From 84a000290363fed9f8c55b422285e65fc017ba12 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 29 Oct 2024 01:47:24 +0100 Subject: [PATCH] drop block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch --- ...anity-checks-in-blk_rq_map_user_bvec.patch | 54 ------------------- queue-6.1/series | 1 - ...anity-checks-in-blk_rq_map_user_bvec.patch | 54 ------------------- queue-6.11/series | 1 - ...anity-checks-in-blk_rq_map_user_bvec.patch | 54 ------------------- queue-6.6/series | 1 - 6 files changed, 165 deletions(-) delete mode 100644 queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch delete mode 100644 queue-6.11/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch delete mode 100644 queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch diff --git a/queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch b/queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch deleted file mode 100644 index 96c52091176..00000000000 --- a/queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001 -From: Xinyu Zhang -Date: Wed, 23 Oct 2024 15:15:19 -0600 -Subject: block: fix sanity checks in blk_rq_map_user_bvec - -From: Xinyu Zhang - -commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream. - -blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which -causes unnecessary failures in NVMe passthrough I/O, reproducible as -follows: - -- register a 2 page, page-aligned buffer against a ring -- use that buffer to do a 1 page io_uring NVMe passthrough read - -The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will -then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so -the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to -fail. This failure is unnecessary, as when the check succeeds, it means -we've checked the entire buffer that will be used by the request - i.e. -blk_rq_map_user_bvec should complete successfully. Therefore, terminate -the loop early and return successfully when the check bytes + bv->bv_len -> nr_iter succeeds. - -While we're at it, also remove the check that all segments in the bvec -are single-page. While this seems to be true for all users of the -function, it doesn't appear to be required anywhere downstream. - -CC: stable@vger.kernel.org -Signed-off-by: Xinyu Zhang -Co-developed-by: Uday Shankar -Signed-off-by: Uday Shankar -Fixes: 37987547932c ("block: extend functionality to map bvec iterator") -Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman ---- - block/blk-map.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - ---- a/block/blk-map.c -+++ b/block/blk-map.c -@@ -597,9 +597,7 @@ static int blk_rq_map_user_bvec(struct r - if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len) - goto put_bio; - if (bytes + bv->bv_len > nr_iter) -- goto put_bio; -- if (bv->bv_offset + bv->bv_len > PAGE_SIZE) -- goto put_bio; -+ break; - - nsegs++; - bytes += bv->bv_len; diff --git a/queue-6.1/series b/queue-6.1/series index 4051afa72cb..c1e922d8ac0 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -130,7 +130,6 @@ drm-amd-display-disable-psr-su-on-parade-08-01-tcon-too.patch selinux-improve-error-checking-in-sel_write_load.patch serial-protect-uart_port_dtr_rts-in-uart_shutdown-to.patch net-phy-dp83822-fix-reset-pin-definitions.patch -block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch platform-x86-dell-wmi-ignore-suspend-notifications.patch acpi-prm-clean-up-guid-type-in-struct-prm_handler_info.patch diff --git a/queue-6.11/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch b/queue-6.11/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch deleted file mode 100644 index b6b39e47c25..00000000000 --- a/queue-6.11/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001 -From: Xinyu Zhang -Date: Wed, 23 Oct 2024 15:15:19 -0600 -Subject: block: fix sanity checks in blk_rq_map_user_bvec - -From: Xinyu Zhang - -commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream. - -blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which -causes unnecessary failures in NVMe passthrough I/O, reproducible as -follows: - -- register a 2 page, page-aligned buffer against a ring -- use that buffer to do a 1 page io_uring NVMe passthrough read - -The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will -then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so -the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to -fail. This failure is unnecessary, as when the check succeeds, it means -we've checked the entire buffer that will be used by the request - i.e. -blk_rq_map_user_bvec should complete successfully. Therefore, terminate -the loop early and return successfully when the check bytes + bv->bv_len -> nr_iter succeeds. - -While we're at it, also remove the check that all segments in the bvec -are single-page. While this seems to be true for all users of the -function, it doesn't appear to be required anywhere downstream. - -CC: stable@vger.kernel.org -Signed-off-by: Xinyu Zhang -Co-developed-by: Uday Shankar -Signed-off-by: Uday Shankar -Fixes: 37987547932c ("block: extend functionality to map bvec iterator") -Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman ---- - block/blk-map.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - ---- a/block/blk-map.c -+++ b/block/blk-map.c -@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct r - if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len) - goto put_bio; - if (bytes + bv->bv_len > nr_iter) -- goto put_bio; -- if (bv->bv_offset + bv->bv_len > PAGE_SIZE) -- goto put_bio; -+ break; - - nsegs++; - bytes += bv->bv_len; diff --git a/queue-6.11/series b/queue-6.11/series index 4f548c495cf..7aee78c9385 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -237,7 +237,6 @@ fgraph-fix-missing-unlock-in-register_ftrace_graph.patch fgraph-change-the-name-of-cpuhp-state-to-fgraph-onli.patch net-phy-dp83822-fix-reset-pin-definitions.patch nfsd-fix-race-between-laundromat-and-free_stateid.patch -block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch drm-amd-display-temp-w-a-for-dp-link-layer-compliance.patch ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch asoc-sof-intel-hda-loader-do-not-wait-for-hdaudio-ioc.patch diff --git a/queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch b/queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch deleted file mode 100644 index b6b39e47c25..00000000000 --- a/queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001 -From: Xinyu Zhang -Date: Wed, 23 Oct 2024 15:15:19 -0600 -Subject: block: fix sanity checks in blk_rq_map_user_bvec - -From: Xinyu Zhang - -commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream. - -blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which -causes unnecessary failures in NVMe passthrough I/O, reproducible as -follows: - -- register a 2 page, page-aligned buffer against a ring -- use that buffer to do a 1 page io_uring NVMe passthrough read - -The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will -then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so -the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to -fail. This failure is unnecessary, as when the check succeeds, it means -we've checked the entire buffer that will be used by the request - i.e. -blk_rq_map_user_bvec should complete successfully. Therefore, terminate -the loop early and return successfully when the check bytes + bv->bv_len -> nr_iter succeeds. - -While we're at it, also remove the check that all segments in the bvec -are single-page. While this seems to be true for all users of the -function, it doesn't appear to be required anywhere downstream. - -CC: stable@vger.kernel.org -Signed-off-by: Xinyu Zhang -Co-developed-by: Uday Shankar -Signed-off-by: Uday Shankar -Fixes: 37987547932c ("block: extend functionality to map bvec iterator") -Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman ---- - block/blk-map.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - ---- a/block/blk-map.c -+++ b/block/blk-map.c -@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct r - if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len) - goto put_bio; - if (bytes + bv->bv_len > nr_iter) -- goto put_bio; -- if (bv->bv_offset + bv->bv_len > PAGE_SIZE) -- goto put_bio; -+ break; - - nsegs++; - bytes += bv->bv_len; diff --git a/queue-6.6/series b/queue-6.6/series index 110eb38ff82..8fcecda424f 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -196,7 +196,6 @@ hv_netvsc-fix-vf-namespace-also-in-synthetic-nic-netdev_register-event.patch drm-amd-display-disable-psr-su-on-parade-08-01-tcon-too.patch selinux-improve-error-checking-in-sel_write_load.patch net-phy-dp83822-fix-reset-pin-definitions.patch -block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch platform-x86-dell-wmi-ignore-suspend-notifications.patch -- 2.47.2