Fixes for 5.15

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.15/nvme-fix-metadata-handling-in-nvme-passthrough.patch b/queue-5.15/nvme-fix-metadata-handling-in-nvme-passthrough.patch
new file mode 100644 (file)
index 0000000..fe607ba
--- /dev/null
+++ b/queue-5.15/nvme-fix-metadata-handling-in-nvme-passthrough.patch
@@ -0,0 +1,69 @@
+From 3df2b93ffa5577bd8b17b80a8afbbc23707be9eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 12:10:08 +0000
+Subject: nvme: fix metadata handling in nvme-passthrough
+
+From: Puranjay Mohan <pjy@amazon.com>
+
+[ Upstream commit 7c2fd76048e95dd267055b5f5e0a48e6e7c81fd9 ]
+
+On an NVMe namespace that does not support metadata, it is possible to
+send an IO command with metadata through io-passthru. This allows issues
+like [1] to trigger in the completion code path.
+nvme_map_user_request() doesn't check if the namespace supports metadata
+before sending it forward. It also allows admin commands with metadata to
+be processed as it ignores metadata when bdev == NULL and may report
+success.
+
+Reject an IO command with metadata when the NVMe namespace doesn't
+support it and reject an admin command if it has metadata.
+
+[1] https://lore.kernel.org/all/mb61pcylvnym8.fsf@amazon.com/
+
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Puranjay Mohan <pjy@amazon.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+[ Move the changes from nvme_map_user_request() to nvme_submit_user_cmd()
+  to make it work on 5.15 ]
+Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/ioctl.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
+index 7397fad4c96ff..22ff0e617b8f0 100644
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@ -61,11 +61,16 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+       bool write = nvme_is_write(cmd);
+       struct nvme_ns *ns = q->queuedata;
+       struct block_device *bdev = ns ? ns->disk->part0 : NULL;
++      bool supports_metadata = bdev && blk_get_integrity(bdev->bd_disk);
++      bool has_metadata = meta_buffer && meta_len;
+       struct request *req;
+       struct bio *bio = NULL;
+       void *meta = NULL;
+       int ret;
+ 
++      if (has_metadata && !supports_metadata)
++                      return -EINVAL;
++
+       req = nvme_alloc_request(q, cmd, 0);
+       if (IS_ERR(req))
+               return PTR_ERR(req);
+@@ -82,7 +87,7 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+               bio = req->bio;
+               if (bdev)
+                       bio_set_dev(bio, bdev);
+-              if (bdev && meta_buffer && meta_len) {
++              if (has_metadata) {
+                       meta = nvme_add_user_metadata(bio, meta_buffer, meta_len,
+                                       meta_seed, write);
+                       if (IS_ERR(meta)) {
+-- 
+2.43.0
+

diff --git a/queue-5.15/series b/queue-5.15/series
index 8168964c0abb2f2a871b6b1e19a5997284c1e3b2..da8b97999972880c84f46d91692face4a7464ed2 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -56,3 +56,4 @@ ipmr-fix-access-to-mfc_cache_list-without-lock-held.patch
 rcu-tasks-idle-tasks-on-offline-cpus-are-in-quiescen.patch
 x86-stackprotector-work-around-strict-clang-tls-symb.patch
 cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch
+nvme-fix-metadata-handling-in-nvme-passthrough.patch