linux-stable.git/drivers/block/rbd.c, branch v6.4

rbd: get snapshot context after exclusive lock is ensured to be held

2023-06-06T07:54:27+00:00

Move capturing the snapshot context into the image request state
machine, after exclusive lock is ensured to be held for the duration of
dealing with the image request.  This is needed to ensure correctness
of fast-diff states (OBJECT_EXISTS vs OBJECT_EXISTS_CLEAN) and object
deltas computed based off of them.  Otherwise the object map that is
forked for the snapshot isn't guaranteed to accurately reflect the
contents of the snapshot when the snapshot is taken under I/O.  This
breaks differential backup and snapshot-based mirroring use cases with
fast-diff enabled: since some object deltas may be incomplete, the
destination image may get corrupted.

Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/61472
Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang

rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting

2023-06-06T07:53:59+00:00

Move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting into the object request
state machine to allow for the snapshot context to be captured in the
image request state machine rather than in rbd_queue_workfn().

Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov 
Reviewed-by: Dongsheng Yang

driver core: bus: mark the struct bus_type for sysfs callbacks as constant

2023-03-23T12:20:40+00:00

struct bus_type should never be modified in a sysfs callback as there is
nothing in the structure to modify, and frankly, the structure is almost
never used in a sysfs callback, so mark it as constant to allow struct
bus_type to be moved to read-only memory.

Cc: "David S. Miller" 
Cc: "James E.J. Bottomley" 
Cc: "K. Y. Srinivasan" 
Cc: Alexander Gordeev 
Cc: Alexandre Bounine 
Cc: Alison Schofield 
Cc: Ben Widawsky 
Cc: Dexuan Cui 
Cc: Eric Dumazet 
Cc: Haiyang Zhang 
Cc: Hannes Reinecke 
Cc: Harald Freudenberger 
Cc: Heiko Carstens 
Cc: Hu Haowen 
Cc: Jakub Kicinski 
Cc: Jens Axboe 
Cc: Jonathan Corbet 
Cc: Laurentiu Tudor 
Cc: Matt Porter 
Cc: Michael Ellerman 
Cc: Paolo Abeni 
Cc: Stuart Yoder 
Cc: Vasily Gorbik 
Cc: Vishal Verma 
Cc: Yanteng Si 
Acked-by: Ilya Dryomov  # rbd
Acked-by: Ira Weiny  # cxl
Reviewed-by: Alex Shi 
Acked-by: Iwona Winiarska 
Acked-by: Dan Williams 
Acked-by: Bjorn Helgaas 	# pci
Acked-by: Wei Liu 
Acked-by: Martin K. Petersen  # scsi
Link: https://lore.kernel.org/r/20230313182918.1312597-23-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

Merge tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client

2023-03-02T18:48:30+00:00

Pull ceph fixes from Ilya Dryomov:
 "Two small fixes from Xiubo and myself, marked for stable"

* tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client:
  rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
  ceph: update the time stamps and try to drop the suid/sgid

rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails

2023-02-26T19:03:14+00:00

If getting an ID or setting up a work queue in rbd_dev_create() fails,
use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts
is triggered in do_rbd_add().  The root cause is that the ownership of
these structures is transfered to rbd_dev prematurely and they all end
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to
returning to do_rbd_add().

Found by Linux Verification Center (linuxtesting.org) with SVACE, an
incomplete patch submitted by Natalia Petrova .

Cc: stable@vger.kernel.org
Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue")
Signed-off-by: Ilya Dryomov

rbd: use bvec_set_page to initialize the copy up bvec

2023-02-03T15:20:55+00:00

Use the bvec_set_page helper to initialize the copy up bvec.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Ilya Dryomov 
Link: https://lore.kernel.org/r/20230203150634.3199647-9-hch@lst.de
Signed-off-by: Jens Axboe

rbd: fix possible memory leak in rbd_sysfs_init()

2022-10-27T13:15:30+00:00

If device_register() returns error in rbd_sysfs_init(), name of kobject
which is allocated in dev_set_name() called in device_add() is leaked.

As comment of device_add() says, it should call put_device() to drop
the reference count that was set in device_initialize() when it fails,
so the name can be freed in kobject_cleanup().

Fault injection test can trigger this problem:

unreferenced object 0xffff88810173aa78 (size 8):
  comm "modprobe", pid 247, jiffies 4294714278 (age 31.789s)
  hex dump (first 8 bytes):
    72 62 64 00 81 88 ff ff                          rbd.....
  backtrace:
    [<00000000f58fae56>] __kmalloc_node_track_caller+0x44/0x1b0
    [<00000000bdd44fe7>] kstrdup+0x3a/0x70
    [<00000000f7844d0b>] kstrdup_const+0x63/0x80
    [<000000001b0a0eeb>] kvasprintf_const+0x10b/0x190
    [<00000000a47bd894>] kobject_set_name_vargs+0x56/0x150
    [<00000000d5edbf18>] dev_set_name+0xab/0xe0
    [<00000000f5153e80>] device_add+0x106/0x1f20

Fixes: dfc5606dc513 ("rbd: replace the rbd sysfs interface")
Signed-off-by: Yang Yingliang 
Reviewed-by: Alex Elder 
Link: https://lore.kernel.org/r/20221027091918.2294132-1-yangyingliang@huawei.com
Signed-off-by: Jens Axboe

Merge tag 'ceph-for-5.20-rc1' of https://github.com/ceph/ceph-client

2022-08-11T19:41:07+00:00

Pull ceph updates from Ilya Dryomov:
 "We have a good pile of various fixes and cleanups from Xiubo, Jeff,
  Luis and others, almost exclusively in the filesystem.

  Several patches touch files outside of our normal purview to set the
  stage for bringing in Jeff's long awaited ceph+fscrypt series in the
  near future. All of them have appropriate acks and sat in linux-next
  for a while"

* tag 'ceph-for-5.20-rc1' of https://github.com/ceph/ceph-client: (27 commits)
  libceph: clean up ceph_osdc_start_request prototype
  libceph: fix ceph_pagelist_reserve() comment typo
  ceph: remove useless check for the folio
  ceph: don't truncate file in atomic_open
  ceph: make f_bsize always equal to f_frsize
  ceph: flush the dirty caps immediatelly when quota is approaching
  libceph: print fsid and epoch with osd id
  libceph: check pointer before assigned to "c->rules[]"
  ceph: don't get the inline data for new creating files
  ceph: update the auth cap when the async create req is forwarded
  ceph: make change_auth_cap_ses a global symbol
  ceph: fix incorrect old_size length in ceph_mds_request_args
  ceph: switch back to testing for NULL folio->private in ceph_dirty_folio
  ceph: call netfs_subreq_terminated with was_async == false
  ceph: convert to generic_file_llseek
  ceph: fix the incorrect comment for the ceph_mds_caps struct
  ceph: don't leak snap_rwsem in handle_cap_grant
  ceph: prevent a client from exceeding the MDS maximum xattr size
  ceph: choose auth MDS for getxattr with the Xs caps
  ceph: add session already open notify support
  ...

libceph: clean up ceph_osdc_start_request prototype

2022-08-03T12:05:39+00:00

This function always returns 0, and ignores the nofail boolean. Drop the
nofail argument, make the function void return and fix up the callers.

Signed-off-by: Jeff Layton 
Reviewed-by: Ilya Dryomov 
Signed-off-by: Ilya Dryomov

block: remove blk_cleanup_disk

2022-06-28T12:33:15+00:00

blk_cleanup_disk is nothing but a trivial wrapper for put_disk now,
so remove it.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Hannes Reinecke 
Link: https://lore.kernel.org/r/20220619060552.1850436-7-hch@lst.de
Signed-off-by: Jens Axboe