Pull device mapper fixes from Mike Snitzer: - Fix DM core retrieve_deps() UAF race due to missing locking of a DM table's list of devices that is managed using dm_{get,put}_device. - Revert DM core's half-baked RCU optimization if IO submitter has set REQ_NOWAIT. Can be revisited, and properly justified, after comprehensively auditing all of DM to also pass GFP_NOWAIT for any allocations if REQ_NOWAIT used. * tag 'for-6.6/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: don't attempt to queue IO under RCU protection dm: fix a race condition in retrieve_deps
Unified · Split
| @@ -214,6 +214,7 @@ struct dm_table { · 213 unmodified lines | ||
| 214 | 214 | |
| 215 | 215 | /* a list of devices used by this table */ |
| 216 | 216 | struct list_head devices; |
| 217 | + struct rw_semaphore devices_lock; | |
| 217 | 218 | |
| 218 | 219 | /* events get handed up using this callback */ |
| 219 | 220 | void (*event_fn)(void *data); |
| @@ -1630,6 +1630,8 @@ static void retrieve_deps(struct dm_table *table, · 1629 unmodified lines | ||
| 1630 | 1630 | struct dm_dev_internal *dd; |
| 1631 | 1631 | struct dm_target_deps *deps; |
| 1632 | 1632 | |
| 1633 | + down_read(&table->devices_lock); | |
| 1634 | + | |
| 1633 | 1635 | deps = get_result_buffer(param, param_size, &len); |
| 1634 | 1636 | |
| 1635 | 1637 | /* |
| @@ -1644,7 +1646,7 @@ static void retrieve_deps(struct dm_table *table, · 8 unmodified lines | ||
| 1644 | 1646 | needed = struct_size(deps, dev, count); |
| 1645 | 1647 | if (len < needed) { |
| 1646 | 1648 | param->flags |= DM_BUFFER_FULL_FLAG; |
| 1647 | − return; | |
| 1649 | + goto out; | |
| 1648 | 1650 | } |
| 1649 | 1651 | |
| 1650 | 1652 | /* |
| @@ -1656,6 +1658,9 @@ static void retrieve_deps(struct dm_table *table, · 5 unmodified lines | ||
| 1656 | 1658 | deps->dev[count++] = huge_encode_dev(dd->dm_dev->bdev->bd_dev); |
| 1657 | 1659 | |
| 1658 | 1660 | param->data_size = param->data_start + needed; |
| 1661 | + | |
| 1662 | +out: | |
| 1663 | + up_read(&table->devices_lock); | |
| 1659 | 1664 | } |
| 1660 | 1665 | |
| 1661 | 1666 | static int table_deps(struct file *filp, struct dm_ioctl *param, size_t param_size) |
| @@ -135,6 +135,7 @@ int dm_table_create(struct dm_table **result, blk_mode_t mode, · 134 unmodified lines | ||
| 135 | 135 | return -ENOMEM; |
| 136 | 136 | |
| 137 | 137 | INIT_LIST_HEAD(&t->devices); |
| 138 | + init_rwsem(&t->devices_lock); | |
| 138 | 139 | |
| 139 | 140 | if (!num_targets) |
| 140 | 141 | num_targets = KEYS_PER_NODE; |
| @@ -359,16 +360,20 @@ int __ref dm_get_device(struct dm_target *ti, const char *path, blk_mode_t mode, · 218 unmodified lines | ||
| 359 | 360 | if (dev == disk_devt(t->md->disk)) |
| 360 | 361 | return -EINVAL; |
| 361 | 362 | |
| 363 | + down_write(&t->devices_lock); | |
| 364 | + | |
| 362 | 365 | dd = find_device(&t->devices, dev); |
| 363 | 366 | if (!dd) { |
| 364 | 367 | dd = kmalloc(sizeof(*dd), GFP_KERNEL); |
| 365 | − if (!dd) | |
| 366 | − return -ENOMEM; | |
| 368 | + if (!dd) { | |
| 369 | + r = -ENOMEM; | |
| 370 | + goto unlock_ret_r; | |
| 371 | + } | |
| 367 | 372 | |
| 368 | 373 | r = dm_get_table_device(t->md, dev, mode, &dd->dm_dev); |
| 369 | 374 | if (r) { |
| 370 | 375 | kfree(dd); |
| 371 | − return r; | |
| 376 | + goto unlock_ret_r; | |
| 372 | 377 | } |
| 373 | 378 | |
| 374 | 379 | refcount_set(&dd->count, 1); |
| @@ -378,12 +383,17 @@ int __ref dm_get_device(struct dm_target *ti, const char *path, blk_mode_t mode, · 3 unmodified lines | ||
| 378 | 383 | } else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) { |
| 379 | 384 | r = upgrade_mode(dd, mode, t->md); |
| 380 | 385 | if (r) |
| 381 | − return r; | |
| 386 | + goto unlock_ret_r; | |
| 382 | 387 | } |
| 383 | 388 | refcount_inc(&dd->count); |
| 384 | 389 | out: |
| 390 | + up_write(&t->devices_lock); | |
| 385 | 391 | *result = dd->dm_dev; |
| 386 | 392 | return 0; |
| 393 | + | |
| 394 | +unlock_ret_r: | |
| 395 | + up_write(&t->devices_lock); | |
| 396 | + return r; | |
| 387 | 397 | } |
| 388 | 398 | EXPORT_SYMBOL(dm_get_device); |
| 389 | 399 | |
| @@ -419,9 +429,12 @@ static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev, · 29 unmodified lines | ||
| 419 | 429 | void dm_put_device(struct dm_target *ti, struct dm_dev *d) |
| 420 | 430 | { |
| 421 | 431 | int found = 0; |
| 422 | − struct list_head *devices = &ti->table->devices; | |
| 432 | + struct dm_table *t = ti->table; | |
| 433 | + struct list_head *devices = &t->devices; | |
| 423 | 434 | struct dm_dev_internal *dd; |
| 424 | 435 | |
| 436 | + down_write(&t->devices_lock); | |
| 437 | + | |
| 425 | 438 | list_for_each_entry(dd, devices, list) { |
| 426 | 439 | if (dd->dm_dev == d) { |
| 427 | 440 | found = 1; |
| @@ -430,14 +443,17 @@ void dm_put_device(struct dm_target *ti, struct dm_dev *d) · 2 unmodified lines | ||
| 430 | 443 | } |
| 431 | 444 | if (!found) { |
| 432 | 445 | DMERR("%s: device %s not in table devices list", |
| 433 | − dm_device_name(ti->table->md), d->name); | |
| 434 | − return; | |
| 446 | + dm_device_name(t->md), d->name); | |
| 447 | + goto unlock_ret; | |
| 435 | 448 | } |
| 436 | 449 | if (refcount_dec_and_test(&dd->count)) { |
| 437 | − dm_put_table_device(ti->table->md, d); | |
| 450 | + dm_put_table_device(t->md, d); | |
| 438 | 451 | list_del(&dd->list); |
| 439 | 452 | kfree(dd); |
| 440 | 453 | } |
| 454 | + | |
| 455 | +unlock_ret: | |
| 456 | + up_write(&t->devices_lock); | |
| 441 | 457 | } |
| 442 | 458 | EXPORT_SYMBOL(dm_put_device); |
| 443 | 459 | |
| @@ -715,24 +715,6 @@ static void dm_put_live_table_fast(struct mapped_device *md) __releases(RCU) · 714 unmodified lines | ||
| 715 | 715 | rcu_read_unlock(); |
| 716 | 716 | } |
| 717 | 717 | |
| 718 | −static inline struct dm_table *dm_get_live_table_bio(struct mapped_device *md, | |
| 719 | − int *srcu_idx, blk_opf_t bio_opf) | |
| 720 | −{ | |
| 721 | − if (bio_opf & REQ_NOWAIT) | |
| 722 | − return dm_get_live_table_fast(md); | |
| 723 | − else | |
| 724 | − return dm_get_live_table(md, srcu_idx); | |
| 725 | −} | |
| 726 | − | |
| 727 | −static inline void dm_put_live_table_bio(struct mapped_device *md, int srcu_idx, | |
| 728 | − blk_opf_t bio_opf) | |
| 729 | −{ | |
| 730 | − if (bio_opf & REQ_NOWAIT) | |
| 731 | − dm_put_live_table_fast(md); | |
| 732 | − else | |
| 733 | − dm_put_live_table(md, srcu_idx); | |
| 734 | −} | |
| 735 | − | |
| 736 | 718 | static char *_dm_claim_ptr = "I belong to device-mapper"; |
| 737 | 719 | |
| 738 | 720 | /* |
| @@ -1833,9 +1815,8 @@ static void dm_submit_bio(struct bio *bio) · 1094 unmodified lines | ||
| 1833 | 1815 | struct mapped_device *md = bio->bi_bdev->bd_disk->private_data; |
| 1834 | 1816 | int srcu_idx; |
| 1835 | 1817 | struct dm_table *map; |
| 1836 | − blk_opf_t bio_opf = bio->bi_opf; | |
| 1837 | 1818 | |
| 1838 | − map = dm_get_live_table_bio(md, &srcu_idx, bio_opf); | |
| 1819 | + map = dm_get_live_table(md, &srcu_idx); | |
| 1839 | 1820 | |
| 1840 | 1821 | /* If suspended, or map not yet available, queue this IO for later */ |
| 1841 | 1822 | if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) || |
| @@ -1851,7 +1832,7 @@ static void dm_submit_bio(struct bio *bio) · 9 unmodified lines | ||
| 1851 | 1832 | |
| 1852 | 1833 | dm_split_and_process_bio(md, map, bio); |
| 1853 | 1834 | out: |
| 1854 | − dm_put_live_table_bio(md, srcu_idx, bio_opf); | |
| 1835 | + dm_put_live_table(md, srcu_idx); | |
| 1855 | 1836 | } |
| 1856 | 1837 | |
| 1857 | 1838 | static bool dm_poll_dm_io(struct dm_io *io, struct io_comp_batch *iob, |