linux-stable.git/drivers/lightnvm/core.c, branch linux-5.4.y

lightnvm: fix memory leak when submit fails

2021-01-27T10:47:53+00:00

commit 97784481757fba7570121a70dd37ca74a29f50a8 upstream.

The allocated page is not released if error occurs in
nvm_submit_io_sync_raw(). __free_page() is moved ealier to avoid
possible memory leak issue.

Fixes: aff3fb18f957 ("lightnvm: move bad block and chunk state logic to core")
Signed-off-by: Pan Bian 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

lightnvm: fix out-of-bounds write to array devices->info[]

2020-10-29T08:58:00+00:00

[ Upstream commit a48faebe65b0db55a73b9220c3d919eee849bb79 ]

There is an off-by-one array check that can lead to a out-of-bounds
write to devices->info[i].  Fix this by checking by using >= rather
than > for the size check. Also replace hard-coded array size limit
with ARRAY_SIZE on the array.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: cd9e9808d18f ("lightnvm: Support for Open-Channel SSDs")
Signed-off-by: Colin Ian King 
Signed-off-by: Jens Axboe 
Signed-off-by: Sasha Levin

lightnvm: print error when target is not found

2019-09-05T19:17:01+00:00

If userspace requests target to be removed, nvm_remove_tgt() will
iterate the nvm_devices to find out the given target, but if not
found, then it should print out an error.

Signed-off-by: Minwoo Im 
Updated output string and patch description.
Signed-off-by: Matias Bjørling 
Signed-off-by: Jens Axboe

lightnvm: introduce pr_fmt for the prefix nvm

2019-09-05T19:16:59+00:00

all the pr_() family can have this prefix by pr_fmt.

Signed-off-by: Minwoo Im 
Reviewed-by: Javier González 
Signed-off-by: Matias Bjørling 
Signed-off-by: Jens Axboe

lightnvm: move metadata mapping to lower level driver

2019-08-06T14:20:10+00:00

Now that blk_rq_map_kern can map both kmem and vmem, move internal
metadata mapping down to the lower level driver.

Reviewed-by: Javier González 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Hans Holmberg 
Signed-off-by: Jens Axboe

lightnvm: remove nvm_submit_io_sync_fn

2019-08-06T14:20:09+00:00

Move the redundant sync handling interface and wait for a completion in
the lightnvm core instead.

Reviewed-by: Javier González 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Hans Holmberg 
Signed-off-by: Jens Axboe

lightnvm: fix uninitialized pointer in nvm_remove_tgt()

2019-06-21T09:14:30+00:00

With gcc 4.1:

    drivers/lightnvm/core.c: In function ‘nvm_remove_tgt’:
    drivers/lightnvm/core.c:510: warning: ‘t’ is used uninitialized in this function

Indeed, if no NVM devices have been registered, t will be an
uninitialized pointer, and may be dereferenced later.  A call to
nvm_remove_tgt() can be triggered from userspace by issuing the
NVM_DEV_REMOVE ioctl on the lightnvm control device.

Fix this by preinitializing t to NULL.

Fixes: 843f2edbdde085b4 ("lightnvm: do not remove instance under global lock")
Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Matias Bjørling 
Signed-off-by: Jens Axboe

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 410

2019-06-05T15:37:14+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license version 2 as
  published by the free software foundation this program is
  distributed in the hope that it will be useful but without any
  warranty without even the implied warranty of merchantability or
  fitness for a particular purpose see the gnu general public license
  for more details you should have received a copy of the gnu general
  public license along with this program see the file copying if not
  write to the free software foundation 675 mass ave cambridge ma
  02139 usa

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 3 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190531190112.675111872@linutronix.de
Signed-off-by: Greg Kroah-Hartman

lightnvm: do not remove instance under global lock

2019-05-06T16:19:19+00:00

Currently all the target instances are removed under global nvm_lock.
This was needed to ensure that nvm_dev struct will not be freed by
hot unplug event during target removal. However, current implementation
has some drawbacks, since the same lock is used when new nvme subsystem
is registered, so we can have a situation, that due to long process of
target removal on drive A, registration (and listing in OS) of the
drive B will take a lot of time, since it will wait for that lock.

Now when we have kref which ensures that nvm_dev will not be freed in
the meantime, we can easily get rid of this lock for a time when we are
removing nvm targets.

Signed-off-by: Igor Konopko 
Reviewed-by: Javier González 
Signed-off-by: Matias Bjørling 
Signed-off-by: Jens Axboe

lightnvm: track inflight target creations

2019-05-06T16:19:19+00:00

When creation process is still in progress, target is not yet on
targets list. This causes a chance for removing whole lightnvm
subsystem by calling nvm_unregister() in the meantime and finally by
causing kernel panic inside target init function.

This patch changes the behaviour by adding kref variable which tracks
all the users of nvm_dev structure. When nvm_dev is allocated, kref
value is set to 1. Then before every target creation the value is
increased and decreased after target removal. The extra reference
is decreased when nvm subsystem is unregistered.

Signed-off-by: Igor Konopko 
Reviewed-by: Javier González 
Signed-off-by: Matias Bjørling 
Signed-off-by: Jens Axboe