1. 26 3月, 2020 6 次提交
  2. 05 3月, 2020 7 次提交
  3. 28 2月, 2020 1 次提交
  4. 21 2月, 2020 1 次提交
    • L
      nvme-multipath: Fix memory leak with ana_log_buf · 3b783090
      Logan Gunthorpe 提交于
      kmemleak reports a memory leak with the ana_log_buf allocated by
      nvme_mpath_init():
      
      unreferenced object 0xffff888120e94000 (size 8208):
        comm "nvme", pid 6884, jiffies 4295020435 (age 78786.312s)
          hex dump (first 32 bytes):
            00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
            01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
          backtrace:
            [<00000000e2360188>] kmalloc_order+0x97/0xc0
            [<0000000079b18dd4>] kmalloc_order_trace+0x24/0x100
            [<00000000f50c0406>] __kmalloc+0x24c/0x2d0
            [<00000000f31a10b9>] nvme_mpath_init+0x23c/0x2b0
            [<000000005802589e>] nvme_init_identify+0x75f/0x1600
            [<0000000058ef911b>] nvme_loop_configure_admin_queue+0x26d/0x280
            [<00000000673774b9>] nvme_loop_create_ctrl+0x2a7/0x710
            [<00000000f1c7a233>] nvmf_dev_write+0xc66/0x10b9
            [<000000004199f8d0>] __vfs_write+0x50/0xa0
            [<0000000065466fef>] vfs_write+0xf3/0x280
            [<00000000b0db9a8b>] ksys_write+0xc6/0x160
            [<0000000082156b91>] __x64_sys_write+0x43/0x50
            [<00000000c34fbb6d>] do_syscall_64+0x77/0x2f0
            [<00000000bbc574c9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      nvme_mpath_init() is called by nvme_init_identify() which is called in
      multiple places (nvme_reset_work(), nvme_passthru_end(), etc). This
      means nvme_mpath_init() may be called multiple times before
      nvme_mpath_uninit() (which is only called on nvme_free_ctrl()).
      
      When nvme_mpath_init() is called multiple times, it overwrites the
      ana_log_buf pointer with a new allocation, thus leaking the previous
      allocation.
      
      To fix this, free ana_log_buf before allocating a new one.
      
      Fixes: 0d0b660f ("nvme: add ANA support")
      Cc: <stable@vger.kernel.org>
      Reviewed-by: NSagi Grimberg <sagi@grimberg.me>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NLogan Gunthorpe <logang@deltatee.com>
      Signed-off-by: NKeith Busch <kbusch@kernel.org>
      3b783090
  5. 20 2月, 2020 1 次提交
  6. 19 2月, 2020 2 次提交
  7. 15 2月, 2020 4 次提交
  8. 05 2月, 2020 3 次提交
    • D
      nvmet: update AEN list and array at one place · 0f5be6a4
      Daniel Wagner 提交于
      All async events are enqueued via nvmet_add_async_event() which
      updates the ctrl->async_event_cmds[] array and additionally an struct
      nvmet_async_event is added to the ctrl->async_events list.
      
      Under normal operations the nvmet_async_event_work() updates again
      the ctrl->async_event_cmds and removes the corresponding struct
      nvmet_async_event from the list again. Though nvmet_sq_destroy() could
      be called which calls nvmet_async_events_free() which only updates the
      ctrl->async_event_cmds[] array.
      
      Add new functions nvmet_async_events_process() and
      nvmet_async_events_free() to process async events, update an array and
      the list.
      
      When we destroy submission queue after clearing the aen present on
      the ctrl->async list we also loop over ctrl->async_event_cmds[] for
      any requests posted by the host for which we don't have the AEN in
      the ctrl->async_events list by calling nvmet_async_event_process()
      and nvmet_async_events_free().
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NDaniel Wagner <dwagner@suse.de>
      [chaitanya.kulkarni@wdc.com
       * Loop over and clear out outstanding requests
       * Update changelog
      ]
      Signed-off-by: NChaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
      Signed-off-by: NKeith Busch <kbusch@kernel.org>
      0f5be6a4
    • I
      nvmet: Fix controller use after free · 1a3f540d
      Israel Rukshin 提交于
      After nvmet_install_queue() sets sq->ctrl calling to nvmet_sq_destroy()
      reduces the controller refcount. In case nvmet_install_queue() fails,
      calling to nvmet_ctrl_put() is done twice (at nvmet_sq_destroy and
      nvmet_execute_io_connect/nvmet_execute_admin_connect) instead of once for
      the queue which leads to use after free of the controller. Fix this by set
      NULL at sq->ctrl in case of a failure at nvmet_install_queue().
      
      The bug leads to the following Call Trace:
      
      [65857.994862] refcount_t: underflow; use-after-free.
      [65858.108304] Workqueue: events nvmet_rdma_release_queue_work [nvmet_rdma]
      [65858.115557] RIP: 0010:refcount_warn_saturate+0xe5/0xf0
      [65858.208141] Call Trace:
      [65858.211203]  nvmet_sq_destroy+0xe1/0xf0 [nvmet]
      [65858.216383]  nvmet_rdma_release_queue_work+0x37/0xf0 [nvmet_rdma]
      [65858.223117]  process_one_work+0x167/0x370
      [65858.227776]  worker_thread+0x49/0x3e0
      [65858.232089]  kthread+0xf5/0x130
      [65858.235895]  ? max_active_store+0x80/0x80
      [65858.240504]  ? kthread_bind+0x10/0x10
      [65858.244832]  ret_from_fork+0x1f/0x30
      [65858.249074] ---[ end trace f82d59250b54beb7 ]---
      
      Fixes: bb1cc747 ("nvmet: implement valid sqhd values in completions")
      Fixes: 1672ddb8 ("nvmet: Add install_queue callout")
      Signed-off-by: NIsrael Rukshin <israelr@mellanox.com>
      Reviewed-by: NMax Gurtovoy <maxg@mellanox.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NKeith Busch <kbusch@kernel.org>
      1a3f540d
    • I
      nvmet: Fix error print message at nvmet_install_queue function · 0b87a2b7
      Israel Rukshin 提交于
      Place the arguments in the correct order.
      
      Fixes: 1672ddb8 ("nvmet: Add install_queue callout")
      Signed-off-by: NIsrael Rukshin <israelr@mellanox.com>
      Reviewed-by: NMax Gurtovoy <maxg@mellanox.com>
      Reviewed-by: NChristoph Hellwig <hch@lst.de>
      Signed-off-by: NKeith Busch <kbusch@kernel.org>
      0b87a2b7
  9. 04 2月, 2020 3 次提交
  10. 01 2月, 2020 1 次提交
  11. 10 1月, 2020 2 次提交
  12. 07 1月, 2020 1 次提交
    • H
      block: Allow t10-pi to be modular · a754bd5f
      Herbert Xu 提交于
      Currently t10-pi can only be built into the block layer which via
      crc-t10dif pulls in a whole chunk of the Crypto API.  In fact all
      users of t10-pi work as modules and there is no reason for it to
      always be built-in.
      
      This patch adds a new hidden option for t10-pi that is selected
      automatically based on BLK_DEV_INTEGRITY and whether the users
      of t10-pi are built-in or not.
      Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      a754bd5f
  13. 07 12月, 2019 3 次提交
  14. 03 12月, 2019 2 次提交
  15. 27 11月, 2019 3 次提交