linux.git/drivers/block/loop.c, branch v3.18.128

loop: remember whether sysfs_create_group() was done

2018-07-22T11:43:24+00:00

commit d3349b6b3c373ac1fbfb040b810fcee5e2adc7e0 upstream.

syzbot is hitting WARN() triggered by memory allocation fault
injection [1] because loop module is calling sysfs_remove_group()
when sysfs_create_group() failed.
Fix this by remembering whether sysfs_create_group() succeeded.

[1] https://syzkaller.appspot.com/bug?id=3f86c0edf75c86d2633aeb9dd69eccc70bc7e90b

Signed-off-by: Tetsuo Handa 
Reported-by: syzbot 
Reviewed-by: Greg Kroah-Hartman 

Renamed sysfs_ready -> sysfs_inited.

Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: add recursion validation to LOOP_CHANGE_FD

2018-07-22T11:43:24+00:00

commit d2ac838e4cd7e5e9891ecc094d626734b0245c99 upstream.

Refactor the validation code used in LOOP_SET_FD so it is also used in
LOOP_CHANGE_FD.  Otherwise it is possible to construct a set of loop
devices that all refer to each other.  This can lead to a infinite
loop in starting with "while (is_loop_device(f)) .." in loop_set_fd().

Fix this by refactoring out the validation code and using it for
LOOP_CHANGE_FD as well as LOOP_SET_FD.

Reported-by: syzbot+4349872271ece473a7c91190b68b4bac7c5dbc87@syzkaller.appspotmail.com
Reported-by: syzbot+40bd32c4d9a3cc12a339@syzkaller.appspotmail.com
Reported-by: syzbot+769c54e66f994b041be7@syzkaller.appspotmail.com
Reported-by: syzbot+0a89a9ce473936c57065@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: fix concurrent lo_open/lo_release

2018-02-07T19:07:54+00:00

commit ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 upstream.

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jens Axboe 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'sched/urgent' into sched/core, to avoid conflicts

2014-05-07T11:15:46+00:00

Signed-off-by: Ingo Molnar

sched, treewide: Replace hardcoded nice values with MIN_NICE/MAX_NICE

2014-04-18T10:07:24+00:00

Replace various -20/+19 hardcoded nice values with MIN_NICE/MAX_NICE.

Signed-off-by: Dongsheng Yang 
Acked-by: Tejun Heo 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/ff13819fd09b7a5dba5ab5ae797f2e7019bdfa17.1394532288.git.yangds.fnst@cn.fujitsu.com
Cc: devel@driverdev.osuosl.org
Cc: devicetree@vger.kernel.org
Cc: fcoe-devel@open-fcoe.org
Cc: linux390@de.ibm.com
Cc: linux-kernel@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: linux-s390@vger.kernel.org
Cc: linux-scsi@vger.kernel.org
Cc: nbd-general@lists.sourceforge.net
Cc: ocfs2-devel@oss.oracle.com
Cc: openipmi-developer@lists.sourceforge.net
Cc: qla2xxx-upstream@qlogic.com
Cc: linux-arch@vger.kernel.org
[ Consolidated the patches, twiddled the changelog. ]
Signed-off-by: Ingo Molnar

drivers/block/loop.c: ratelimit error messages

2014-04-08T20:44:35+00:00

Metric tons of high speed spew is not helpful when things go pear shaped.
systemd lost its mind, forgot how to stop services it insists on being
sole manager of, massive printk() flood ensued, box eventually died.

[16206.684000] loop: Write error at byte offset 11412291584, length 4096.
[16206.684000] systemd-journald[1758]: /dev/kmsg buffer overrun, some messages lost.
[16206.684000] loop: Write error at byte offset 13155434496, length 4096.
[16206.684000] loop: Write error at byte offset 13155438592, length 4096.
[16206.684000] loop: Write error at byte offset 13155442688, length 4096.
[16206.684000] loop: Write error at byte offset 13960736768, length 4096.
[16206.684000] loop: Write error at byte offset 14229172224, length 4096.
[16206.684000] systemd-journald[1758]: /dev/kmsg buffer overrun, some messages lost.
[16206.684000] loop: Write error at byte offset 14766043136, length 4096.
[16206.684000] loop: Write error at byte offset 15034478592, length 4096.
[16206.684000] systemd-journald[1758]: /dev/kmsg buffer overrun, some messages lost.

Signed-off-by: Mike Galbraith 
Cc: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Jens Axboe

drivers/block/loop.c: fix comment typo in loop_config_discard

2014-01-22T04:16:56+00:00

Discard requests are ignored if the encryption is enabled for the given
loop device.  Update comment to match the code, and similar comments
elsewhere in the file.

Signed-off-by: Olaf Hering 
Signed-off-by: Andrew Morton 
Signed-off-by: Jens Axboe

block: Convert bio_for_each_segment() to bvec_iter

2013-11-24T06:33:49+00:00

More prep work for immutable biovecs - with immutable bvecs drivers
won't be able to use the biovec directly, they'll need to use helpers
that take into account bio->bi_iter.bi_bvec_done.

This updates callers for the new usage without changing the
implementation yet.

Signed-off-by: Kent Overstreet 
Cc: Jens Axboe 
Cc: Geert Uytterhoeven 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Cc: "Ed L. Cashin" 
Cc: Nick Piggin 
Cc: Lars Ellenberg 
Cc: Jiri Kosina 
Cc: Paul Clements 
Cc: Jim Paris 
Cc: Geoff Levand 
Cc: Yehuda Sadeh 
Cc: Sage Weil 
Cc: Alex Elder 
Cc: ceph-devel@vger.kernel.org
Cc: Joshua Morris 
Cc: Philip Kelleher 
Cc: Konrad Rzeszutek Wilk 
Cc: Jeremy Fitzhardinge 
Cc: Neil Brown 
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: linux390@de.ibm.com
Cc: Nagalakshmi Nandigama 
Cc: Sreekanth Reddy 
Cc: support@lsi.com
Cc: "James E.J. Bottomley" 
Cc: Greg Kroah-Hartman 
Cc: Alexander Viro 
Cc: Steven Whitehouse 
Cc: Herton Ronaldo Krzesinski 
Cc: Tejun Heo 
Cc: Andrew Morton 
Cc: Guo Chao 
Cc: Asai Thambi S P 
Cc: Selvan Mani 
Cc: Sam Bradshaw 
Cc: Matthew Wilcox 
Cc: Keith Busch 
Cc: Stephen Hemminger 
Cc: Quoc-Son Anh 
Cc: Sebastian Ott 
Cc: Nitin Gupta 
Cc: Minchan Kim 
Cc: Jerome Marchand 
Cc: Seth Jennings 
Cc: "Martin K. Petersen" 
Cc: Mike Snitzer 
Cc: Vivek Goyal 
Cc: "Darrick J. Wong" 
Cc: Chris Metcalf 
Cc: Jan Kara 
Cc: linux-m68k@lists.linux-m68k.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: drbd-user@lists.linbit.com
Cc: nbd-general@lists.sourceforge.net
Cc: cbe-oss-dev@lists.ozlabs.org
Cc: xen-devel@lists.xensource.com
Cc: virtualization@lists.linux-foundation.org
Cc: linux-raid@vger.kernel.org
Cc: linux-s390@vger.kernel.org
Cc: DL-MPTFusionLinux@lsi.com
Cc: linux-scsi@vger.kernel.org
Cc: devel@driverdev.osuosl.org
Cc: linux-fsdevel@vger.kernel.org
Cc: cluster-devel@redhat.com
Cc: linux-mm@kvack.org
Acked-by: Geoff Levand

block: Abstract out bvec iterator

2013-11-24T06:33:47+00:00

Immutable biovecs are going to require an explicit iterator. To
implement immutable bvecs, a later patch is going to add a bi_bvec_done
member to this struct; for now, this patch effectively just renames
things.

Signed-off-by: Kent Overstreet 
Cc: Jens Axboe 
Cc: Geert Uytterhoeven 
Cc: Benjamin Herrenschmidt 
Cc: Paul Mackerras 
Cc: "Ed L. Cashin" 
Cc: Nick Piggin 
Cc: Lars Ellenberg 
Cc: Jiri Kosina 
Cc: Matthew Wilcox 
Cc: Geoff Levand 
Cc: Yehuda Sadeh 
Cc: Sage Weil 
Cc: Alex Elder 
Cc: ceph-devel@vger.kernel.org
Cc: Joshua Morris 
Cc: Philip Kelleher 
Cc: Rusty Russell 
Cc: "Michael S. Tsirkin" 
Cc: Konrad Rzeszutek Wilk 
Cc: Jeremy Fitzhardinge 
Cc: Neil Brown 
Cc: Alasdair Kergon 
Cc: Mike Snitzer 
Cc: dm-devel@redhat.com
Cc: Martin Schwidefsky 
Cc: Heiko Carstens 
Cc: linux390@de.ibm.com
Cc: Boaz Harrosh 
Cc: Benny Halevy 
Cc: "James E.J. Bottomley" 
Cc: Greg Kroah-Hartman 
Cc: "Nicholas A. Bellinger" 
Cc: Alexander Viro 
Cc: Chris Mason 
Cc: "Theodore Ts'o" 
Cc: Andreas Dilger 
Cc: Jaegeuk Kim 
Cc: Steven Whitehouse 
Cc: Dave Kleikamp 
Cc: Joern Engel 
Cc: Prasad Joshi 
Cc: Trond Myklebust 
Cc: KONISHI Ryusuke 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: Ben Myers 
Cc: xfs@oss.sgi.com
Cc: Steven Rostedt 
Cc: Frederic Weisbecker 
Cc: Ingo Molnar 
Cc: Len Brown 
Cc: Pavel Machek 
Cc: "Rafael J. Wysocki" 
Cc: Herton Ronaldo Krzesinski 
Cc: Ben Hutchings 
Cc: Andrew Morton 
Cc: Guo Chao 
Cc: Tejun Heo 
Cc: Asai Thambi S P 
Cc: Selvan Mani 
Cc: Sam Bradshaw 
Cc: Wei Yongjun 
Cc: "Roger Pau Monné" 
Cc: Jan Beulich 
Cc: Stefano Stabellini 
Cc: Ian Campbell 
Cc: Sebastian Ott 
Cc: Christian Borntraeger 
Cc: Minchan Kim 
Cc: Jiang Liu 
Cc: Nitin Gupta 
Cc: Jerome Marchand 
Cc: Joe Perches 
Cc: Peng Tao 
Cc: Andy Adamson 
Cc: fanchaoting 
Cc: Jie Liu 
Cc: Sunil Mushran 
Cc: "Martin K. Petersen" 
Cc: Namjae Jeon 
Cc: Pankaj Kumar 
Cc: Dan Magenheimer 
Cc: Mel Gorman 6

loop: fix crash when using unassigned loop device

2013-11-08T16:10:28+00:00

When the loop module is loaded, it creates 8 loop devices /dev/loop[0-7].
The devices have no request routine and thus, when they are used without
being assigned, a crash happens.

For example, these commands cause crash (assuming there are no used loop
devices):

Kernel Fault: Code=26 regs=000000007f420980 (Addr=0000000000000010)
CPU: 1 PID: 50 Comm: kworker/1:1 Not tainted 3.11.0 #1
Workqueue: ksnaphd do_metadata [dm_snapshot]
task: 000000007fcf4078 ti: 000000007f420000 task.ti: 000000007f420000
[  116.319988]
     YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00001000000001001111111100001111 Not tainted
r00-03  000000ff0804ff0f 00000000408bf5d0 00000000402d8204 000000007b7ff6c0
r04-07  00000000408a95d0 000000007f420950 000000007b7ff6c0 000000007d06c930
r08-11  000000007f4205c0 0000000000000001 000000007f4205c0 000000007f4204b8
r12-15  0000000000000010 0000000000000000 0000000000000000 0000000000000000
r16-19  000000001108dd48 000000004061cd7c 000000007d859800 000000000800000f
r20-23  0000000000000000 0000000000000008 0000000000000000 0000000000000000
r24-27  00000000ffffffff 000000007b7ff6c0 000000007d859800 00000000408a95d0
r28-31  0000000000000000 000000007f420950 000000007f420980 000000007f4208e8
sr00-03  0000000000000000 0000000000000000 0000000000000000 0000000000303000
sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000
[  117.549988]
IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000402d82fc 00000000402d8300
 IIR: 53820020    ISR: 0000000000000000  IOR: 0000000000000010
 CPU:        1   CR30: 000000007f420000 CR31: ffffffffffffffff
 ORIG_R28: 0000000000000001
 IAOQ[0]: generic_make_request+0x11c/0x1a0
 IAOQ[1]: generic_make_request+0x120/0x1a0
 RP(r2): generic_make_request+0x24/0x1a0
Backtrace:
 [<00000000402d83f0>] submit_bio+0x70/0x140
 [<0000000011087c4c>] dispatch_io+0x234/0x478 [dm_mod]
 [<0000000011087f44>] sync_io+0xb4/0x190 [dm_mod]
 [<00000000110883bc>] dm_io+0x2c4/0x310 [dm_mod]
 [<00000000110bfcd0>] do_metadata+0x28/0xb0 [dm_snapshot]
 [<00000000401591d8>] process_one_work+0x160/0x460
 [<0000000040159bc0>] worker_thread+0x300/0x478
 [<0000000040161a70>] kthread+0x118/0x128
 [<0000000040104020>] end_fault_vector+0x20/0x28
 [<0000000040177220>] task_tick_fair+0x420/0x4d0
 [<00000000401aa048>] invoke_rcu_core+0x50/0x60
 [<00000000401ad5b8>] rcu_check_callbacks+0x210/0x8d8
 [<000000004014aaa0>] update_process_times+0xa8/0xc0
 [<00000000401ab86c>] rcu_process_callbacks+0x4b4/0x598
 [<0000000040142408>] __do_softirq+0x250/0x2c0
 [<00000000401789d0>] find_busiest_group+0x3c0/0xc70
[  119.379988]
Kernel panic - not syncing: Kernel Fault
Rebooting in 1 seconds..

Signed-off-by: Mikulas Patocka 
Cc: stable@kernel.org
Signed-off-by: Jens Axboe