1. 24 6月, 2020 2 次提交
  2. 27 5月, 2020 2 次提交
  3. 13 5月, 2020 2 次提交
  4. 05 5月, 2020 1 次提交
  5. 21 4月, 2020 1 次提交
  6. 27 3月, 2020 1 次提交
  7. 25 3月, 2020 7 次提交
  8. 24 3月, 2020 5 次提交
  9. 19 3月, 2020 1 次提交
  10. 12 3月, 2020 2 次提交
    • S
      block: Fix partition support for host aware zoned block devices · b53df2e7
      Shin'ichiro Kawasaki 提交于
      Commit b7205307 ("block: allow partitions on host aware zone
      devices") introduced the helper function disk_has_partitions() to check
      if a given disk has valid partitions. However, since this function result
      directly depends on the disk partition table length rather than the
      actual existence of valid partitions in the table, it returns true even
      after all partitions are removed from the disk. For host aware zoned
      block devices, this results in zone management support to be kept
      disabled even after removing all partitions.
      
      Fix this by changing disk_has_partitions() to walk through the partition
      table entries and return true if and only if a valid non-zero size
      partition is found.
      
      Fixes: b7205307 ("block: allow partitions on host aware zone devices")
      Cc: stable@vger.kernel.org # 5.5
      Reviewed-by: NDamien Le Moal <damien.lemoal@wdc.com>
      Reviewed-by: NJohannes Thumshirn <johannes.thumshirn@wdc.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NShin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      b53df2e7
    • S
      block: Document genhd capability flags · 9243c6f3
      Stephen Kitt 提交于
      The kernel documentation includes a brief section about genhd
      capabilities, but it turns out that the only documented
      capability (GENHD_FL_MEDIA_CHANGE_NOTIFY) isn't used any more.
      
      This patch removes that flag, and documents the rest, based on my
      understanding of the current uses of these flags in the kernel. The
      documentation is kept in the header file, alongside the declarations,
      in the hope that it will be kept up-to-date in future; the kernel
      documentation is changed to include the documentation generated from
      the header file.
      
      Because the ultimate goal is to provide some end-user
      documentation (or end-administrator documentation), the comments are
      perhaps more user-oriented than might be expected. Since the values
      are shown to users in hexadecimal, the documentation lists them in
      hexadecimal, and the constant declarations are adjusted to match.
      Reviewed-by: NMatthew Wilcox (Oracle) <willy@infradead.org>
      Signed-off-by: NStephen Kitt <steve@sk2.org>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      9243c6f3
  11. 27 1月, 2020 1 次提交
  12. 08 12月, 2019 1 次提交
  13. 14 11月, 2019 3 次提交
  14. 22 4月, 2019 1 次提交
    • Y
      block: fix use-after-free on gendisk · 6fcc44d1
      Yufen Yu 提交于
      commit 2da78092 "block: Fix dev_t minor allocation lifetime"
      specifically moved blk_free_devt(dev->devt) call to part_release()
      to avoid reallocating device number before the device is fully
      shutdown.
      
      However, it can cause use-after-free on gendisk in get_gendisk().
      We use md device as example to show the race scenes:
      
      Process1		Worker			Process2
      md_free
      						blkdev_open
      del_gendisk
        add delete_partition_work_fn() to wq
        						__blkdev_get
      						get_gendisk
      put_disk
        disk_release
          kfree(disk)
          						find part from ext_devt_idr
      						get_disk_and_module(disk)
          					  	cause use after free
      
          			delete_partition_work_fn
      			put_device(part)
          		  	part_release
      		    	remove part from ext_devt_idr
      
      Before <devt, hd_struct pointer> is removed from ext_devt_idr by
      delete_partition_work_fn(), we can find the devt and then access
      gendisk by hd_struct pointer. But, if we access the gendisk after
      it have been freed, it can cause in use-after-freeon gendisk in
      get_gendisk().
      
      We fix this by adding a new helper blk_invalidate_devt() in
      delete_partition() and del_gendisk(). It replaces hd_struct
      pointer in idr with value 'NULL', and deletes the entry from
      idr in part_release() as we do now.
      
      Thanks to Jan Kara for providing the solution and more clear comments
      for the code.
      
      Fixes: 2da78092 ("block: Fix dev_t minor allocation lifetime")
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Reviewed-by: NBart Van Assche <bvanassche@acm.org>
      Reviewed-by: NKeith Busch <keith.busch@intel.com>
      Reviewed-by: NJan Kara <jack@suse.cz>
      Suggested-by: NJan Kara <jack@suse.cz>
      Signed-off-by: NYufen Yu <yuyufen@huawei.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      6fcc44d1
  15. 16 4月, 2019 1 次提交
    • Y
      block: fix use-after-free on gendisk · 2c88e3c7
      Yufen Yu 提交于
      commit 2da78092 "block: Fix dev_t minor allocation lifetime"
      specifically moved blk_free_devt(dev->devt) call to part_release()
      to avoid reallocating device number before the device is fully
      shutdown.
      
      However, it can cause use-after-free on gendisk in get_gendisk().
      We use md device as example to show the race scenes:
      
      Process1		Worker			Process2
      md_free
      						blkdev_open
      del_gendisk
        add delete_partition_work_fn() to wq
        						__blkdev_get
      						get_gendisk
      put_disk
        disk_release
          kfree(disk)
          						find part from ext_devt_idr
      						get_disk_and_module(disk)
          					  	cause use after free
      
          			delete_partition_work_fn
      			put_device(part)
          		  	part_release
      		    	remove part from ext_devt_idr
      
      Before <devt, hd_struct pointer> is removed from ext_devt_idr by
      delete_partition_work_fn(), we can find the devt and then access
      gendisk by hd_struct pointer. But, if we access the gendisk after
      it have been freed, it can cause in use-after-freeon gendisk in
      get_gendisk().
      
      We fix this by adding a new helper blk_invalidate_devt() in
      delete_partition() and del_gendisk(). It replaces hd_struct
      pointer in idr with value 'NULL', and deletes the entry from
      idr in part_release() as we do now.
      
      Thanks to Jan Kara for providing the solution and more clear comments
      for the code.
      
      Fixes: 2da78092 ("block: Fix dev_t minor allocation lifetime")
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Reviewed-by: NBart Van Assche <bvanassche@acm.org>
      Reviewed-by: NKeith Busch <keith.busch@intel.com>
      Reviewed-by: NJan Kara <jack@suse.cz>
      Suggested-by: NJan Kara <jack@suse.cz>
      Signed-off-by: NYufen Yu <yuyufen@huawei.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      2c88e3c7
  16. 13 4月, 2019 2 次提交
    • M
      block: disk_events: introduce event flags · c92e2f04
      Martin Wilck 提交于
      Currently, an empty disk->events field tells the block layer not to
      forward media change events to user space. This was done in commit
      7c88a168 ("block: don't propagate unlisted DISK_EVENTs to userland")
      in order to avoid events from "fringe" drivers to be forwarded to user
      space. By doing so, the block layer lost the information which events
      were supported by a particular block device, and most importantly,
      whether or not a given device supports media change events at all.
      
      Prepare for not interpreting the "events" field this way in the future
      any more. This is done by adding an additional field "event_flags" to
      struct gendisk, and two flag bits that can be set to have the device
      treated like one that had the "events" field set to a non-zero value
      before. This applies only to the sd and sr drivers, which are changed to
      set the new flags.
      
      The new flags are DISK_EVENT_FLAG_POLL to enforce polling of the device
      for synchronous events, and DISK_EVENT_FLAG_UEVENT to tell the
      blocklayer to generate udev events from kernel events.
      
      In order to add the event_flags field to struct gendisk, the events
      field is converted to an "unsigned short"; it doesn't need to hold
      values bigger than 2 anyway.
      
      This patch doesn't change behavior.
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NMartin Wilck <mwilck@suse.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      c92e2f04
    • M
      block: genhd: remove async_events field · 673387a9
      Martin Wilck 提交于
      The async_events field, intended to be used for drivers that support
      asynchronous notifications about disk events (aka media change events),
      isn't currently used by any driver, and apparently that has been that
      way for a long time (if not forever). Remove it.
      Reviewed-by: NHannes Reinecke <hare@suse.de>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NMartin Wilck <mwilck@suse.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      673387a9
  17. 07 4月, 2019 1 次提交
    • C
      block: remove CONFIG_LBDAF · 72deb455
      Christoph Hellwig 提交于
      Currently support for 64-bit sector_t and blkcnt_t is optional on 32-bit
      architectures.  These types are required to support block device and/or
      file sizes larger than 2 TiB, and have generally defaulted to on for
      a long time.  Enabling the option only increases the i386 tinyconfig
      size by 145 bytes, and many data structures already always use
      64-bit values for their in-core and on-disk data structures anyway,
      so there should not be a large change in dynamic memory usage either.
      
      Dropping this option removes a somewhat weird non-default config that
      has cause various bugs or compiler warnings when actually used.
      Signed-off-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      72deb455
  18. 10 12月, 2018 4 次提交
  19. 29 11月, 2018 1 次提交
    • Y
      block: use rcu_work instead of call_rcu to avoid sleep in softirq · 94a2c3a3
      Yufen Yu 提交于
      We recently got a stack by syzkaller like this:
      
      BUG: sleeping function called from invalid context at mm/slab.h:361
      in_atomic(): 1, irqs_disabled(): 0, pid: 6644, name: blkid
      INFO: lockdep is turned off.
      CPU: 1 PID: 6644 Comm: blkid Not tainted 4.4.163-514.55.6.9.x86_64+ #76
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
       0000000000000000 5ba6a6b879e50c00 ffff8801f6b07b10 ffffffff81cb2194
       0000000041b58ab3 ffffffff833c7745 ffffffff81cb2080 5ba6a6b879e50c00
       0000000000000000 0000000000000001 0000000000000004 0000000000000000
      Call Trace:
       <IRQ>  [<ffffffff81cb2194>] __dump_stack lib/dump_stack.c:15 [inline]
       <IRQ>  [<ffffffff81cb2194>] dump_stack+0x114/0x1a0 lib/dump_stack.c:51
       [<ffffffff8129a981>] ___might_sleep+0x291/0x490 kernel/sched/core.c:7675
       [<ffffffff8129ac33>] __might_sleep+0xb3/0x270 kernel/sched/core.c:7637
       [<ffffffff81794c13>] slab_pre_alloc_hook mm/slab.h:361 [inline]
       [<ffffffff81794c13>] slab_alloc_node mm/slub.c:2610 [inline]
       [<ffffffff81794c13>] slab_alloc mm/slub.c:2692 [inline]
       [<ffffffff81794c13>] kmem_cache_alloc_trace+0x2c3/0x5c0 mm/slub.c:2709
       [<ffffffff81cbe9a7>] kmalloc include/linux/slab.h:479 [inline]
       [<ffffffff81cbe9a7>] kzalloc include/linux/slab.h:623 [inline]
       [<ffffffff81cbe9a7>] kobject_uevent_env+0x2c7/0x1150 lib/kobject_uevent.c:227
       [<ffffffff81cbf84f>] kobject_uevent+0x1f/0x30 lib/kobject_uevent.c:374
       [<ffffffff81cbb5b9>] kobject_cleanup lib/kobject.c:633 [inline]
       [<ffffffff81cbb5b9>] kobject_release+0x229/0x440 lib/kobject.c:675
       [<ffffffff81cbb0a2>] kref_sub include/linux/kref.h:73 [inline]
       [<ffffffff81cbb0a2>] kref_put include/linux/kref.h:98 [inline]
       [<ffffffff81cbb0a2>] kobject_put+0x72/0xd0 lib/kobject.c:692
       [<ffffffff8216f095>] put_device+0x25/0x30 drivers/base/core.c:1237
       [<ffffffff81c4cc34>] delete_partition_rcu_cb+0x1d4/0x2f0 block/partition-generic.c:232
       [<ffffffff813c08bc>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
       [<ffffffff813c08bc>] rcu_do_batch kernel/rcu/tree.c:2705 [inline]
       [<ffffffff813c08bc>] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline]
       [<ffffffff813c08bc>] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline]
       [<ffffffff813c08bc>] rcu_process_callbacks+0x59c/0x1c70 kernel/rcu/tree.c:2957
       [<ffffffff8120f509>] __do_softirq+0x299/0xe20 kernel/softirq.c:273
       [<ffffffff81210496>] invoke_softirq kernel/softirq.c:350 [inline]
       [<ffffffff81210496>] irq_exit+0x216/0x2c0 kernel/softirq.c:391
       [<ffffffff82c2cd7b>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
       [<ffffffff82c2cd7b>] smp_apic_timer_interrupt+0x8b/0xc0 arch/x86/kernel/apic/apic.c:926
       [<ffffffff82c2bc25>] apic_timer_interrupt+0xa5/0xb0 arch/x86/entry/entry_64.S:746
       <EOI>  [<ffffffff814cbf40>] ? audit_kill_trees+0x180/0x180
       [<ffffffff8187d2f7>] fd_install+0x57/0x80 fs/file.c:626
       [<ffffffff8180989e>] do_sys_open+0x45e/0x550 fs/open.c:1043
       [<ffffffff818099c2>] SYSC_open fs/open.c:1055 [inline]
       [<ffffffff818099c2>] SyS_open+0x32/0x40 fs/open.c:1050
       [<ffffffff82c299e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
      
      In softirq context, we call rcu callback function delete_partition_rcu_cb(),
      which may allocate memory by kzalloc with GFP_KERNEL flag. If the
      allocation cannot be satisfied, it may sleep. However, That is not allowed
      in softirq contex.
      
      Although we found this problem on linux 4.4, the latest kernel version
      seems to have this problem as well. And it is very similar to the
      previous one:
      	https://lkml.org/lkml/2018/7/9/391
      
      Fix it by using RCU workqueue, which allows sleep.
      Reviewed-by: NPaul E. McKenney <paulmck@linux.ibm.com>
      Signed-off-by: NYufen Yu <yuyufen@huawei.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      94a2c3a3
  20. 28 9月, 2018 1 次提交