if (!(mode & FMODE_EXCL))
11161120
bd_abort_claiming(bdev, loop_configure);
11171121

1118-
error = 0;
1119-
done:
1120-
/* enable and uncork uevent now that we are done */
1121-
dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0);
1122-
return error;
1122+
return 0;
11231123

11241124
out_unlock:
11251125
loop_global_unlock(lo, is_loop);
@@ -1130,7 +1130,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
11301130
fput(file);
11311131
/* This is safe: open() is still holding a reference. */
11321132
module_put(THIS_MODULE);
1133-
goto done;
1133+
return error;
11341134
}
11351135

11361136
static void __loop_clr_fd(struct loop_device *lo, bool release)

‎drivers/md/md.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6260,7 +6260,6 @@ static void __md_stop(struct mddev *mddev)
62606260
module_put(pers->owner);
62616261
clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
62626262

6263-
percpu_ref_exit(&mddev->writes_pending);
62646263
percpu_ref_exit(&mddev->active_io);
62656264
bioset_exit(&mddev->bio_set);
62666265
bioset_exit(&mddev->sync_set);
@@ -6273,6 +6272,7 @@ void md_stop(struct mddev *mddev)
62736272
*/
62746273
__md_stop_writes(mddev);
62756274
__md_stop(mddev);
6275+
percpu_ref_exit(&mddev->writes_pending);
62766276
}
62776277

62786278
EXPORT_SYMBOL_GPL(md_stop);
@@ -7843,6 +7843,7 @@ static void md_free_disk(struct gendisk *disk)
78437843
{
78447844
struct mddev *mddev = disk->private_data;
78457845

7846+
percpu_ref_exit(&mddev->writes_pending);
78467847
mddev_free(mddev);
78477848
}
78487849

‎drivers/nvme/host/pci.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3441,7 +3441,8 @@ static const struct pci_device_id nvme_id_table[] = {
34413441
{ PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */
34423442
.driver_data = NVME_QUIRK_BOGUS_NID, },
34433443
{ PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */
3444-
.driver_data = NVME_QUIRK_BOGUS_NID, },
3444+
.driver_data = NVME_QUIRK_BOGUS_NID |
3445+
NVME_QUIRK_IGNORE_DEV_SUBNQN, },
34453446
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
34463447
.driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
34473448
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065),

‎drivers/nvme/host/tcp.c‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1620,22 +1620,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid)
16201620
if (ret)
16211621
goto err_init_connect;
16221622

1623-
queue->rd_enabled = true;
16241623
set_bit(NVME_TCP_Q_ALLOCATED, &queue->flags);
1625-
nvme_tcp_init_recv_ctx(queue);
1626-
1627-
write_lock_bh(&queue->sock->sk->sk_callback_lock);
1628-
queue->sock->sk->sk_user_data = queue;
1629-
queue->state_change = queue->sock->sk->sk_state_change;
1630-
queue->data_ready = queue->sock->sk->sk_data_ready;
1631-
queue->write_space = queue->sock->sk->sk_write_space;
1632-
queue->sock->sk->sk_data_ready = nvme_tcp_data_ready;
1633-
queue->sock->sk->sk_state_change = nvme_tcp_state_change;
1634-
queue->sock->sk->sk_write_space = nvme_tcp_write_space;
1635-
#ifdef CONFIG_NET_RX_BUSY_POLL
1636-
queue->sock->sk->sk_ll_usec = 1;
1637-
#endif
1638-
write_unlock_bh(&queue->sock->sk->sk_callback_lock);
16391624

16401625
return 0;
16411626

@@ -1655,7 +1640,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, int qid)
16551640
return ret;
16561641
}
16571642

1658-
static void nvme_tcp_restore_sock_calls(struct nvme_tcp_queue *queue)
1643+
static void nvme_tcp_restore_sock_ops(struct nvme_tcp_queue *queue)
16591644
{
16601645
struct socket *sock = queue->sock;
16611646

@@ -1670,7 +1655,7 @@ static void nvme_tcp_restore_sock_calls(struct nvme_tcp_queue *queue)
16701655
static void __nvme_tcp_stop_queue(struct nvme_tcp_queue *queue)
16711656
{
16721657
kernel_sock_shutdown(queue->sock, SHUT_RDWR);
1673-
nvme_tcp_restore_sock_calls(queue);
1658+
nvme_tcp_restore_sock_ops(queue);
16741659
cancel_work_sync(&queue->io_work);
16751660
}
16761661

@@ -1688,21 +1673,42 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid)
16881673
mutex_unlock(&queue->queue_lock);
16891674
}
16901675

1676+
static void nvme_tcp_setup_sock_ops(struct nvme_tcp_queue *queue)
1677+
{
1678+
write_lock_bh(&queue->sock->sk->sk_callback_lock);
1679+
queue->sock->sk->sk_user_data = queue;
1680+
queue->state_change = queue->sock->sk->sk_state_change;
1681+
queue->data_ready = queue->sock->sk->sk_data_ready;
1682+
queue->write_space = queue->sock->sk->sk_write_space;
1683+
queue->sock->sk->sk_data_ready = nvme_tcp_data_ready;
1684+
queue->sock->sk->sk_state_change = nvme_tcp_state_change;
1685+
queue->sock->sk->sk_write_space = nvme_tcp_write_space;
1686+
#ifdef CONFIG_NET_RX_BUSY_POLL
1687+
queue->sock->sk->sk_ll_usec = 1;
1688+
#endif
1689+
write_unlock_bh(&queue->sock->sk->sk_callback_lock);
1690+
}
1691+
16911692
static int nvme_tcp_start_queue(struct nvme_ctrl *nctrl, int idx)
16921693
{
16931694
struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
1695+
struct nvme_tcp_queue *queue = &ctrl->queues[idx];
16941696
int ret;
16951697

1698+
queue->rd_enabled = true;
1699+
nvme_tcp_init_recv_ctx(queue);
1700+
nvme_tcp_setup_sock_ops(queue);
1701+
16961702
if (idx)
16971703
ret = nvmf_connect_io_queue(nctrl, idx);
16981704
else
16991705
ret = nvmf_connect_admin_queue(nctrl);
17001706

17011707
if (!ret) {
1702-
set_bit(NVME_TCP_Q_LIVE, &ctrl->queues[idx].flags);
1708+
set_bit(NVME_TCP_Q_LIVE, &queue->flags);
17031709
} else {
1704-
if (test_bit(NVME_TCP_Q_ALLOCATED, &ctrl->queues[idx].flags))
1705-
__nvme_tcp_stop_queue(&ctrl->queues[idx]);
1710+
if (test_bit(NVME_TCP_Q_ALLOCATED, &queue->flags))
1711+
__nvme_tcp_stop_queue(queue);
17061712
dev_err(nctrl->device,
17071713
"failed to connect queue: %d ret=%d\n", idx, ret);
17081714
}

0 commit comments

Comments
 (0)