linux-block.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] nullb: Prevent use of legacy request queue mode
@ 2019-01-28  6:10 Damien Le Moal
  2019-01-29  1:49 ` Chaitanya Kulkarni
  0 siblings, 1 reply; 2+ messages in thread
From: Damien Le Moal @ 2019-01-28  6:10 UTC (permalink / raw)
  To: linux-block, Jens Axboe; +Cc: Matias Bjorling, Christoph Hellwig

When null_blk queue mode is specified together with modprobe/insmod, a
check to prevent setting the nullb device queue mode to 1 (NULL_Q_RQ) is
done. However, the same check is not performed when setting up a nullb
device through configfs, resulting in a oops (NULL pointer dereference
for the device request queue).

Fix this problem by checking for an invalid queue mode value in
null_validate_conf(), propagating -EINVAL to null_add_dev() if the queue
mode is NULL_Q_RQ. While at it, also fix the propagation to user space
of null_add_dev() return value when a nullb device is created through
configfs power attribute.

Fixes: 49f6613632f9 ("nullb: remove leftover legacy request code")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
---
 drivers/block/null_blk_main.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 62c9654b9ce8..5570d0da59b4 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -318,9 +318,10 @@ static ssize_t nullb_device_power_store(struct config_item *item,
 	if (!dev->power && newp) {
 		if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags))
 			return count;
-		if (null_add_dev(dev)) {
+		ret = null_add_dev(dev);
+		if (ret) {
 			clear_bit(NULLB_DEV_FL_UP, &dev->flags);
-			return -ENOMEM;
+			return ret;
 		}
 
 		set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
@@ -1561,8 +1562,13 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
 	return blk_mq_alloc_tag_set(set);
 }
 
-static void null_validate_conf(struct nullb_device *dev)
+static int null_validate_conf(struct nullb_device *dev)
 {
+	if (dev->queue_mode == NULL_Q_RQ) {
+		pr_err("null_blk: legacy IO path no longer available\n");
+		return -EINVAL;
+	}
+
 	dev->blocksize = round_down(dev->blocksize, 512);
 	dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);
 
@@ -1588,6 +1594,8 @@ static void null_validate_conf(struct nullb_device *dev)
 	/* can not stop a queue */
 	if (dev->queue_mode == NULL_Q_BIO)
 		dev->mbps = 0;
+
+	return 0;
 }
 
 #ifdef CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION
@@ -1620,7 +1628,9 @@ static int null_add_dev(struct nullb_device *dev)
 	struct nullb *nullb;
 	int rv;
 
-	null_validate_conf(dev);
+	rv = null_validate_conf(dev);
+	if (rv)
+		goto out;
 
 	nullb = kzalloc_node(sizeof(*nullb), GFP_KERNEL, dev->home_node);
 	if (!nullb) {
@@ -1648,8 +1658,10 @@ static int null_add_dev(struct nullb_device *dev)
 		if (rv)
 			goto out_cleanup_queues;
 
-		if (!null_setup_fault())
+		if (!null_setup_fault()) {
+			rv = -EINVAL;
 			goto out_cleanup_queues;
+		}
 
 		nullb->tag_set->timeout = 5 * HZ;
 		nullb->q = blk_mq_init_queue(nullb->tag_set);
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 2+ messages in thread
* Re: [PATCH] nullb: Prevent use of legacy request queue mode
  2019-01-28  6:10 [PATCH] nullb: Prevent use of legacy request queue mode Damien Le Moal
@ 2019-01-29  1:49 ` Chaitanya Kulkarni
  0 siblings, 0 replies; 2+ messages in thread
From: Chaitanya Kulkarni @ 2019-01-29  1:49 UTC (permalink / raw)
  To: Damien Le Moal, linux-block, Jens Axboe
  Cc: Matias Bjorling, Christoph Hellwig

Looks good.

Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>

From: linux-block-owner@vger.kernel.org <linux-block-owner@vger.kernel.org> on behalf of Damien Le Moal <damien.lemoal@wdc.com>
Sent: Sunday, January 27, 2019 10:10 PM
To: linux-block@vger.kernel.org; Jens Axboe
Cc: Matias Bjorling; Christoph Hellwig
Subject: [PATCH] nullb: Prevent use of legacy request queue mode
  
 
When null_blk queue mode is specified together with modprobe/insmod, a
check to prevent setting the nullb device queue mode to 1 (NULL_Q_RQ) is
done. However, the same check is not performed when setting up a nullb
device through configfs, resulting in a oops (NULL pointer dereference
for the device request queue).

Fix this problem by checking for an invalid queue mode value in
null_validate_conf(), propagating -EINVAL to null_add_dev() if the queue
mode is NULL_Q_RQ. While at it, also fix the propagation to user space
of null_add_dev() return value when a nullb device is created through
configfs power attribute.

Fixes: 49f6613632f9 ("nullb: remove leftover legacy request code")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
---
 drivers/block/null_blk_main.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
index 62c9654b9ce8..5570d0da59b4 100644
--- a/drivers/block/null_blk_main.c
+++ b/drivers/block/null_blk_main.c
@@ -318,9 +318,10 @@ static ssize_t nullb_device_power_store(struct config_item *item,
         if (!dev->power && newp) {
                 if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags))
                         return count;
-               if (null_add_dev(dev)) {
+               ret = null_add_dev(dev);
+               if (ret) {
                         clear_bit(NULLB_DEV_FL_UP, &dev->flags);
-                       return -ENOMEM;
+                       return ret;
                 }
 
                 set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
@@ -1561,8 +1562,13 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
         return blk_mq_alloc_tag_set(set);
 }
 
-static void null_validate_conf(struct nullb_device *dev)
+static int null_validate_conf(struct nullb_device *dev)
 {
+       if (dev->queue_mode == NULL_Q_RQ) {
+               pr_err("null_blk: legacy IO path no longer available\n");
+               return -EINVAL;
+       }
+
         dev->blocksize = round_down(dev->blocksize, 512);
         dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);
 
@@ -1588,6 +1594,8 @@ static void null_validate_conf(struct nullb_device *dev)
         /* can not stop a queue */
         if (dev->queue_mode == NULL_Q_BIO)
                 dev->mbps = 0;
+
+       return 0;
 }
 
 #ifdef CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION
@@ -1620,7 +1628,9 @@ static int null_add_dev(struct nullb_device *dev)
         struct nullb *nullb;
         int rv;
 
-       null_validate_conf(dev);
+       rv = null_validate_conf(dev);
+       if (rv)
+               goto out;
 
         nullb = kzalloc_node(sizeof(*nullb), GFP_KERNEL, dev->home_node);
         if (!nullb) {
@@ -1648,8 +1658,10 @@ static int null_add_dev(struct nullb_device *dev)
                 if (rv)
                         goto out_cleanup_queues;
 
-               if (!null_setup_fault())
+               if (!null_setup_fault()) {
+                       rv = -EINVAL;
                         goto out_cleanup_queues;
+               }
 
                 nullb->tag_set->timeout = 5 * HZ;
                 nullb->q = blk_mq_init_queue(nullb->tag_set);
-- 
2.20.1

    

^ permalink raw reply related	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-01-29  1:49 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-28  6:10 [PATCH] nullb: Prevent use of legacy request queue mode Damien Le Moal
2019-01-29  1:49 ` Chaitanya Kulkarni

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).