rebase patches on top of Ubuntu-5.11.0-39.43
(generated with debian/scripts/import-upstream-tag) Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht
parent
b5e5237aef
commit
2d31e5666b
@ -75,7 +75,7 @@ index ee85be64b680..a38a8e44422e 100644
|
||||
Safety option to keep boot IRQs enabled. This
|
||||
should never be necessary.
|
||||
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
||||
index 6e9f3c366298..cc0e3a76168e 100644
|
||||
index 35d0734830f6..7aa9d54c9263 100644
|
||||
--- a/drivers/pci/quirks.c
|
||||
+++ b/drivers/pci/quirks.c
|
||||
@@ -193,6 +193,106 @@ static int __init pci_apply_final_quirks(void)
|
||||
|
||||
@ -27,10 +27,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/fs/io_uring.c b/fs/io_uring.c
|
||||
index d24eb8e53c4c..b5192f2f8178 100644
|
||||
index d43626339a2d..32b9d5a56c8c 100644
|
||||
--- a/fs/io_uring.c
|
||||
+++ b/fs/io_uring.c
|
||||
@@ -2743,6 +2743,13 @@ static bool io_rw_reissue(struct io_kiocb *req, long res)
|
||||
@@ -2744,6 +2744,13 @@ static bool io_rw_reissue(struct io_kiocb *req, long res)
|
||||
if (percpu_ref_is_dying(&req->ctx->refs))
|
||||
return false;
|
||||
|
||||
|
||||
@ -1,75 +0,0 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Ming Lei <ming.lei@redhat.com>
|
||||
Date: Fri, 10 Sep 2021 14:30:15 +0200
|
||||
Subject: [PATCH] blk-mq: fix kernel panic during iterating over flush request
|
||||
|
||||
commit c2da19ed50554ce52ecbad3655c98371fe58599f upstream.
|
||||
|
||||
For fixing use-after-free during iterating over requests, we grabbed
|
||||
request's refcount before calling ->fn in commit 2e315dc07df0 ("blk-mq:
|
||||
grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter").
|
||||
Turns out this way may cause kernel panic when iterating over one flush
|
||||
request:
|
||||
|
||||
1) old flush request's tag is just released, and this tag is reused by
|
||||
one new request, but ->rqs[] isn't updated yet
|
||||
|
||||
2) the flush request can be re-used for submitting one new flush command,
|
||||
so blk_rq_init() is called at the same time
|
||||
|
||||
3) meantime blk_mq_queue_tag_busy_iter() is called, and old flush request
|
||||
is retrieved from ->rqs[tag]; when blk_mq_put_rq_ref() is called,
|
||||
flush_rq->end_io may not be updated yet, so NULL pointer dereference
|
||||
is triggered in blk_mq_put_rq_ref().
|
||||
|
||||
Fix the issue by calling refcount_set(&flush_rq->ref, 1) after
|
||||
flush_rq->end_io is set. So far the only other caller of blk_rq_init() is
|
||||
scsi_ioctl_reset() in which the request doesn't enter block IO stack and
|
||||
the request reference count isn't used, so the change is safe.
|
||||
|
||||
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
|
||||
Reported-by: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
||||
Tested-by: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
||||
Signed-off-by: Ming Lei <ming.lei@redhat.com>
|
||||
Reviewed-by: Christoph Hellwig <hch@lst.de>
|
||||
Reviewed-by: John Garry <john.garry@huawei.com>
|
||||
Link: https://lore.kernel.org/r/20210811142624.618598-1-ming.lei@redhat.com
|
||||
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
||||
Cc: Yi Zhang <yi.zhang@redhat.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
block/blk-core.c | 1 -
|
||||
block/blk-flush.c | 8 ++++++++
|
||||
2 files changed, 8 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/block/blk-core.c b/block/blk-core.c
|
||||
index ce3b75f8b56d..9658caafddc2 100644
|
||||
--- a/block/blk-core.c
|
||||
+++ b/block/blk-core.c
|
||||
@@ -121,7 +121,6 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
|
||||
rq->internal_tag = BLK_MQ_NO_TAG;
|
||||
rq->start_time_ns = ktime_get_ns();
|
||||
rq->part = NULL;
|
||||
- refcount_set(&rq->ref, 1);
|
||||
blk_crypto_rq_set_defaults(rq);
|
||||
}
|
||||
EXPORT_SYMBOL(blk_rq_init);
|
||||
diff --git a/block/blk-flush.c b/block/blk-flush.c
|
||||
index e89d007dbf6a..8b11ab3b3762 100644
|
||||
--- a/block/blk-flush.c
|
||||
+++ b/block/blk-flush.c
|
||||
@@ -329,6 +329,14 @@ static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq,
|
||||
flush_rq->rq_flags |= RQF_FLUSH_SEQ;
|
||||
flush_rq->rq_disk = first_rq->rq_disk;
|
||||
flush_rq->end_io = flush_end_io;
|
||||
+ /*
|
||||
+ * Order WRITE ->end_io and WRITE rq->ref, and its pair is the one
|
||||
+ * implied in refcount_inc_not_zero() called from
|
||||
+ * blk_mq_find_and_get_req(), which orders WRITE/READ flush_rq->ref
|
||||
+ * and READ flush_rq->end_io
|
||||
+ */
|
||||
+ smp_wmb();
|
||||
+ refcount_set(&flush_rq->ref, 1);
|
||||
|
||||
blk_flush_queue_rq(flush_rq, false);
|
||||
}
|
||||
@ -1,91 +0,0 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Ming Lei <ming.lei@redhat.com>
|
||||
Date: Fri, 10 Sep 2021 14:30:16 +0200
|
||||
Subject: [PATCH] blk-mq: fix is_flush_rq
|
||||
|
||||
commit a9ed27a764156929efe714033edb3e9023c5f321 upstream.
|
||||
|
||||
is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
|
||||
following check:
|
||||
|
||||
hctx->fq->flush_rq == req
|
||||
|
||||
but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
|
||||
|
||||
1) memory re-order in blk_mq_rq_ctx_init():
|
||||
|
||||
rq->mq_hctx = data->hctx;
|
||||
...
|
||||
refcount_set(&rq->ref, 1);
|
||||
|
||||
OR
|
||||
|
||||
2) tag re-use and ->rqs[] isn't updated with new request.
|
||||
|
||||
Fix the issue by re-writing is_flush_rq() as:
|
||||
|
||||
return rq->end_io == flush_end_io;
|
||||
|
||||
which turns out simpler to follow and immune to data race since we have
|
||||
ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
|
||||
|
||||
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
|
||||
Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
||||
Cc: Yufen Yu <yuyufen@huawei.com>
|
||||
Signed-off-by: Ming Lei <ming.lei@redhat.com>
|
||||
Link: https://lore.kernel.org/r/20210818010925.607383-1-ming.lei@redhat.com
|
||||
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
||||
Cc: Yi Zhang <yi.zhang@redhat.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
---
|
||||
block/blk-flush.c | 5 +++++
|
||||
block/blk-mq.c | 2 +-
|
||||
block/blk.h | 6 +-----
|
||||
3 files changed, 7 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/block/blk-flush.c b/block/blk-flush.c
|
||||
index 8b11ab3b3762..705ee6c99020 100644
|
||||
--- a/block/blk-flush.c
|
||||
+++ b/block/blk-flush.c
|
||||
@@ -262,6 +262,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
|
||||
spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
|
||||
}
|
||||
|
||||
+bool is_flush_rq(struct request *rq)
|
||||
+{
|
||||
+ return rq->end_io == flush_end_io;
|
||||
+}
|
||||
+
|
||||
/**
|
||||
* blk_kick_flush - consider issuing flush request
|
||||
* @q: request_queue being kicked
|
||||
diff --git a/block/blk-mq.c b/block/blk-mq.c
|
||||
index 82db8595bdaa..7dd1b6973c79 100644
|
||||
--- a/block/blk-mq.c
|
||||
+++ b/block/blk-mq.c
|
||||
@@ -937,7 +937,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next)
|
||||
|
||||
void blk_mq_put_rq_ref(struct request *rq)
|
||||
{
|
||||
- if (is_flush_rq(rq, rq->mq_hctx))
|
||||
+ if (is_flush_rq(rq))
|
||||
rq->end_io(rq, 0);
|
||||
else if (refcount_dec_and_test(&rq->ref))
|
||||
__blk_mq_free_request(rq);
|
||||
diff --git a/block/blk.h b/block/blk.h
|
||||
index 7550364c326c..4a4ffd992790 100644
|
||||
--- a/block/blk.h
|
||||
+++ b/block/blk.h
|
||||
@@ -43,11 +43,7 @@ static inline void __blk_get_queue(struct request_queue *q)
|
||||
kobject_get(&q->kobj);
|
||||
}
|
||||
|
||||
-static inline bool
|
||||
-is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
|
||||
-{
|
||||
- return hctx->fq->flush_rq == req;
|
||||
-}
|
||||
+bool is_flush_rq(struct request *req);
|
||||
|
||||
struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
|
||||
gfp_t flags);
|
||||
@ -1,34 +0,0 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Adrian Bunk <bunk@kernel.org>
|
||||
Date: Sun, 12 Sep 2021 22:05:23 +0300
|
||||
Subject: [PATCH] bnx2x: Fix enabling network interfaces without VFs
|
||||
|
||||
This function is called to enable SR-IOV when available,
|
||||
not enabling interfaces without VFs was a regression.
|
||||
|
||||
Fixes: 65161c35554f ("bnx2x: Fix missing error code in bnx2x_iov_init_one()")
|
||||
Signed-off-by: Adrian Bunk <bunk@kernel.org>
|
||||
Reported-by: YunQiang Su <wzssyqa@gmail.com>
|
||||
Tested-by: YunQiang Su <wzssyqa@gmail.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
Acked-by: Shai Malin <smalin@marvell.com>
|
||||
Link: https://lore.kernel.org/r/20210912190523.27991-1-bunk@kernel.org
|
||||
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||
---
|
||||
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
|
||||
index f255fd0b16db..6fbf735fca31 100644
|
||||
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
|
||||
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
|
||||
@@ -1224,7 +1224,7 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
|
||||
|
||||
/* SR-IOV capability was enabled but there are no VFs*/
|
||||
if (iov->total == 0) {
|
||||
- err = -EINVAL;
|
||||
+ err = 0;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user