Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'block-6.6-2023-09-15' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe:
- NVMe pull via Keith:
- nvme-tcp iov len fix (Varun)
- nvme-hwmon const qualifier for safety (Krzysztof)
- nvme-fc null pointer checks (Nigel)
- nvme-pci no numa node fix (Pratyush)
- nvme timeout fix for non-compliant controllers (Keith)
- MD pull via Song fixing regressions with both 6.5 and 6.6
- Fix a use-after-free regression in resizing blk-mq tags (Chengming)
* tag 'block-6.6-2023-09-15' of git://git.kernel.dk/linux:
nvme: avoid bogus CRTO values
md: Put the right device in md_seq_next
nvme-pci: do not set the NUMA node of device if it has none
blk-mq: fix tags UAF when shrinking q->nr_hw_queues
md/raid1: fix error: ISO C90 forbids mixed declarations
md: fix warning for holder mismatch from export_rdev()
md: don't dereference mddev after export_rdev()
nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
nvme: host: hwmon: constify pointers to hwmon_channel_info
nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
+65
-40
+7
-6
block/blk-mq.c
+7
-6
block/blk-mq.c
···
4405
4405
struct blk_mq_tags **new_tags;
4406
4406
int i;
4407
4407
4408
-
if (set->nr_hw_queues >= new_nr_hw_queues) {
4409
-
for (i = new_nr_hw_queues; i < set->nr_hw_queues; i++)
4410
-
__blk_mq_free_map_and_rqs(set, i);
4408
+
if (set->nr_hw_queues >= new_nr_hw_queues)
4411
4409
goto done;
4412
-
}
4413
4410
4414
4411
new_tags = kcalloc_node(new_nr_hw_queues, sizeof(struct blk_mq_tags *),
4415
4412
GFP_KERNEL, set->numa_node);
···
4716
4719
{
4717
4720
struct request_queue *q;
4718
4721
LIST_HEAD(head);
4719
-
int prev_nr_hw_queues;
4722
+
int prev_nr_hw_queues = set->nr_hw_queues;
4723
+
int i;
4720
4724
4721
4725
lockdep_assert_held(&set->tag_list_lock);
4722
4726
···
4744
4746
blk_mq_sysfs_unregister_hctxs(q);
4745
4747
}
4746
4748
4747
-
prev_nr_hw_queues = set->nr_hw_queues;
4748
4749
if (blk_mq_realloc_tag_set_tags(set, nr_hw_queues) < 0)
4749
4750
goto reregister;
4750
4751
···
4778
4781
4779
4782
list_for_each_entry(q, &set->tag_list, tag_set_list)
4780
4783
blk_mq_unfreeze_queue(q);
4784
+
4785
+
/* Free the excess tags when nr_hw_queues shrink. */
4786
+
for (i = set->nr_hw_queues; i < prev_nr_hw_queues; i++)
4787
+
__blk_mq_free_map_and_rqs(set, i);
4781
4788
}
4782
4789
4783
4790
void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
+16
-7
drivers/md/md.c
+16
-7
drivers/md/md.c
···
798
798
} else
799
799
mutex_unlock(&mddev->reconfig_mutex);
800
800
801
+
md_wakeup_thread(mddev->thread);
802
+
wake_up(&mddev->sb_wait);
803
+
801
804
list_for_each_entry_safe(rdev, tmp, &delete, same_set) {
802
805
list_del_init(&rdev->same_set);
803
806
kobject_del(&rdev->kobj);
804
807
export_rdev(rdev, mddev);
805
808
}
806
-
807
-
md_wakeup_thread(mddev->thread);
808
-
wake_up(&mddev->sb_wait);
809
809
}
810
810
EXPORT_SYMBOL_GPL(mddev_unlock);
811
811
···
2452
2452
if (test_bit(AutoDetected, &rdev->flags))
2453
2453
md_autodetect_dev(rdev->bdev->bd_dev);
2454
2454
#endif
2455
-
blkdev_put(rdev->bdev, mddev->external ? &claim_rdev : rdev);
2455
+
blkdev_put(rdev->bdev,
2456
+
test_bit(Holder, &rdev->flags) ? rdev : &claim_rdev);
2456
2457
rdev->bdev = NULL;
2457
2458
kobject_put(&rdev->kobj);
2458
2459
}
···
3633
3632
static struct md_rdev *md_import_device(dev_t newdev, int super_format, int super_minor)
3634
3633
{
3635
3634
struct md_rdev *rdev;
3635
+
struct md_rdev *holder;
3636
3636
sector_t size;
3637
3637
int err;
3638
3638
···
3648
3646
if (err)
3649
3647
goto out_clear_rdev;
3650
3648
3649
+
if (super_format == -2) {
3650
+
holder = &claim_rdev;
3651
+
} else {
3652
+
holder = rdev;
3653
+
set_bit(Holder, &rdev->flags);
3654
+
}
3655
+
3651
3656
rdev->bdev = blkdev_get_by_dev(newdev, BLK_OPEN_READ | BLK_OPEN_WRITE,
3652
-
super_format == -2 ? &claim_rdev : rdev, NULL);
3657
+
holder, NULL);
3653
3658
if (IS_ERR(rdev->bdev)) {
3654
3659
pr_warn("md: could not open device unknown-block(%u,%u).\n",
3655
3660
MAJOR(newdev), MINOR(newdev));
···
3693
3684
return rdev;
3694
3685
3695
3686
out_blkdev_put:
3696
-
blkdev_put(rdev->bdev, super_format == -2 ? &claim_rdev : rdev);
3687
+
blkdev_put(rdev->bdev, holder);
3697
3688
out_clear_rdev:
3698
3689
md_rdev_clear(rdev);
3699
3690
out_free_rdev:
···
8265
8256
spin_unlock(&all_mddevs_lock);
8266
8257
8267
8258
if (to_put)
8268
-
mddev_put(mddev);
8259
+
mddev_put(to_put);
8269
8260
return next_mddev;
8270
8261
8271
8262
}
+3
drivers/md/md.h
+3
drivers/md/md.h
+1
-2
drivers/md/raid1.c
+1
-2
drivers/md/raid1.c
···
1837
1837
struct r1conf *conf = mddev->private;
1838
1838
int err = 0;
1839
1839
int number = rdev->raid_disk;
1840
+
struct raid1_info *p = conf->mirrors + number;
1840
1841
1841
1842
if (unlikely(number >= conf->raid_disks))
1842
1843
goto abort;
1843
-
1844
-
struct raid1_info *p = conf->mirrors + number;
1845
1844
1846
1845
if (rdev != p->rdev)
1847
1846
p = conf->mirrors + conf->raid_disks + number;
+35
-19
drivers/nvme/host/core.c
+35
-19
drivers/nvme/host/core.c
···
2245
2245
else
2246
2246
ctrl->ctrl_config = NVME_CC_CSS_NVM;
2247
2247
2248
-
if (ctrl->cap & NVME_CAP_CRMS_CRWMS) {
2249
-
u32 crto;
2250
-
2251
-
ret = ctrl->ops->reg_read32(ctrl, NVME_REG_CRTO, &crto);
2252
-
if (ret) {
2253
-
dev_err(ctrl->device, "Reading CRTO failed (%d)\n",
2254
-
ret);
2255
-
return ret;
2256
-
}
2257
-
2258
-
if (ctrl->cap & NVME_CAP_CRMS_CRIMS) {
2259
-
ctrl->ctrl_config |= NVME_CC_CRIME;
2260
-
timeout = NVME_CRTO_CRIMT(crto);
2261
-
} else {
2262
-
timeout = NVME_CRTO_CRWMT(crto);
2263
-
}
2264
-
} else {
2265
-
timeout = NVME_CAP_TIMEOUT(ctrl->cap);
2266
-
}
2248
+
if (ctrl->cap & NVME_CAP_CRMS_CRWMS && ctrl->cap & NVME_CAP_CRMS_CRIMS)
2249
+
ctrl->ctrl_config |= NVME_CC_CRIME;
2267
2250
2268
2251
ctrl->ctrl_config |= (NVME_CTRL_PAGE_SHIFT - 12) << NVME_CC_MPS_SHIFT;
2269
2252
ctrl->ctrl_config |= NVME_CC_AMS_RR | NVME_CC_SHN_NONE;
···
2259
2276
ret = ctrl->ops->reg_read32(ctrl, NVME_REG_CC, &ctrl->ctrl_config);
2260
2277
if (ret)
2261
2278
return ret;
2279
+
2280
+
/* CAP value may change after initial CC write */
2281
+
ret = ctrl->ops->reg_read64(ctrl, NVME_REG_CAP, &ctrl->cap);
2282
+
if (ret)
2283
+
return ret;
2284
+
2285
+
timeout = NVME_CAP_TIMEOUT(ctrl->cap);
2286
+
if (ctrl->cap & NVME_CAP_CRMS_CRWMS) {
2287
+
u32 crto, ready_timeout;
2288
+
2289
+
ret = ctrl->ops->reg_read32(ctrl, NVME_REG_CRTO, &crto);
2290
+
if (ret) {
2291
+
dev_err(ctrl->device, "Reading CRTO failed (%d)\n",
2292
+
ret);
2293
+
return ret;
2294
+
}
2295
+
2296
+
/*
2297
+
* CRTO should always be greater or equal to CAP.TO, but some
2298
+
* devices are known to get this wrong. Use the larger of the
2299
+
* two values.
2300
+
*/
2301
+
if (ctrl->ctrl_config & NVME_CC_CRIME)
2302
+
ready_timeout = NVME_CRTO_CRIMT(crto);
2303
+
else
2304
+
ready_timeout = NVME_CRTO_CRWMT(crto);
2305
+
2306
+
if (ready_timeout < timeout)
2307
+
dev_warn_once(ctrl->device, "bad crto:%x cap:%llx\n",
2308
+
crto, ctrl->cap);
2309
+
else
2310
+
timeout = ready_timeout;
2311
+
}
2262
2312
2263
2313
ctrl->ctrl_config |= NVME_CC_ENABLE;
2264
2314
ret = ctrl->ops->reg_write32(ctrl, NVME_REG_CC, ctrl->ctrl_config);
+1
-1
drivers/nvme/host/fc.c
+1
-1
drivers/nvme/host/fc.c
···
1924
1924
struct nvme_fc_fcp_op *op = fcp_req_to_fcp_op(req);
1925
1925
struct request *rq = op->rq;
1926
1926
1927
-
if (!IS_ENABLED(CONFIG_BLK_CGROUP_FC_APPID) || !rq->bio)
1927
+
if (!IS_ENABLED(CONFIG_BLK_CGROUP_FC_APPID) || !rq || !rq->bio)
1928
1928
return NULL;
1929
1929
return blkcg_get_fc_appid(rq->bio);
1930
1930
}
+1
-1
drivers/nvme/host/hwmon.c
+1
-1
drivers/nvme/host/hwmon.c
···
187
187
return 0;
188
188
}
189
189
190
-
static const struct hwmon_channel_info *nvme_hwmon_info[] = {
190
+
static const struct hwmon_channel_info *const nvme_hwmon_info[] = {
191
191
HWMON_CHANNEL_INFO(chip, HWMON_C_REGISTER_TZ),
192
192
HWMON_CHANNEL_INFO(temp,
193
193
HWMON_T_INPUT | HWMON_T_MAX | HWMON_T_MIN |
-3
drivers/nvme/host/pci.c
-3
drivers/nvme/host/pci.c