Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux
Pull block fixes from Jens Axboe:
"A fix for a regression with sed-opal and saved keys, and outside of
that an NVMe pull request fixing a few minor issues on that front"
* tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux:
nvme-pci: add BOGUS_NID for Intel 0a54 device
nvmet-auth: complete a request only after freeing the dhchap pointers
nvme: sanitize metadata bounce buffer for reads
block: Fix regression in sed-opal for a saved key.
nvme-auth: use chap->s2 to indicate bidirectional authentication
nvmet-tcp: Fix a possible UAF in queue intialization setup
nvme-rdma: do not try to stop unallocated queues
+25
-18
+3
-4
block/sed-opal.c
+3
-4
block/sed-opal.c
···
2888
2888
if (lk_unlk->session.who > OPAL_USER9)
2889
2889
return -EINVAL;
2890
2890
2891
-
ret = opal_get_key(dev, &lk_unlk->session.opal_key);
2892
-
if (ret)
2893
-
return ret;
2894
2891
mutex_lock(&dev->dev_lock);
2895
2892
opal_lock_check_for_saved_key(dev, lk_unlk);
2896
-
ret = __opal_lock_unlock(dev, lk_unlk);
2893
+
ret = opal_get_key(dev, &lk_unlk->session.opal_key);
2894
+
if (!ret)
2895
+
ret = __opal_lock_unlock(dev, lk_unlk);
2897
2896
mutex_unlock(&dev->dev_lock);
2898
2897
2899
2898
return ret;
+2
-2
drivers/nvme/host/auth.c
+2
-2
drivers/nvme/host/auth.c
···
341
341
struct nvmf_auth_dhchap_success1_data *data = chap->buf;
342
342
size_t size = sizeof(*data);
343
343
344
-
if (chap->ctrl_key)
344
+
if (chap->s2)
345
345
size += chap->hash_len;
346
346
347
347
if (size > CHAP_BUF_SIZE) {
···
825
825
goto fail2;
826
826
}
827
827
828
-
if (chap->ctrl_key) {
828
+
if (chap->s2) {
829
829
/* DH-HMAC-CHAP Step 5: send success2 */
830
830
dev_dbg(ctrl->device, "%s: qid %d send success2\n",
831
831
__func__, chap->qid);
+7
-3
drivers/nvme/host/ioctl.c
+7
-3
drivers/nvme/host/ioctl.c
···
108
108
if (!buf)
109
109
goto out;
110
110
111
-
ret = -EFAULT;
112
-
if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len))
113
-
goto out_free_meta;
111
+
if (req_op(req) == REQ_OP_DRV_OUT) {
112
+
ret = -EFAULT;
113
+
if (copy_from_user(buf, ubuf, len))
114
+
goto out_free_meta;
115
+
} else {
116
+
memset(buf, 0, len);
117
+
}
114
118
115
119
bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);
116
120
if (IS_ERR(bip)) {
+2
-1
drivers/nvme/host/pci.c
+2
-1
drivers/nvme/host/pci.c
···
3329
3329
{ PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */
3330
3330
.driver_data = NVME_QUIRK_STRIPE_SIZE |
3331
3331
NVME_QUIRK_DEALLOCATE_ZEROES |
3332
-
NVME_QUIRK_IGNORE_DEV_SUBNQN, },
3332
+
NVME_QUIRK_IGNORE_DEV_SUBNQN |
3333
+
NVME_QUIRK_BOGUS_NID, },
3333
3334
{ PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */
3334
3335
.driver_data = NVME_QUIRK_STRIPE_SIZE |
3335
3336
NVME_QUIRK_DEALLOCATE_ZEROES, },
+3
drivers/nvme/host/rdma.c
+3
drivers/nvme/host/rdma.c
···
638
638
639
639
static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
640
640
{
641
+
if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
642
+
return;
643
+
641
644
mutex_lock(&queue->queue_lock);
642
645
if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
643
646
__nvme_rdma_stop_queue(queue);
+6
-3
drivers/nvme/target/fabrics-cmd-auth.c
+6
-3
drivers/nvme/target/fabrics-cmd-auth.c
···
333
333
__func__, ctrl->cntlid, req->sq->qid,
334
334
status, req->error_loc);
335
335
req->cqe->result.u64 = 0;
336
-
nvmet_req_complete(req, status);
337
336
if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
338
337
req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
339
338
unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
340
339
341
340
mod_delayed_work(system_wq, &req->sq->auth_expired_work,
342
341
auth_expire_secs * HZ);
343
-
return;
342
+
goto complete;
344
343
}
345
344
/* Final states, clear up variables */
346
345
nvmet_auth_sq_free(req->sq);
347
346
if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)
348
347
nvmet_ctrl_fatal_error(ctrl);
348
+
349
+
complete:
350
+
nvmet_req_complete(req, status);
349
351
}
350
352
351
353
static int nvmet_auth_challenge(struct nvmet_req *req, void *d, int al)
···
516
514
kfree(d);
517
515
done:
518
516
req->cqe->result.u64 = 0;
519
-
nvmet_req_complete(req, status);
517
+
520
518
if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2)
521
519
nvmet_auth_sq_free(req->sq);
522
520
else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {
523
521
nvmet_auth_sq_free(req->sq);
524
522
nvmet_ctrl_fatal_error(ctrl);
525
523
}
524
+
nvmet_req_complete(req, status);
526
525
}
+2
-5
drivers/nvme/target/tcp.c
+2
-5
drivers/nvme/target/tcp.c
···
372
372
373
373
static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
374
374
{
375
+
queue->rcv_state = NVMET_TCP_RECV_ERR;
375
376
if (status == -EPIPE || status == -ECONNRESET)
376
377
kernel_sock_shutdown(queue->sock, SHUT_RDWR);
377
378
else
···
911
910
iov.iov_len = sizeof(*icresp);
912
911
ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
913
912
if (ret < 0)
914
-
goto free_crypto;
913
+
return ret; /* queue removal will cleanup */
915
914
916
915
queue->state = NVMET_TCP_Q_LIVE;
917
916
nvmet_prepare_receive_pdu(queue);
918
917
return 0;
919
-
free_crypto:
920
-
if (queue->hdr_digest || queue->data_digest)
921
-
nvmet_tcp_free_crypto(queue);
922
-
return ret;
923
918
}
924
919
925
920
static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,