linux-stable.git/block/bio.c, branch linux-4.1.y

more bio_map_user_iov() leak fixes

2018-02-28T22:38:14+00:00

[ Upstream commit 2b04e8f6bbb196cab4b232af0f8d48ff2c7a8058 ]

we need to take care of failure exit as well - pages already
in bio should be dropped by analogue of bio_unmap_pages(),
since their refcounts had been bumped only once per reference
in bio.

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

fix unbalanced page refcounting in bio_map_user_iov

2017-11-06T04:54:26+00:00

[ Upstream commit 95d78c28b5a85bacbc29b8dba7c04babb9b0d467 ]

bio_map_user_iov and bio_unmap_user do unbalanced pages refcounting if
IO vector has small consecutive buffers belonging to the same page.
bio_add_pc_page merges them into one, but the page reference is never
dropped.

Cc: stable@vger.kernel.org
Signed-off-by: Vitaly Mayatskikh 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

bio: return EINTR if copying to user space got interrupted

2016-03-04T15:25:43+00:00

[ Upstream commit 2d99b55d378c996b9692a0c93dd25f4ed5d58934 ]

Commit 35dc248383bbab0a7203fca4d722875bc81ef091 introduced a check for
current->mm to see if we have a user space context and only copies data
if we do. Now if an IO gets interrupted by a signal data isn't copied
into user space any more (as we don't have a user space context) but
user space isn't notified about it.

This patch modifies the behaviour to return -EINTR from bio_uncopy_user()
to notify userland that a signal has interrupted the syscall, otherwise
it could lead to a situation where the caller may get a buffer with
no data returned.

This can be reproduced by issuing SG_IO ioctl()s in one thread while
constantly sending signals to it.

Fixes: 35dc248 [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a signal
Signed-off-by: Johannes Thumshirn 
Signed-off-by: Hannes Reinecke 
Cc: stable@vger.kernel.org # v.3.11+
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

block: Do a full clone when splitting discard bios

2015-08-03T16:29:07+00:00

commit f3f5da624e0a891c34d8cd513c57f1d9b0c7dadc upstream.

This fixes a data corruption bug when using discard on top of MD linear,
raid0 and raid10 personalities.

Commit 20d0189b1012 "block: Introduce new bio_split()" permits sharing
the bio_vec between the two resulting bios. That is fine for read/write
requests where the bio_vec is immutable. For discards, however, we need
to be able to attach a payload and update the bio_vec so the page can
get mapped to a scatterlist entry. Therefore the bio_vec can not be
shared when splitting discards and we must do a full clone.

Signed-off-by: Martin K. Petersen 
Reported-by: Seunguk Shin 
Tested-by: Seunguk Shin 
Cc: Seunguk Shin 
Cc: Jens Axboe 
Cc: Kent Overstreet 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

block: rewrite and split __bio_copy_iov()

2015-02-05T16:30:44+00:00

Rewrite __bio_copy_iov using the copy_page_{from,to}_iter helpers, and
split it into two simpler functions.

This commit should contain only literal replacements, without
functional changes.

Cc: Kent Overstreet 
Cc: Jens Axboe 
Cc: Al Viro 
Signed-off-by: Dongsu Park 
[hch: removed the __bio_copy_iov wrapper]
Signed-off-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Jens Axboe

block: merge __bio_map_user_iov into bio_map_user_iov

2015-02-05T16:30:43+00:00

And also remove the unused bdev argument.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Jens Axboe

block: merge __bio_map_kern into bio_map_kern

2015-02-05T16:30:42+00:00

This saves a little code, and allow to simplify the error handling.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Jens Axboe

block: pass iov_iter to the BLOCK_PC mapping functions

2015-02-05T16:30:40+00:00

Make use of a new interface provided by iov_iter, backed by
scatter-gather list of iovec, instead of the old interface based on
sg_iovec. Also use iov_iter_advance() instead of manual iteration.

This commit should contain only literal replacements, without
functional changes.

Cc: Christoph Hellwig 
Cc: Jens Axboe 
Cc: Doug Gilbert 
Cc: "James E.J. Bottomley" 
Signed-off-by: Kent Overstreet 
[dpark: add more description in commit message]
Signed-off-by: Dongsu Park 
[hch: fixed to do a deep clone of the iov_iter, and to properly use
      the iov_iter direction]
Signed-off-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Jens Axboe

block: add a helper to free bio bounce buffer pages

2015-02-05T16:30:39+00:00

The code sniplet to walk all bio_vecs and free their pages is opencoded in
way to many places, so factor it into a helper.  Also convert the slightly
more complex cases in bio_kern_endio and __bio_copy_iov where we break
the freeing from an existing loop into a separate one.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Jens Axboe

block: use blk_rq_map_user_iov to implement blk_rq_map_user

2015-02-05T16:30:37+00:00

Signed-off-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Jens Axboe