Commit 569c3a28 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.2-2022-12-19' of git://git.kernel.dk/linux 

Pull block fixes from Jens Axboe:

 - Various fixes for BFQ (Yu, Yuwei)

 - Fix for loop command line parsing (Isaac)

 - No need to specifically clear REQ_ALLOC_CACHE on IOPOLL downgrade
   anymore (me)

 - blk-iocost enum fix for newer gcc (Jiri)

 - UAF fix for queue release (Ming)

 - blk-iolatency error handling memory leak fix (Tejun)

* tag 'block-6.2-2022-12-19' of git://git.kernel.dk/linux:
  block: don't clear REQ_ALLOC_CACHE for non-polled requests
  block: fix use-after-free of q->q_usage_counter
  block, bfq: only do counting of pending-request for BFQ_GROUP_IOSCHED
  blk-iolatency: Fix memory leak on add_disk() failures
  loop: Fix the max_loop commandline argument treatment when it is set to 0
  block/blk-iocost (gcc13): keep large values in a new enum
  block, bfq: replace 0/1 with false/true in bic apis
  block, bfq: don't return bfqg from __bfq_bic_change_cgroup()
  block, bfq: fix possible uaf for 'bfqq->bic'
parents 5d4740fc 53eab8e7

block/bfq-cgroup.c

+7 −9
Original line number Diff line number Diff line
@@ -724,19 +724,19 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, 
 * sure that the reference to cgroup is valid across the call (see

 * comments in bfq_bic_update_cgroup on this issue)

 */

static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd,

static void __bfq_bic_change_cgroup(struct bfq_data *bfqd,

				    struct bfq_io_cq *bic,

				    struct bfq_group *bfqg)

{

	struct bfq_queue *async_bfqq = bic_to_bfqq(bic, 0);

	struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, 1);

	struct bfq_queue *async_bfqq = bic_to_bfqq(bic, false);

	struct bfq_queue *sync_bfqq = bic_to_bfqq(bic, true);

	struct bfq_entity *entity;



	if (async_bfqq) {

		entity = &async_bfqq->entity;



		if (entity->sched_data != &bfqg->sched_data) {

			bic_set_bfqq(bic, NULL, 0);

			bic_set_bfqq(bic, NULL, false);

			bfq_release_process_ref(bfqd, async_bfqq);

		}

	}
@@ -772,12 +772,10 @@ static void *__bfq_bic_change_cgroup(struct bfq_data *bfqd, 
				 */

				bfq_put_cooperator(sync_bfqq);

				bfq_release_process_ref(bfqd, sync_bfqq);

				bic_set_bfqq(bic, NULL, 1);

				bic_set_bfqq(bic, NULL, true);

			}

		}

	}



	return bfqg;

}



void bfq_bic_update_cgroup(struct bfq_io_cq *bic, struct bio *bio)

block/bfq-iosched.c

+10 −3
Original line number Diff line number Diff line
@@ -386,6 +386,12 @@ static void bfq_put_stable_ref(struct bfq_queue *bfqq); 


void bic_set_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq, bool is_sync)

{

	struct bfq_queue *old_bfqq = bic->bfqq[is_sync];



	/* Clear bic pointer if bfqq is detached from this bic */

	if (old_bfqq && old_bfqq->bic == bic)

		old_bfqq->bic = NULL;



	/*

	 * If bfqq != NULL, then a non-stable queue merge between

	 * bic->bfqq and bfqq is happening here. This causes troubles
@@ -3108,7 +3114,7 @@ bfq_merge_bfqqs(struct bfq_data *bfqd, struct bfq_io_cq *bic, 
	/*

	 * Merge queues (that is, let bic redirect its requests to new_bfqq)

	 */

	bic_set_bfqq(bic, new_bfqq, 1);

	bic_set_bfqq(bic, new_bfqq, true);

	bfq_mark_bfqq_coop(new_bfqq);

	/*

	 * new_bfqq now belongs to at least two bics (it is a shared queue):
@@ -5311,7 +5317,6 @@ static void bfq_exit_icq_bfqq(struct bfq_io_cq *bic, bool is_sync) 
		unsigned long flags;



		spin_lock_irqsave(&bfqd->lock, flags);

		bfqq->bic = NULL;

		bfq_exit_bfqq(bfqd, bfqq);

		bic_set_bfqq(bic, NULL, is_sync);

		spin_unlock_irqrestore(&bfqd->lock, flags);
@@ -6557,7 +6562,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) 
		return bfqq;

	}



	bic_set_bfqq(bic, NULL, 1);

	bic_set_bfqq(bic, NULL, true);



	bfq_put_cooperator(bfqq);
@@ -7058,7 +7063,9 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_type *e) 
	bfqd->idle_slice_timer.function = bfq_idle_slice_timer;



	bfqd->queue_weights_tree = RB_ROOT_CACHED;

#ifdef CONFIG_BFQ_GROUP_IOSCHED

	bfqd->num_groups_with_pending_reqs = 0;

#endif



	INIT_LIST_HEAD(&bfqd->active_list);

	INIT_LIST_HEAD(&bfqd->idle_list);

block/bfq-iosched.h

+4 −0
Original line number Diff line number Diff line
@@ -197,8 +197,10 @@ struct bfq_entity { 
	/* flag, set to request a weight, ioprio or ioprio_class change  */

	int prio_changed;



#ifdef CONFIG_BFQ_GROUP_IOSCHED

	/* flag, set if the entity is counted in groups_with_pending_reqs */

	bool in_groups_with_pending_reqs;

#endif



	/* last child queue of entity created (for non-leaf entities) */

	struct bfq_queue *last_bfqq_created;
@@ -491,6 +493,7 @@ struct bfq_data { 
	 */

	struct rb_root_cached queue_weights_tree;



#ifdef CONFIG_BFQ_GROUP_IOSCHED

	/*

	 * Number of groups with at least one process that

	 * has at least one request waiting for completion. Note that
@@ -538,6 +541,7 @@ struct bfq_data { 
	 * with no request waiting for completion.

	 */

	unsigned int num_groups_with_pending_reqs;

#endif



	/*

	 * Per-class (RT, BE, IDLE) number of bfq_queues containing

block/bfq-wf2q.c

+4 −4
Original line number Diff line number Diff line
@@ -1612,28 +1612,28 @@ void bfq_requeue_bfqq(struct bfq_data *bfqd, struct bfq_queue *bfqq, 


void bfq_add_bfqq_in_groups_with_pending_reqs(struct bfq_queue *bfqq)

{

#ifdef CONFIG_BFQ_GROUP_IOSCHED

	struct bfq_entity *entity = &bfqq->entity;



	if (!entity->in_groups_with_pending_reqs) {

		entity->in_groups_with_pending_reqs = true;

#ifdef CONFIG_BFQ_GROUP_IOSCHED

		if (!(bfqq_group(bfqq)->num_queues_with_pending_reqs++))

			bfqq->bfqd->num_groups_with_pending_reqs++;

#endif

	}

#endif

}



void bfq_del_bfqq_in_groups_with_pending_reqs(struct bfq_queue *bfqq)

{

#ifdef CONFIG_BFQ_GROUP_IOSCHED

	struct bfq_entity *entity = &bfqq->entity;



	if (entity->in_groups_with_pending_reqs) {

		entity->in_groups_with_pending_reqs = false;

#ifdef CONFIG_BFQ_GROUP_IOSCHED

		if (!(--bfqq_group(bfqq)->num_queues_with_pending_reqs))

			bfqq->bfqd->num_groups_with_pending_reqs--;

#endif

	}

#endif

}



/*

block/blk-cgroup.c

+2 −0
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include "blk-cgroup.h"

#include "blk-ioprio.h"

#include "blk-throttle.h"

#include "blk-rq-qos.h"



/*

 * blkcg_pol_mutex protects blkcg_policy[] and policy [de]activation.
@@ -1322,6 +1323,7 @@ int blkcg_init_disk(struct gendisk *disk) 
void blkcg_exit_disk(struct gendisk *disk)

{

	blkg_destroy_all(disk);

	rq_qos_exit(disk->queue);

	blk_throtl_exit(disk);

}