Skip to content
  1. Feb 17, 2022
  2. Feb 12, 2022
  3. Feb 11, 2022
  4. Feb 10, 2022
  5. Feb 09, 2022
  6. Feb 04, 2022
  7. Feb 03, 2022
    • Uday Shankar's avatar
      nvme-fabrics: fix state check in nvmf_ctlr_matches_baseopts() · 6a51abde
      Uday Shankar authored
      Controller deletion/reset, immediately followed by or concurrent with
      a reconnect, is hard failing the connect attempt resulting in a
      complete loss of connectivity to the controller.
      
      In the connect request, fabrics looks for an existing controller with
      the same address components and aborts the connect if a controller
      already exists and the duplicate connect option isn't set. The match
      routine filters out controllers that are dead or dying, so they don't
      interfere with the new connect request.
      
      When NVME_CTRL_DELETING_NOIO was added, it missed updating the state
      filters in the nvmf_ctlr_matches_baseopts() routine. Thus, when in this
      new state, it's seen as a live controller and fails the connect request.
      
      Correct by adding the DELETING_NIO state to the match checks.
      
      Fixes: ecca390e
      
       ("nvme: fix deadlock in disconnect during scan_work and/or ana_work")
      Cc: <stable@vger.kernel.org> # v5.7+
      Signed-off-by: default avatarUday Shankar <ushankar@purestorage.com>
      Reviewed-by: default avatarJames Smart <jsmart2021@gmail.com>
      Reviewed-by: default avatarSagi Grimberg <sagi@grimberg.me>
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      6a51abde
    • Song Liu's avatar
      md: fix NULL pointer deref with nowait but no mddev->queue · 0f9650bd
      Song Liu authored
      Leon reported NULL pointer deref with nowait support:
      
      [   15.123761] device-mapper: raid: Loading target version 1.15.1
      [   15.124185] device-mapper: raid: Ignoring chunk size parameter for RAID 1
      [   15.124192] device-mapper: raid: Choosing default region size of 4MiB
      [   15.129524] BUG: kernel NULL pointer dereference, address: 0000000000000060
      [   15.129530] #PF: supervisor write access in kernel mode
      [   15.129533] #PF: error_code(0x0002) - not-present page
      [   15.129535] PGD 0 P4D 0
      [   15.129538] Oops: 0002 [#1] PREEMPT SMP NOPTI
      [   15.129541] CPU: 5 PID: 494 Comm: ldmtool Not tainted 5.17.0-rc2-1-mainline #1 9fe89d43dfcb215d2731e6f8851740520778615e
      [   15.129546] Hardware name: Gigabyte Technology Co., Ltd. X570 AORUS ELITE/X570 AORUS ELITE, BIOS F36e 10/14/2021
      [   15.129549] RIP: 0010:blk_queue_flag_set+0x7/0x20
      [   15.129555] Code: 00 00 00 0f 1f 44 00 00 48 8b 35 e4 e0 04 02 48 8d 57 28 bf 40 01 \
             00 00 e9 16 c1 be ff 66 0f 1f 44 00 00 0f 1f 44 00 00 89 ff <f0> 48 0f ab 7e 60 \
             31 f6 89 f7 c3 66 66 2e 0f 1f 84 00 00 00 00 00
      [   15.129559] RSP: 0018:ffff966b81987a88 EFLAGS: 00010202
      [   15.129562] RAX: ffff8b11c363a0d0 RBX: ffff8b11e294b070 RCX: 0000000000000000
      [   15.129564] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000001d
      [   15.129566] RBP: ffff8b11e294b058 R08: 0000000000000000 R09: 0000000000000000
      [   15.129568] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b11e294b070
      [   15.129570] R13: 0000000000000000 R14: ffff8b11e294b000 R15: 0000000000000001
      [   15.129572] FS:  00007fa96e826780(0000) GS:ffff8b18deb40000(0000) knlGS:0000000000000000
      [   15.129575] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [   15.129577] CR2: 0000000000000060 CR3: 000000010b8ce000 CR4: 00000000003506e0
      [   15.129580] Call Trace:
      [   15.129582]  <TASK>
      [   15.129584]  md_run+0x67c/0xc70 [md_mod 1e470c1b6bcf1114198109f42682f5a2740e9531]
      [   15.129597]  raid_ctr+0x134a/0x28ea [dm_raid 6a645dd7519e72834bd7e98c23497eeade14cd63]
      [   15.129604]  ? dm_split_args+0x63/0x150 [dm_mod 0d7b0bc3414340a79c4553bae5ca97294b78336e]
      [   15.129615]  dm_table_add_target+0x188/0x380 [dm_mod 0d7b0bc3414340a79c4553bae5ca97294b78336e]
      [   15.129625]  table_load+0x13b/0x370 [dm_mod 0d7b0bc3414340a79c4553bae5ca97294b78336e]
      [   15.129635]  ? dev_suspend+0x2d0/0x2d0 [dm_mod 0d7b0bc3414340a79c4553bae5ca97294b78336e]
      [   15.129644]  ctl_ioctl+0x1bd/0x460 [dm_mod 0d7b0bc3414340a79c4553bae5ca97294b78336e]
      [   15.129655]  dm_ctl_ioctl+0xa/0x20 [dm_mod 0d7b0bc3414340a79c4553bae5ca97294b78336e]
      [   15.129663]  __x64_sys_ioctl+0x8e/0xd0
      [   15.129667]  do_syscall_64+0x5c/0x90
      [   15.129672]  ? syscall_exit_to_user_mode+0x23/0x50
      [   15.129675]  ? do_syscall_64+0x69/0x90
      [   15.129677]  ? do_syscall_64+0x69/0x90
      [   15.129679]  ? syscall_exit_to_user_mode+0x23/0x50
      [   15.129682]  ? do_syscall_64+0x69/0x90
      [   15.129684]  ? do_syscall_64+0x69/0x90
      [   15.129686]  entry_SYSCALL_64_after_hwframe+0x44/0xae
      [   15.129689] RIP: 0033:0x7fa96ecd559b
      [   15.129692] Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c \
          c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff \
          ff 73 01 c3 48 8b 0d a5 a8 0c 00 f7 d8 64 89 01 48
      [   15.129696] RSP: 002b:00007ffcaf85c258 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
      [   15.129699] RAX: ffffffffffffffda RBX: 00007fa96f1b48f0 RCX: 00007fa96ecd559b
      [   15.129701] RDX: 00007fa97017e610 RSI: 00000000c138fd09 RDI: 0000000000000003
      [   15.129702] RBP: 00007fa96ebab583 R08: 00007fa97017c9e0 R09: 00007ffcaf85bf27
      [   15.129704] R10: 0000000000000001 R11: 0000000000000206 R12: 00007fa97017e610
      [   15.129706] R13: 00007fa97017e640 R14: 00007fa97017e6c0 R15: 00007fa97017e530
      [   15.129709]  </TASK>
      
      This is caused by missing mddev->queue check for setting QUEUE_FLAG_NOWAIT
      Fix this by moving the QUEUE_FLAG_NOWAIT logic to under mddev->queue check.
      
      Fixes: f51d46d0
      
       ("md: add support for REQ_NOWAIT")
      Reported-by: default avatarLeon Möller <jkhsjdhjs@totally.rip>
      Tested-by: default avatarLeon Möller <jkhsjdhjs@totally.rip>
      Cc: Vishal Verma <vverma@digitalocean.com>
      Signed-off-by: default avatarSong Liu <song@kernel.org>
      0f9650bd
  8. Feb 02, 2022
    • Ilya Dryomov's avatar
      block: fix DIO handling regressions in blkdev_read_iter() · 3e1f941d
      Ilya Dryomov authored
      Commit ceaa7625 ("block: move direct_IO into our own read_iter
      handler") introduced several regressions for bdev DIO:
      
      1. read spanning EOF always returns 0 instead of the number of bytes
         read.  This is because "count" is assigned early and isn't updated
         when the iterator is truncated:
      
           $ lsblk -o name,size /dev/vdb
           NAME SIZE
           vdb    1G
           $ xfs_io -d -c 'pread -b 4M 1021M 4M' /dev/vdb
           read 0/4194304 bytes at offset 1070596096
           0.000000 bytes, 0 ops; 0.0007 sec (0.000000 bytes/sec and 0.0000 ops/sec)
      
           instead of
      
           $ xfs_io -d -c 'pread -b 4M 1021M 4M' /dev/vdb
           read 3145728/4194304 bytes at offset 1070596096
           3 MiB, 1 ops; 0.0007 sec (3.865 GiB/sec and 1319.2612 ops/sec)
      
      2. truncated iterator isn't reexpanded
      3. iterator isn't reverted on blkdev_direct_IO() error
      4. zero size read no longer skips atime update
      
      Fixes: ceaa7625
      
       ("block: move direct_IO into our own read_iter handler")
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Link: https://lore.kernel.org/r/20220201100420.25875-1-idryomov@gmail.com
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      3e1f941d
    • Sagi Grimberg's avatar
      nvme-rdma: fix possible use-after-free in transport error_recovery work · b6bb1722
      Sagi Grimberg authored
      
      
      While nvme_rdma_submit_async_event_work is checking the ctrl and queue
      state before preparing the AER command and scheduling io_work, in order
      to fully prevent a race where this check is not reliable the error
      recovery work must flush async_event_work before continuing to destroy
      the admin queue after setting the ctrl state to RESETTING such that
      there is no race .submit_async_event and the error recovery handler
      itself changing the ctrl state.
      
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      b6bb1722
    • Sagi Grimberg's avatar
      nvme-tcp: fix possible use-after-free in transport error_recovery work · ff9fc7eb
      Sagi Grimberg authored
      
      
      While nvme_tcp_submit_async_event_work is checking the ctrl and queue
      state before preparing the AER command and scheduling io_work, in order
      to fully prevent a race where this check is not reliable the error
      recovery work must flush async_event_work before continuing to destroy
      the admin queue after setting the ctrl state to RESETTING such that
      there is no race .submit_async_event and the error recovery handler
      itself changing the ctrl state.
      
      Tested-by: default avatarChris Leech <cleech@redhat.com>
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      ff9fc7eb
    • Sagi Grimberg's avatar
      nvme: fix a possible use-after-free in controller reset during load · 0fa0f99f
      Sagi Grimberg authored
      
      
      Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl
      readiness for AER submission. This may lead to a use-after-free
      condition that was observed with nvme-tcp.
      
      The race condition may happen in the following scenario:
      1. driver executes its reset_ctrl_work
      2. -> nvme_stop_ctrl - flushes ctrl async_event_work
      3. ctrl sends AEN which is received by the host, which in turn
         schedules AEN handling
      4. teardown admin queue (which releases the queue socket)
      5. AEN processed, submits another AER, calling the driver to submit
      6. driver attempts to send the cmd
      ==> use-after-free
      
      In order to fix that, add ctrl state check to validate the ctrl
      is actually able to accept the AER submission.
      
      This addresses the above race in controller resets because the driver
      during teardown should:
      1. change ctrl state to RESETTING
      2. flush async_event_work (as well as other async work elements)
      
      So after 1,2, any other AER command will find the
      ctrl state to be RESETTING and bail out without submitting the AER.
      
      Signed-off-by: default avatarSagi Grimberg <sagi@grimberg.me>
      0fa0f99f
  9. Jan 29, 2022
  10. Jan 28, 2022
  11. Jan 27, 2022
  12. Jan 26, 2022
  13. Jan 24, 2022
  14. Jan 23, 2022