Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.dk/linux-block
Pull block layer fixes from Jens Axboe:
"Distilled down version of bug fixes for 3.7. The patches have been
well tested. If you notice that commit dates are from today, it's
because I pulled less important bits out and shuffled them into the
3.8 mix. Apart from that, no changes, base still the same.
It contains:
- Fix for aoe, don't run request_fn while it's plugged.
- Fix for a regression in floppy since 3.6, which causes problems if
no floppy is found.
- Stable fix for blk_exec(), don't touch a request after it has been
sent to the scheduler (and the device as well).
- Five fixes for various nasties in mtip32xx."
* 'for-linus' of git://git.kernel.dk/linux-block:
block: Don't access request after it might be freed
mtip32xx: Fix padding issue
aoe: avoid running request handler on plugged queue
mtip32xx: fix potential NULL pointer dereference in mtip_timeout_function()
mtip32xx: fix shift larger than type warning
mtip32xx: Fix incorrect mask used for erase mode
mtip32xx: Fix to make lba address correct in big-endian systems
mtip32xx: fix potential crash on SEC_ERASE_UNIT
dm: fix deadlock with request based dm and queue request_fn recursion
floppy: destroy floppy workqueue before cleaning up the queue
+33
-14
+7
-1
block/blk-exec.c
+7
-1
block/blk-exec.c
···
52
52
rq_end_io_fn *done)
53
53
{
54
54
int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
55
+
bool is_pm_resume;
55
56
56
57
WARN_ON(irqs_disabled());
57
58
58
59
rq->rq_disk = bd_disk;
59
60
rq->end_io = done;
61
+
/*
62
+
* need to check this before __blk_run_queue(), because rq can
63
+
* be freed before that returns.
64
+
*/
65
+
is_pm_resume = rq->cmd_type == REQ_TYPE_PM_RESUME;
60
66
61
67
spin_lock_irq(q->queue_lock);
62
68
···
77
71
__elv_add_request(q, rq, where);
78
72
__blk_run_queue(q);
79
73
/* the queue is stopped so it won't be run */
80
-
if (rq->cmd_type == REQ_TYPE_PM_RESUME)
74
+
if (is_pm_resume)
81
75
q->request_fn(q);
82
76
spin_unlock_irq(q->queue_lock);
83
77
}
+1
-1
drivers/block/aoe/aoecmd.c
+1
-1
drivers/block/aoe/aoecmd.c
+3
-2
drivers/block/floppy.c
+3
-2
drivers/block/floppy.c
···
4330
4330
out_unreg_blkdev:
4331
4331
unregister_blkdev(FLOPPY_MAJOR, "fd");
4332
4332
out_put_disk:
4333
+
destroy_workqueue(floppy_wq);
4333
4334
for (drive = 0; drive < N_DRIVE; drive++) {
4334
4335
if (!disks[drive])
4335
4336
break;
···
4341
4340
}
4342
4341
put_disk(disks[drive]);
4343
4342
}
4344
-
destroy_workqueue(floppy_wq);
4345
4343
return err;
4346
4344
}
4347
4345
···
4555
4555
unregister_blkdev(FLOPPY_MAJOR, "fd");
4556
4556
platform_driver_unregister(&floppy_driver);
4557
4557
4558
+
destroy_workqueue(floppy_wq);
4559
+
4558
4560
for (drive = 0; drive < N_DRIVE; drive++) {
4559
4561
del_timer_sync(&motor_off_timer[drive]);
4560
4562
···
4580
4578
4581
4579
cancel_delayed_work_sync(&fd_timeout);
4582
4580
cancel_delayed_work_sync(&fd_timer);
4583
-
destroy_workqueue(floppy_wq);
4584
4581
4585
4582
if (atomic_read(&usage_count))
4586
4583
floppy_release_irq_and_dma();
+12
-6
drivers/block/mtip32xx/mtip32xx.c
+12
-6
drivers/block/mtip32xx/mtip32xx.c
···
559
559
struct mtip_cmd *command;
560
560
int tag, cmdto_cnt = 0;
561
561
unsigned int bit, group;
562
-
unsigned int num_command_slots = port->dd->slot_groups * 32;
562
+
unsigned int num_command_slots;
563
563
unsigned long to, tagaccum[SLOTBITS_IN_LONGS];
564
564
565
565
if (unlikely(!port))
···
572
572
}
573
573
/* clear the tag accumulator */
574
574
memset(tagaccum, 0, SLOTBITS_IN_LONGS * sizeof(long));
575
+
num_command_slots = port->dd->slot_groups * 32;
575
576
576
577
for (tag = 0; tag < num_command_slots; tag++) {
577
578
/*
···
2219
2218
fis.device);
2220
2219
2221
2220
/* check for erase mode support during secure erase.*/
2222
-
if ((fis.command == ATA_CMD_SEC_ERASE_UNIT)
2223
-
&& (outbuf[0] & MTIP_SEC_ERASE_MODE)) {
2221
+
if ((fis.command == ATA_CMD_SEC_ERASE_UNIT) && outbuf &&
2222
+
(outbuf[0] & MTIP_SEC_ERASE_MODE)) {
2224
2223
erasemode = 1;
2225
2224
}
2226
2225
···
2440
2439
* return value
2441
2440
* None
2442
2441
*/
2443
-
static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
2442
+
static void mtip_hw_submit_io(struct driver_data *dd, sector_t sector,
2444
2443
int nsect, int nents, int tag, void *callback,
2445
2444
void *data, int dir)
2446
2445
{
···
2448
2447
struct mtip_port *port = dd->port;
2449
2448
struct mtip_cmd *command = &port->commands[tag];
2450
2449
int dma_dir = (dir == READ) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
2450
+
u64 start = sector;
2451
2451
2452
2452
/* Map the scatter list for DMA access */
2453
2453
nents = dma_map_sg(&dd->pdev->dev, command->sg, nents, dma_dir);
···
2467
2465
fis->opts = 1 << 7;
2468
2466
fis->command =
2469
2467
(dir == READ ? ATA_CMD_FPDMA_READ : ATA_CMD_FPDMA_WRITE);
2470
-
*((unsigned int *) &fis->lba_low) = (start & 0xFFFFFF);
2471
-
*((unsigned int *) &fis->lba_low_ex) = ((start >> 24) & 0xFFFFFF);
2468
+
fis->lba_low = start & 0xFF;
2469
+
fis->lba_mid = (start >> 8) & 0xFF;
2470
+
fis->lba_hi = (start >> 16) & 0xFF;
2471
+
fis->lba_low_ex = (start >> 24) & 0xFF;
2472
+
fis->lba_mid_ex = (start >> 32) & 0xFF;
2473
+
fis->lba_hi_ex = (start >> 40) & 0xFF;
2472
2474
fis->device = 1 << 6;
2473
2475
fis->features = nsect & 0xFF;
2474
2476
fis->features_ex = (nsect >> 8) & 0xFF;
+3
-3
drivers/block/mtip32xx/mtip32xx.h
+3
-3
drivers/block/mtip32xx/mtip32xx.h
···
34
34
#define PCIE_CONFIG_EXT_DEVICE_CONTROL_OFFSET 0x48
35
35
36
36
/* check for erase mode support during secure erase */
37
-
#define MTIP_SEC_ERASE_MODE 0x3
37
+
#define MTIP_SEC_ERASE_MODE 0x2
38
38
39
39
/* # of times to retry timed out/failed IOs */
40
40
#define MTIP_MAX_RETRIES 2
···
155
155
MTIP_DDF_REBUILD_FAILED_BIT = 8,
156
156
};
157
157
158
-
__packed struct smart_attr{
158
+
struct smart_attr {
159
159
u8 attr_id;
160
160
u16 flags;
161
161
u8 cur;
162
162
u8 worst;
163
163
u32 data;
164
164
u8 res[3];
165
-
};
165
+
} __packed;
166
166
167
167
/* Register Frame Information Structure (FIS), host to device. */
168
168
struct host_to_dev_fis {
+7
-1
drivers/md/dm.c
+7
-1
drivers/md/dm.c
···
740
740
if (!md_in_flight(md))
741
741
wake_up(&md->wait);
742
742
743
+
/*
744
+
* Run this off this callpath, as drivers could invoke end_io while
745
+
* inside their request_fn (and holding the queue lock). Calling
746
+
* back into ->request_fn() could deadlock attempting to grab the
747
+
* queue lock again.
748
+
*/
743
749
if (run_queue)
744
-
blk_run_queue(md->queue);
750
+
blk_run_queue_async(md->queue);
745
751
746
752
/*
747
753
* dm_put() must be at the end of this function. See the comment above