Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'block-6.0-2022-09-09' of git://git.kernel.dk/linux-block
Pull block fixes from Jens Axboe:
- NVMe pull via Christoph:
- fix a use after free in nvmet (Bart Van Assche)
- fix a use after free when detecting digest errors
(Sagi Grimberg)
- fix regression that causes sporadic TCP requests to time out
(Sagi Grimberg)
- fix two off by ones errors in the nvmet ZNS support
(Dennis Maisenbacher)
- requeue aen after firmware activation (Keith Busch)
- Fix missing request flags in debugfs code (me)
- Partition scan fix (Ming)
* tag 'block-6.0-2022-09-09' of git://git.kernel.dk/linux-block:
block: add missing request flags to debugfs code
nvme: requeue aen after firmware activation
nvmet: fix mar and mor off-by-one errors
nvme-tcp: fix regression that causes sporadic requests to time out
nvme-tcp: fix UAF when detecting digest errors
nvmet: fix a use-after-free
block: don't add partitions if GD_SUPPRESS_PART_SCAN is set
+37
-12
+2
block/blk-mq-debugfs.c
+2
block/blk-mq-debugfs.c
+3
block/partitions/core.c
+3
block/partitions/core.c
+11
-3
drivers/nvme/host/core.c
+11
-3
drivers/nvme/host/core.c
···
4703
4703
nvme_start_queues(ctrl);
4704
4704
/* read FW slot information to clear the AER */
4705
4705
nvme_get_fw_slot_info(ctrl);
4706
+
4707
+
queue_work(nvme_wq, &ctrl->async_event_work);
4706
4708
}
4707
4709
4708
4710
static u32 nvme_aer_type(u32 result)
···
4717
4715
return (result & 0xff00) >> 8;
4718
4716
}
4719
4717
4720
-
static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
4718
+
static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
4721
4719
{
4722
4720
u32 aer_notice_type = nvme_aer_subtype(result);
4721
+
bool requeue = true;
4723
4722
4724
4723
trace_nvme_async_event(ctrl, aer_notice_type);
4725
4724
···
4737
4734
*/
4738
4735
if (nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING)) {
4739
4736
nvme_auth_stop(ctrl);
4737
+
requeue = false;
4740
4738
queue_work(nvme_wq, &ctrl->fw_act_work);
4741
4739
}
4742
4740
break;
···
4754
4750
default:
4755
4751
dev_warn(ctrl->device, "async event result %08x\n", result);
4756
4752
}
4753
+
return requeue;
4757
4754
}
4758
4755
4759
4756
static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl)
···
4770
4765
u32 result = le32_to_cpu(res->u32);
4771
4766
u32 aer_type = nvme_aer_type(result);
4772
4767
u32 aer_subtype = nvme_aer_subtype(result);
4768
+
bool requeue = true;
4773
4769
4774
4770
if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS)
4775
4771
return;
4776
4772
4777
4773
switch (aer_type) {
4778
4774
case NVME_AER_NOTICE:
4779
-
nvme_handle_aen_notice(ctrl, result);
4775
+
requeue = nvme_handle_aen_notice(ctrl, result);
4780
4776
break;
4781
4777
case NVME_AER_ERROR:
4782
4778
/*
···
4798
4792
default:
4799
4793
break;
4800
4794
}
4801
-
queue_work(nvme_wq, &ctrl->async_event_work);
4795
+
4796
+
if (requeue)
4797
+
queue_work(nvme_wq, &ctrl->async_event_work);
4802
4798
}
4803
4799
EXPORT_SYMBOL_GPL(nvme_complete_async_event);
4804
4800
+2
-5
drivers/nvme/host/tcp.c
+2
-5
drivers/nvme/host/tcp.c
···
121
121
struct mutex send_mutex;
122
122
struct llist_head req_list;
123
123
struct list_head send_list;
124
-
bool more_requests;
125
124
126
125
/* recv state */
127
126
void *pdu;
···
319
320
static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue)
320
321
{
321
322
return !list_empty(&queue->send_list) ||
322
-
!llist_empty(&queue->req_list) || queue->more_requests;
323
+
!llist_empty(&queue->req_list);
323
324
}
324
325
325
326
static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req,
···
338
339
*/
339
340
if (queue->io_cpu == raw_smp_processor_id() &&
340
341
sync && empty && mutex_trylock(&queue->send_mutex)) {
341
-
queue->more_requests = !last;
342
342
nvme_tcp_send_all(queue);
343
-
queue->more_requests = false;
344
343
mutex_unlock(&queue->send_mutex);
345
344
}
346
345
···
1226
1229
else if (unlikely(result < 0))
1227
1230
return;
1228
1231
1229
-
if (!pending)
1232
+
if (!pending || !queue->rd_enabled)
1230
1233
return;
1231
1234
1232
1235
} while (!time_after(jiffies, deadline)); /* quota is exhausted */
+4
-2
drivers/nvme/target/core.c
+4
-2
drivers/nvme/target/core.c
···
735
735
736
736
static void __nvmet_req_complete(struct nvmet_req *req, u16 status)
737
737
{
738
+
struct nvmet_ns *ns = req->ns;
739
+
738
740
if (!req->sq->sqhd_disabled)
739
741
nvmet_update_sq_head(req);
740
742
req->cqe->sq_id = cpu_to_le16(req->sq->qid);
···
747
745
748
746
trace_nvmet_req_complete(req);
749
747
750
-
if (req->ns)
751
-
nvmet_put_namespace(req->ns);
752
748
req->ops->queue_response(req);
749
+
if (ns)
750
+
nvmet_put_namespace(ns);
753
751
}
754
752
755
753
void nvmet_req_complete(struct nvmet_req *req, u16 status)
+15
-2
drivers/nvme/target/zns.c
+15
-2
drivers/nvme/target/zns.c
···
100
100
struct nvme_id_ns_zns *id_zns;
101
101
u64 zsze;
102
102
u16 status;
103
+
u32 mar, mor;
103
104
104
105
if (le32_to_cpu(req->cmd->identify.nsid) == NVME_NSID_ALL) {
105
106
req->error_loc = offsetof(struct nvme_identify, nsid);
···
131
130
zsze = (bdev_zone_sectors(req->ns->bdev) << 9) >>
132
131
req->ns->blksize_shift;
133
132
id_zns->lbafe[0].zsze = cpu_to_le64(zsze);
134
-
id_zns->mor = cpu_to_le32(bdev_max_open_zones(req->ns->bdev));
135
-
id_zns->mar = cpu_to_le32(bdev_max_active_zones(req->ns->bdev));
133
+
134
+
mor = bdev_max_open_zones(req->ns->bdev);
135
+
if (!mor)
136
+
mor = U32_MAX;
137
+
else
138
+
mor--;
139
+
id_zns->mor = cpu_to_le32(mor);
140
+
141
+
mar = bdev_max_active_zones(req->ns->bdev);
142
+
if (!mar)
143
+
mar = U32_MAX;
144
+
else
145
+
mar--;
146
+
id_zns->mar = cpu_to_le32(mar);
136
147
137
148
done:
138
149
status = nvmet_copy_to_sgl(req, 0, id_zns, sizeof(*id_zns));