Merge tag 'block-6.1-2022-11-11' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

- NVMe pull request via Christoph:
- Quiet user passthrough command errors (Keith Busch)
- Fix memory leak in nvmet_subsys_attr_model_store_locked
- Fix a memory leak in nvmet-auth (Sagi Grimberg)

- Fix a potential NULL point deref in bfq (Yu)

- Allocate command/response buffers separately for DMA for sed-opal,
rather than rely on embedded alignment (Serge)

* tag 'block-6.1-2022-11-11' of git://git.kernel.dk/linux:
nvmet: fix a memory leak
nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
nvme: quiet user passthrough command errors
block: sed-opal: kmalloc the cmd/resp buffers
block, bfq: fix null pointer dereference in bfq_bio_bfqg()

Linus Torvalds 3 years ago b0b6e2c9 4e6b2b2e

+39 -10

5 changed files

expand all

block

bfq-cgroup.c

sed-opal.c

drivers

nvme

host

core.c

pci.c

target

configfs.c

block/bfq-cgroup.c

··· 610 610 struct bfq_group *bfqg; 611 611 612 612 while (blkg) { 613 + if (!blkg->online) { 614 + blkg = blkg->parent; 615 + continue; 616 + } 613 617 bfqg = blkg_to_bfqg(blkg); 614 618 if (bfqg->online) { 615 619 bio_associate_blkg_from_css(bio, &blkg->blkcg->css);

+28 -4

block/sed-opal.c

··· 87 87 u64 lowest_lba; 88 88 89 89 size_t pos; 90 - u8 cmd[IO_BUFFER_LENGTH]; 91 - u8 resp[IO_BUFFER_LENGTH]; 90 + u8 *cmd; 91 + u8 *resp; 92 92 93 93 struct parsed_resp parsed; 94 94 size_t prev_d_len; ··· 2175 2175 return; 2176 2176 2177 2177 clean_opal_dev(dev); 2178 + kfree(dev->resp); 2179 + kfree(dev->cmd); 2178 2180 kfree(dev); 2179 2181 } 2180 2182 EXPORT_SYMBOL(free_opal_dev); ··· 2189 2187 if (!dev) 2190 2188 return NULL; 2191 2189 2190 + /* 2191 + * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes 2192 + * sure the allocated buffer is DMA-safe in that regard. 2193 + */ 2194 + dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); 2195 + if (!dev->cmd) 2196 + goto err_free_dev; 2197 + 2198 + dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); 2199 + if (!dev->resp) 2200 + goto err_free_cmd; 2201 + 2192 2202 INIT_LIST_HEAD(&dev->unlk_lst); 2193 2203 mutex_init(&dev->dev_lock); 2194 2204 dev->flags = 0; ··· 2208 2194 dev->send_recv = send_recv; 2209 2195 if (check_opal_support(dev) != 0) { 2210 2196 pr_debug("Opal is not supported on this device\n"); 2211 - kfree(dev); 2212 - return NULL; 2197 + goto err_free_resp; 2213 2198 } 2214 2199 2215 2200 return dev; 2201 + 2202 + err_free_resp: 2203 + kfree(dev->resp); 2204 + 2205 + err_free_cmd: 2206 + kfree(dev->cmd); 2207 + 2208 + err_free_dev: 2209 + kfree(dev); 2210 + 2211 + return NULL; 2216 2212 } 2217 2213 EXPORT_SYMBOL(init_opal_dev); 2218 2214

+1 -2

drivers/nvme/host/core.c

··· 675 675 if (req->mq_hctx->type == HCTX_TYPE_POLL) 676 676 req->cmd_flags |= REQ_POLLED; 677 677 nvme_clear_nvme_request(req); 678 + req->rq_flags |= RQF_QUIET; 678 679 memcpy(nvme_req(req)->cmd, cmd, sizeof(*cmd)); 679 680 } 680 681 EXPORT_SYMBOL_GPL(nvme_init_request); ··· 1038 1037 goto out; 1039 1038 } 1040 1039 1041 - req->rq_flags |= RQF_QUIET; 1042 1040 ret = nvme_execute_rq(req, at_head); 1043 1041 if (result && ret >= 0) 1044 1042 *result = nvme_req(req)->result; ··· 1227 1227 rq->timeout = ctrl->kato * HZ; 1228 1228 rq->end_io = nvme_keep_alive_end_io; 1229 1229 rq->end_io_data = ctrl; 1230 - rq->rq_flags |= RQF_QUIET; 1231 1230 blk_execute_rq_nowait(rq, false); 1232 1231 } 1233 1232

-2

drivers/nvme/host/pci.c

··· 1436 1436 1437 1437 abort_req->end_io = abort_endio; 1438 1438 abort_req->end_io_data = NULL; 1439 - abort_req->rq_flags |= RQF_QUIET; 1440 1439 blk_execute_rq_nowait(abort_req, false); 1441 1440 1442 1441 /* ··· 2489 2490 req->end_io_data = nvmeq; 2490 2491 2491 2492 init_completion(&nvmeq->delete_done); 2492 - req->rq_flags |= RQF_QUIET; 2493 2493 blk_execute_rq_nowait(req, false); 2494 2494 return 0; 2495 2495 }

+6 -2

drivers/nvme/target/configfs.c

··· 1215 1215 const char *page, size_t count) 1216 1216 { 1217 1217 int pos = 0, len; 1218 + char *val; 1218 1219 1219 1220 if (subsys->subsys_discovered) { 1220 1221 pr_err("Can't set model number. %s is already assigned\n", ··· 1238 1237 return -EINVAL; 1239 1238 } 1240 1239 1241 - subsys->model_number = kmemdup_nul(page, len, GFP_KERNEL); 1242 - if (!subsys->model_number) 1240 + val = kmemdup_nul(page, len, GFP_KERNEL); 1241 + if (!val) 1243 1242 return -ENOMEM; 1243 + kfree(subsys->model_number); 1244 + subsys->model_number = val; 1244 1245 return count; 1245 1246 } 1246 1247 ··· 1839 1836 1840 1837 #ifdef CONFIG_NVME_TARGET_AUTH 1841 1838 kfree(host->dhchap_secret); 1839 + kfree(host->dhchap_ctrl_secret); 1842 1840 #endif 1843 1841 kfree(host); 1844 1842 }

Configure Feed

Configure Feed