* [PATCH] blk-mq: don't add non-pt request with ->end_io to batch
@ 2022-10-27 8:57 ` Ming Lei
0 siblings, 0 replies; 4+ messages in thread
From: Ming Lei @ 2022-10-27 8:57 UTC (permalink / raw)
To: Jens Axboe; +Cc: linux-block, Ming Lei, dm-devel, Mike Snitzer, Changhui Zhong
dm-rq implements ->end_io callback for request issued to underlying queue,
and it isn't passthrough request.
Commit ab3e1d3bbab9 ("block: allow end_io based requests in the completion
batch handling") doesn't clear rq->bio and rq->__data_len for request
with ->end_io in blk_mq_end_request_batch(), and this way is actually
dangerous, but so far it is only for nvme passthrough request.
dm-rq needs to clean up remained bios in case of partial completion,
and req->bio is required, then use-after-free is triggered, so the
underlying clone request can't be completed in blk_mq_end_request_batch.
Fix panic by not adding such request into batch list, and the issue
can be triggered simply by exposing nvme pci to dm-mpath simply.
Fixes: ab3e1d3bbab9 ("block: allow end_io based requests in the completion batch handling")
Cc: dm-devel@redhat.com
Cc: Mike Snitzer <snitzer@kernel.org>
Reported-by: Changhui Zhong <czhong@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
include/linux/blk-mq.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index ba18e9bdb799..d6119c5d1069 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -853,7 +853,8 @@ static inline bool blk_mq_add_to_batch(struct request *req,
struct io_comp_batch *iob, int ioerror,
void (*complete)(struct io_comp_batch *))
{
- if (!iob || (req->rq_flags & RQF_ELV) || ioerror)
+ if (!iob || (req->rq_flags & RQF_ELV) || ioerror ||
+ (req->end_io && !blk_rq_is_passthrough(req)))
return false;
if (!iob->complete)
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [dm-devel] [PATCH] blk-mq: don't add non-pt request with ->end_io to batch
@ 2022-10-27 8:57 ` Ming Lei
0 siblings, 0 replies; 4+ messages in thread
From: Ming Lei @ 2022-10-27 8:57 UTC (permalink / raw)
To: Jens Axboe; +Cc: linux-block, dm-devel, Changhui Zhong, Mike Snitzer, Ming Lei
dm-rq implements ->end_io callback for request issued to underlying queue,
and it isn't passthrough request.
Commit ab3e1d3bbab9 ("block: allow end_io based requests in the completion
batch handling") doesn't clear rq->bio and rq->__data_len for request
with ->end_io in blk_mq_end_request_batch(), and this way is actually
dangerous, but so far it is only for nvme passthrough request.
dm-rq needs to clean up remained bios in case of partial completion,
and req->bio is required, then use-after-free is triggered, so the
underlying clone request can't be completed in blk_mq_end_request_batch.
Fix panic by not adding such request into batch list, and the issue
can be triggered simply by exposing nvme pci to dm-mpath simply.
Fixes: ab3e1d3bbab9 ("block: allow end_io based requests in the completion batch handling")
Cc: dm-devel@redhat.com
Cc: Mike Snitzer <snitzer@kernel.org>
Reported-by: Changhui Zhong <czhong@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
include/linux/blk-mq.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index ba18e9bdb799..d6119c5d1069 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -853,7 +853,8 @@ static inline bool blk_mq_add_to_batch(struct request *req,
struct io_comp_batch *iob, int ioerror,
void (*complete)(struct io_comp_batch *))
{
- if (!iob || (req->rq_flags & RQF_ELV) || ioerror)
+ if (!iob || (req->rq_flags & RQF_ELV) || ioerror ||
+ (req->end_io && !blk_rq_is_passthrough(req)))
return false;
if (!iob->complete)
--
2.31.1
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] blk-mq: don't add non-pt request with ->end_io to batch
2022-10-27 8:57 ` [dm-devel] " Ming Lei
@ 2022-10-27 13:15 ` Jens Axboe
-1 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2022-10-27 13:15 UTC (permalink / raw)
To: Ming Lei; +Cc: dm-devel, linux-block, Changhui Zhong, Mike Snitzer
On Thu, 27 Oct 2022 16:57:09 +0800, Ming Lei wrote:
> dm-rq implements ->end_io callback for request issued to underlying queue,
> and it isn't passthrough request.
>
> Commit ab3e1d3bbab9 ("block: allow end_io based requests in the completion
> batch handling") doesn't clear rq->bio and rq->__data_len for request
> with ->end_io in blk_mq_end_request_batch(), and this way is actually
> dangerous, but so far it is only for nvme passthrough request.
>
> [...]
Applied, thanks!
[1/1] blk-mq: don't add non-pt request with ->end_io to batch
(no commit info)
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-devel] [PATCH] blk-mq: don't add non-pt request with ->end_io to batch
@ 2022-10-27 13:15 ` Jens Axboe
0 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2022-10-27 13:15 UTC (permalink / raw)
To: Ming Lei; +Cc: linux-block, dm-devel, Mike Snitzer, Changhui Zhong
On Thu, 27 Oct 2022 16:57:09 +0800, Ming Lei wrote:
> dm-rq implements ->end_io callback for request issued to underlying queue,
> and it isn't passthrough request.
>
> Commit ab3e1d3bbab9 ("block: allow end_io based requests in the completion
> batch handling") doesn't clear rq->bio and rq->__data_len for request
> with ->end_io in blk_mq_end_request_batch(), and this way is actually
> dangerous, but so far it is only for nvme passthrough request.
>
> [...]
Applied, thanks!
[1/1] blk-mq: don't add non-pt request with ->end_io to batch
(no commit info)
Best regards,
--
Jens Axboe
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-10-27 13:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-27 8:57 [PATCH] blk-mq: don't add non-pt request with ->end_io to batch Ming Lei
2022-10-27 8:57 ` [dm-devel] " Ming Lei
2022-10-27 13:15 ` Jens Axboe
2022-10-27 13:15 ` [dm-devel] " Jens Axboe
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.