Merge tag 'block-6.1-2022-11-11' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

 - NVMe pull request via Christoph:
        - Quiet user passthrough command errors (Keith Busch)
        - Fix memory leak in nvmet_subsys_attr_model_store_locked
        - Fix a memory leak in nvmet-auth (Sagi Grimberg)

 - Fix a potential NULL point deref in bfq (Yu)

 - Allocate command/response buffers separately for DMA for sed-opal,
   rather than rely on embedded alignment (Serge)

* tag 'block-6.1-2022-11-11' of git://git.kernel.dk/linux:
  nvmet: fix a memory leak
  nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
  nvme: quiet user passthrough command errors
  block: sed-opal: kmalloc the cmd/resp buffers
  block, bfq: fix null pointer dereference in bfq_bio_bfqg()

diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index 144bca006463dbbf83e6b51f7c719e3fb3b6f3e8..7d624a3a3f0f896e112f8b52f9abf19da5b816ed 100644 (file)
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -610,6 +610,10 @@ struct bfq_group *bfq_bio_bfqg(struct bfq_data *bfqd, struct bio *bio)
        struct bfq_group *bfqg;
 
        while (blkg) {
+               if (!blkg->online) {
+                       blkg = blkg->parent;
+                       continue;
+               }
                bfqg = blkg_to_bfqg(blkg);
                if (bfqg->online) {
                        bio_associate_blkg_from_css(bio, &blkg->blkcg->css);

diff --git a/block/sed-opal.c b/block/sed-opal.c
index 2c5327a0543a66889e3b5eb0c0ec0786e1845c19..9bdb833e5817dad4f0caa2ce0e86dfe772249152 100644 (file)
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -87,8 +87,8 @@ struct opal_dev {
        u64 lowest_lba;
 
        size_t pos;
-       u8 cmd[IO_BUFFER_LENGTH];
-       u8 resp[IO_BUFFER_LENGTH];
+       u8 *cmd;
+       u8 *resp;
 
        struct parsed_resp parsed;
        size_t prev_d_len;
@@ -2175,6 +2175,8 @@ void free_opal_dev(struct opal_dev *dev)
                return;
 
        clean_opal_dev(dev);
+       kfree(dev->resp);
+       kfree(dev->cmd);
        kfree(dev);
 }
 EXPORT_SYMBOL(free_opal_dev);
@@ -2187,6 +2189,18 @@ struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv)
        if (!dev)
                return NULL;
 
+       /*
+        * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes
+        * sure the allocated buffer is DMA-safe in that regard.
+        */
+       dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
+       if (!dev->cmd)
+               goto err_free_dev;
+
+       dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL);
+       if (!dev->resp)
+               goto err_free_cmd;
+
        INIT_LIST_HEAD(&dev->unlk_lst);
        mutex_init(&dev->dev_lock);
        dev->flags = 0;
@@ -2194,11 +2208,21 @@ struct opal_dev *init_opal_dev(void *data, sec_send_recv *send_recv)
        dev->send_recv = send_recv;
        if (check_opal_support(dev) != 0) {
                pr_debug("Opal is not supported on this device\n");
-               kfree(dev);
-               return NULL;
+               goto err_free_resp;
        }
 
        return dev;
+
+err_free_resp:
+       kfree(dev->resp);
+
+err_free_cmd:
+       kfree(dev->cmd);
+
+err_free_dev:
+       kfree(dev);
+
+       return NULL;
 }
 EXPORT_SYMBOL(init_opal_dev);
 

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index dc42206005855dce9ce9cc2ec60429995f246573..da55ce45ac7013be5839979228438175b8a8f5d3 100644 (file)
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -675,6 +675,7 @@ void nvme_init_request(struct request *req, struct nvme_command *cmd)
        if (req->mq_hctx->type == HCTX_TYPE_POLL)
                req->cmd_flags |= REQ_POLLED;
        nvme_clear_nvme_request(req);
+       req->rq_flags |= RQF_QUIET;
        memcpy(nvme_req(req)->cmd, cmd, sizeof(*cmd));
 }
 EXPORT_SYMBOL_GPL(nvme_init_request);
@@ -1037,7 +1038,6 @@ int __nvme_submit_sync_cmd(struct request_queue *q, struct nvme_command *cmd,
                        goto out;
        }
 
-       req->rq_flags |= RQF_QUIET;
        ret = nvme_execute_rq(req, at_head);
        if (result && ret >= 0)
                *result = nvme_req(req)->result;
@@ -1227,7 +1227,6 @@ static void nvme_keep_alive_work(struct work_struct *work)
        rq->timeout = ctrl->kato * HZ;
        rq->end_io = nvme_keep_alive_end_io;
        rq->end_io_data = ctrl;
-       rq->rq_flags |= RQF_QUIET;
        blk_execute_rq_nowait(rq, false);
 }
 

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 31e577b01257d6196d71523b20575eea8d99e4a8..02b5578773a178d314bbe865b1229e71d05dda6e 100644 (file)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1436,7 +1436,6 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req)
 
        abort_req->end_io = abort_endio;
        abort_req->end_io_data = NULL;
-       abort_req->rq_flags |= RQF_QUIET;
        blk_execute_rq_nowait(abort_req, false);
 
        /*
@@ -2490,7 +2489,6 @@ static int nvme_delete_queue(struct nvme_queue *nvmeq, u8 opcode)
        req->end_io_data = nvmeq;
 
        init_completion(&nvmeq->delete_done);
-       req->rq_flags |= RQF_QUIET;
        blk_execute_rq_nowait(req, false);
        return 0;
 }

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 9443ee1d4ae3dd6c367db6a3ca7b24a1b90da15f..6a2816f3b4e807813a51ddd2d73a1611a7f10ba1 100644 (file)
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -1215,6 +1215,7 @@ static ssize_t nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys,
                const char *page, size_t count)
 {
        int pos = 0, len;
+       char *val;
 
        if (subsys->subsys_discovered) {
                pr_err("Can't set model number. %s is already assigned\n",
@@ -1237,9 +1238,11 @@ static ssize_t nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys,
                        return -EINVAL;
        }
 
-       subsys->model_number = kmemdup_nul(page, len, GFP_KERNEL);
-       if (!subsys->model_number)
+       val = kmemdup_nul(page, len, GFP_KERNEL);
+       if (!val)
                return -ENOMEM;
+       kfree(subsys->model_number);
+       subsys->model_number = val;
        return count;
 }
 
@@ -1836,6 +1839,7 @@ static void nvmet_host_release(struct config_item *item)
 
 #ifdef CONFIG_NVME_TARGET_AUTH
        kfree(host->dhchap_secret);
+       kfree(host->dhchap_ctrl_secret);
 #endif
        kfree(host);
 }