linux-stable.git/drivers/block/rbd.c, branch linux-6.4.y

rbd: prevent busy loop when requesting exclusive lock

2023-08-11T10:14:21+00:00

commit 9d01e07fd1bfb4daae156ab528aa196f5ac2b2bc upstream.

Due to rbd_try_acquire_lock() effectively swallowing all but
EBLOCKLISTED error from rbd_try_lock() ("request lock anyway") and
rbd_request_lock() returning ETIMEDOUT error not only for an actual
notify timeout but also when the lock owner doesn't respond, a busy
loop inside of rbd_acquire_lock() between rbd_try_acquire_lock() and
rbd_request_lock() is possible.

Requesting the lock on EBUSY error (returned by get_lock_owner_info()
if an incompatible lock or invalid lock owner is detected) makes very
little sense.  The same goes for ETIMEDOUT error (might pop up pretty
much anywhere if osd_request_timeout option is set) and many others.

Just fail I/O requests on rbd_dev->acquiring_list immediately on any
error from rbd_try_lock().

Cc: stable@vger.kernel.org # 588159009d5b: rbd: retrieve and check lock owner twice before blocklisting
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang 
Signed-off-by: Greg Kroah-Hartman

rbd: retrieve and check lock owner twice before blocklisting

2023-08-03T08:26:14+00:00

commit 588159009d5b7a09c3e5904cffddbe4a4e170301 upstream.

An attempt to acquire exclusive lock can race with the current lock
owner closing the image:

1. lock is held by client123, rbd_lock() returns -EBUSY
2. get_lock_owner_info() returns client123 instance details
3. client123 closes the image, lock is released
4. find_watcher() returns 0 as there is no matching watcher anymore
5. client123 instance gets erroneously blocklisted

Particularly impacted is mirror snapshot scheduler in snapshot-based
mirroring since it happens to open and close images a lot (images are
opened only for as long as it takes to take the next mirror snapshot,
the same client instance is used for all images).

To reduce the potential for erroneous blocklisting, retrieve the lock
owner again after find_watcher() returns 0.  If it's still there, make
sure it matches the previously detected lock owner.

Cc: stable@vger.kernel.org # f38cb9d9c204: rbd: make get_lock_owner_info() return a single locker or NULL
Cc: stable@vger.kernel.org # 8ff2c64c9765: rbd: harden get_lock_owner_info() a bit
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang 
Signed-off-by: Greg Kroah-Hartman

rbd: harden get_lock_owner_info() a bit

2023-08-03T08:26:13+00:00

commit 8ff2c64c9765446c3cef804fb99da04916603e27 upstream.

- we want the exclusive lock type, so test for it directly
- use sscanf() to actually parse the lock cookie and avoid admitting
  invalid handles
- bail if locker has a blank address

Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang 
Signed-off-by: Greg Kroah-Hartman

rbd: make get_lock_owner_info() return a single locker or NULL

2023-08-03T08:26:13+00:00

commit f38cb9d9c2045dad16eead4a2e1aedfddd94603b upstream.

Make the "num_lockers can be only 0 or 1" assumption explicit and
simplify the API by getting rid of output parameters in preparation
for calling get_lock_owner_info() twice before blocklisting.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang 
Signed-off-by: Greg Kroah-Hartman

rbd: get snapshot context after exclusive lock is ensured to be held

2023-06-06T07:54:27+00:00

Move capturing the snapshot context into the image request state
machine, after exclusive lock is ensured to be held for the duration of
dealing with the image request.  This is needed to ensure correctness
of fast-diff states (OBJECT_EXISTS vs OBJECT_EXISTS_CLEAN) and object
deltas computed based off of them.  Otherwise the object map that is
forked for the snapshot isn't guaranteed to accurately reflect the
contents of the snapshot when the snapshot is taken under I/O.  This
breaks differential backup and snapshot-based mirroring use cases with
fast-diff enabled: since some object deltas may be incomplete, the
destination image may get corrupted.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/61472
Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang

rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting

2023-06-06T07:53:59+00:00

Move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting into the object request
state machine to allow for the snapshot context to be captured in the
image request state machine rather than in rbd_queue_workfn().

Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang

driver core: bus: mark the struct bus_type for sysfs callbacks as constant

2023-03-23T12:20:40+00:00

struct bus_type should never be modified in a sysfs callback as there is
nothing in the structure to modify, and frankly, the structure is almost
never used in a sysfs callback, so mark it as constant to allow struct
bus_type to be moved to read-only memory.

Cc: "David S. Miller" 
Cc: "James E.J. Bottomley" 
Cc: "K. Y. Srinivasan" 
Cc: Alexander Gordeev 
Cc: Alexandre Bounine 
Cc: Alison Schofield 
Cc: Ben Widawsky 
Cc: Dexuan Cui 
Cc: Eric Dumazet 
Cc: Haiyang Zhang 
Cc: Hannes Reinecke 
Cc: Harald Freudenberger 
Cc: Heiko Carstens 
Cc: Hu Haowen 
Cc: Jakub Kicinski 
Cc: Jens Axboe 
Cc: Jonathan Corbet 
Cc: Laurentiu Tudor 
Cc: Matt Porter 
Cc: Michael Ellerman 
Cc: Paolo Abeni 
Cc: Stuart Yoder 
Cc: Vasily Gorbik 
Cc: Vishal Verma 
Cc: Yanteng Si 
Acked-by: Ilya Dryomov  # rbd
Acked-by: Ira Weiny  # cxl
Reviewed-by: Alex Shi 
Acked-by: Iwona Winiarska 
Acked-by: Dan Williams 
Acked-by: Bjorn Helgaas 	# pci
Acked-by: Wei Liu 
Acked-by: Martin K. Petersen  # scsi
Link: https://lore.kernel.org/r/20230313182918.1312597-23-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

Merge tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client

2023-03-02T18:48:30+00:00

Pull ceph fixes from Ilya Dryomov:
 "Two small fixes from Xiubo and myself, marked for stable"

* tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client:
  rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  ceph: update the time stamps and try to drop the suid/sgid

rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails

2023-02-26T19:03:14+00:00

If getting an ID or setting up a work queue in rbd_dev_create() fails,
use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts
is triggered in do_rbd_add().  The root cause is that the ownership of
these structures is transfered to rbd_dev prematurely and they all end
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to
returning to do_rbd_add().

Found by Linux Verification Center (linuxtesting.org) with SVACE, an
incomplete patch submitted by Natalia Petrova .

Cc: stable@vger.kernel.org
Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue")
Signed-off-by: Ilya Dryomov

rbd: use bvec_set_page to initialize the copy up bvec

2023-02-03T15:20:55+00:00

Use the bvec_set_page helper to initialize the copy up bvec.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Ilya Dryomov 
Link: https://lore.kernel.org/r/20230203150634.3199647-9-hch@lst.de
Signed-off-by: Jens Axboe