Commit 40f92e79 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.16-20250710' of git://git.kernel.dk/linux 

Pull block fixes from Jens Axboe:

 - MD changes via Yu:
     - fix UAF due to stack memory used for bio mempool (Jinchao)
     - fix raid10/raid1 nowait IO error path (Nigel and Qixing)
     - fix kernel crash from reading bitmap sysfs entry (Håkon)

 - Fix for a UAF in the nbd connect error path

 - Fix for blocksize being bigger than pagesize, if THP isn't enabled

* tag 'block-6.16-20250710' of git://git.kernel.dk/linux:
  block: reject bs > ps block devices when THP is disabled
  nbd: fix uaf in nbd_genl_connect() error path
  md/md-bitmap: fix GPF in bitmap_get_stats()
  md/raid1,raid10: strip REQ_NOWAIT from member bios
  raid10: cleanup memleak at raid10_make_request
  md/raid1: Fix stack memory use after return in raid1_reshape
parents cb3002e0 4cdf1bdd

drivers/block/nbd.c

+3 −3
Original line number Diff line number Diff line
@@ -2198,9 +2198,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) 
				goto out;

		}

	}

	ret = nbd_start_device(nbd);

	if (ret)

		goto out;



	if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) {

		nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER],

					  GFP_KERNEL);
@@ -2216,6 +2214,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) 
		goto out;

	}

	set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags);



	ret = nbd_start_device(nbd);

out:

	mutex_unlock(&nbd->config_lock);

	if (!ret) {

drivers/md/md-bitmap.c

+1 −2
Original line number Diff line number Diff line
@@ -2366,8 +2366,7 @@ static int bitmap_get_stats(void *data, struct md_bitmap_stats *stats) 


	if (!bitmap)

		return -ENOENT;

	if (!bitmap->mddev->bitmap_info.external &&

	    !bitmap->storage.sb_page)

	if (!bitmap->storage.sb_page)

		return -EINVAL;

	sb = kmap_local_page(bitmap->storage.sb_page);

	stats->sync_size = le64_to_cpu(sb->sync_size);

drivers/md/raid1.c

+3 −1
Original line number Diff line number Diff line
@@ -1399,7 +1399,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, 
	}

	read_bio = bio_alloc_clone(mirror->rdev->bdev, bio, gfp,

				   &mddev->bio_set);



	read_bio->bi_opf &= ~REQ_NOWAIT;

	r1_bio->bios[rdisk] = read_bio;



	read_bio->bi_iter.bi_sector = r1_bio->sector +
@@ -1649,6 +1649,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, 
				wait_for_serialization(rdev, r1_bio);

		}



		mbio->bi_opf &= ~REQ_NOWAIT;

		r1_bio->bios[i] = mbio;



		mbio->bi_iter.bi_sector	= (r1_bio->sector + rdev->data_offset);
@@ -3428,6 +3429,7 @@ static int raid1_reshape(struct mddev *mddev) 
	/* ok, everything is stopped */

	oldpool = conf->r1bio_pool;

	conf->r1bio_pool = newpool;

	init_waitqueue_head(&conf->r1bio_pool.wait);



	for (d = d2 = 0; d < conf->raid_disks; d++) {

		struct md_rdev *rdev = conf->mirrors[d].rdev;

drivers/md/raid10.c

+10 −2
Original line number Diff line number Diff line
@@ -1182,8 +1182,11 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, 
		}

	}



	if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors))

	if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) {

		raid_end_bio_io(r10_bio);

		return;

	}



	rdev = read_balance(conf, r10_bio, &max_sectors);

	if (!rdev) {

		if (err_rdev) {
@@ -1221,6 +1224,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, 
		r10_bio->master_bio = bio;

	}

	read_bio = bio_alloc_clone(rdev->bdev, bio, gfp, &mddev->bio_set);

	read_bio->bi_opf &= ~REQ_NOWAIT;



	r10_bio->devs[slot].bio = read_bio;

	r10_bio->devs[slot].rdev = rdev;
@@ -1256,6 +1260,7 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, 
			     conf->mirrors[devnum].rdev;



	mbio = bio_alloc_clone(rdev->bdev, bio, GFP_NOIO, &mddev->bio_set);

	mbio->bi_opf &= ~REQ_NOWAIT;

	if (replacement)

		r10_bio->devs[n_copy].repl_bio = mbio;

	else
@@ -1370,8 +1375,11 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio, 
	}



	sectors = r10_bio->sectors;

	if (!regular_request_wait(mddev, conf, bio, sectors))

	if (!regular_request_wait(mddev, conf, bio, sectors)) {

		raid_end_bio_io(r10_bio);

		return;

	}



	if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&

	    (mddev->reshape_backwards

	     ? (bio->bi_iter.bi_sector < conf->reshape_safe &&

include/linux/blkdev.h

+5 −0
Original line number Diff line number Diff line
@@ -269,11 +269,16 @@ static inline dev_t disk_devt(struct gendisk *disk) 
	return MKDEV(disk->major, disk->first_minor);

}



#ifdef CONFIG_TRANSPARENT_HUGEPAGE

/*

 * We should strive for 1 << (PAGE_SHIFT + MAX_PAGECACHE_ORDER)

 * however we constrain this to what we can validate and test.

 */

#define BLK_MAX_BLOCK_SIZE      SZ_64K

#else

#define BLK_MAX_BLOCK_SIZE      PAGE_SIZE

#endif





/* blk_validate_limits() validates bsize, so drivers don't usually need to */

static inline int blk_validate_block_size(unsigned long bsize)