Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'block-5.14-2021-07-16' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:

- NVMe fixes via Christoph:
- fix various races in nvme-pci when shutting down just after
probing (Casey Chen)
- fix a net_device leak in nvme-tcp (Prabhakar Kushwaha)

- Fix regression in xen-blkfront by cleaning up the removal state
machine (Christoph)

- Fix tag_set and queue cleanup ordering regression in nbd (Wang)

- Fix tag_set and queue cleanup ordering regression in pd (Guoqing)

* tag 'block-5.14-2021-07-16' of git://git.kernel.dk/linux-block:
xen-blkfront: sanitize the removal state machine
nbd: fix order of cleaning up the queue and freeing the tagset
pd: fix order of cleaning up the queue and freeing the tagset
nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
nvme-pci: fix multiple races in nvme_setup_io_queues
nvme-tcp: use __dev_get_by_name instead dev_get_by_name for OPT_HOST_IFACE

+90 -215
+1 -1
drivers/block/nbd.c
··· 239 239 240 240 if (disk) { 241 241 del_gendisk(disk); 242 - blk_mq_free_tag_set(&nbd->tag_set); 243 242 blk_cleanup_disk(disk); 243 + blk_mq_free_tag_set(&nbd->tag_set); 244 244 } 245 245 246 246 /*
+1 -1
drivers/block/paride/pd.c
··· 1014 1014 if (p) { 1015 1015 disk->gd = NULL; 1016 1016 del_gendisk(p); 1017 - blk_mq_free_tag_set(&disk->tag_set); 1018 1017 blk_cleanup_disk(p); 1018 + blk_mq_free_tag_set(&disk->tag_set); 1019 1019 pi_release(disk->pi); 1020 1020 } 1021 1021 }
+29 -201
drivers/block/xen-blkfront.c
··· 502 502 static int blkif_ioctl(struct block_device *bdev, fmode_t mode, 503 503 unsigned command, unsigned long argument) 504 504 { 505 - struct blkfront_info *info = bdev->bd_disk->private_data; 506 505 int i; 507 - 508 - dev_dbg(&info->xbdev->dev, "command: 0x%x, argument: 0x%lx\n", 509 - command, (long)argument); 510 506 511 507 switch (command) { 512 508 case CDROMMULTISESSION: 513 - dev_dbg(&info->xbdev->dev, "FIXME: support multisession CDs later\n"); 514 509 for (i = 0; i < sizeof(struct cdrom_multisession); i++) 515 510 if (put_user(0, (char __user *)(argument + i))) 516 511 return -EFAULT; 517 512 return 0; 518 - 519 - case CDROM_GET_CAPABILITY: { 520 - struct gendisk *gd = info->gd; 521 - if (gd->flags & GENHD_FL_CD) 513 + case CDROM_GET_CAPABILITY: 514 + if (bdev->bd_disk->flags & GENHD_FL_CD) 522 515 return 0; 523 516 return -EINVAL; 524 - } 525 - 526 517 default: 527 - /*printk(KERN_ALERT "ioctl %08x not supported by Xen blkdev\n", 528 - command);*/ 529 - return -EINVAL; /* same return as native Linux */ 518 + return -EINVAL; 530 519 } 531 - 532 - return 0; 533 520 } 534 521 535 522 static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo, ··· 1164 1177 return err; 1165 1178 } 1166 1179 1167 - static void xlvbd_release_gendisk(struct blkfront_info *info) 1168 - { 1169 - unsigned int minor, nr_minors, i; 1170 - struct blkfront_ring_info *rinfo; 1171 - 1172 - if (info->rq == NULL) 1173 - return; 1174 - 1175 - /* No more blkif_request(). */ 1176 - blk_mq_stop_hw_queues(info->rq); 1177 - 1178 - for_each_rinfo(info, rinfo, i) { 1179 - /* No more gnttab callback work. */ 1180 - gnttab_cancel_free_callback(&rinfo->callback); 1181 - 1182 - /* Flush gnttab callback work. Must be done with no locks held. */ 1183 - flush_work(&rinfo->work); 1184 - } 1185 - 1186 - del_gendisk(info->gd); 1187 - 1188 - minor = info->gd->first_minor; 1189 - nr_minors = info->gd->minors; 1190 - xlbd_release_minors(minor, nr_minors); 1191 - 1192 - blk_cleanup_disk(info->gd); 1193 - info->gd = NULL; 1194 - blk_mq_free_tag_set(&info->tag_set); 1195 - } 1196 - 1197 1180 /* Already hold rinfo->ring_lock. */ 1198 1181 static inline void kick_pending_request_queues_locked(struct blkfront_ring_info *rinfo) 1199 1182 { ··· 1713 1756 return err; 1714 1757 } 1715 1758 1716 - static void free_info(struct blkfront_info *info) 1717 - { 1718 - list_del(&info->info_list); 1719 - kfree(info); 1720 - } 1721 - 1722 1759 /* Common code used when first setting up, and when resuming. */ 1723 1760 static int talk_to_blkback(struct xenbus_device *dev, 1724 1761 struct blkfront_info *info) ··· 1831 1880 xenbus_dev_fatal(dev, err, "%s", message); 1832 1881 destroy_blkring: 1833 1882 blkif_free(info, 0); 1834 - 1835 - mutex_lock(&blkfront_mutex); 1836 - free_info(info); 1837 - mutex_unlock(&blkfront_mutex); 1838 - 1839 - dev_set_drvdata(&dev->dev, NULL); 1840 - 1841 1883 return err; 1842 1884 } 1843 1885 ··· 2070 2126 static void blkfront_closing(struct blkfront_info *info) 2071 2127 { 2072 2128 struct xenbus_device *xbdev = info->xbdev; 2073 - struct block_device *bdev = NULL; 2129 + struct blkfront_ring_info *rinfo; 2130 + unsigned int i; 2074 2131 2075 - mutex_lock(&info->mutex); 2076 - 2077 - if (xbdev->state == XenbusStateClosing) { 2078 - mutex_unlock(&info->mutex); 2132 + if (xbdev->state == XenbusStateClosing) 2079 2133 return; 2134 + 2135 + /* No more blkif_request(). */ 2136 + blk_mq_stop_hw_queues(info->rq); 2137 + blk_set_queue_dying(info->rq); 2138 + set_capacity(info->gd, 0); 2139 + 2140 + for_each_rinfo(info, rinfo, i) { 2141 + /* No more gnttab callback work. */ 2142 + gnttab_cancel_free_callback(&rinfo->callback); 2143 + 2144 + /* Flush gnttab callback work. Must be done with no locks held. */ 2145 + flush_work(&rinfo->work); 2080 2146 } 2081 2147 2082 - if (info->gd) 2083 - bdev = bdgrab(info->gd->part0); 2084 - 2085 - mutex_unlock(&info->mutex); 2086 - 2087 - if (!bdev) { 2088 - xenbus_frontend_closed(xbdev); 2089 - return; 2090 - } 2091 - 2092 - mutex_lock(&bdev->bd_disk->open_mutex); 2093 - 2094 - if (bdev->bd_openers) { 2095 - xenbus_dev_error(xbdev, -EBUSY, 2096 - "Device in use; refusing to close"); 2097 - xenbus_switch_state(xbdev, XenbusStateClosing); 2098 - } else { 2099 - xlvbd_release_gendisk(info); 2100 - xenbus_frontend_closed(xbdev); 2101 - } 2102 - 2103 - mutex_unlock(&bdev->bd_disk->open_mutex); 2104 - bdput(bdev); 2148 + xenbus_frontend_closed(xbdev); 2105 2149 } 2106 2150 2107 2151 static void blkfront_setup_discard(struct blkfront_info *info) ··· 2404 2472 break; 2405 2473 fallthrough; 2406 2474 case XenbusStateClosing: 2407 - if (info) 2408 - blkfront_closing(info); 2475 + blkfront_closing(info); 2409 2476 break; 2410 2477 } 2411 2478 } ··· 2412 2481 static int blkfront_remove(struct xenbus_device *xbdev) 2413 2482 { 2414 2483 struct blkfront_info *info = dev_get_drvdata(&xbdev->dev); 2415 - struct block_device *bdev = NULL; 2416 - struct gendisk *disk; 2417 2484 2418 2485 dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename); 2419 2486 2420 - if (!info) 2421 - return 0; 2487 + del_gendisk(info->gd); 2488 + 2489 + mutex_lock(&blkfront_mutex); 2490 + list_del(&info->info_list); 2491 + mutex_unlock(&blkfront_mutex); 2422 2492 2423 2493 blkif_free(info, 0); 2494 + xlbd_release_minors(info->gd->first_minor, info->gd->minors); 2495 + blk_cleanup_disk(info->gd); 2496 + blk_mq_free_tag_set(&info->tag_set); 2424 2497 2425 - mutex_lock(&info->mutex); 2426 - 2427 - disk = info->gd; 2428 - if (disk) 2429 - bdev = bdgrab(disk->part0); 2430 - 2431 - info->xbdev = NULL; 2432 - mutex_unlock(&info->mutex); 2433 - 2434 - if (!bdev) { 2435 - mutex_lock(&blkfront_mutex); 2436 - free_info(info); 2437 - mutex_unlock(&blkfront_mutex); 2438 - return 0; 2439 - } 2440 - 2441 - /* 2442 - * The xbdev was removed before we reached the Closed 2443 - * state. See if it's safe to remove the disk. If the bdev 2444 - * isn't closed yet, we let release take care of it. 2445 - */ 2446 - 2447 - mutex_lock(&disk->open_mutex); 2448 - info = disk->private_data; 2449 - 2450 - dev_warn(disk_to_dev(disk), 2451 - "%s was hot-unplugged, %d stale handles\n", 2452 - xbdev->nodename, bdev->bd_openers); 2453 - 2454 - if (info && !bdev->bd_openers) { 2455 - xlvbd_release_gendisk(info); 2456 - disk->private_data = NULL; 2457 - mutex_lock(&blkfront_mutex); 2458 - free_info(info); 2459 - mutex_unlock(&blkfront_mutex); 2460 - } 2461 - 2462 - mutex_unlock(&disk->open_mutex); 2463 - bdput(bdev); 2464 - 2498 + kfree(info); 2465 2499 return 0; 2466 2500 } 2467 2501 ··· 2437 2541 return info->is_ready && info->xbdev; 2438 2542 } 2439 2543 2440 - static int blkif_open(struct block_device *bdev, fmode_t mode) 2441 - { 2442 - struct gendisk *disk = bdev->bd_disk; 2443 - struct blkfront_info *info; 2444 - int err = 0; 2445 - 2446 - mutex_lock(&blkfront_mutex); 2447 - 2448 - info = disk->private_data; 2449 - if (!info) { 2450 - /* xbdev gone */ 2451 - err = -ERESTARTSYS; 2452 - goto out; 2453 - } 2454 - 2455 - mutex_lock(&info->mutex); 2456 - 2457 - if (!info->gd) 2458 - /* xbdev is closed */ 2459 - err = -ERESTARTSYS; 2460 - 2461 - mutex_unlock(&info->mutex); 2462 - 2463 - out: 2464 - mutex_unlock(&blkfront_mutex); 2465 - return err; 2466 - } 2467 - 2468 - static void blkif_release(struct gendisk *disk, fmode_t mode) 2469 - { 2470 - struct blkfront_info *info = disk->private_data; 2471 - struct xenbus_device *xbdev; 2472 - 2473 - mutex_lock(&blkfront_mutex); 2474 - if (disk->part0->bd_openers) 2475 - goto out_mutex; 2476 - 2477 - /* 2478 - * Check if we have been instructed to close. We will have 2479 - * deferred this request, because the bdev was still open. 2480 - */ 2481 - 2482 - mutex_lock(&info->mutex); 2483 - xbdev = info->xbdev; 2484 - 2485 - if (xbdev && xbdev->state == XenbusStateClosing) { 2486 - /* pending switch to state closed */ 2487 - dev_info(disk_to_dev(disk), "releasing disk\n"); 2488 - xlvbd_release_gendisk(info); 2489 - xenbus_frontend_closed(info->xbdev); 2490 - } 2491 - 2492 - mutex_unlock(&info->mutex); 2493 - 2494 - if (!xbdev) { 2495 - /* sudden device removal */ 2496 - dev_info(disk_to_dev(disk), "releasing disk\n"); 2497 - xlvbd_release_gendisk(info); 2498 - disk->private_data = NULL; 2499 - free_info(info); 2500 - } 2501 - 2502 - out_mutex: 2503 - mutex_unlock(&blkfront_mutex); 2504 - } 2505 - 2506 2544 static const struct block_device_operations xlvbd_block_fops = 2507 2545 { 2508 2546 .owner = THIS_MODULE, 2509 - .open = blkif_open, 2510 - .release = blkif_release, 2511 2547 .getgeo = blkif_getgeo, 2512 2548 .ioctl = blkif_ioctl, 2513 2549 .compat_ioctl = blkdev_compat_ptr_ioctl,
+58 -9
drivers/nvme/host/pci.c
··· 1554 1554 wmb(); /* ensure the first interrupt sees the initialization */ 1555 1555 } 1556 1556 1557 + /* 1558 + * Try getting shutdown_lock while setting up IO queues. 1559 + */ 1560 + static int nvme_setup_io_queues_trylock(struct nvme_dev *dev) 1561 + { 1562 + /* 1563 + * Give up if the lock is being held by nvme_dev_disable. 1564 + */ 1565 + if (!mutex_trylock(&dev->shutdown_lock)) 1566 + return -ENODEV; 1567 + 1568 + /* 1569 + * Controller is in wrong state, fail early. 1570 + */ 1571 + if (dev->ctrl.state != NVME_CTRL_CONNECTING) { 1572 + mutex_unlock(&dev->shutdown_lock); 1573 + return -ENODEV; 1574 + } 1575 + 1576 + return 0; 1577 + } 1578 + 1557 1579 static int nvme_create_queue(struct nvme_queue *nvmeq, int qid, bool polled) 1558 1580 { 1559 1581 struct nvme_dev *dev = nvmeq->dev; ··· 1604 1582 goto release_cq; 1605 1583 1606 1584 nvmeq->cq_vector = vector; 1607 - nvme_init_queue(nvmeq, qid); 1608 1585 1586 + result = nvme_setup_io_queues_trylock(dev); 1587 + if (result) 1588 + return result; 1589 + nvme_init_queue(nvmeq, qid); 1609 1590 if (!polled) { 1610 1591 result = queue_request_irq(nvmeq); 1611 1592 if (result < 0) ··· 1616 1591 } 1617 1592 1618 1593 set_bit(NVMEQ_ENABLED, &nvmeq->flags); 1594 + mutex_unlock(&dev->shutdown_lock); 1619 1595 return result; 1620 1596 1621 1597 release_sq: 1622 1598 dev->online_queues--; 1599 + mutex_unlock(&dev->shutdown_lock); 1623 1600 adapter_delete_sq(dev, qid); 1624 1601 release_cq: 1625 1602 adapter_delete_cq(dev, qid); ··· 2194 2167 if (nr_io_queues == 0) 2195 2168 return 0; 2196 2169 2197 - clear_bit(NVMEQ_ENABLED, &adminq->flags); 2170 + /* 2171 + * Free IRQ resources as soon as NVMEQ_ENABLED bit transitions 2172 + * from set to unset. If there is a window to it is truely freed, 2173 + * pci_free_irq_vectors() jumping into this window will crash. 2174 + * And take lock to avoid racing with pci_free_irq_vectors() in 2175 + * nvme_dev_disable() path. 2176 + */ 2177 + result = nvme_setup_io_queues_trylock(dev); 2178 + if (result) 2179 + return result; 2180 + if (test_and_clear_bit(NVMEQ_ENABLED, &adminq->flags)) 2181 + pci_free_irq(pdev, 0, adminq); 2198 2182 2199 2183 if (dev->cmb_use_sqes) { 2200 2184 result = nvme_cmb_qdepth(dev, nr_io_queues, ··· 2221 2183 result = nvme_remap_bar(dev, size); 2222 2184 if (!result) 2223 2185 break; 2224 - if (!--nr_io_queues) 2225 - return -ENOMEM; 2186 + if (!--nr_io_queues) { 2187 + result = -ENOMEM; 2188 + goto out_unlock; 2189 + } 2226 2190 } while (1); 2227 2191 adminq->q_db = dev->dbs; 2228 2192 2229 2193 retry: 2230 2194 /* Deregister the admin queue's interrupt */ 2231 - pci_free_irq(pdev, 0, adminq); 2195 + if (test_and_clear_bit(NVMEQ_ENABLED, &adminq->flags)) 2196 + pci_free_irq(pdev, 0, adminq); 2232 2197 2233 2198 /* 2234 2199 * If we enable msix early due to not intx, disable it again before ··· 2240 2199 pci_free_irq_vectors(pdev); 2241 2200 2242 2201 result = nvme_setup_irqs(dev, nr_io_queues); 2243 - if (result <= 0) 2244 - return -EIO; 2202 + if (result <= 0) { 2203 + result = -EIO; 2204 + goto out_unlock; 2205 + } 2245 2206 2246 2207 dev->num_vecs = result; 2247 2208 result = max(result - 1, 1); ··· 2257 2214 */ 2258 2215 result = queue_request_irq(adminq); 2259 2216 if (result) 2260 - return result; 2217 + goto out_unlock; 2261 2218 set_bit(NVMEQ_ENABLED, &adminq->flags); 2219 + mutex_unlock(&dev->shutdown_lock); 2262 2220 2263 2221 result = nvme_create_io_queues(dev); 2264 2222 if (result || dev->online_queues < 2) ··· 2268 2224 if (dev->online_queues - 1 < dev->max_qid) { 2269 2225 nr_io_queues = dev->online_queues - 1; 2270 2226 nvme_disable_io_queues(dev); 2227 + result = nvme_setup_io_queues_trylock(dev); 2228 + if (result) 2229 + return result; 2271 2230 nvme_suspend_io_queues(dev); 2272 2231 goto retry; 2273 2232 } ··· 2279 2232 dev->io_queues[HCTX_TYPE_READ], 2280 2233 dev->io_queues[HCTX_TYPE_POLL]); 2281 2234 return 0; 2235 + out_unlock: 2236 + mutex_unlock(&dev->shutdown_lock); 2237 + return result; 2282 2238 } 2283 2239 2284 2240 static void nvme_del_queue_end(struct request *req, blk_status_t error) ··· 3012 2962 if (!pci_device_is_present(pdev)) { 3013 2963 nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DEAD); 3014 2964 nvme_dev_disable(dev, true); 3015 - nvme_dev_remove_admin(dev); 3016 2965 } 3017 2966 3018 2967 flush_work(&dev->ctrl.reset_work);
+1 -3
drivers/nvme/host/tcp.c
··· 123 123 struct blk_mq_tag_set admin_tag_set; 124 124 struct sockaddr_storage addr; 125 125 struct sockaddr_storage src_addr; 126 - struct net_device *ndev; 127 126 struct nvme_ctrl ctrl; 128 127 129 128 struct work_struct err_work; ··· 2532 2533 } 2533 2534 2534 2535 if (opts->mask & NVMF_OPT_HOST_IFACE) { 2535 - ctrl->ndev = dev_get_by_name(&init_net, opts->host_iface); 2536 - if (!ctrl->ndev) { 2536 + if (!__dev_get_by_name(&init_net, opts->host_iface)) { 2537 2537 pr_err("invalid interface passed: %s\n", 2538 2538 opts->host_iface); 2539 2539 ret = -ENODEV;