Commit c3200081 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux 

Pull block fixes from Jens Axboe:
 "A fix for a regression with sed-opal and saved keys, and outside of
  that an NVMe pull request fixing a few minor issues on that front"

* tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux:
  nvme-pci: add BOGUS_NID for Intel 0a54 device
  nvmet-auth: complete a request only after freeing the dhchap pointers
  nvme: sanitize metadata bounce buffer for reads
  block: Fix regression in sed-opal for a saved key.
  nvme-auth: use chap->s2 to indicate bidirectional authentication
  nvmet-tcp: Fix a possible UAF in queue intialization setup
  nvme-rdma: do not try to stop unallocated queues
parents 747b7628 c3414550

block/sed-opal.c

+3 −4
Original line number Diff line number Diff line
@@ -2888,11 +2888,10 @@ static int opal_lock_unlock(struct opal_dev *dev, 
	if (lk_unlk->session.who > OPAL_USER9)

		return -EINVAL;



	ret = opal_get_key(dev, &lk_unlk->session.opal_key);

	if (ret)

		return ret;

	mutex_lock(&dev->dev_lock);

	opal_lock_check_for_saved_key(dev, lk_unlk);

	ret = opal_get_key(dev, &lk_unlk->session.opal_key);

	if (!ret)

		ret = __opal_lock_unlock(dev, lk_unlk);

	mutex_unlock(&dev->dev_lock);

drivers/nvme/host/auth.c

+2 −2
Original line number Diff line number Diff line
@@ -341,7 +341,7 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl, 
	struct nvmf_auth_dhchap_success1_data *data = chap->buf;

	size_t size = sizeof(*data);



	if (chap->ctrl_key)

	if (chap->s2)

		size += chap->hash_len;



	if (size > CHAP_BUF_SIZE) {
@@ -825,7 +825,7 @@ static void nvme_queue_auth_work(struct work_struct *work) 
		goto fail2;

	}



	if (chap->ctrl_key) {

	if (chap->s2) {

		/* DH-HMAC-CHAP Step 5: send success2 */

		dev_dbg(ctrl->device, "%s: qid %d send success2\n",

			__func__, chap->qid);

drivers/nvme/host/ioctl.c

+7 −3
Original line number Diff line number Diff line
@@ -108,9 +108,13 @@ static void *nvme_add_user_metadata(struct request *req, void __user *ubuf, 
	if (!buf)

		goto out;



	if (req_op(req) == REQ_OP_DRV_OUT) {

		ret = -EFAULT;

	if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len))

		if (copy_from_user(buf, ubuf, len))

			goto out_free_meta;

	} else {

		memset(buf, 0, len);

	}



	bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);

	if (IS_ERR(bip)) {

drivers/nvme/host/pci.c

+2 −1
Original line number Diff line number Diff line
@@ -3329,7 +3329,8 @@ static const struct pci_device_id nvme_id_table[] = { 
	{ PCI_VDEVICE(INTEL, 0x0a54),	/* Intel P4500/P4600 */

		.driver_data = NVME_QUIRK_STRIPE_SIZE |

				NVME_QUIRK_DEALLOCATE_ZEROES |

				NVME_QUIRK_IGNORE_DEV_SUBNQN, },

				NVME_QUIRK_IGNORE_DEV_SUBNQN |

				NVME_QUIRK_BOGUS_NID, },

	{ PCI_VDEVICE(INTEL, 0x0a55),	/* Dell Express Flash P4600 */

		.driver_data = NVME_QUIRK_STRIPE_SIZE |

				NVME_QUIRK_DEALLOCATE_ZEROES, },

drivers/nvme/host/rdma.c

+3 −0
Original line number Diff line number Diff line
@@ -638,6 +638,9 @@ static void __nvme_rdma_stop_queue(struct nvme_rdma_queue *queue) 


static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)

{

	if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))

		return;



	mutex_lock(&queue->queue_lock);

	if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))

		__nvme_rdma_stop_queue(queue);