Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge branch 'for-linus' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:
"A few fixes for the current series that should go into -rc4. This
contains:

- a fix for a potential corruption of un-started requests from Ming.

- a blk-stat fix from Omar, ensuring we flush the stat batch before
checking nr_samples.

- a set of fixes from Sagi for the nvmeof family"

* 'for-linus' of git://git.kernel.dk/linux-block:
blk-mq: don't complete un-started request in timeout handler
nvme-loop: handle cpu unplug when re-establishing the controller
nvme-rdma: handle cpu unplug when re-establishing the controller
nvmet-rdma: Fix a possible uninitialized variable dereference
nvmet: confirm sq percpu has scheduled and switched to atomic
nvme-loop: fix a possible use-after-free when destroying the admin queue
blk-stat: fix blk_stat_sum() if all samples are batched

+82 -71
+1 -10
block/blk-mq.c
··· 697 697 { 698 698 struct blk_mq_timeout_data *data = priv; 699 699 700 - if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) { 701 - /* 702 - * If a request wasn't started before the queue was 703 - * marked dying, kill it here or it'll go unnoticed. 704 - */ 705 - if (unlikely(blk_queue_dying(rq->q))) { 706 - rq->errors = -EIO; 707 - blk_mq_end_request(rq, rq->errors); 708 - } 700 + if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) 709 701 return; 710 - } 711 702 712 703 if (time_after_eq(jiffies, rq->deadline)) { 713 704 if (!blk_mark_rq_complete(rq))
+2 -2
block/blk-stat.c
··· 30 30 31 31 static void blk_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src) 32 32 { 33 + blk_stat_flush_batch(src); 34 + 33 35 if (!src->nr_samples) 34 36 return; 35 - 36 - blk_stat_flush_batch(src); 37 37 38 38 dst->min = min(dst->min, src->min); 39 39 dst->max = max(dst->max, src->max);
+14 -14
drivers/nvme/host/rdma.c
··· 343 343 struct ib_device *ibdev = dev->dev; 344 344 int ret; 345 345 346 - BUG_ON(queue_idx >= ctrl->queue_count); 347 - 348 346 ret = nvme_rdma_alloc_qe(ibdev, &req->sqe, sizeof(struct nvme_command), 349 347 DMA_TO_DEVICE); 350 348 if (ret) ··· 650 652 651 653 static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl) 652 654 { 655 + struct nvmf_ctrl_options *opts = ctrl->ctrl.opts; 656 + unsigned int nr_io_queues; 653 657 int i, ret; 658 + 659 + nr_io_queues = min(opts->nr_io_queues, num_online_cpus()); 660 + ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues); 661 + if (ret) 662 + return ret; 663 + 664 + ctrl->queue_count = nr_io_queues + 1; 665 + if (ctrl->queue_count < 2) 666 + return 0; 667 + 668 + dev_info(ctrl->ctrl.device, 669 + "creating %d I/O queues.\n", nr_io_queues); 654 670 655 671 for (i = 1; i < ctrl->queue_count; i++) { 656 672 ret = nvme_rdma_init_queue(ctrl, i, ··· 1803 1791 1804 1792 static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl) 1805 1793 { 1806 - struct nvmf_ctrl_options *opts = ctrl->ctrl.opts; 1807 1794 int ret; 1808 - 1809 - ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues); 1810 - if (ret) 1811 - return ret; 1812 - 1813 - ctrl->queue_count = opts->nr_io_queues + 1; 1814 - if (ctrl->queue_count < 2) 1815 - return 0; 1816 - 1817 - dev_info(ctrl->ctrl.device, 1818 - "creating %d I/O queues.\n", opts->nr_io_queues); 1819 1795 1820 1796 ret = nvme_rdma_init_io_queues(ctrl); 1821 1797 if (ret)
+10 -1
drivers/nvme/target/core.c
··· 425 425 ctrl->sqs[qid] = sq; 426 426 } 427 427 428 + static void nvmet_confirm_sq(struct percpu_ref *ref) 429 + { 430 + struct nvmet_sq *sq = container_of(ref, struct nvmet_sq, ref); 431 + 432 + complete(&sq->confirm_done); 433 + } 434 + 428 435 void nvmet_sq_destroy(struct nvmet_sq *sq) 429 436 { 430 437 /* ··· 440 433 */ 441 434 if (sq->ctrl && sq->ctrl->sqs && sq->ctrl->sqs[0] == sq) 442 435 nvmet_async_events_free(sq->ctrl); 443 - percpu_ref_kill(&sq->ref); 436 + percpu_ref_kill_and_confirm(&sq->ref, nvmet_confirm_sq); 437 + wait_for_completion(&sq->confirm_done); 444 438 wait_for_completion(&sq->free_done); 445 439 percpu_ref_exit(&sq->ref); 446 440 ··· 469 461 return ret; 470 462 } 471 463 init_completion(&sq->free_done); 464 + init_completion(&sq->confirm_done); 472 465 473 466 return 0; 474 467 }
+51 -39
drivers/nvme/target/loop.c
··· 223 223 static int nvme_loop_init_iod(struct nvme_loop_ctrl *ctrl, 224 224 struct nvme_loop_iod *iod, unsigned int queue_idx) 225 225 { 226 - BUG_ON(queue_idx >= ctrl->queue_count); 227 - 228 226 iod->req.cmd = &iod->cmd; 229 227 iod->req.rsp = &iod->rsp; 230 228 iod->queue = &ctrl->queues[queue_idx]; ··· 286 288 287 289 static void nvme_loop_destroy_admin_queue(struct nvme_loop_ctrl *ctrl) 288 290 { 291 + nvmet_sq_destroy(&ctrl->queues[0].nvme_sq); 289 292 blk_cleanup_queue(ctrl->ctrl.admin_q); 290 293 blk_mq_free_tag_set(&ctrl->admin_tag_set); 291 - nvmet_sq_destroy(&ctrl->queues[0].nvme_sq); 292 294 } 293 295 294 296 static void nvme_loop_free_ctrl(struct nvme_ctrl *nctrl) ··· 310 312 nvmf_free_options(nctrl->opts); 311 313 free_ctrl: 312 314 kfree(ctrl); 315 + } 316 + 317 + static void nvme_loop_destroy_io_queues(struct nvme_loop_ctrl *ctrl) 318 + { 319 + int i; 320 + 321 + for (i = 1; i < ctrl->queue_count; i++) 322 + nvmet_sq_destroy(&ctrl->queues[i].nvme_sq); 323 + } 324 + 325 + static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl) 326 + { 327 + struct nvmf_ctrl_options *opts = ctrl->ctrl.opts; 328 + unsigned int nr_io_queues; 329 + int ret, i; 330 + 331 + nr_io_queues = min(opts->nr_io_queues, num_online_cpus()); 332 + ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues); 333 + if (ret || !nr_io_queues) 334 + return ret; 335 + 336 + dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", nr_io_queues); 337 + 338 + for (i = 1; i <= nr_io_queues; i++) { 339 + ctrl->queues[i].ctrl = ctrl; 340 + ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq); 341 + if (ret) 342 + goto out_destroy_queues; 343 + 344 + ctrl->queue_count++; 345 + } 346 + 347 + return 0; 348 + 349 + out_destroy_queues: 350 + nvme_loop_destroy_io_queues(ctrl); 351 + return ret; 313 352 } 314 353 315 354 static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl) ··· 420 385 421 386 static void nvme_loop_shutdown_ctrl(struct nvme_loop_ctrl *ctrl) 422 387 { 423 - int i; 424 - 425 388 nvme_stop_keep_alive(&ctrl->ctrl); 426 389 427 390 if (ctrl->queue_count > 1) { 428 391 nvme_stop_queues(&ctrl->ctrl); 429 392 blk_mq_tagset_busy_iter(&ctrl->tag_set, 430 393 nvme_cancel_request, &ctrl->ctrl); 431 - 432 - for (i = 1; i < ctrl->queue_count; i++) 433 - nvmet_sq_destroy(&ctrl->queues[i].nvme_sq); 394 + nvme_loop_destroy_io_queues(ctrl); 434 395 } 435 396 436 397 if (ctrl->ctrl.state == NVME_CTRL_LIVE) ··· 498 467 if (ret) 499 468 goto out_disable; 500 469 501 - for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) { 502 - ctrl->queues[i].ctrl = ctrl; 503 - ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq); 504 - if (ret) 505 - goto out_free_queues; 470 + ret = nvme_loop_init_io_queues(ctrl); 471 + if (ret) 472 + goto out_destroy_admin; 506 473 507 - ctrl->queue_count++; 508 - } 509 - 510 - for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) { 474 + for (i = 1; i < ctrl->queue_count; i++) { 511 475 ret = nvmf_connect_io_queue(&ctrl->ctrl, i); 512 476 if (ret) 513 - goto out_free_queues; 477 + goto out_destroy_io; 514 478 } 515 479 516 480 changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); ··· 518 492 519 493 return; 520 494 521 - out_free_queues: 522 - for (i = 1; i < ctrl->queue_count; i++) 523 - nvmet_sq_destroy(&ctrl->queues[i].nvme_sq); 495 + out_destroy_io: 496 + nvme_loop_destroy_io_queues(ctrl); 497 + out_destroy_admin: 524 498 nvme_loop_destroy_admin_queue(ctrl); 525 499 out_disable: 526 500 dev_warn(ctrl->ctrl.device, "Removing after reset failure\n"); ··· 559 533 560 534 static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl) 561 535 { 562 - struct nvmf_ctrl_options *opts = ctrl->ctrl.opts; 563 536 int ret, i; 564 537 565 - ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues); 566 - if (ret || !opts->nr_io_queues) 538 + ret = nvme_loop_init_io_queues(ctrl); 539 + if (ret) 567 540 return ret; 568 - 569 - dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", 570 - opts->nr_io_queues); 571 - 572 - for (i = 1; i <= opts->nr_io_queues; i++) { 573 - ctrl->queues[i].ctrl = ctrl; 574 - ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq); 575 - if (ret) 576 - goto out_destroy_queues; 577 - 578 - ctrl->queue_count++; 579 - } 580 541 581 542 memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set)); 582 543 ctrl->tag_set.ops = &nvme_loop_mq_ops; ··· 588 575 goto out_free_tagset; 589 576 } 590 577 591 - for (i = 1; i <= opts->nr_io_queues; i++) { 578 + for (i = 1; i < ctrl->queue_count; i++) { 592 579 ret = nvmf_connect_io_queue(&ctrl->ctrl, i); 593 580 if (ret) 594 581 goto out_cleanup_connect_q; ··· 601 588 out_free_tagset: 602 589 blk_mq_free_tag_set(&ctrl->tag_set); 603 590 out_destroy_queues: 604 - for (i = 1; i < ctrl->queue_count; i++) 605 - nvmet_sq_destroy(&ctrl->queues[i].nvme_sq); 591 + nvme_loop_destroy_io_queues(ctrl); 606 592 return ret; 607 593 } 608 594
+1
drivers/nvme/target/nvmet.h
··· 73 73 u16 qid; 74 74 u16 size; 75 75 struct completion free_done; 76 + struct completion confirm_done; 76 77 }; 77 78 78 79 /**
+3 -5
drivers/nvme/target/rdma.c
··· 703 703 { 704 704 u16 status; 705 705 706 - cmd->queue = queue; 707 - cmd->n_rdma = 0; 708 - cmd->req.port = queue->port; 709 - 710 - 711 706 ib_dma_sync_single_for_cpu(queue->dev->device, 712 707 cmd->cmd->sge[0].addr, cmd->cmd->sge[0].length, 713 708 DMA_FROM_DEVICE); ··· 755 760 756 761 cmd->queue = queue; 757 762 rsp = nvmet_rdma_get_rsp(queue); 763 + rsp->queue = queue; 758 764 rsp->cmd = cmd; 759 765 rsp->flags = 0; 760 766 rsp->req.cmd = cmd->nvme_cmd; 767 + rsp->req.port = queue->port; 768 + rsp->n_rdma = 0; 761 769 762 770 if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) { 763 771 unsigned long flags;