summaryrefslogtreecommitdiff
path: root/drivers/block
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/block')
-rw-r--r--drivers/block/drbd/drbd_receiver.c5
-rw-r--r--drivers/block/floppy.c2
-rw-r--r--drivers/block/loop.c32
-rw-r--r--drivers/block/rbd.c7
-rw-r--r--drivers/block/ublk_drv.c69
-rw-r--r--drivers/block/xen-blkfront.c9
6 files changed, 86 insertions, 38 deletions
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 58b95bf4bdca..2135c14354a8 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1810,6 +1810,11 @@ static int recv_dless_read(struct drbd_peer_device *peer_device, struct drbd_req
data_size -= digest_size;
}
+ if (data_size < 0) {
+ drbd_err(peer_device, "Invalid data reply size\n");
+ return -EIO;
+ }
+
/* optimistically update recv_cnt. if receiving fails below,
* we disconnect anyways, and counters will be reset. */
peer_device->device->recv_cnt += data_size>>9;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index dca495be0683..f04397b8e381 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -180,7 +180,7 @@ static int print_unex = 1;
#include <linux/major.h>
#include <linux/mc146818rtc.h> /* CMOS defines */
#include <linux/mm.h>
-#include <linux/mod_devicetable.h>
+#include <linux/device-id/pnp.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/platform_device.h>
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 310de0463beb..1faecef33009 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1113,6 +1113,7 @@ static void __loop_clr_fd(struct loop_device *lo)
struct queue_limits lim;
struct file *filp;
gfp_t gfp = lo->old_gfp_mask;
+ int err;
spin_lock_irq(&lo->lo_lock);
filp = lo->lo_backing_file;
@@ -1146,26 +1147,21 @@ static void __loop_clr_fd(struct loop_device *lo)
disk_force_media_change(lo->lo_disk);
- if (lo->lo_flags & LO_FLAGS_PARTSCAN) {
- int err;
-
- /*
- * open_mutex has been held already in release path, so don't
- * acquire it if this function is called in such case.
- *
- * If the reread partition isn't from release path, lo_refcnt
- * must be at least one and it can only become zero when the
- * current holder is released.
- */
- err = bdev_disk_changed(lo->lo_disk, false);
- if (err)
- pr_warn("%s: partition scan of loop%d failed (rc=%d)\n",
- __func__, lo->lo_number, err);
- /* Device is gone, no point in returning error */
- }
+ /*
+ * Remove all partitions, including partitions added manually with
+ * BLKPG, which may exist even if LO_FLAGS_PARTSCAN is not set.
+ *
+ * open_mutex has been held already in release path, so don't acquire
+ * it here.
+ */
+ err = bdev_disk_changed(lo->lo_disk, false);
+ if (err)
+ pr_warn("%s: partition scan of loop%d failed (rc=%d)\n",
+ __func__, lo->lo_number, err);
+ /* Device is gone, no point in returning error */
/*
- * lo->lo_state is set to Lo_unbound here after above partscan has
+ * lo->lo_state is set to Lo_unbound here after removing partitions has
* finished. There cannot be anybody else entering __loop_clr_fd() as
* Lo_rundown state protects us from all the other places trying to
* change the 'lo' device.
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index ac90d81aa294..1f1c2810f6ee 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -1950,10 +1950,15 @@ static int rbd_object_map_update_finish(struct rbd_obj_request *obj_req,
bool has_current_state;
void *p;
- if (osd_req->r_result)
+ if (osd_req->r_result < 0)
return osd_req->r_result;
/*
+ * Writes aren't allowed to return a data payload.
+ */
+ WARN_ON_ONCE(osd_req->r_result > 0);
+
+ /*
* Nothing to do for a snapshot object map.
*/
if (osd_req->r_num_ops == 1)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 4f6d9e652187..2a22f9dc1f2f 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -19,6 +19,7 @@
#include <linux/errno.h>
#include <linux/major.h>
#include <linux/wait.h>
+#include <linux/wait_bit.h>
#include <linux/blkdev.h>
#include <linux/init.h>
#include <linux/swap.h>
@@ -26,7 +27,6 @@
#include <linux/compat.h>
#include <linux/mutex.h>
#include <linux/writeback.h>
-#include <linux/completion.h>
#include <linux/highmem.h>
#include <linux/sysfs.h>
#include <linux/miscdevice.h>
@@ -327,7 +327,6 @@ struct ublk_device {
struct ublk_params params;
- struct completion completion;
u32 nr_queue_ready;
bool unprivileged_daemons;
struct mutex cancel_mutex;
@@ -3054,12 +3053,12 @@ static void ublk_mark_io_ready(struct ublk_device *ub, u16 q_id,
if (ublk_dev_ready(ub)) {
/*
* All queues ready - clear device-level canceling flag
- * and complete the recovery/initialization.
+ * and wake ublk_dev_ready() waiters.
*/
mutex_lock(&ub->cancel_mutex);
ub->canceling = false;
mutex_unlock(&ub->cancel_mutex);
- complete_all(&ub->completion);
+ wake_up_var(&ub->nr_queue_ready);
}
}
@@ -3584,6 +3583,7 @@ ublk_batch_auto_buf_reg(const struct ublk_batch_io *uc,
#define UBLK_CMD_BATCH_TMP_BUF_SZ (48 * 10)
struct ublk_batch_io_iter {
void __user *uaddr;
+ const u8 *kaddr;
unsigned done, total;
unsigned char elem_bytes;
/* copy to this buffer from user space */
@@ -3632,7 +3632,10 @@ static int ublk_walk_cmd_buf(struct ublk_batch_io_iter *iter,
while (iter->done < iter->total) {
unsigned int len = min(sizeof(iter->buf), iter->total - iter->done);
- if (copy_from_user(iter->buf, iter->uaddr + iter->done, len)) {
+ if (iter->kaddr) {
+ memcpy(iter->buf, iter->kaddr + iter->done, len);
+ } else if (copy_from_user(iter->buf, iter->uaddr + iter->done,
+ len)) {
pr_warn("ublk%d: read batch cmd buffer failed\n",
data->ub->dev_info.dev_id);
return -EFAULT;
@@ -3723,14 +3726,21 @@ static int ublk_handle_batch_prep_cmd(const struct ublk_batch_io_data *data)
.total = uc->nr_elem * uc->elem_bytes,
.elem_bytes = uc->elem_bytes,
};
+ void *cmd_buf;
int ret;
+ cmd_buf = vmemdup_user(iter.uaddr, iter.total);
+ if (IS_ERR(cmd_buf))
+ return PTR_ERR(cmd_buf);
+ iter.kaddr = cmd_buf;
+
mutex_lock(&data->ub->mutex);
ret = ublk_walk_cmd_buf(&iter, data, ublk_batch_prep_io);
if (ret && iter.done)
ublk_batch_revert_prep_cmd(&iter, data);
mutex_unlock(&data->ub->mutex);
+ kvfree(cmd_buf);
return ret;
}
@@ -4262,7 +4272,6 @@ static int ublk_init_queues(struct ublk_device *ub)
goto fail;
}
- init_completion(&ub->completion);
return 0;
fail:
@@ -4406,6 +4415,26 @@ static bool ublk_validate_user_pid(struct ublk_device *ub, pid_t ublksrv_pid)
return ub->ublksrv_tgid == ublksrv_pid;
}
+/*
+ * Wait until all queues have fetched their I/O commands, and return with
+ * ub->mutex held and readiness guaranteed: then every queue's ->canceling
+ * is cleared. Ready may regress between wakeup and mutex_lock() (F_BATCH
+ * UNPREP, daemon death), so re-check it under the mutex and wait again.
+ */
+static int ublk_wait_dev_ready_and_lock(struct ublk_device *ub)
+{
+ while (true) {
+ if (wait_var_event_interruptible(&ub->nr_queue_ready,
+ ublk_dev_ready(ub)))
+ return -EINTR;
+
+ mutex_lock(&ub->mutex);
+ if (ublk_dev_ready(ub))
+ return 0;
+ mutex_unlock(&ub->mutex);
+ }
+}
+
static int ublk_ctrl_start_dev(struct ublk_device *ub,
const struct ublksrv_ctrl_cmd *header)
{
@@ -4488,15 +4517,10 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub,
};
}
- if (wait_for_completion_interruptible(&ub->completion) != 0)
+ if (ublk_wait_dev_ready_and_lock(ub))
return -EINTR;
- if (!ublk_validate_user_pid(ub, ublksrv_pid))
- return -EINVAL;
-
- mutex_lock(&ub->mutex);
- /* device may become not ready in case of F_BATCH */
- if (!ublk_dev_ready(ub)) {
+ if (!ublk_validate_user_pid(ub, ublksrv_pid)) {
ret = -EINVAL;
goto out_unlock;
}
@@ -4741,6 +4765,15 @@ static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header)
ub->dev_info.dev_id = ub->ub_number;
/*
+ * ->state and ->ublksrv_pid are owned by the driver and only read back
+ * by userspace, but they come from the copied-in dev_info, so reset
+ * them. Otherwise a device added with ->state != DEAD looks live while
+ * ->ub_disk is still NULL.
+ */
+ ub->dev_info.state = UBLK_S_DEV_DEAD;
+ ub->dev_info.ublksrv_pid = -1;
+
+ /*
* 64bit flags will be copied back to userspace as feature
* negotiation result, so have to clear flags which driver
* doesn't support yet, then userspace can get correct flags
@@ -5060,7 +5093,6 @@ static int ublk_ctrl_start_recovery(struct ublk_device *ub)
goto out_unlock;
}
pr_devel("%s: start recovery for dev id %d\n", __func__, ub->ub_number);
- init_completion(&ub->completion);
ret = 0;
out_unlock:
mutex_unlock(&ub->mutex);
@@ -5076,16 +5108,17 @@ static int ublk_ctrl_end_recovery(struct ublk_device *ub,
pr_devel("%s: Waiting for all FETCH_REQs, dev id %d...\n", __func__,
header->dev_id);
- if (wait_for_completion_interruptible(&ub->completion))
+ if (ublk_wait_dev_ready_and_lock(ub))
return -EINTR;
pr_devel("%s: All FETCH_REQs received, dev id %d\n", __func__,
header->dev_id);
- if (!ublk_validate_user_pid(ub, ublksrv_pid))
- return -EINVAL;
+ if (!ublk_validate_user_pid(ub, ublksrv_pid)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
- mutex_lock(&ub->mutex);
if (ublk_nosrv_should_stop_dev(ub))
goto out_unlock;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index f765970578f9..8dad7bf5f664 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2080,6 +2080,15 @@ static int blkfront_resume(struct xenbus_device *dev)
continue;
/*
+ * For requests split across multiple slots, process the
+ * underlying request only once: skip the linked, sg-less
+ * secondary slot.
+ */
+ if (shadow[j].associated_id != NO_ASSOCIATED_ID &&
+ shadow[j].num_sg == 0)
+ continue;
+
+ /*
* Get the bios in the request so we can re-queue them.
*/
if (req_op(shadow[j].request) == REQ_OP_FLUSH ||