Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd1ae514 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.dk/linux-block 

Pull block fixes from Jens Axboe:
 "Here's a set of block fixes for the current 4.8-rc release.  This
  contains:

   - a fix for a secure erase regression, from Adrian.

   - a fix for an mmc use-after-free bug regression, also from Adrian.

   - potential zero pointer deference in bdev freezing, from Andrey.

   - a race fix for blk_set_queue_dying() from Bart.

   - a set of xen blkfront fixes from Bob Liu.

   - three small fixes for bcache, from Eric and Kent.

   - a fix for a potential invalid NVMe state transition, from Gabriel.

   - blk-mq CPU offline fix, preventing us from issuing and completing a
     request on the wrong queue.  From me.

   - revert two previous floppy changes, since they caused a user
     visibile regression.  A better fix is in the works.

   - ensure that we don't send down bios that have more than 256
     elements in them.  Fixes a crash with bcache, for example.  From
     Ming.

   - a fix for deferencing an error pointer with cgroup writeback.
     Fixes a regression.  From Vegard"

* 'for-linus' of git://git.kernel.dk/linux-block:
  mmc: fix use-after-free of struct request
  Revert "floppy: refactor open() flags handling"
  Revert "floppy: fix open(O_ACCMODE) for ioctl-only open"
  fs/block_dev: fix potential NULL ptr deref in freeze_bdev()
  blk-mq: improve warning for running a queue on the wrong CPU
  blk-mq: don't overwrite rq->mq_ctx
  block: make sure a big bio is split into at most 256 bvecs
  nvme: Fix nvme_get/set_features() with a NULL result pointer
  bdev: fix NULL pointer dereference
  xen-blkfront: free resources if xlvbd_alloc_gendisk fails
  xen-blkfront: introduce blkif_set_queue_limits()
  xen-blkfront: fix places not updated after introducing 64KB page granularity
  bcache: pr_err: more meaningful error message when nr_stripes is invalid
  bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two.
  bcache: register_bcache(): call blkdev_put() when cache_alloc() fails
  block: Fix race triggered by blk_set_queue_dying()
  block: Fix secure erase
  nvme: Prevent controller state invalid transition
parents b09c412a 869c5548

block/bio.c

+11 −10
Original line number Diff line number Diff line
@@ -667,18 +667,19 @@ struct bio *bio_clone_bioset(struct bio *bio_src, gfp_t gfp_mask, 
	bio->bi_iter.bi_sector	= bio_src->bi_iter.bi_sector;

	bio->bi_iter.bi_size	= bio_src->bi_iter.bi_size;



	if (bio_op(bio) == REQ_OP_DISCARD)

		goto integrity_clone;



	if (bio_op(bio) == REQ_OP_WRITE_SAME) {

	switch (bio_op(bio)) {

	case REQ_OP_DISCARD:

	case REQ_OP_SECURE_ERASE:

		break;

	case REQ_OP_WRITE_SAME:

		bio->bi_io_vec[bio->bi_vcnt++] = bio_src->bi_io_vec[0];

		goto integrity_clone;

	}



		break;

	default:

		bio_for_each_segment(bv, bio_src, iter)

			bio->bi_io_vec[bio->bi_vcnt++] = bv;

		break;

	}



integrity_clone:

	if (bio_integrity(bio_src)) {

		int ret;
@@ -1788,7 +1789,7 @@ struct bio *bio_split(struct bio *bio, int sectors, 
	 * Discards need a mutable bio_vec to accommodate the payload

	 * required by the DSM TRIM and UNMAP commands.

	 */

	if (bio_op(bio) == REQ_OP_DISCARD)

	if (bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE)

		split = bio_clone_bioset(bio, gfp, bs);

	else

		split = bio_clone_fast(bio, gfp, bs);

block/blk-core.c

+3 −1
Original line number Diff line number Diff line
@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end); 


void blk_set_queue_dying(struct request_queue *q)

{

	queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);

	spin_lock_irq(q->queue_lock);

	queue_flag_set(QUEUE_FLAG_DYING, q);

	spin_unlock_irq(q->queue_lock);



	if (q->mq_ops)

		blk_mq_wake_waiters(q);

block/blk-merge.c

+41 −14
Original line number Diff line number Diff line
@@ -94,8 +94,30 @@ static struct bio *blk_bio_segment_split(struct request_queue *q, 
	bool do_split = true;

	struct bio *new = NULL;

	const unsigned max_sectors = get_max_io_size(q, bio);

	unsigned bvecs = 0;



	bio_for_each_segment(bv, bio, iter) {

		/*

		 * With arbitrary bio size, the incoming bio may be very

		 * big. We have to split the bio into small bios so that

		 * each holds at most BIO_MAX_PAGES bvecs because

		 * bio_clone() can fail to allocate big bvecs.

		 *

		 * It should have been better to apply the limit per

		 * request queue in which bio_clone() is involved,

		 * instead of globally. The biggest blocker is the

		 * bio_clone() in bio bounce.

		 *

		 * If bio is splitted by this reason, we should have

		 * allowed to continue bios merging, but don't do

		 * that now for making the change simple.

		 *

		 * TODO: deal with bio bounce's bio_clone() gracefully

		 * and convert the global limit into per-queue limit.

		 */

		if (bvecs++ >= BIO_MAX_PAGES)

			goto split;



		/*

		 * If the queue doesn't support SG gaps and adding this

		 * offset would create a gap, disallow it.
@@ -172,12 +194,18 @@ void blk_queue_split(struct request_queue *q, struct bio **bio, 
	struct bio *split, *res;

	unsigned nsegs;



	if (bio_op(*bio) == REQ_OP_DISCARD)

	switch (bio_op(*bio)) {

	case REQ_OP_DISCARD:

	case REQ_OP_SECURE_ERASE:

		split = blk_bio_discard_split(q, *bio, bs, &nsegs);

	else if (bio_op(*bio) == REQ_OP_WRITE_SAME)

		break;

	case REQ_OP_WRITE_SAME:

		split = blk_bio_write_same_split(q, *bio, bs, &nsegs);

	else

		break;

	default:

		split = blk_bio_segment_split(q, *bio, q->bio_split, &nsegs);

		break;

	}



	/* physical segments can be figured out during splitting */

	res = split ? split : *bio;
@@ -213,7 +241,7 @@ static unsigned int __blk_recalc_rq_segments(struct request_queue *q, 
	 * This should probably be returning 0, but blk_add_request_payload()

	 * (Christoph!!!!)

	 */

	if (bio_op(bio) == REQ_OP_DISCARD)

	if (bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE)

		return 1;



	if (bio_op(bio) == REQ_OP_WRITE_SAME)
@@ -385,7 +413,9 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio, 
	nsegs = 0;

	cluster = blk_queue_cluster(q);



	if (bio_op(bio) == REQ_OP_DISCARD) {

	switch (bio_op(bio)) {

	case REQ_OP_DISCARD:

	case REQ_OP_SECURE_ERASE:

		/*

		 * This is a hack - drivers should be neither modifying the

		 * biovec, nor relying on bi_vcnt - but because of
@@ -393,19 +423,16 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio, 
		 * a payload we need to set up here (thank you Christoph) and

		 * bi_vcnt is really the only way of telling if we need to.

		 */



		if (bio->bi_vcnt)

			goto single_segment;



		if (!bio->bi_vcnt)

			return 0;

	}



	if (bio_op(bio) == REQ_OP_WRITE_SAME) {

single_segment:

		/* Fall through */

	case REQ_OP_WRITE_SAME:

		*sg = sglist;

		bvec = bio_iovec(bio);

		sg_set_page(*sg, bvec.bv_page, bvec.bv_len, bvec.bv_offset);

		return 1;

	default:

		break;

	}



	for_each_bio(bio)

block/blk-mq.c

+19 −41
Original line number Diff line number Diff line
@@ -793,11 +793,12 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx) 
	struct list_head *dptr;

	int queued;



	WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask));



	if (unlikely(test_bit(BLK_MQ_S_STOPPED, &hctx->state)))

		return;



	WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) &&

		cpu_online(hctx->next_cpu));



	hctx->run++;



	/*
@@ -1036,10 +1037,11 @@ void blk_mq_delay_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs) 
EXPORT_SYMBOL(blk_mq_delay_queue);



static inline void __blk_mq_insert_req_list(struct blk_mq_hw_ctx *hctx,

					    struct blk_mq_ctx *ctx,

					    struct request *rq,

					    bool at_head)

{

	struct blk_mq_ctx *ctx = rq->mq_ctx;



	trace_block_rq_insert(hctx->queue, rq);



	if (at_head)
@@ -1053,20 +1055,16 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx, 
{

	struct blk_mq_ctx *ctx = rq->mq_ctx;



	__blk_mq_insert_req_list(hctx, ctx, rq, at_head);

	__blk_mq_insert_req_list(hctx, rq, at_head);

	blk_mq_hctx_mark_pending(hctx, ctx);

}



void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,

			   bool async)

{

	struct blk_mq_ctx *ctx = rq->mq_ctx;

	struct request_queue *q = rq->q;

	struct blk_mq_hw_ctx *hctx;

	struct blk_mq_ctx *ctx = rq->mq_ctx, *current_ctx;



	current_ctx = blk_mq_get_ctx(q);

	if (!cpu_online(ctx->cpu))

		rq->mq_ctx = ctx = current_ctx;



	hctx = q->mq_ops->map_queue(q, ctx->cpu);
@@ -1076,8 +1074,6 @@ void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue, 


	if (run_queue)

		blk_mq_run_hw_queue(hctx, async);



	blk_mq_put_ctx(current_ctx);

}



static void blk_mq_insert_requests(struct request_queue *q,
@@ -1088,14 +1084,9 @@ static void blk_mq_insert_requests(struct request_queue *q, 


{

	struct blk_mq_hw_ctx *hctx;

	struct blk_mq_ctx *current_ctx;



	trace_block_unplug(q, depth, !from_schedule);



	current_ctx = blk_mq_get_ctx(q);



	if (!cpu_online(ctx->cpu))

		ctx = current_ctx;

	hctx = q->mq_ops->map_queue(q, ctx->cpu);



	/*
@@ -1107,15 +1098,14 @@ static void blk_mq_insert_requests(struct request_queue *q, 
		struct request *rq;



		rq = list_first_entry(list, struct request, queuelist);

		BUG_ON(rq->mq_ctx != ctx);

		list_del_init(&rq->queuelist);

		rq->mq_ctx = ctx;

		__blk_mq_insert_req_list(hctx, ctx, rq, false);

		__blk_mq_insert_req_list(hctx, rq, false);

	}

	blk_mq_hctx_mark_pending(hctx, ctx);

	spin_unlock(&ctx->lock);



	blk_mq_run_hw_queue(hctx, from_schedule);

	blk_mq_put_ctx(current_ctx);

}



static int plug_ctx_cmp(void *priv, struct list_head *a, struct list_head *b)
@@ -1630,16 +1620,17 @@ static int blk_mq_alloc_bitmap(struct blk_mq_ctxmap *bitmap, int node) 
	return 0;

}



/*

 * 'cpu' is going away. splice any existing rq_list entries from this

 * software queue to the hw queue dispatch list, and ensure that it

 * gets run.

 */

static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)

{

	struct request_queue *q = hctx->queue;

	struct blk_mq_ctx *ctx;

	LIST_HEAD(tmp);



	/*

	 * Move ctx entries to new CPU, if this one is going away.

	 */

	ctx = __blk_mq_get_ctx(q, cpu);

	ctx = __blk_mq_get_ctx(hctx->queue, cpu);



	spin_lock(&ctx->lock);

	if (!list_empty(&ctx->rq_list)) {
@@ -1651,24 +1642,11 @@ static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu) 
	if (list_empty(&tmp))

		return NOTIFY_OK;



	ctx = blk_mq_get_ctx(q);

	spin_lock(&ctx->lock);



	while (!list_empty(&tmp)) {

		struct request *rq;



		rq = list_first_entry(&tmp, struct request, queuelist);

		rq->mq_ctx = ctx;

		list_move_tail(&rq->queuelist, &ctx->rq_list);

	}



	hctx = q->mq_ops->map_queue(q, ctx->cpu);

	blk_mq_hctx_mark_pending(hctx, ctx);



	spin_unlock(&ctx->lock);

	spin_lock(&hctx->lock);

	list_splice_tail_init(&tmp, &hctx->dispatch);

	spin_unlock(&hctx->lock);



	blk_mq_run_hw_queue(hctx, true);

	blk_mq_put_ctx(ctx);

	return NOTIFY_OK;

}

block/elevator.c

+1 −1
Original line number Diff line number Diff line
@@ -366,7 +366,7 @@ void elv_dispatch_sort(struct request_queue *q, struct request *rq) 
	list_for_each_prev(entry, &q->queue_head) {

		struct request *pos = list_entry_rq(entry);



		if ((req_op(rq) == REQ_OP_DISCARD) != (req_op(pos) == REQ_OP_DISCARD))

		if (req_op(rq) != req_op(pos))

			break;

		if (rq_data_dir(rq) != rq_data_dir(pos))

			break;