linux-stable.git/drivers/block/nbd.c, branch linux-4.8.y

nbd: fix race in ioctl

2016-08-04T20:19:16+00:00

Quentin ran into this bug:

WARNING: CPU: 64 PID: 10085 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x65/0x80
sysfs: cannot create duplicate filename '/devices/virtual/block/nbd3/pid'
Modules linked in: nbd
CPU: 64 PID: 10085 Comm: qemu-nbd Tainted: G      D         4.6.0+ #7
 0000000000000000 ffff8820330bba68 ffffffff814b8791 ffff8820330bbac8
 0000000000000000 ffff8820330bbab8 ffffffff810d04ab ffff8820330bbaa8
 0000001f00000296 0000000000017681 ffff8810380bf000 ffffffffa0001790
Call Trace:
 [] dump_stack+0x4d/0x6c
 [] __warn+0xdb/0x100
 [] warn_slowpath_fmt+0x44/0x50
 [] sysfs_warn_dup+0x65/0x80
 [] sysfs_add_file_mode_ns+0x172/0x180
 [] sysfs_create_file_ns+0x25/0x30
 [] device_create_file+0x36/0x90
 [] __nbd_ioctl+0x32d/0x9b0 [nbd]
 [] ? find_next_bit+0x18/0x20
 [] ? select_idle_sibling+0xe9/0x120
 [] ? __enqueue_entity+0x67/0x70
 [] ? enqueue_task_fair+0x630/0xe20
 [] ? resched_curr+0x36/0x70
 [] ? check_preempt_curr+0x78/0x90
 [] ? ttwu_do_wakeup+0x12/0x80
 [] ? ttwu_do_activate.constprop.86+0x61/0x70
 [] ? try_to_wake_up+0x185/0x2d0
 [] ? default_wake_function+0xd/0x10
 [] ? autoremove_wake_function+0x11/0x40
 [] nbd_ioctl+0x67/0x94 [nbd]
 [] blkdev_ioctl+0x14d/0x940
 [] ? put_pipe_info+0x22/0x60
 [] block_ioctl+0x3c/0x40
 [] do_vfs_ioctl+0x8d/0x5e0
 [] ? ____fput+0x9/0x10
 [] ? task_work_run+0x72/0x90
 [] SyS_ioctl+0x47/0x80
 [] entry_SYSCALL_64_fastpath+0x17/0x93
---[ end trace 7899b295e4f850c8 ]---

It seems fairly obvious that device_create_file() is not being protected
from being run concurrently on the same nbd.

Quentin found the following relevant commits:

1a2ad21 nbd: add locking to nbd_ioctl
90b8f28 [PATCH] end of methods switch: remove the old ones
d4430d6 [PATCH] beginning of methods conversion
08f8585 [PATCH] move block_device_operations to blkdev.h

It would seem that the race was introduced in the process of moving nbd
from BKL to unlocked ioctls.

By setting nbd->task_recv while the mutex is held, we can prevent other
processes from running concurrently (since nbd->task_recv is also checked
while the mutex is held).

Reported-and-tested-by: Quentin Casasnovas 
Cc: Markus Pargmann 
Cc: Paul Clements 
Cc: Pavel Machek 
Cc: Jens Axboe 
Cc: Al Viro 
Signed-off-by: Vegard Nossum 
Signed-off-by: Jens Axboe

Merge branch 'for-4.8/core' of git://git.kernel.dk/linux-block

2016-07-26T22:03:07+00:00

Pull core block updates from Jens Axboe:

   - the big change is the cleanup from Mike Christie, cleaning up our
     uses of command types and modified flags.  This is what will throw
     some merge conflicts

   - regression fix for the above for btrfs, from Vincent

   - following up to the above, better packing of struct request from
     Christoph

   - a 2038 fix for blktrace from Arnd

   - a few trivial/spelling fixes from Bart Van Assche

   - a front merge check fix from Damien, which could cause issues on
     SMR drives

   - Atari partition fix from Gabriel

   - convert cfq to highres timers, since jiffies isn't granular enough
     for some devices these days.  From Jan and Jeff

   - CFQ priority boost fix idle classes, from me

   - cleanup series from Ming, improving our bio/bvec iteration

   - a direct issue fix for blk-mq from Omar

   - fix for plug merging not involving the IO scheduler, like we do for
     other types of merges.  From Tahsin

   - expose DAX type internally and through sysfs.  From Toshi and Yigal

* 'for-4.8/core' of git://git.kernel.dk/linux-block: (76 commits)
  block: Fix front merge check
  block: do not merge requests without consulting with io scheduler
  block: Fix spelling in a source code comment
  block: expose QUEUE_FLAG_DAX in sysfs
  block: add QUEUE_FLAG_DAX for devices to advertise their DAX support
  Btrfs: fix comparison in __btrfs_map_block()
  block: atari: Return early for unsupported sector size
  Doc: block: Fix a typo in queue-sysfs.txt
  cfq-iosched: Charge at least 1 jiffie instead of 1 ns
  cfq-iosched: Fix regression in bonnie++ rewrite performance
  cfq-iosched: Convert slice_resid from u64 to s64
  block: Convert fifo_time from ulong to u64
  blktrace: avoid using timespec
  block/blk-cgroup.c: Declare local symbols static
  block/bio-integrity.c: Add #include "blk.h"
  block/partition-generic.c: Remove a set-but-not-used variable
  block: bio: kill BIO_MAX_SIZE
  cfq-iosched: temporarily boost queue priority for idle classes
  block: drbd: avoid to use BIO_MAX_SIZE
  block: bio: remove BIO_MAX_SECTORS
  ...

nbd: pass the nbd pointer for flags debugfs

2016-06-08T15:03:54+00:00

We were passing in &nbd for the private data in debugfs_create_file() for the
flags entry.  We expect it to just be nbd, fix this so we get proper output from
this debugfs entry.

Signed-off-by: Josef Bacik 
Signed-off-by: Jens Axboe

block, drivers: add REQ_OP_FLUSH operation

2016-06-07T19:41:38+00:00

This adds a REQ_OP_FLUSH operation that is sent to request_fn
based drivers by the block layer's flush code, instead of
sending requests with the request->cmd_flags REQ_FLUSH bit set.

Signed-off-by: Mike Christie 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Jens Axboe

drivers: use req op accessor

2016-06-07T19:41:38+00:00

The req operation REQ_OP is separated from the rq_flag_bits
definition. This converts the block layer drivers to
use req_op to get the op from the request struct.

Signed-off-by: Mike Christie 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Jens Axboe

nbd: switch to using blk_queue_write_cache()

2016-04-12T22:00:39+00:00

Signed-off-by: Jens Axboe 
Reviewed-by: Christoph Hellwig

nbd: use correct div_s64 helper

2016-03-05T00:20:12+00:00

The do_div() macro now checks its arguments for the correct type,
and refuses anything other than u64, so we get a warning about
nbd_ioctl passing in an loff_t:

drivers/block/nbd.c: In function '__nbd_ioctl':
drivers/block/nbd.c:757:77: error: comparison of distinct pointer types lacks a cast [-Werror]

This changes the nbd code to use div_s64() instead, which takes
a signed argument.

Signed-off-by: Arnd Bergmann 
Fixes: 37091fdd831f ("nbd: Create size change events for userspace")
Signed-off-by: Jens Axboe

nbd: Create size change events for userspace

2016-02-15T09:35:47+00:00

The userspace needs to know when nbd devices are ready for use.
Currently no events are created for the userspace which doesn't work for
systemd.

See the discussion here: https://github.com/systemd/systemd/pull/358

This patch uses a central point to setup the nbd-internal sizes. A ioctl
to set a size does not lead to a visible size change. The size of the
block device will be kept at 0 until nbd is connected. As soon as it
connects, the size will be changed to the real value and a uevent is
created. When disconnecting, the blockdevice is set to 0 size and
another uevent is generated.

Signed-off-by: Markus Pargmann

nbd: ratelimit error msgs after socket close

2016-02-05T07:55:15+00:00

Make the "Attempted send on closed socket" error messages generated in
nbd_request_handler() ratelimited.

When the nbd socket is shutdown, the nbd_request_handler() function emits
an error message for every request remaining in its queue.  If the queue
is large, this will spam a large amount of messages to the log.  There's
no need for a separate error message for each request, so this patch
ratelimits it.

In the specific case this was found, the system was virtual and the error
messages were logged to the serial port, which overwhelmed it.

Fixes: 4d48a542b427 ("nbd: fix I/O hang on disconnected nbds")
Signed-off-by: Dan Streetman 
Signed-off-by: Markus Pargmann

nbd: Move flag parsing to a function

2016-02-05T07:52:33+00:00

nbd changes properties of the blockdevice depending on flags that were
received. This patch moves this flag parsing into a separate function
nbd_parse_flags().

Signed-off-by: Markus Pargmann