History

Merge tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe: "A fix for a regression with sed-opal and saved keys, and outside of that an NVMe pull request fixing a few minor issues on that front" * tag 'block-6.6-2023-10-20' of git://git.kernel.dk/linux: nvme-pci: add BOGUS_NID for Intel 0a54 device nvmet-auth: complete a request only after freeing the dhchap pointers nvme: sanitize metadata bounce buffer for reads block: Fix regression in sed-opal for a saved key. nvme-auth: use chap->s2 to indicate bidirectional authentication nvmet-tcp: Fix a possible UAF in queue intialization setup nvme-rdma: do not try to stop unallocated queues

Linus Torvalds committed 3 years ago

Commit c3200082 parents 747b762 c3414557 files · +25 −18Browse files

Unified · Split

7 files
  1. block/sed-opal.c +3 −4
  2. drivers/nvme/host/auth.c +2 −2
  3. drivers/nvme/host/ioctl.c +7 −3
  4. drivers/nvme/host/pci.c +2 −1
  5. drivers/nvme/host/rdma.c +3 −0
  6. drivers/nvme/target/fabrics-cmd-auth.c +6 −3
  7. drivers/nvme/target/tcp.c +2 −5
block/sed-opal.c+3−4
@@ -2888,12 +2888,11 @@ static int opal_lock_unlock(struct opal_dev *dev, · 2887 unmodified lines
2888 if (lk_unlk->session.who > OPAL_USER9)2888 if (lk_unlk->session.who > OPAL_USER9)
2889 return -EINVAL;2889 return -EINVAL;
2890 2890
2891 ret = opal_get_key(dev, &lk_unlk->session.opal_key);
2892 if (ret)
2893 return ret;
2894 mutex_lock(&dev->dev_lock);2891 mutex_lock(&dev->dev_lock);
2895 opal_lock_check_for_saved_key(dev, lk_unlk);2892 opal_lock_check_for_saved_key(dev, lk_unlk);
2896 ret = __opal_lock_unlock(dev, lk_unlk);2893 ret = opal_get_key(dev, &lk_unlk->session.opal_key);
2894 if (!ret)
2895 ret = __opal_lock_unlock(dev, lk_unlk);
2897 mutex_unlock(&dev->dev_lock);2896 mutex_unlock(&dev->dev_lock);
2898 2897
2899 return ret;2898 return ret;
drivers/nvme/host/auth.c+2−2
@@ -341,7 +341,7 @@ static int nvme_auth_process_dhchap_success1(struct nvme_ctrl *ctrl, · 340 unmodified lines
341 struct nvmf_auth_dhchap_success1_data *data = chap->buf;341 struct nvmf_auth_dhchap_success1_data *data = chap->buf;
342 size_t size = sizeof(*data);342 size_t size = sizeof(*data);
343 343
344 if (chap->ctrl_key)344 if (chap->s2)
345 size += chap->hash_len;345 size += chap->hash_len;
346 346
347 if (size > CHAP_BUF_SIZE) {347 if (size > CHAP_BUF_SIZE) {
@@ -825,7 +825,7 @@ static void nvme_queue_auth_work(struct work_struct *work) · 477 unmodified lines
825 goto fail2;825 goto fail2;
826 }826 }
827 827
828 if (chap->ctrl_key) {828 if (chap->s2) {
829 /* DH-HMAC-CHAP Step 5: send success2 */829 /* DH-HMAC-CHAP Step 5: send success2 */
830 dev_dbg(ctrl->device, "%s: qid %d send success2\n",830 dev_dbg(ctrl->device, "%s: qid %d send success2\n",
831 __func__, chap->qid);831 __func__, chap->qid);
drivers/nvme/host/ioctl.c+7−3
@@ -108,9 +108,13 @@ static void *nvme_add_user_metadata(struct request *req, void __user *ubuf, · 107 unmodified lines
108 if (!buf)108 if (!buf)
109 goto out;109 goto out;
110 110
111 ret = -EFAULT;111 if (req_op(req) == REQ_OP_DRV_OUT) {
112 if ((req_op(req) == REQ_OP_DRV_OUT) && copy_from_user(buf, ubuf, len))112 ret = -EFAULT;
113 goto out_free_meta;113 if (copy_from_user(buf, ubuf, len))
114 goto out_free_meta;
115 } else {
116 memset(buf, 0, len);
117 }
114 118
115 bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);119 bip = bio_integrity_alloc(bio, GFP_KERNEL, 1);
116 if (IS_ERR(bip)) {120 if (IS_ERR(bip)) {
drivers/nvme/host/pci.c+2−1
@@ -3329,7 +3329,8 @@ static const struct pci_device_id nvme_id_table[] = { · 3328 unmodified lines
3329 { PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */3329 { PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */
3330 .driver_data = NVME_QUIRK_STRIPE_SIZE |3330 .driver_data = NVME_QUIRK_STRIPE_SIZE |
3331 NVME_QUIRK_DEALLOCATE_ZEROES |3331 NVME_QUIRK_DEALLOCATE_ZEROES |
3332 NVME_QUIRK_IGNORE_DEV_SUBNQN, },3332 NVME_QUIRK_IGNORE_DEV_SUBNQN |
3333 NVME_QUIRK_BOGUS_NID, },
3333 { PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */3334 { PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */
3334 .driver_data = NVME_QUIRK_STRIPE_SIZE |3335 .driver_data = NVME_QUIRK_STRIPE_SIZE |
3335 NVME_QUIRK_DEALLOCATE_ZEROES, },3336 NVME_QUIRK_DEALLOCATE_ZEROES, },
drivers/nvme/host/rdma.c+3−0
@@ -638,6 +638,9 @@ static void __nvme_rdma_stop_queue(struct nvme_rdma_queue *queue) · 637 unmodified lines
638 638
639static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)639static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
640{640{
641 if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
642 return;
643
641 mutex_lock(&queue->queue_lock);644 mutex_lock(&queue->queue_lock);
642 if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))645 if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
643 __nvme_rdma_stop_queue(queue);646 __nvme_rdma_stop_queue(queue);
drivers/nvme/target/fabrics-cmd-auth.c+6−3
@@ -333,19 +333,21 @@ done: · 332 unmodified lines
333 __func__, ctrl->cntlid, req->sq->qid,333 __func__, ctrl->cntlid, req->sq->qid,
334 status, req->error_loc);334 status, req->error_loc);
335 req->cqe->result.u64 = 0;335 req->cqe->result.u64 = 0;
336 nvmet_req_complete(req, status);
337 if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&336 if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 &&
338 req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {337 req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) {
339 unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;338 unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120;
340 339
341 mod_delayed_work(system_wq, &req->sq->auth_expired_work,340 mod_delayed_work(system_wq, &req->sq->auth_expired_work,
342 auth_expire_secs * HZ);341 auth_expire_secs * HZ);
343 return;342 goto complete;
344 }343 }
345 /* Final states, clear up variables */344 /* Final states, clear up variables */
346 nvmet_auth_sq_free(req->sq);345 nvmet_auth_sq_free(req->sq);
347 if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)346 if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE2)
348 nvmet_ctrl_fatal_error(ctrl);347 nvmet_ctrl_fatal_error(ctrl);
348
349complete:
350 nvmet_req_complete(req, status);
349}351}
350 352
351static int nvmet_auth_challenge(struct nvmet_req *req, void *d, int al)353static int nvmet_auth_challenge(struct nvmet_req *req, void *d, int al)
@@ -514,11 +516,12 @@ void nvmet_execute_auth_receive(struct nvmet_req *req) · 162 unmodified lines
514 kfree(d);516 kfree(d);
515done:517done:
516 req->cqe->result.u64 = 0;518 req->cqe->result.u64 = 0;
517 nvmet_req_complete(req, status);519
518 if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2)520 if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2)
519 nvmet_auth_sq_free(req->sq);521 nvmet_auth_sq_free(req->sq);
520 else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {522 else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) {
521 nvmet_auth_sq_free(req->sq);523 nvmet_auth_sq_free(req->sq);
522 nvmet_ctrl_fatal_error(ctrl);524 nvmet_ctrl_fatal_error(ctrl);
523 }525 }
526 nvmet_req_complete(req, status);
524}527}
drivers/nvme/target/tcp.c+2−5
@@ -372,6 +372,7 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) · 371 unmodified lines
372 372
373static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)373static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
374{374{
375 queue->rcv_state = NVMET_TCP_RECV_ERR;
375 if (status == -EPIPE || status == -ECONNRESET)376 if (status == -EPIPE || status == -ECONNRESET)
376 kernel_sock_shutdown(queue->sock, SHUT_RDWR);377 kernel_sock_shutdown(queue->sock, SHUT_RDWR);
377 else378 else
@@ -910,15 +911,11 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) · 532 unmodified lines
910 iov.iov_len = sizeof(*icresp);911 iov.iov_len = sizeof(*icresp);
911 ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);912 ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
912 if (ret < 0)913 if (ret < 0)
913 goto free_crypto;914 return ret; /* queue removal will cleanup */
914 915
915 queue->state = NVMET_TCP_Q_LIVE;916 queue->state = NVMET_TCP_Q_LIVE;
916 nvmet_prepare_receive_pdu(queue);917 nvmet_prepare_receive_pdu(queue);
917 return 0;918 return 0;
918free_crypto:
919 if (queue->hdr_digest || queue->data_digest)
920 nvmet_tcp_free_crypto(queue);
921 return ret;
922}919}
923 920
924static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,921static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t