diff for duplicates of <1448043978.29114.1.camel@intel.com> diff --git a/a/1.txt b/N1/1.txt index 55b7da4..59bb663 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -5,7 +5,7 @@ On Fri, 2015-11-20 at 13:12 -0500, Matthew Wilcox wrote: > > Acked-by: Matthew Wilcox <willy@linux.intel.com> -Thanks! Fixed up version: +Thanks!  Fixed up version: 8<---- Subject: block: protect rw_page against device teardown @@ -14,24 +14,24 @@ From: Dan Williams <dan.j.williams@intel.com> Fix use after free crashes like the following: - general protection fault: 0000 [#1] SMP - Call Trace: - [<ffffffffa0050216>] ? pmem_do_bvec.isra.12+0xa6/0xf0 [nd_pmem] - [<ffffffffa0050ba2>] pmem_rw_page+0x42/0x80 [nd_pmem] - [<ffffffff8128fd90>] bdev_read_page+0x50/0x60 - [<ffffffff812972f0>] do_mpage_readpage+0x510/0x770 - [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20 - [<ffffffff811d86dc>] ? lru_cache_add+0x1c/0x50 - [<ffffffff81297657>] mpage_readpages+0x107/0x170 - [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20 - [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20 - [<ffffffff8129058d>] blkdev_readpages+0x1d/0x20 - [<ffffffff811d615f>] __do_page_cache_readahead+0x28f/0x310 - [<ffffffff811d6039>] ? __do_page_cache_readahead+0x169/0x310 - [<ffffffff811c5abd>] ? pagecache_get_page+0x2d/0x1d0 - [<ffffffff811c76f6>] filemap_fault+0x396/0x530 - [<ffffffff811f816e>] __do_fault+0x4e/0xf0 - [<ffffffff811fce7d>] handle_mm_fault+0x11bd/0x1b50 + general protection fault: 0000 [#1] SMP + Call Trace: + [<ffffffffa0050216>] ? pmem_do_bvec.isra.12+0xa6/0xf0 [nd_pmem] + [<ffffffffa0050ba2>] pmem_rw_page+0x42/0x80 [nd_pmem] + [<ffffffff8128fd90>] bdev_read_page+0x50/0x60 + [<ffffffff812972f0>] do_mpage_readpage+0x510/0x770 + [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20 + [<ffffffff811d86dc>] ? lru_cache_add+0x1c/0x50 + [<ffffffff81297657>] mpage_readpages+0x107/0x170 + [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20 + [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20 + [<ffffffff8129058d>] blkdev_readpages+0x1d/0x20 + [<ffffffff811d615f>] __do_page_cache_readahead+0x28f/0x310 + [<ffffffff811d6039>] ? __do_page_cache_readahead+0x169/0x310 + [<ffffffff811c5abd>] ? pagecache_get_page+0x2d/0x1d0 + [<ffffffff811c76f6>] filemap_fault+0x396/0x530 + [<ffffffff811f816e>] __do_fault+0x4e/0xf0 + [<ffffffff811fce7d>] handle_mm_fault+0x11bd/0x1b50 Cc: <stable@vger.kernel.org> Cc: Jens Axboe <axboe@fb.com> @@ -41,35 +41,35 @@ Acked-by: Matthew Wilcox <willy@linux.intel.com> [willy: symmetry fixups] Signed-off-by: Dan Williams <dan.j.williams@intel.com> --- - block/blk.h | 2 -- - fs/block_dev.c | 18 ++++++++++++++++-- - include/linux/blkdev.h | 2 ++ - 3 files changed, 18 insertions(+), 4 deletions(-) + block/blk.h            |    2 -- + fs/block_dev.c         |   18 ++++++++++++++++-- + include/linux/blkdev.h |    2 ++ + 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/block/blk.h b/block/blk.h index da722eb786df..c43926d3d74d 100644 --- a/block/blk.h +++ b/block/blk.h @@ -72,8 +72,6 @@ void blk_dequeue_request(struct request *rq); - void __blk_queue_free_tags(struct request_queue *q); - bool __blk_end_bidi_request(struct request *rq, int error, - unsigned int nr_bytes, unsigned int bidi_bytes); + void __blk_queue_free_tags(struct request_queue *q); + bool __blk_end_bidi_request(struct request *rq, int error, +     unsigned int nr_bytes, unsigned int bidi_bytes); -int blk_queue_enter(struct request_queue *q, gfp_t gfp); -void blk_queue_exit(struct request_queue *q); - void blk_freeze_queue(struct request_queue *q); - - static inline void blk_queue_enter_live(struct request_queue *q) + void blk_freeze_queue(struct request_queue *q); + + static inline void blk_queue_enter_live(struct request_queue *q) diff --git a/fs/block_dev.c b/fs/block_dev.c index bb0dfb1c7af1..c25639e907bd 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -390,9 +390,17 @@ int bdev_read_page(struct block_device *bdev, sector_t sector, - struct page *page) - { - const struct block_device_operations *ops = bdev->bd_disk->fops; + struct page *page) + { + const struct block_device_operations *ops = bdev->bd_disk->fops; + int result = -EOPNOTSUPP; + - if (!ops->rw_page || bdev_get_integrity(bdev)) + if (!ops->rw_page || bdev_get_integrity(bdev)) - return -EOPNOTSUPP; - return ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ); + return result; @@ -80,40 +80,40 @@ index bb0dfb1c7af1..c25639e907bd 100644 + result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ); + blk_queue_exit(bdev->bd_queue); + return result; - } - EXPORT_SYMBOL_GPL(bdev_read_page); - + } + EXPORT_SYMBOL_GPL(bdev_read_page); + @@ -421,14 +429,20 @@ int bdev_write_page(struct block_device *bdev, sector_t sector, - int result; - int rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE; - const struct block_device_operations *ops = bdev->bd_disk->fops; + int result; + int rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE; + const struct block_device_operations *ops = bdev->bd_disk->fops; + - if (!ops->rw_page || bdev_get_integrity(bdev)) - return -EOPNOTSUPP; + if (!ops->rw_page || bdev_get_integrity(bdev)) + return -EOPNOTSUPP; + result = blk_queue_enter(bdev->bd_queue, GFP_KERNEL); + if (result) + return result; + - set_page_writeback(page); - result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw); - if (result) - end_page_writeback(page); - else - unlock_page(page); + set_page_writeback(page); + result = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw); + if (result) + end_page_writeback(page); + else + unlock_page(page); + blk_queue_exit(bdev->bd_queue); - return result; - } - EXPORT_SYMBOL_GPL(bdev_write_page); + return result; + } + EXPORT_SYMBOL_GPL(bdev_write_page); diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 3fe27f8d91f0..c0d2b7927c1f 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -794,6 +794,8 @@ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t, - extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t, - struct scsi_ioctl_command __user *); - + extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t, +  struct scsi_ioctl_command __user *); + +extern int blk_queue_enter(struct request_queue *q, gfp_t gfp); +extern void blk_queue_exit(struct request_queue *q); - extern void blk_start_queue(struct request_queue *q); - extern void blk_stop_queue(struct request_queue *q); - extern void blk_sync_queue(struct request_queue *q); + extern void blk_start_queue(struct request_queue *q); + extern void blk_stop_queue(struct request_queue *q); + extern void blk_sync_queue(struct request_queue *q);ÿôèº{.nÇ+‰·Ÿ®‰†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a¢f£¢·hšïêÿ‘êçz_è®\x03(階ŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨èÚ&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥ diff --git a/a/content_digest b/N1/content_digest index b39e92b..8c604fb 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -6,7 +6,7 @@ "Date\0Fri, 20 Nov 2015 18:26:19 +0000\0" "To\0willy@linux.intel.com <willy@linux.intel.com>\0" "Cc\0linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>" - linux-nvdimm@lists.01.org <linux-nvdimm@lists.01.org> + linux-nvdimm@lists.01.org <linux-nvdimm@ml01.01.org> linux-block@vger.kernel.org <linux-block@vger.kernel.org> stable@vger.kernel.org <stable@vger.kernel.org> axboe@fb.com <axboe@fb.com> @@ -20,7 +20,7 @@ "> \n" "> Acked-by: Matthew Wilcox <willy@linux.intel.com>\n" "\n" - "Thanks! \302\240Fixed up version:\n" + "Thanks! \303\202\302\240Fixed up version:\n" "\n" "8<----\n" "Subject: block: protect rw_page against device teardown\n" @@ -29,24 +29,24 @@ "\n" "Fix use after free crashes like the following:\n" "\n" - "\302\240general protection fault: 0000 [#1] SMP\n" - "\302\240Call Trace:\n" - "\302\240 [<ffffffffa0050216>] ? pmem_do_bvec.isra.12+0xa6/0xf0 [nd_pmem]\n" - "\302\240 [<ffffffffa0050ba2>] pmem_rw_page+0x42/0x80 [nd_pmem]\n" - "\302\240 [<ffffffff8128fd90>] bdev_read_page+0x50/0x60\n" - "\302\240 [<ffffffff812972f0>] do_mpage_readpage+0x510/0x770\n" - "\302\240 [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20\n" - "\302\240 [<ffffffff811d86dc>] ? lru_cache_add+0x1c/0x50\n" - "\302\240 [<ffffffff81297657>] mpage_readpages+0x107/0x170\n" - "\302\240 [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20\n" - "\302\240 [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20\n" - "\302\240 [<ffffffff8129058d>] blkdev_readpages+0x1d/0x20\n" - "\302\240 [<ffffffff811d615f>] __do_page_cache_readahead+0x28f/0x310\n" - "\302\240 [<ffffffff811d6039>] ? __do_page_cache_readahead+0x169/0x310\n" - "\302\240 [<ffffffff811c5abd>] ? pagecache_get_page+0x2d/0x1d0\n" - "\302\240 [<ffffffff811c76f6>] filemap_fault+0x396/0x530\n" - "\302\240 [<ffffffff811f816e>] __do_fault+0x4e/0xf0\n" - "\302\240 [<ffffffff811fce7d>] handle_mm_fault+0x11bd/0x1b50\n" + "\303\202\302\240general protection fault: 0000 [#1] SMP\n" + "\303\202\302\240Call Trace:\n" + "\303\202\302\240 [<ffffffffa0050216>] ? pmem_do_bvec.isra.12+0xa6/0xf0 [nd_pmem]\n" + "\303\202\302\240 [<ffffffffa0050ba2>] pmem_rw_page+0x42/0x80 [nd_pmem]\n" + "\303\202\302\240 [<ffffffff8128fd90>] bdev_read_page+0x50/0x60\n" + "\303\202\302\240 [<ffffffff812972f0>] do_mpage_readpage+0x510/0x770\n" + "\303\202\302\240 [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20\n" + "\303\202\302\240 [<ffffffff811d86dc>] ? lru_cache_add+0x1c/0x50\n" + "\303\202\302\240 [<ffffffff81297657>] mpage_readpages+0x107/0x170\n" + "\303\202\302\240 [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20\n" + "\303\202\302\240 [<ffffffff8128fd20>] ? I_BDEV+0x20/0x20\n" + "\303\202\302\240 [<ffffffff8129058d>] blkdev_readpages+0x1d/0x20\n" + "\303\202\302\240 [<ffffffff811d615f>] __do_page_cache_readahead+0x28f/0x310\n" + "\303\202\302\240 [<ffffffff811d6039>] ? __do_page_cache_readahead+0x169/0x310\n" + "\303\202\302\240 [<ffffffff811c5abd>] ? pagecache_get_page+0x2d/0x1d0\n" + "\303\202\302\240 [<ffffffff811c76f6>] filemap_fault+0x396/0x530\n" + "\303\202\302\240 [<ffffffff811f816e>] __do_fault+0x4e/0xf0\n" + "\303\202\302\240 [<ffffffff811fce7d>] handle_mm_fault+0x11bd/0x1b50\n" "\n" "Cc: <stable@vger.kernel.org>\n" "Cc: Jens Axboe <axboe@fb.com>\n" @@ -56,35 +56,35 @@ "[willy: symmetry fixups]\n" "Signed-off-by: Dan Williams <dan.j.williams@intel.com>\n" "---\n" - "\302\240block/blk.h\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240|\302\240\302\240\302\240\302\2402 --\n" - "\302\240fs/block_dev.c\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240|\302\240\302\240\302\24018 ++++++++++++++++--\n" - "\302\240include/linux/blkdev.h |\302\240\302\240\302\240\302\2402 ++\n" - "\302\2403 files changed, 18 insertions(+), 4 deletions(-)\n" + "\303\202\302\240block/blk.h\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240|\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\2402 --\n" + "\303\202\302\240fs/block_dev.c\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240|\303\202\302\240\303\202\302\240\303\202\302\24018 ++++++++++++++++--\n" + "\303\202\302\240include/linux/blkdev.h |\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\2402 ++\n" + "\303\202\302\2403 files changed, 18 insertions(+), 4 deletions(-)\n" "\n" "diff --git a/block/blk.h b/block/blk.h\n" "index da722eb786df..c43926d3d74d 100644\n" "--- a/block/blk.h\n" "+++ b/block/blk.h\n" "@@ -72,8 +72,6 @@ void blk_dequeue_request(struct request *rq);\n" - "\302\240void __blk_queue_free_tags(struct request_queue *q);\n" - "\302\240bool __blk_end_bidi_request(struct request *rq, int error,\n" - "\302\240\t\t\t\302\240\302\240\302\240\302\240unsigned int nr_bytes, unsigned int bidi_bytes);\n" + "\303\202\302\240void __blk_queue_free_tags(struct request_queue *q);\n" + "\303\202\302\240bool __blk_end_bidi_request(struct request *rq, int error,\n" + "\303\202\302\240\t\t\t\303\202\302\240\303\202\302\240\303\202\302\240\303\202\302\240unsigned int nr_bytes, unsigned int bidi_bytes);\n" "-int blk_queue_enter(struct request_queue *q, gfp_t gfp);\n" "-void blk_queue_exit(struct request_queue *q);\n" - "\302\240void blk_freeze_queue(struct request_queue *q);\n" - "\302\240\n" - "\302\240static inline void blk_queue_enter_live(struct request_queue *q)\n" + "\303\202\302\240void blk_freeze_queue(struct request_queue *q);\n" + "\303\202\302\240\n" + "\303\202\302\240static inline void blk_queue_enter_live(struct request_queue *q)\n" "diff --git a/fs/block_dev.c b/fs/block_dev.c\n" "index bb0dfb1c7af1..c25639e907bd 100644\n" "--- a/fs/block_dev.c\n" "+++ b/fs/block_dev.c\n" "@@ -390,9 +390,17 @@ int bdev_read_page(struct block_device *bdev, sector_t sector,\n" - "\302\240\t\t\tstruct page *page)\n" - "\302\240{\n" - "\302\240\tconst struct block_device_operations *ops = bdev->bd_disk->fops;\n" + "\303\202\302\240\t\t\tstruct page *page)\n" + "\303\202\302\240{\n" + "\303\202\302\240\tconst struct block_device_operations *ops = bdev->bd_disk->fops;\n" "+\tint result = -EOPNOTSUPP;\n" "+\n" - "\302\240\tif (!ops->rw_page || bdev_get_integrity(bdev))\n" + "\303\202\302\240\tif (!ops->rw_page || bdev_get_integrity(bdev))\n" "-\t\treturn -EOPNOTSUPP;\n" "-\treturn ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);\n" "+\t\treturn result;\n" @@ -95,42 +95,42 @@ "+\tresult = ops->rw_page(bdev, sector + get_start_sect(bdev), page, READ);\n" "+\tblk_queue_exit(bdev->bd_queue);\n" "+\treturn result;\n" - "\302\240}\n" - "\302\240EXPORT_SYMBOL_GPL(bdev_read_page);\n" - "\302\240\n" + "\303\202\302\240}\n" + "\303\202\302\240EXPORT_SYMBOL_GPL(bdev_read_page);\n" + "\303\202\302\240\n" "@@ -421,14 +429,20 @@ int bdev_write_page(struct block_device *bdev, sector_t sector,\n" - "\302\240\tint result;\n" - "\302\240\tint rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE;\n" - "\302\240\tconst struct block_device_operations *ops = bdev->bd_disk->fops;\n" + "\303\202\302\240\tint result;\n" + "\303\202\302\240\tint rw = (wbc->sync_mode == WB_SYNC_ALL) ? WRITE_SYNC : WRITE;\n" + "\303\202\302\240\tconst struct block_device_operations *ops = bdev->bd_disk->fops;\n" "+\n" - "\302\240\tif (!ops->rw_page || bdev_get_integrity(bdev))\n" - "\302\240\t\treturn -EOPNOTSUPP;\n" + "\303\202\302\240\tif (!ops->rw_page || bdev_get_integrity(bdev))\n" + "\303\202\302\240\t\treturn -EOPNOTSUPP;\n" "+\tresult = blk_queue_enter(bdev->bd_queue, GFP_KERNEL);\n" "+\tif (result)\n" "+\t\treturn result;\n" "+\n" - "\302\240\tset_page_writeback(page);\n" - "\302\240\tresult = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw);\n" - "\302\240\tif (result)\n" - "\302\240\t\tend_page_writeback(page);\n" - "\302\240\telse\n" - "\302\240\t\tunlock_page(page);\n" + "\303\202\302\240\tset_page_writeback(page);\n" + "\303\202\302\240\tresult = ops->rw_page(bdev, sector + get_start_sect(bdev), page, rw);\n" + "\303\202\302\240\tif (result)\n" + "\303\202\302\240\t\tend_page_writeback(page);\n" + "\303\202\302\240\telse\n" + "\303\202\302\240\t\tunlock_page(page);\n" "+\tblk_queue_exit(bdev->bd_queue);\n" - "\302\240\treturn result;\n" - "\302\240}\n" - "\302\240EXPORT_SYMBOL_GPL(bdev_write_page);\n" + "\303\202\302\240\treturn result;\n" + "\303\202\302\240}\n" + "\303\202\302\240EXPORT_SYMBOL_GPL(bdev_write_page);\n" "diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h\n" "index 3fe27f8d91f0..c0d2b7927c1f 100644\n" "--- a/include/linux/blkdev.h\n" "+++ b/include/linux/blkdev.h\n" "@@ -794,6 +794,8 @@ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,\n" - "\302\240extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,\n" - "\302\240\t\t\t\302\240struct scsi_ioctl_command __user *);\n" - "\302\240\n" + "\303\202\302\240extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,\n" + "\303\202\302\240\t\t\t\303\202\302\240struct scsi_ioctl_command __user *);\n" + "\303\202\302\240\n" "+extern int blk_queue_enter(struct request_queue *q, gfp_t gfp);\n" "+extern void blk_queue_exit(struct request_queue *q);\n" - "\302\240extern void blk_start_queue(struct request_queue *q);\n" - "\302\240extern void blk_stop_queue(struct request_queue *q);\n" - "\302\240extern void blk_sync_queue(struct request_queue *q);" + "\303\202\302\240extern void blk_start_queue(struct request_queue *q);\n" + "\303\202\302\240extern void blk_stop_queue(struct request_queue *q);\n" + "\303\202\302\240extern void blk_sync_queue(struct request_queue *q);\303\277\303\264\303\250\302\272{.n\303\207+\302\211\302\267\302\237\302\256\302\211\302\255\302\206+%\302\212\303\213\303\277\302\261\303\251\303\235\302\266\027\302\245\302\212w\303\277\302\272{.n\303\207+\302\211\302\267\302\245\302\212{\302\261\303\276G\302\253\302\235\303\251\303\277\302\212{ay\302\272\035\303\212\302\207\303\232\302\231\303\253,j\a\302\255\302\242f\302\243\302\242\302\267h\302\232\302\217\303\257\302\201\303\252\303\277\302\221\303\252\303\247z_\303\250\302\256\003(\302\255\303\251\302\232\302\216\302\212\303\235\302\242j\"\302\235\303\272\032\302\266\033m\302\247\303\277\303\277\302\276\a\302\253\303\276G\302\253\302\235\303\251\303\277\302\242\302\270?\302\231\302\250\303\250\302\255\303\232&\302\243\303\270\302\247~\302\217\303\241\302\266iO\302\225\303\246\302\254z\302\267\302\232v\303\230^\024\004\032\302\266\033m\302\247\303\277\303\277\303\203\f\303\277\302\266\303\254\303\277\302\242\302\270?\302\226I\302\245" -47f1e2a40d99a51f9dc69aaaf58ac9b808db5db943dd1c8bf8a838e839bad52a +191793f2369ad7f09e99427b3b3cc880e4a1a558a8791d685e9987a4cb15be84
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.