tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

- NVMe pull request via Keith:
- Fix nvme-pci IRQ race and slab-out-of-bounds access
- Fix recursive workqueue locking for target async events
- Various cleanups

- Fix a potential NULL pointer dereference in ublk on size setting

- ublk automatic partition scanning fix

- Two s390 dasd fixes

* tag 'block-7.0-20260312' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
nvme: Annotate struct nvme_dhchap_key with __counted_by
nvme-core: do not pass empty queue_limits to blk_mq_alloc_queue()
nvme-pci: Fix race bug in nvme_poll_irqdisable()
nvmet: move async event work off nvmet-wq
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
s390/dasd: Copy detected format information to secondary device
s390/dasd: Move quiesce state with pprc swap
ublk: don't clear GD_SUPPRESS_PART_SCAN for unprivileged daemons
ublk: fix NULL pointer dereference in ublk_ctrl_set_size()

Linus Torvalds 73548503 e67bf352

+50 -13
+12 -4
drivers/block/ublk_drv.c
··· 4443 4443 4444 4444 /* Skip partition scan if disabled by user */ 4445 4445 if (ub->dev_info.flags & UBLK_F_NO_AUTO_PART_SCAN) { 4446 - clear_bit(GD_SUPPRESS_PART_SCAN, &disk->state); 4446 + /* Not clear for unprivileged daemons, see comment above */ 4447 + if (!ub->unprivileged_daemons) 4448 + clear_bit(GD_SUPPRESS_PART_SCAN, &disk->state); 4447 4449 } else { 4448 4450 /* Schedule async partition scan for trusted daemons */ 4449 4451 if (!ub->unprivileged_daemons) ··· 5008 5006 return 0; 5009 5007 } 5010 5008 5011 - static void ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksrv_ctrl_cmd *header) 5009 + static int ublk_ctrl_set_size(struct ublk_device *ub, const struct ublksrv_ctrl_cmd *header) 5012 5010 { 5013 5011 struct ublk_param_basic *p = &ub->params.basic; 5014 5012 u64 new_size = header->data[0]; 5013 + int ret = 0; 5015 5014 5016 5015 mutex_lock(&ub->mutex); 5016 + if (!ub->ub_disk) { 5017 + ret = -ENODEV; 5018 + goto out; 5019 + } 5017 5020 p->dev_sectors = new_size; 5018 5021 set_capacity_and_notify(ub->ub_disk, p->dev_sectors); 5022 + out: 5019 5023 mutex_unlock(&ub->mutex); 5024 + return ret; 5020 5025 } 5021 5026 5022 5027 struct count_busy { ··· 5344 5335 ret = ublk_ctrl_end_recovery(ub, &header); 5345 5336 break; 5346 5337 case UBLK_CMD_UPDATE_SIZE: 5347 - ublk_ctrl_set_size(ub, &header); 5348 - ret = 0; 5338 + ret = ublk_ctrl_set_size(ub, &header); 5349 5339 break; 5350 5340 case UBLK_CMD_QUIESCE_DEV: 5351 5341 ret = ublk_ctrl_quiesce_dev(ub, &header);
+1 -2
drivers/nvme/host/core.c
··· 4834 4834 int nvme_alloc_admin_tag_set(struct nvme_ctrl *ctrl, struct blk_mq_tag_set *set, 4835 4835 const struct blk_mq_ops *ops, unsigned int cmd_size) 4836 4836 { 4837 - struct queue_limits lim = {}; 4838 4837 int ret; 4839 4838 4840 4839 memset(set, 0, sizeof(*set)); ··· 4860 4861 if (ctrl->admin_q) 4861 4862 blk_put_queue(ctrl->admin_q); 4862 4863 4863 - ctrl->admin_q = blk_mq_alloc_queue(set, &lim, NULL); 4864 + ctrl->admin_q = blk_mq_alloc_queue(set, NULL, NULL); 4864 4865 if (IS_ERR(ctrl->admin_q)) { 4865 4866 ret = PTR_ERR(ctrl->admin_q); 4866 4867 goto out_free_tagset;
+5 -3
drivers/nvme/host/pci.c
··· 544 544 /* Free memory and continue on */ 545 545 nvme_dbbuf_dma_free(dev); 546 546 547 - for (i = 1; i <= dev->online_queues; i++) 547 + for (i = 1; i < dev->online_queues; i++) 548 548 nvme_dbbuf_free(&dev->queues[i]); 549 549 } 550 550 } ··· 1625 1625 static void nvme_poll_irqdisable(struct nvme_queue *nvmeq) 1626 1626 { 1627 1627 struct pci_dev *pdev = to_pci_dev(nvmeq->dev->dev); 1628 + int irq; 1628 1629 1629 1630 WARN_ON_ONCE(test_bit(NVMEQ_POLLED, &nvmeq->flags)); 1630 1631 1631 - disable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); 1632 + irq = pci_irq_vector(pdev, nvmeq->cq_vector); 1633 + disable_irq(irq); 1632 1634 spin_lock(&nvmeq->cq_poll_lock); 1633 1635 nvme_poll_cq(nvmeq, NULL); 1634 1636 spin_unlock(&nvmeq->cq_poll_lock); 1635 - enable_irq(pci_irq_vector(pdev, nvmeq->cq_vector)); 1637 + enable_irq(irq); 1636 1638 } 1637 1639 1638 1640 static int nvme_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)
+1 -1
drivers/nvme/target/admin-cmd.c
··· 1585 1585 ctrl->async_event_cmds[ctrl->nr_async_event_cmds++] = req; 1586 1586 mutex_unlock(&ctrl->lock); 1587 1587 1588 - queue_work(nvmet_wq, &ctrl->async_event_work); 1588 + queue_work(nvmet_aen_wq, &ctrl->async_event_work); 1589 1589 } 1590 1590 1591 1591 void nvmet_execute_keep_alive(struct nvmet_req *req)
+12 -2
drivers/nvme/target/core.c
··· 27 27 28 28 struct workqueue_struct *nvmet_wq; 29 29 EXPORT_SYMBOL_GPL(nvmet_wq); 30 + struct workqueue_struct *nvmet_aen_wq; 31 + EXPORT_SYMBOL_GPL(nvmet_aen_wq); 30 32 31 33 /* 32 34 * This read/write semaphore is used to synchronize access to configuration ··· 208 206 list_add_tail(&aen->entry, &ctrl->async_events); 209 207 mutex_unlock(&ctrl->lock); 210 208 211 - queue_work(nvmet_wq, &ctrl->async_event_work); 209 + queue_work(nvmet_aen_wq, &ctrl->async_event_work); 212 210 } 213 211 214 212 static void nvmet_add_to_changed_ns_log(struct nvmet_ctrl *ctrl, __le32 nsid) ··· 1958 1956 if (!nvmet_wq) 1959 1957 goto out_free_buffered_work_queue; 1960 1958 1959 + nvmet_aen_wq = alloc_workqueue("nvmet-aen-wq", 1960 + WQ_MEM_RECLAIM | WQ_UNBOUND, 0); 1961 + if (!nvmet_aen_wq) 1962 + goto out_free_nvmet_work_queue; 1963 + 1961 1964 error = nvmet_init_debugfs(); 1962 1965 if (error) 1963 - goto out_free_nvmet_work_queue; 1966 + goto out_free_nvmet_aen_work_queue; 1964 1967 1965 1968 error = nvmet_init_discovery(); 1966 1969 if (error) ··· 1981 1974 nvmet_exit_discovery(); 1982 1975 out_exit_debugfs: 1983 1976 nvmet_exit_debugfs(); 1977 + out_free_nvmet_aen_work_queue: 1978 + destroy_workqueue(nvmet_aen_wq); 1984 1979 out_free_nvmet_work_queue: 1985 1980 destroy_workqueue(nvmet_wq); 1986 1981 out_free_buffered_work_queue: ··· 2000 1991 nvmet_exit_discovery(); 2001 1992 nvmet_exit_debugfs(); 2002 1993 ida_destroy(&cntlid_ida); 1994 + destroy_workqueue(nvmet_aen_wq); 2003 1995 destroy_workqueue(nvmet_wq); 2004 1996 destroy_workqueue(buffered_io_wq); 2005 1997 destroy_workqueue(zbd_wq);
+1
drivers/nvme/target/nvmet.h
··· 501 501 extern struct workqueue_struct *buffered_io_wq; 502 502 extern struct workqueue_struct *zbd_wq; 503 503 extern struct workqueue_struct *nvmet_wq; 504 + extern struct workqueue_struct *nvmet_aen_wq; 504 505 505 506 static inline void nvmet_set_result(struct nvmet_req *req, u32 result) 506 507 {
+1
drivers/nvme/target/rdma.c
··· 2087 2087 mutex_unlock(&nvmet_rdma_queue_mutex); 2088 2088 2089 2089 flush_workqueue(nvmet_wq); 2090 + flush_workqueue(nvmet_aen_wq); 2090 2091 } 2091 2092 2092 2093 static struct ib_client nvmet_rdma_ib_client = {
+16
drivers/s390/block/dasd_eckd.c
··· 6135 6135 static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid, 6136 6136 char *sec_busid) 6137 6137 { 6138 + struct dasd_eckd_private *prim_priv, *sec_priv; 6138 6139 struct dasd_device *primary, *secondary; 6139 6140 struct dasd_copy_relation *copy; 6140 6141 struct dasd_block *block; ··· 6155 6154 secondary = copy_relation_find_device(copy, sec_busid); 6156 6155 if (!secondary) 6157 6156 return DASD_COPYPAIRSWAP_SECONDARY; 6157 + 6158 + prim_priv = primary->private; 6159 + sec_priv = secondary->private; 6158 6160 6159 6161 /* 6160 6162 * usually the device should be quiesced for swap ··· 6185 6181 dev_name(&primary->cdev->dev), 6186 6182 dev_name(&secondary->cdev->dev), rc); 6187 6183 } 6184 + 6185 + if (primary->stopped & DASD_STOPPED_QUIESCE) { 6186 + dasd_device_set_stop_bits(secondary, DASD_STOPPED_QUIESCE); 6187 + dasd_device_remove_stop_bits(primary, DASD_STOPPED_QUIESCE); 6188 + } 6189 + 6190 + /* 6191 + * The secondary device never got through format detection, but since it 6192 + * is a copy of the primary device, the format is exactly the same; 6193 + * therefore, the detected layout can simply be copied. 6194 + */ 6195 + sec_priv->uses_cdl = prim_priv->uses_cdl; 6188 6196 6189 6197 /* re-enable device */ 6190 6198 dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC);
+1 -1
include/linux/nvme-auth.h
··· 11 11 struct nvme_dhchap_key { 12 12 size_t len; 13 13 u8 hash; 14 - u8 key[]; 14 + u8 key[] __counted_by(len); 15 15 }; 16 16 17 17 u32 nvme_auth_get_seqnum(void);