Commit 0136d86b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.2-2023-02-03' of git://git.kernel.dk/linux 

Pull block fixes from Jens Axboe:
 "A bit bigger than I'd like at this point, but mostly a bunch of little
  fixes. In detail:

   - NVMe pull request via Christoph:
       - Fix a missing queue put in nvmet_fc_ls_create_association
         (Amit Engel)
       - Clear queue pointers on tag_set initialization failure
         (Maurizio Lombardi)
       - Use workqueue dedicated to authentication (Shin'ichiro
         Kawasaki)

   - Fix for an overflow in ublk (Liu)

   - Fix for leaking a queue reference in block cgroups (Ming)

   - Fix for a use-after-free in BFQ (Yu)"

* tag 'block-6.2-2023-02-03' of git://git.kernel.dk/linux:
  blk-cgroup: don't update io stat for root cgroup
  nvme-auth: use workqueue dedicated to authentication
  nvme: clear the request_queue pointers on failure in nvme_alloc_io_tag_set
  nvme: clear the request_queue pointers on failure in nvme_alloc_admin_tag_set
  nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
  block: Fix the blk_mq_destroy_queue() documentation
  block: ublk: extending queue_size to fix overflow
  block, bfq: fix uaf for bfqq in bic_set_bfqq()
parents 7b753a90 e02bbac7

block/bfq-cgroup.c

+1 −1
Original line number Diff line number Diff line
@@ -769,8 +769,8 @@ static void __bfq_bic_change_cgroup(struct bfq_data *bfqd, 
				 * request from the old cgroup.

				 */

				bfq_put_cooperator(sync_bfqq);

				bfq_release_process_ref(bfqd, sync_bfqq);

				bic_set_bfqq(bic, NULL, true);

				bfq_release_process_ref(bfqd, sync_bfqq);

			}

		}

	}

block/bfq-iosched.c

+3 −1
Original line number Diff line number Diff line
@@ -5425,9 +5425,11 @@ static void bfq_check_ioprio_change(struct bfq_io_cq *bic, struct bio *bio) 


	bfqq = bic_to_bfqq(bic, false);

	if (bfqq) {

		bfq_release_process_ref(bfqd, bfqq);

		struct bfq_queue *old_bfqq = bfqq;



		bfqq = bfq_get_queue(bfqd, bio, false, bic, true);

		bic_set_bfqq(bic, bfqq, false);

		bfq_release_process_ref(bfqd, old_bfqq);

	}



	bfqq = bic_to_bfqq(bic, true);

block/blk-cgroup.c

+4 −0
Original line number Diff line number Diff line
@@ -2001,6 +2001,10 @@ void blk_cgroup_bio_start(struct bio *bio) 
	struct blkg_iostat_set *bis;

	unsigned long flags;



	/* Root-level stats are sourced from system-wide IO stats */

	if (!cgroup_parent(blkcg->css.cgroup))

		return;



	cpu = get_cpu();

	bis = per_cpu_ptr(bio->bi_blkg->iostat_cpu, cpu);

	flags = u64_stats_update_begin_irqsave(&bis->sync);

block/blk-mq.c

+3 −2
Original line number Diff line number Diff line
@@ -4069,8 +4069,9 @@ EXPORT_SYMBOL(blk_mq_init_queue); 
 * blk_mq_destroy_queue - shutdown a request queue

 * @q: request queue to shutdown

 *

 * This shuts down a request queue allocated by blk_mq_init_queue() and drops

 * the initial reference.  All future requests will failed with -ENODEV.

 * This shuts down a request queue allocated by blk_mq_init_queue(). All future

 * requests will be failed with -ENODEV. The caller is responsible for dropping

 * the reference from blk_mq_init_queue() by calling blk_put_queue().

 *

 * Context: can sleep

 */

drivers/block/ublk_drv.c

+1 −1
Original line number Diff line number Diff line
@@ -137,7 +137,7 @@ struct ublk_device { 


	char	*__queues;



	unsigned short  queue_size;

	unsigned int	queue_size;

	struct ublksrv_ctrl_dev_info	dev_info;



	struct blk_mq_tag_set	tag_set;