From 8123fc72460d7656c9e05e1283d7718bb7de3d00 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 30 Jan 2020 16:51:24 +0100 Subject: [PATCH] 4.19-stable patches added patches: block-cleanup-__blkdev_issue_discard.patch block-fix-32-bit-overflow-in-__blkdev_issue_discard.patch --- ...block-cleanup-__blkdev_issue_discard.patch | 75 +++++++++++++++++++ ...t-overflow-in-__blkdev_issue_discard.patch | 57 ++++++++++++++ queue-4.19/series | 2 + 3 files changed, 134 insertions(+) create mode 100644 queue-4.19/block-cleanup-__blkdev_issue_discard.patch create mode 100644 queue-4.19/block-fix-32-bit-overflow-in-__blkdev_issue_discard.patch diff --git a/queue-4.19/block-cleanup-__blkdev_issue_discard.patch b/queue-4.19/block-cleanup-__blkdev_issue_discard.patch new file mode 100644 index 00000000000..1c3bd0d5877 --- /dev/null +++ b/queue-4.19/block-cleanup-__blkdev_issue_discard.patch @@ -0,0 +1,75 @@ +From ba5d73851e71847ba7f7f4c27a1a6e1f5ab91c79 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Mon, 29 Oct 2018 20:57:18 +0800 +Subject: block: cleanup __blkdev_issue_discard() + +From: Ming Lei + +commit ba5d73851e71847ba7f7f4c27a1a6e1f5ab91c79 upstream. + +Cleanup __blkdev_issue_discard() a bit: + +- remove local variable of 'end_sect' +- remove code block of 'fail' + +Cc: Mike Snitzer +Cc: Christoph Hellwig +Cc: Xiao Ni +Cc: Mariusz Dabrowski +Tested-by: Rui Salvaterra +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-lib.c | 23 ++++++----------------- + 1 file changed, 6 insertions(+), 17 deletions(-) + +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -52,15 +52,12 @@ int __blkdev_issue_discard(struct block_ + if ((sector | nr_sects) & bs_mask) + return -EINVAL; + +- while (nr_sects) { +- unsigned int req_sects = nr_sects; +- sector_t end_sect; +- +- if (!req_sects) +- goto fail; +- req_sects = min(req_sects, bio_allowed_max_sectors(q)); ++ if (!nr_sects) ++ return -EINVAL; + +- end_sect = sector + req_sects; ++ while (nr_sects) { ++ unsigned int req_sects = min_t(unsigned int, nr_sects, ++ bio_allowed_max_sectors(q)); + + bio = next_bio(bio, 0, gfp_mask); + bio->bi_iter.bi_sector = sector; +@@ -68,8 +65,8 @@ int __blkdev_issue_discard(struct block_ + bio_set_op_attrs(bio, op, 0); + + bio->bi_iter.bi_size = req_sects << 9; ++ sector += req_sects; + nr_sects -= req_sects; +- sector = end_sect; + + /* + * We can loop for a long time in here, if someone does +@@ -82,14 +79,6 @@ int __blkdev_issue_discard(struct block_ + + *biop = bio; + return 0; +- +-fail: +- if (bio) { +- submit_bio_wait(bio); +- bio_put(bio); +- } +- *biop = NULL; +- return -EOPNOTSUPP; + } + EXPORT_SYMBOL(__blkdev_issue_discard); + diff --git a/queue-4.19/block-fix-32-bit-overflow-in-__blkdev_issue_discard.patch b/queue-4.19/block-fix-32-bit-overflow-in-__blkdev_issue_discard.patch new file mode 100644 index 00000000000..f4ccc42aad2 --- /dev/null +++ b/queue-4.19/block-fix-32-bit-overflow-in-__blkdev_issue_discard.patch @@ -0,0 +1,57 @@ +From 4800bf7bc8c725e955fcbc6191cc872f43f506d3 Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Wed, 14 Nov 2018 08:17:18 -0700 +Subject: block: fix 32 bit overflow in __blkdev_issue_discard() + +From: Dave Chinner + +commit 4800bf7bc8c725e955fcbc6191cc872f43f506d3 upstream. + +A discard cleanup merged into 4.20-rc2 causes fstests xfs/259 to +fall into an endless loop in the discard code. The test is creating +a device that is exactly 2^32 sectors in size to test mkfs boundary +conditions around the 32 bit sector overflow region. + +mkfs issues a discard for the entire device size by default, and +hence this throws a sector count of 2^32 into +blkdev_issue_discard(). It takes the number of sectors to discard as +a sector_t - a 64 bit value. + +The commit ba5d73851e71 ("block: cleanup __blkdev_issue_discard") +takes this sector count and casts it to a 32 bit value before +comapring it against the maximum allowed discard size the device +has. This truncates away the upper 32 bits, and so if the lower 32 +bits of the sector count is zero, it starts issuing discards of +length 0. This causes the code to fall into an endless loop, issuing +a zero length discards over and over again on the same sector. + +Fixes: ba5d73851e71 ("block: cleanup __blkdev_issue_discard") +Tested-by: Darrick J. Wong +Reviewed-by: Darrick J. Wong +Signed-off-by: Dave Chinner + +Killed pointless WARN_ON(). + +Signed-off-by: Jens Axboe +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-lib.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -56,9 +56,11 @@ int __blkdev_issue_discard(struct block_ + return -EINVAL; + + while (nr_sects) { +- unsigned int req_sects = min_t(unsigned int, nr_sects, ++ sector_t req_sects = min_t(sector_t, nr_sects, + bio_allowed_max_sectors(q)); + ++ WARN_ON_ONCE((req_sects << 9) > UINT_MAX); ++ + bio = next_bio(bio, 0, gfp_mask); + bio->bi_iter.bi_sector = sector; + bio_set_dev(bio, bdev); diff --git a/queue-4.19/series b/queue-4.19/series index 15e564591f9..c79ae06b1d1 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -50,3 +50,5 @@ rsi-fix-memory-leak-on-failed-urb-submission.patch rsi-fix-non-atomic-allocation-in-completion-handler.patch crypto-af_alg-use-bh_lock_sock-in-sk_destruct.patch random-try-to-actively-add-entropy-rather-than-passively-wait-for-it.patch +block-cleanup-__blkdev_issue_discard.patch +block-fix-32-bit-overflow-in-__blkdev_issue_discard.patch -- 2.47.3