Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Kill unlikely checks for blk-rq-qos. These checks are really
all-or-nothing, either the branch is taken all the time, or it's not.
Depending on the configuration, either one of those cases may be
true. Just remove the annotation
- Fix for merging bios with different app tags set
- Fix for a recently introduced slowdown due to RCU synchronization
- Fix for a status change on loop while it's in use, and then a later
fix for that fix
- Fix for the async partition scanning in ublk
* tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
ublk: fix use-after-free in ublk_partition_scan_work
blk-mq: avoid stall during boot due to synchronize_rcu_expedited
loop: add missing bd_abort_claiming in loop_set_status
block: don't merge bios with different app_tags
blk-rq-qos: Remove unlikely() hints from QoS checks
loop: don't change loop device under exclusive opener in loop_set_status
+83
-50
+18
-5
block/blk-integrity.c
+18
-5
block/blk-integrity.c
···
140
140
bool blk_integrity_merge_rq(struct request_queue *q, struct request *req,
141
141
struct request *next)
142
142
{
143
+
struct bio_integrity_payload *bip, *bip_next;
144
+
143
145
if (blk_integrity_rq(req) == 0 && blk_integrity_rq(next) == 0)
144
146
return true;
145
147
146
148
if (blk_integrity_rq(req) == 0 || blk_integrity_rq(next) == 0)
147
149
return false;
148
150
149
-
if (bio_integrity(req->bio)->bip_flags !=
150
-
bio_integrity(next->bio)->bip_flags)
151
+
bip = bio_integrity(req->bio);
152
+
bip_next = bio_integrity(next->bio);
153
+
if (bip->bip_flags != bip_next->bip_flags)
154
+
return false;
155
+
156
+
if (bip->bip_flags & BIP_CHECK_APPTAG &&
157
+
bip->app_tag != bip_next->app_tag)
151
158
return false;
152
159
153
160
if (req->nr_integrity_segments + next->nr_integrity_segments >
···
170
163
bool blk_integrity_merge_bio(struct request_queue *q, struct request *req,
171
164
struct bio *bio)
172
165
{
166
+
struct bio_integrity_payload *bip, *bip_bio = bio_integrity(bio);
173
167
int nr_integrity_segs;
174
168
175
-
if (blk_integrity_rq(req) == 0 && bio_integrity(bio) == NULL)
169
+
if (blk_integrity_rq(req) == 0 && bip_bio == NULL)
176
170
return true;
177
171
178
-
if (blk_integrity_rq(req) == 0 || bio_integrity(bio) == NULL)
172
+
if (blk_integrity_rq(req) == 0 || bip_bio == NULL)
179
173
return false;
180
174
181
-
if (bio_integrity(req->bio)->bip_flags != bio_integrity(bio)->bip_flags)
175
+
bip = bio_integrity(req->bio);
176
+
if (bip->bip_flags != bip_bio->bip_flags)
177
+
return false;
178
+
179
+
if (bip->bip_flags & BIP_CHECK_APPTAG &&
180
+
bip->app_tag != bip_bio->app_tag)
182
181
return false;
183
182
184
183
nr_integrity_segs = blk_rq_count_integrity_sg(q, bio);
+1
-2
block/blk-mq.c
+1
-2
block/blk-mq.c
+9
-16
block/blk-rq-qos.h
+9
-16
block/blk-rq-qos.h
···
112
112
113
113
static inline void rq_qos_cleanup(struct request_queue *q, struct bio *bio)
114
114
{
115
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
116
-
q->rq_qos)
115
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
117
116
__rq_qos_cleanup(q->rq_qos, bio);
118
117
}
119
118
120
119
static inline void rq_qos_done(struct request_queue *q, struct request *rq)
121
120
{
122
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
123
-
q->rq_qos && !blk_rq_is_passthrough(rq))
121
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) &&
122
+
q->rq_qos && !blk_rq_is_passthrough(rq))
124
123
__rq_qos_done(q->rq_qos, rq);
125
124
}
126
125
127
126
static inline void rq_qos_issue(struct request_queue *q, struct request *rq)
128
127
{
129
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
130
-
q->rq_qos)
128
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
131
129
__rq_qos_issue(q->rq_qos, rq);
132
130
}
133
131
134
132
static inline void rq_qos_requeue(struct request_queue *q, struct request *rq)
135
133
{
136
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
137
-
q->rq_qos)
134
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
138
135
__rq_qos_requeue(q->rq_qos, rq);
139
136
}
140
137
···
159
162
160
163
static inline void rq_qos_throttle(struct request_queue *q, struct bio *bio)
161
164
{
162
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
163
-
q->rq_qos) {
165
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos) {
164
166
bio_set_flag(bio, BIO_QOS_THROTTLED);
165
167
__rq_qos_throttle(q->rq_qos, bio);
166
168
}
···
168
172
static inline void rq_qos_track(struct request_queue *q, struct request *rq,
169
173
struct bio *bio)
170
174
{
171
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
172
-
q->rq_qos)
175
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
173
176
__rq_qos_track(q->rq_qos, rq, bio);
174
177
}
175
178
176
179
static inline void rq_qos_merge(struct request_queue *q, struct request *rq,
177
180
struct bio *bio)
178
181
{
179
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
180
-
q->rq_qos) {
182
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos) {
181
183
bio_set_flag(bio, BIO_QOS_MERGED);
182
184
__rq_qos_merge(q->rq_qos, rq, bio);
183
185
}
···
183
189
184
190
static inline void rq_qos_queue_depth_changed(struct request_queue *q)
185
191
{
186
-
if (unlikely(test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags)) &&
187
-
q->rq_qos)
192
+
if (test_bit(QUEUE_FLAG_QOS_ENABLED, &q->queue_flags) && q->rq_qos)
188
193
__rq_qos_queue_depth_changed(q->rq_qos);
189
194
}
190
195
+33
-12
drivers/block/loop.c
+33
-12
drivers/block/loop.c
···
1225
1225
}
1226
1226
1227
1227
static int
1228
-
loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
1228
+
loop_set_status(struct loop_device *lo, blk_mode_t mode,
1229
+
struct block_device *bdev, const struct loop_info64 *info)
1229
1230
{
1230
1231
int err;
1231
1232
bool partscan = false;
1232
1233
bool size_changed = false;
1233
1234
unsigned int memflags;
1234
1235
1236
+
/*
1237
+
* If we don't hold exclusive handle for the device, upgrade to it
1238
+
* here to avoid changing device under exclusive owner.
1239
+
*/
1240
+
if (!(mode & BLK_OPEN_EXCL)) {
1241
+
err = bd_prepare_to_claim(bdev, loop_set_status, NULL);
1242
+
if (err)
1243
+
goto out_reread_partitions;
1244
+
}
1245
+
1235
1246
err = mutex_lock_killable(&lo->lo_mutex);
1236
1247
if (err)
1237
-
return err;
1248
+
goto out_abort_claiming;
1249
+
1238
1250
if (lo->lo_state != Lo_bound) {
1239
1251
err = -ENXIO;
1240
1252
goto out_unlock;
···
1285
1273
}
1286
1274
out_unlock:
1287
1275
mutex_unlock(&lo->lo_mutex);
1276
+
out_abort_claiming:
1277
+
if (!(mode & BLK_OPEN_EXCL))
1278
+
bd_abort_claiming(bdev, loop_set_status);
1279
+
out_reread_partitions:
1288
1280
if (partscan)
1289
1281
loop_reread_partitions(lo);
1290
1282
···
1368
1352
}
1369
1353
1370
1354
static int
1371
-
loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
1355
+
loop_set_status_old(struct loop_device *lo, blk_mode_t mode,
1356
+
struct block_device *bdev,
1357
+
const struct loop_info __user *arg)
1372
1358
{
1373
1359
struct loop_info info;
1374
1360
struct loop_info64 info64;
···
1378
1360
if (copy_from_user(&info, arg, sizeof (struct loop_info)))
1379
1361
return -EFAULT;
1380
1362
loop_info64_from_old(&info, &info64);
1381
-
return loop_set_status(lo, &info64);
1363
+
return loop_set_status(lo, mode, bdev, &info64);
1382
1364
}
1383
1365
1384
1366
static int
1385
-
loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg)
1367
+
loop_set_status64(struct loop_device *lo, blk_mode_t mode,
1368
+
struct block_device *bdev,
1369
+
const struct loop_info64 __user *arg)
1386
1370
{
1387
1371
struct loop_info64 info64;
1388
1372
1389
1373
if (copy_from_user(&info64, arg, sizeof (struct loop_info64)))
1390
1374
return -EFAULT;
1391
-
return loop_set_status(lo, &info64);
1375
+
return loop_set_status(lo, mode, bdev, &info64);
1392
1376
}
1393
1377
1394
1378
static int
···
1569
1549
case LOOP_SET_STATUS:
1570
1550
err = -EPERM;
1571
1551
if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
1572
-
err = loop_set_status_old(lo, argp);
1552
+
err = loop_set_status_old(lo, mode, bdev, argp);
1573
1553
break;
1574
1554
case LOOP_GET_STATUS:
1575
1555
return loop_get_status_old(lo, argp);
1576
1556
case LOOP_SET_STATUS64:
1577
1557
err = -EPERM;
1578
1558
if ((mode & BLK_OPEN_WRITE) || capable(CAP_SYS_ADMIN))
1579
-
err = loop_set_status64(lo, argp);
1559
+
err = loop_set_status64(lo, mode, bdev, argp);
1580
1560
break;
1581
1561
case LOOP_GET_STATUS64:
1582
1562
return loop_get_status64(lo, argp);
···
1670
1650
}
1671
1651
1672
1652
static int
1673
-
loop_set_status_compat(struct loop_device *lo,
1674
-
const struct compat_loop_info __user *arg)
1653
+
loop_set_status_compat(struct loop_device *lo, blk_mode_t mode,
1654
+
struct block_device *bdev,
1655
+
const struct compat_loop_info __user *arg)
1675
1656
{
1676
1657
struct loop_info64 info64;
1677
1658
int ret;
···
1680
1659
ret = loop_info64_from_compat(arg, &info64);
1681
1660
if (ret < 0)
1682
1661
return ret;
1683
-
return loop_set_status(lo, &info64);
1662
+
return loop_set_status(lo, mode, bdev, &info64);
1684
1663
}
1685
1664
1686
1665
static int
···
1706
1685
1707
1686
switch(cmd) {
1708
1687
case LOOP_SET_STATUS:
1709
-
err = loop_set_status_compat(lo,
1688
+
err = loop_set_status_compat(lo, mode, bdev,
1710
1689
(const struct compat_loop_info __user *)arg);
1711
1690
break;
1712
1691
case LOOP_GET_STATUS:
+22
-15
drivers/block/ublk_drv.c
+22
-15
drivers/block/ublk_drv.c
···
255
255
u16 q_id, u16 tag, struct ublk_io *io, size_t offset);
256
256
static inline unsigned int ublk_req_build_flags(struct request *req);
257
257
258
-
static void ublk_partition_scan_work(struct work_struct *work)
259
-
{
260
-
struct ublk_device *ub =
261
-
container_of(work, struct ublk_device, partition_scan_work);
262
-
263
-
if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
264
-
&ub->ub_disk->state)))
265
-
return;
266
-
267
-
mutex_lock(&ub->ub_disk->open_mutex);
268
-
bdev_disk_changed(ub->ub_disk, false);
269
-
mutex_unlock(&ub->ub_disk->open_mutex);
270
-
}
271
-
272
258
static inline struct ublksrv_io_desc *
273
259
ublk_get_iod(const struct ublk_queue *ubq, unsigned tag)
274
260
{
···
1583
1597
put_device(disk_to_dev(disk));
1584
1598
}
1585
1599
1600
+
static void ublk_partition_scan_work(struct work_struct *work)
1601
+
{
1602
+
struct ublk_device *ub =
1603
+
container_of(work, struct ublk_device, partition_scan_work);
1604
+
/* Hold disk reference to prevent UAF during concurrent teardown */
1605
+
struct gendisk *disk = ublk_get_disk(ub);
1606
+
1607
+
if (!disk)
1608
+
return;
1609
+
1610
+
if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
1611
+
&disk->state)))
1612
+
goto out;
1613
+
1614
+
mutex_lock(&disk->open_mutex);
1615
+
bdev_disk_changed(disk, false);
1616
+
mutex_unlock(&disk->open_mutex);
1617
+
out:
1618
+
ublk_put_disk(disk);
1619
+
}
1620
+
1586
1621
/*
1587
1622
* Use this function to ensure that ->canceling is consistently set for
1588
1623
* the device and all queues. Do not set these flags directly.
···
2048
2041
mutex_lock(&ub->mutex);
2049
2042
ublk_stop_dev_unlocked(ub);
2050
2043
mutex_unlock(&ub->mutex);
2051
-
flush_work(&ub->partition_scan_work);
2044
+
cancel_work_sync(&ub->partition_scan_work);
2052
2045
ublk_cancel_dev(ub);
2053
2046
}
2054
2047