Commit 360c1f1f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.12-20241004' of git://git.kernel.dk/linux 

Pull block fixes from Jens Axboe:

 - Fix another use-after-free in aoe

 - Fixup wrong nested non-saving irq disable/restore in blk-iocost

 - Fixup a kerneldoc complaint introduced by a merge window patch

* tag 'block-6.12-20241004' of git://git.kernel.dk/linux:
  aoe: fix the potential use-after-free problem in more places
  blk_iocost: remove some duplicate irq disable/enables
  block: fix blk_rq_map_integrity_sg kernel-doc
parents 43454e83 6d6e54fc

block/blk-integrity.c

+1 −2
Original line number Diff line number Diff line
@@ -56,8 +56,7 @@ int blk_rq_count_integrity_sg(struct request_queue *q, struct bio *bio) 


/**

 * blk_rq_map_integrity_sg - Map integrity metadata into a scatterlist

 * @q:		request queue

 * @bio:	bio with integrity metadata attached

 * @rq:		request to map

 * @sglist:	target scatterlist

 *

 * Description: Map the integrity vectors in request into a

block/blk-iocost.c

+4 −4
Original line number Diff line number Diff line
@@ -3166,7 +3166,7 @@ static u64 ioc_qos_prfill(struct seq_file *sf, struct blkg_policy_data *pd, 
	if (!dname)

		return 0;



	spin_lock_irq(&ioc->lock);

	spin_lock(&ioc->lock);

	seq_printf(sf, "%s enable=%d ctrl=%s rpct=%u.%02u rlat=%u wpct=%u.%02u wlat=%u min=%u.%02u max=%u.%02u\n",

		   dname, ioc->enabled, ioc->user_qos_params ? "user" : "auto",

		   ioc->params.qos[QOS_RPPM] / 10000,
@@ -3179,7 +3179,7 @@ static u64 ioc_qos_prfill(struct seq_file *sf, struct blkg_policy_data *pd, 
		   ioc->params.qos[QOS_MIN] % 10000 / 100,

		   ioc->params.qos[QOS_MAX] / 10000,

		   ioc->params.qos[QOS_MAX] % 10000 / 100);

	spin_unlock_irq(&ioc->lock);

	spin_unlock(&ioc->lock);

	return 0;

}
@@ -3366,14 +3366,14 @@ static u64 ioc_cost_model_prfill(struct seq_file *sf, 
	if (!dname)

		return 0;



	spin_lock_irq(&ioc->lock);

	spin_lock(&ioc->lock);

	seq_printf(sf, "%s ctrl=%s model=linear "

		   "rbps=%llu rseqiops=%llu rrandiops=%llu "

		   "wbps=%llu wseqiops=%llu wrandiops=%llu\n",

		   dname, ioc->user_cost_model ? "user" : "auto",

		   u[I_LCOEF_RBPS], u[I_LCOEF_RSEQIOPS], u[I_LCOEF_RRANDIOPS],

		   u[I_LCOEF_WBPS], u[I_LCOEF_WSEQIOPS], u[I_LCOEF_WRANDIOPS]);

	spin_unlock_irq(&ioc->lock);

	spin_unlock(&ioc->lock);

	return 0;

}

drivers/block/aoe/aoecmd.c

+12 −1
Original line number Diff line number Diff line
@@ -361,6 +361,7 @@ ata_rw_frameinit(struct frame *f) 
	}



	ah->cmdstat = ATA_CMD_PIO_READ | writebit | extbit;

	dev_hold(t->ifp->nd);

	skb->dev = t->ifp->nd;

}
@@ -401,6 +402,8 @@ aoecmd_ata_rw(struct aoedev *d) 
		__skb_queue_head_init(&queue);

		__skb_queue_tail(&queue, skb);

		aoenet_xmit(&queue);

	} else {

		dev_put(f->t->ifp->nd);

	}

	return 1;

}
@@ -483,10 +486,13 @@ resend(struct aoedev *d, struct frame *f) 
	memcpy(h->dst, t->addr, sizeof h->dst);

	memcpy(h->src, t->ifp->nd->dev_addr, sizeof h->src);



	dev_hold(t->ifp->nd);

	skb->dev = t->ifp->nd;

	skb = skb_clone(skb, GFP_ATOMIC);

	if (skb == NULL)

	if (skb == NULL) {

		dev_put(t->ifp->nd);

		return;

	}

	f->sent = ktime_get();

	__skb_queue_head_init(&queue);

	__skb_queue_tail(&queue, skb);
@@ -617,6 +623,8 @@ probe(struct aoetgt *t) 
		__skb_queue_head_init(&queue);

		__skb_queue_tail(&queue, skb);

		aoenet_xmit(&queue);

	} else {

		dev_put(f->t->ifp->nd);

	}

}
@@ -1395,6 +1403,7 @@ aoecmd_ata_id(struct aoedev *d) 
	ah->cmdstat = ATA_CMD_ID_ATA;

	ah->lba3 = 0xa0;



	dev_hold(t->ifp->nd);

	skb->dev = t->ifp->nd;



	d->rttavg = RTTAVG_INIT;
@@ -1404,6 +1413,8 @@ aoecmd_ata_id(struct aoedev *d) 
	skb = skb_clone(skb, GFP_ATOMIC);

	if (skb)

		f->sent = ktime_get();

	else

		dev_put(t->ifp->nd);



	return skb;

}