1. 30 Apr, 2021 4 commits
    • Benjamin Block's avatar
      dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails · 8e947c8f
      Benjamin Block authored
      When loading a device-mapper table for a request-based mapped device,
      and the allocation/initialization of the blk_mq_tag_set for the device
      fails, a following device remove will cause a double free.
      
      E.g. (dmesg):
        device-mapper: core: Cannot initialize queue for request-based dm-mq mapped device
        device-mapper: ioctl: unable to set up device queue for new table.
        Unable to handle kernel pointer dereference in virtual kernel address space
        Failing address: 0305e098835de000 TEID: 0305e098835de803
        Fault in home space mode while using kernel ASCE.
        AS:000000025efe0007 R3:0000000000000024
        Oops: 0038 ilc:3 [#1] SMP
        Modules linked in: ... lots of modules ...
        Supported: Yes, External
        CPU: 0 PID: 7348 Comm: multipathd Kdump: loaded Tainted: G        W      X    5.3.18-53-default #1 SLE15-SP3
        Hardware name: IBM 8561 T01 7I2 (LPAR)
        Krnl PSW : 0704e00180000000 000000025e368eca (kfree+0x42/0x330)
                   R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
        Krnl GPRS: 000000000000004a 000000025efe5230 c1773200d779968d 0000000000000000
                   000000025e520270 000000025e8d1b40 0000000000000003 00000007aae10000
                   000000025e5202a2 0000000000000001 c1773200d779968d 0305e098835de640
                   00000007a8170000 000003ff80138650 000000025e5202a2 000003e00396faa8
        Krnl Code: 000000025e368eb8: c4180041e100       lgrl    %r1,25eba50b8
                   000000025e368ebe: ecba06b93a55       risbg   %r11,%r10,6,185,58
                  #000000025e368ec4: e3b010000008       ag      %r11,0(%r1)
                  >000000025e368eca: e310b0080004       lg      %r1,8(%r11)
                   000000025e368ed0: a7110001           tmll    %r1,1
                   000000025e368ed4: a7740129           brc     7,25e369126
                   000000025e368ed8: e320b0080004       lg      %r2,8(%r11)
                   000000025e368ede: b904001b           lgr     %r1,%r11
        Call Trace:
         [<000000025e368eca>] kfree+0x42/0x330
         [<000000025e5202a2>] blk_mq_free_tag_set+0x72/0xb8
         [<000003ff801316a8>] dm_mq_cleanup_mapped_device+0x38/0x50 [dm_mod]
         [<000003ff80120082>] free_dev+0x52/0xd0 [dm_mod]
         [<000003ff801233f0>] __dm_destroy+0x150/0x1d0 [dm_mod]
         [<000003ff8012bb9a>] dev_remove+0x162/0x1c0 [dm_mod]
         [<000003ff8012a988>] ctl_ioctl+0x198/0x478 [dm_mod]
         [<000003ff8012ac8a>] dm_ctl_ioctl+0x22/0x38 [dm_mod]
         [<000000025e3b11ee>] ksys_ioctl+0xbe/0xe0
         [<000000025e3b127a>] __s390x_sys_ioctl+0x2a/0x40
         [<000000025e8c15ac>] system_call+0xd8/0x2c8
        Last Breaking-Event-Address:
         [<000000025e52029c>] blk_mq_free_tag_set+0x6c/0xb8
        Kernel panic - not syncing: Fatal exception: panic_on_oops
      
      When allocation/initialization of the blk_mq_tag_set fails in
      dm_mq_init_request_queue(), it is uninitialized/freed, but the pointer
      is not reset to NULL; so when dev_remove() later gets into
      dm_mq_cleanup_mapped_device() it sees the pointer and tries to
      uninitialize and free it again.
      
      Fix this by setting the pointer to NULL in dm_mq_init_request_queue()
      error-handling. Also set it to NULL in dm_mq_cleanup_mapped_device().
      
      Cc: <stable@vger.kernel.org> # 4.6+
      Fixes: 1c357a1e ("dm: allocate blk_mq_tag_set rather than embed in mapped_device")
      Signed-off-by: default avatarBenjamin Block <bblock@linux.ibm.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      8e947c8f
    • Mikulas Patocka's avatar
      dm integrity: use discard support when recalculating · 7a5b96b4
      Mikulas Patocka authored
      If we have discard support we don't have to recalculate hash - we can
      just fill the metadata with the discard pattern.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      7a5b96b4
    • Mikulas Patocka's avatar
      dm integrity: increase RECALC_SECTORS to improve recalculate speed · b1a2b933
      Mikulas Patocka authored
      Increase RECALC_SECTORS because it improves recalculate speed slightly
      (from 390kiB/s to 410kiB/s).
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      b1a2b933
    • Mikulas Patocka's avatar
      dm integrity: don't re-write metadata if discarding same blocks · a9c0fda4
      Mikulas Patocka authored
      If we discard already discarded blocks we do not need to write discard
      pattern to the metadata, because it is already there.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      a9c0fda4
  2. 21 Apr, 2021 1 commit
    • Heinz Mauelshagen's avatar
      dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences · f99a8e43
      Heinz Mauelshagen authored
      If fast table reloads occur during an ongoing reshape of raid4/5/6
      devices the target may race reading a superblock vs the the MD resync
      thread; causing an inconclusive reshape state to be read in its
      constructor.
      
      lvm2 test lvconvert-raid-reshape-stripes-load-reload.sh can cause
      BUG_ON() to trigger in md_run(), e.g.:
      "kernel BUG at drivers/md/raid5.c:7567!".
      
      Scenario triggering the bug:
      
      1. the MD sync thread calls end_reshape() from raid5_sync_request()
         when done reshaping. However end_reshape() _only_ updates the
         reshape position to MaxSector keeping the changed layout
         configuration though (i.e. any delta disks, chunk sector or RAID
         algorithm changes). That inconclusive configuration is stored in
         the superblock.
      
      2. dm-raid constructs a mapping, loading named inconsistent superblock
         as of step 1 before step 3 is able to finish resetting the reshape
         state completely, and calls md_run() which leads to mentioned bug
         in raid5.c.
      
      3. the MD RAID personality's finish_reshape() is called; which resets
         the reshape information on chunk sectors, delta disks, etc. This
         explains why the bug is rarely seen on multi-core machines, as MD's
         finish_reshape() superblock update races with the dm-raid
         constructor's superblock load in step 2.
      
      Fix identifies inconclusive superblock content in the dm-raid
      constructor and resets it before calling md_run(), factoring out
      identifying checks into rs_is_layout_change() to share in existing
      rs_reshape_requested() and new rs_reset_inclonclusive_reshape(). Also
      enhance a comment and remove an empty line.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarHeinz Mauelshagen <heinzm@redhat.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      f99a8e43
  3. 20 Apr, 2021 1 commit
  4. 19 Apr, 2021 7 commits
  5. 26 Mar, 2021 13 commits
  6. 22 Mar, 2021 3 commits
    • Mikulas Patocka's avatar
      dm: don't report "detected capacity change" on device creation · 5424a0b8
      Mikulas Patocka authored
      When a DM device is first created it doesn't yet have an established
      capacity, therefore the use of set_capacity_and_notify() should be
      conditional given the potential for needless pr_info "detected
      capacity change" noise even if capacity is 0.
      
      One could argue that the pr_info() in set_capacity_and_notify() is
      misplaced, but that position is not held uniformly.
      Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
      Fixes: f64d9b2e ("dm: use set_capacity_and_notify")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      5424a0b8
    • Shin'ichiro Kawasaki's avatar
      dm table: Fix zoned model check and zone sectors check · 2d669ceb
      Shin'ichiro Kawasaki authored
      Commit 24f6b603 ("dm table: fix zoned iterate_devices based device
      capability checks") triggered dm table load failure when dm-zoned device
      is set up for zoned block devices and a regular device for cache.
      
      The commit inverted logic of two callback functions for iterate_devices:
      device_is_zoned_model() and device_matches_zone_sectors(). The logic of
      device_is_zoned_model() was inverted then all destination devices of all
      targets in dm table are required to have the expected zoned model. This
      is fine for dm-linear, dm-flakey and dm-crypt on zoned block devices
      since each target has only one destination device. However, this results
      in failure for dm-zoned with regular cache device since that target has
      both regular block device and zoned block devices.
      
      As for device_matches_zone_sectors(), the commit inverted the logic to
      require all zoned block devices in each target have the specified
      zone_sectors. This check also fails for regular block device which does
      not have zones.
      
      To avoid the check failures, fix the zone model check and the zone
      sectors check. For zone model check, introduce the new feature flag
      DM_TARGET_MIXED_ZONED_MODEL, and set it to dm-zoned target. When the
      target has this flag, allow it to have destination devices with any
      zoned model. For zone sectors check, skip the check if the destination
      device is not a zoned block device. Also add comments and improve an
      error message to clarify expectations to the two checks.
      
      Fixes: 24f6b603 ("dm table: fix zoned iterate_devices based device capability checks")
      Signed-off-by: default avatarShin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
      Signed-off-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      2d669ceb
    • JeongHyeon Lee's avatar
      dm verity: fix DM_VERITY_OPTS_MAX value · 160f99db
      JeongHyeon Lee authored
      Three optional parameters must be accepted at once in a DM verity table, e.g.:
        (verity_error_handling_mode) (ignore_zero_block) (check_at_most_once)
      Fix this to be possible by incrementing DM_VERITY_OPTS_MAX.
      Signed-off-by: default avatarJeongHyeon Lee <jhs2.lee@samsung.com>
      Fixes: 843f38d3 ("dm verity: add 'check_at_most_once' option to only validate hashes once")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
      160f99db
  7. 21 Mar, 2021 11 commits
    • Linus Torvalds's avatar
      Linux 5.12-rc4 · 0d02ec6b
      Linus Torvalds authored
      0d02ec6b
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · d7f5f1bd
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Miscellaneous ext4 bug fixes for v5.12"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: initialize ret to suppress smatch warning
        ext4: stop inode update before return
        ext4: fix rename whiteout with fast commit
        ext4: fix timer use-after-free on failed mount
        ext4: fix potential error in ext4_do_update_inode
        ext4: do not try to set xattr into ea_inode if value is empty
        ext4: do not iput inode under running transaction in ext4_rename()
        ext4: find old entry again if failed to rename whiteout
        ext4: fix error handling in ext4_end_enable_verity()
        ext4: fix bh ref count on error paths
        fs/ext4: fix integer overflow in s_log_groups_per_flex
        ext4: add reclaim checks to xattr code
        ext4: shrink race window in ext4_should_retry_alloc()
      d7f5f1bd
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.12-2021-03-21' of git://git.kernel.dk/linux-block · 2c41fab1
      Linus Torvalds authored
      Pull io_uring followup fixes from Jens Axboe:
      
       - The SIGSTOP change from Eric, so we properly ignore that for
         PF_IO_WORKER threads.
      
       - Disallow sending signals to PF_IO_WORKER threads in general, we're
         not interested in having them funnel back to the io_uring owning
         task.
      
       - Stable fix from Stefan, ensuring we properly break links for short
         send/sendmsg recv/recvmsg if MSG_WAITALL is set.
      
       - Catch and loop when needing to run task_work before a PF_IO_WORKER
         threads goes to sleep.
      
      * tag 'io_uring-5.12-2021-03-21' of git://git.kernel.dk/linux-block:
        io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with MSG_WAITALL
        io-wq: ensure task is running before processing task_work
        signal: don't allow STOP on PF_IO_WORKER threads
        signal: don't allow sending any signals to PF_IO_WORKER threads
      2c41fab1
    • Linus Torvalds's avatar
      Merge tag 'staging-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 1d4345eb
      Linus Torvalds authored
      Pull staging and IIO driver fixes from Greg KH:
       "Some small staging and IIO driver fixes:
      
         - MAINTAINERS changes for the move of the staging mailing list
      
         - comedi driver fixes to get request_irq() to work correctly
      
         - counter driver fixes for reported issues with iio devices
      
         - tiny iio driver fixes for reported issues.
      
        All of these have been in linux-next with no reported problems"
      
      * tag 'staging-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: vt665x: fix alignment constraints
        staging: comedi: cb_pcidas64: fix request_irq() warn
        staging: comedi: cb_pcidas: fix request_irq() warn
        MAINTAINERS: move the staging subsystem to lists.linux.dev
        MAINTAINERS: move some real subsystems off of the staging mailing list
        iio: gyro: mpu3050: Fix error handling in mpu3050_trigger_handler
        iio: hid-sensor-temperature: Fix issues of timestamp channel
        iio: hid-sensor-humidity: Fix alignment issue of timestamp channel
        counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register
        counter: stm32-timer-cnt: fix ceiling write max value
        counter: stm32-timer-cnt: Report count function when SLAVE_MODE_DISABLED
        iio: adc: ab8500-gpadc: Fix off by 10 to 3
        iio:adc:stm32-adc: Add HAS_IOMEM dependency
        iio: adis16400: Fix an error code in adis16400_initial_setup()
        iio: adc: adi-axi-adc: add proper Kconfig dependencies
        iio: adc: ad7949: fix wrong ADC result due to incorrect bit mask
        iio: hid-sensor-prox: Fix scale not correct issue
        iio:adc:qcom-spmi-vadc: add default scale to LR_MUX2_BAT_ID channel
      1d4345eb
    • Linus Torvalds's avatar
      Merge tag 'usb-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 3001c355
      Linus Torvalds authored
      Pull USB and Thunderbolt driver fixes from Greg KH:
       "Here are some small Thunderbolt and USB driver fixes for some reported
        issues:
      
         - thunderbolt fixes for minor problems
      
         - typec fixes for power issues
      
         - usb-storage quirk addition
      
         - usbip bugfix
      
         - dwc3 bugfix when stopping transfers
      
         - cdnsp bugfix for isoc transfers
      
         - gadget use-after-free fix
      
        All have been in linux-next this week with no reported issues"
      
      * tag 'usb-5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: typec: tcpm: Skip sink_cap query only when VDM sm is busy
        usb: dwc3: gadget: Prevent EP queuing while stopping transfers
        usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy-
        usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct
        usb-storage: Add quirk to defeat Kindle's automatic unload
        usb: gadget: configfs: Fix KASAN use-after-free
        usbip: Fix incorrect double assignment to udc->ud.tcp_rx
        usb: cdnsp: Fixes incorrect value in ISOC TRB
        thunderbolt: Increase runtime PM reference count on DP tunnel discovery
        thunderbolt: Initialize HopID IDAs in tb_switch_alloc()
      3001c355
    • Linus Torvalds's avatar
      Merge tag 'irq-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5ee96fa9
      Linus Torvalds authored
      Pull irq fix from Ingo Molnar:
       "A change to robustify force-threaded IRQ handlers to always disable
        interrupts, plus a DocBook fix.
      
        The force-threaded IRQ handler change has been accelerated from the
        normal schedule of such a change to keep the bad pattern/workaround of
        spin_lock_irqsave() in handlers or IRQF_NOTHREAD as a kludge from
        spreading"
      
      * tag 'irq-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        genirq: Disable interrupts for force threaded handlers
        genirq/irq_sim: Fix typos in kernel doc (fnode -> fwnode)
      5ee96fa9
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1c74516c
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Boundary condition fixes for bugs unearthed by the perf fuzzer"
      
      * tag 'perf-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/intel: Fix unchecked MSR access error caused by VLBR_EVENT
        perf/x86/intel: Fix a crash caused by zero PEBS status
      1c74516c
    • Linus Torvalds's avatar
      Merge tag 'locking-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5ba33b48
      Linus Torvalds authored
      Pull locking fixes from Ingo Molnar:
      
       - Get static calls & modules right. Hopefully.
      
       - WW mutex fixes
      
      * tag 'locking-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        static_call: Fix static_call_update() sanity check
        static_call: Align static_call_is_init() patching condition
        static_call: Fix static_call_set_init()
        locking/ww_mutex: Fix acquire/release imbalance in ww_acquire_init()/ww_acquire_fini()
        locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling
      5ba33b48
    • Linus Torvalds's avatar
      Merge tag 'efi-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 92ed88cb
      Linus Torvalds authored
      Pull EFI fixes from Ingo Molnar:
      
       - another missing RT_PROP table related fix, to ensure that the
         efivarfs pseudo filesystem fails gracefully if variable services
         are unsupported
      
       - use the correct alignment for literal EFI GUIDs
      
       - fix a use after unmap issue in the memreserve code
      
      * tag 'efi-urgent-2021-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi: use 32-bit alignment for efi_guid_t literals
        firmware/efi: Fix a use after bug in efi_mem_reserve_persistent
        efivars: respect EFI_UNSUPPORTED return from firmware
      92ed88cb
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 5e3ddf96
      Linus Torvalds authored
      Pull x86 fixes from Borislav Petkov:
       "The freshest pile of shiny x86 fixes for 5.12:
      
         - Add the arch-specific mapping between physical and logical CPUs to
           fix devicetree-node lookups
      
         - Restore the IRQ2 ignore logic
      
         - Fix get_nr_restart_syscall() to return the correct restart syscall
           number. Split in a 4-patches set to avoid kABI breakage when
           backporting to dead kernels"
      
      * tag 'x86_urgent_for_v5.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/apic/of: Fix CPU devicetree-node lookups
        x86/ioapic: Ignore IRQ2 again
        x86: Introduce restart_block->arch_data to remove TS_COMPAT_RESTART
        x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
        x86: Move TS_COMPAT back to asm/thread_info.h
        kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
      5e3ddf96
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · b35660a7
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       - Fix a possible stack corruption and subsequent DLPAR failure in the
         rpadlpar_io PCI hotplug driver
      
       - Two build fixes for uncommon configurations
      
      Thanks to Christophe Leroy and Tyrel Datwyler.
      
      * tag 'powerpc-5.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        PCI: rpadlpar: Fix potential drc_name corruption in store functions
        powerpc: Force inlining of cpu_has_feature() to avoid build failure
        powerpc/vdso32: Add missing _restgpr_31_x to fix build failure
      b35660a7