Fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.4/nvme-fix-metadata-handling-in-nvme-passthrough.patch b/queue-5.4/nvme-fix-metadata-handling-in-nvme-passthrough.patch
new file mode 100644 (file)
index 0000000..f2306a9
--- /dev/null
+++ b/queue-5.4/nvme-fix-metadata-handling-in-nvme-passthrough.patch
@@ -0,0 +1,69 @@
+From b11ce968206c5f5f179962238fec849b3acaa931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 13:53:34 +0000
+Subject: nvme: fix metadata handling in nvme-passthrough
+
+From: Puranjay Mohan <pjy@amazon.com>
+
+[ Upstream commit 7c2fd76048e95dd267055b5f5e0a48e6e7c81fd9 ]
+
+On an NVMe namespace that does not support metadata, it is possible to
+send an IO command with metadata through io-passthru. This allows issues
+like [1] to trigger in the completion code path.
+nvme_map_user_request() doesn't check if the namespace supports metadata
+before sending it forward. It also allows admin commands with metadata to
+be processed as it ignores metadata when bdev == NULL and may report
+success.
+
+Reject an IO command with metadata when the NVMe namespace doesn't
+support it and reject an admin command if it has metadata.
+
+[1] https://lore.kernel.org/all/mb61pcylvnym8.fsf@amazon.com/
+
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Puranjay Mohan <pjy@amazon.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+[ Move the changes from nvme_map_user_request() to nvme_submit_user_cmd()
+  to make it work on 5.4 ]
+Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 0676637e1eab6..a841fd4929adc 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -921,11 +921,16 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+       bool write = nvme_is_write(cmd);
+       struct nvme_ns *ns = q->queuedata;
+       struct gendisk *disk = ns ? ns->disk : NULL;
++      bool supports_metadata = disk && blk_get_integrity(disk);
++      bool has_metadata = meta_buffer && meta_len;
+       struct request *req;
+       struct bio *bio = NULL;
+       void *meta = NULL;
+       int ret;
+ 
++      if (has_metadata && !supports_metadata)
++              return -EINVAL;
++
+       req = nvme_alloc_request(q, cmd, 0, NVME_QID_ANY);
+       if (IS_ERR(req))
+               return PTR_ERR(req);
+@@ -940,7 +945,7 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+                       goto out;
+               bio = req->bio;
+               bio->bi_disk = disk;
+-              if (disk && meta_buffer && meta_len) {
++              if (has_metadata) {
+                       meta = nvme_add_user_metadata(bio, meta_buffer, meta_len,
+                                       meta_seed, write);
+                       if (IS_ERR(meta)) {
+-- 
+2.43.0
+

diff --git a/queue-5.4/series b/queue-5.4/series
index 5dcde1a54fe2bfe211ac04fab980596a2bf0cf9f..57215c04f69ac51fb11b4b7b1262cddfe5afc20b 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -24,3 +24,4 @@ proc-softirqs-replace-seq_printf-with-seq_put_decima.patch
 ipmr-fix-access-to-mfc_cache_list-without-lock-held.patch
 cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch
 nfsd-force-all-nfsv4.2-copy-requests-to-be-synchrono.patch
+nvme-fix-metadata-handling-in-nvme-passthrough.patch