Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe: - Fix a ublk recovery hang, where END_USER_RECOVERY without a successful START_USER_RECOVERY could be satisfied by a stale completion latch - Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl - MAINTAINERS email address update for Roger Pau Monne * tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: MAINTAINERS: update my email address cdrom: fix stack out-of-bounds read in CDROMVOLCTRL ublk: wait on ublk_dev_ready() instead of ub->completion

Linus Torvalds committed 3 months ago

Commit 0ce37742 parents 73387b8 093fbff3 files · +32 −18Browse files

Unified · Split

3 files

MAINTAINERS +1 −1
drivers/block/ublk_drv.c +30 −17
drivers/cdrom/cdrom.c +1 −0

MAINTAINERS+1−1

@@ -29400,7 +29400,7 @@ F: net/xdp/ · 29399 unmodified lines
29400	F: tools/testing/selftests/bpf/xsk	29400	F: tools/testing/selftests/bpf/xsk
29401		29401
29402	XEN BLOCK SUBSYSTEM	29402	XEN BLOCK SUBSYSTEM
29403	M: Roger Pau Monné <roger.pau@citrix.com>	29403	M: Roger Pau Monné <roger@xenproject.org>
29404	L: xen-devel@lists.xenproject.org (moderated for non-subscribers)	29404	L: xen-devel@lists.xenproject.org (moderated for non-subscribers)
29405	S: Supported	29405	S: Supported
29406	F: drivers/block/xen*	29406	F: drivers/block/xen*

drivers/block/ublk_drv.c+30−17

 #include <linux/errno.h>
 #include <linux/major.h>
 #include <linux/wait.h>
+#include <linux/wait_bit.h>
 #include <linux/blkdev.h>
 #include <linux/init.h>
 #include <linux/swap.h>
 #include <linux/compat.h>
 #include <linux/mutex.h>
 #include <linux/writeback.h>
-#include <linux/completion.h>
 #include <linux/highmem.h>
 #include <linux/sysfs.h>
 #include <linux/miscdevice.h>
 	struct ublk_params	params;
-	struct completion	completion;
 	u32			nr_queue_ready;
 	bool 			unprivileged_daemons;
 	struct mutex cancel_mutex;
 	if (ublk_dev_ready(ub)) {
 		/*
 		 * All queues ready - clear device-level canceling flag
-		 * and complete the recovery/initialization.
+		 * and wake ublk_dev_ready() waiters.
 		 */
 		mutex_lock(&ub->cancel_mutex);
 		ub->canceling = false;
 		mutex_unlock(&ub->cancel_mutex);
-		complete_all(&ub->completion);
+		wake_up_var(&ub->nr_queue_ready);
 	}
 }
 			goto fail;
 	}
-	init_completion(&ub->completion);
 	return 0;
  fail:
 	return ub->ublksrv_tgid == ublksrv_pid;
 }
+/*
+ * Wait until all queues have fetched their I/O commands, and return with
+ * ub->mutex held and readiness guaranteed: then every queue's ->canceling
+ * is cleared. Ready may regress between wakeup and mutex_lock() (F_BATCH
+ * UNPREP, daemon death), so re-check it under the mutex and wait again.
+ */
+static int ublk_wait_dev_ready_and_lock(struct ublk_device *ub)
+{
+	while (true) {
+		if (wait_var_event_interruptible(&ub->nr_queue_ready,
+						 ublk_dev_ready(ub)))
+			return -EINTR;
+		mutex_lock(&ub->mutex);
+		if (ublk_dev_ready(ub))
+			return 0;
+		mutex_unlock(&ub->mutex);
+	}
+}
 static int ublk_ctrl_start_dev(struct ublk_device *ub,
 		const struct ublksrv_ctrl_cmd *header)
 {
 		};
 	}
-	if (wait_for_completion_interruptible(&ub->completion) != 0)
+	if (ublk_wait_dev_ready_and_lock(ub))
 		return -EINTR;
-	if (!ublk_validate_user_pid(ub, ublksrv_pid))
+	if (!ublk_validate_user_pid(ub, ublksrv_pid)) {
-		return -EINVAL;
-	mutex_lock(&ub->mutex);
-	/* device may become not ready in case of F_BATCH */
-	if (!ublk_dev_ready(ub)) {
 		ret = -EINVAL;
 		goto out_unlock;
 	}
 		goto out_unlock;
 	}
 	pr_devel("%s: start recovery for dev id %d\n", __func__, ub->ub_number);
-	init_completion(&ub->completion);
 	ret = 0;
  out_unlock:
 	mutex_unlock(&ub->mutex);
 	pr_devel("%s: Waiting for all FETCH_REQs, dev id %d...\n", __func__,
 		 header->dev_id);
-	if (wait_for_completion_interruptible(&ub->completion))
+	if (ublk_wait_dev_ready_and_lock(ub))
 		return -EINTR;
 	pr_devel("%s: All FETCH_REQs received, dev id %d\n", __func__,
 		 header->dev_id);
-	if (!ublk_validate_user_pid(ub, ublksrv_pid))
+	if (!ublk_validate_user_pid(ub, ublksrv_pid)) {
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unlock;
+	}
-	mutex_lock(&ub->mutex);
 	if (ublk_nosrv_should_stop_dev(ub))
 		goto out_unlock;

drivers/cdrom/cdrom.c+1−0

@@ -3187,6 +3187,7 @@ static noinline int mmc_ioctl_cdrom_volume(struct cdrom_device_info *cdi, · 3186 unmodified lines
3187		3187
3188	/* set volume */	3188	/* set volume */
3189	cgc->buffer = buffer + offset - 8;	3189	cgc->buffer = buffer + offset - 8;
		3190	cgc->buflen -= offset - 8;
3190	memset(cgc->buffer, 0, 8);	3191	memset(cgc->buffer, 0, 8);
3191	return cdrom_mode_select(cdi, cgc);	3192	return cdrom_mode_select(cdi, cgc);
3192	}	3193	}