linux.git/drivers/block/loop.c, branch v4.14.30

loop: Fix lost writes caused by missing flag

2018-03-15T09:54:32+00:00

commit 1d037577c323e5090ce281e96bc313ab2eee5be2 upstream.

The following commit:

commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")

replaced __do_lo_send_write(), which used ITER_KVEC iterators, with
lo_write_bvec() which uses ITER_BVEC iterators.  In this change, though,
the WRITE flag was lost:

-       iov_iter_kvec(&from, ITER_KVEC | WRITE, &kvec, 1, len);
+       iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);

This flag is necessary for the DAX case because we make decisions based on
whether or not the iterator is a READ or a WRITE in dax_iomap_actor() and
in dax_iomap_rw().

We end up going through this path in configurations where we combine a PMEM
device with 4k sectors, a loopback device and DAX.  The consequence of this
missed flag is that what we intend as a write actually turns into a read in
the DAX code, so no data is ever written.

The very simplest test case is to create a loopback device and try and
write a small string to it, then hexdump a few bytes of the device to see
if the write took.  Without this patch you read back all zeros, with this
you read back the string you wrote.

For XFS this causes us to fail or panic during the following xfstests:

	xfs/074 xfs/078 xfs/216 xfs/217 xfs/250

For ext4 we have a similar issue where writes never happen, but we don't
currently have any xfstests that use loopback and show this issue.

Fix this by restoring the WRITE flag argument to iov_iter_bvec().  This
causes the xfstests to all pass.

Cc: Al Viro 
Cc: stable@vger.kernel.org
Fixes: commit aa4d86163e4e ("block: loop: switch to VFS ITER_BVEC")
Reviewed-by: Christoph Hellwig 
Reviewed-by: Ming Lei 
Signed-off-by: Ross Zwisler 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

loop: fix concurrent lo_open/lo_release

2018-02-03T16:38:47+00:00

commit ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 upstream.

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jens Axboe 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

loop: set physical block size to logical block size

2017-09-06T17:08:49+00:00

Commit 6c6b6f28b333 ("loop: set physical block size to PAGE_SIZE")
caused mkfs.xfs to barf on ppc64 [1]. Always using PAGE_SIZE as the
physical block size still makes the most sense semantically, but let's
just lie and always set it to the same value as the logical block size
(same goes for io_min). In the future we might want to at least bump up
io_min to PAGE_SIZE but I'm sick of these stupid changes so let's play
it safe.

1: https://marc.info/?l=linux-xfs&m=150459024723753&w=2

Tested-by: Chandan Rajendra 
Signed-off-by: Omar Sandoval 
Signed-off-by: Jens Axboe

block/loop: fix use after free

2017-09-01T19:57:33+00:00

lo_rw_aio->call_read_iter->
1       aops->direct_IO
2       iov_iter_revert
lo_rw_aio_complete could happen between 1 and 2, the bio and bvec could
be freed before 2, which accesses bvec.

Signed-off-by: Shaohua Li 
Signed-off-by: Jens Axboe

block/loop: allow request merge for directio mode

2017-09-01T14:44:34+00:00

Currently loop disables merge. While it makes sense for buffer IO mode,
directio mode can benefit from request merge. Without merge, loop could
send small size IO to underlayer disk and harm performance.

Reviewed-by: Omar Sandoval 
Signed-off-by: Shaohua Li 
Signed-off-by: Jens Axboe

block/loop: set hw_sectors

2017-09-01T14:44:32+00:00

Loop can handle any size of request. Limiting it to 255 sectors just
burns the CPU for bio split and request merge for underlayer disk and
also cause bad fs block allocation in directio mode.

Reviewed-by: Omar Sandoval 
Reviewed-by: Ming Lei 
Signed-off-by: Shaohua Li 
Signed-off-by: Jens Axboe

loop: fold loop_switch() into callers

2017-08-31T19:51:16+00:00

The comments here are really outdated, and blk-mq made flushing much
simpler, so just fold the two cases into the callers.

Reviewed-by: Ming Lei 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Omar Sandoval 
Signed-off-by: Jens Axboe

loop: add ioctl for changing logical block size

2017-08-31T19:51:14+00:00

This is a different approach from the first attempt in f2c6df7dbf9a
("loop: support 4k physical blocksize"). Rather than extending
LOOP_{GET,SET}_STATUS, add a separate ioctl just for setting the block
size.

Reviewed-by: Ming Lei 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Omar Sandoval 
Signed-off-by: Jens Axboe

loop: set physical block size to PAGE_SIZE

2017-08-31T19:51:12+00:00

The physical block size is "the lowest possible sector size that the
hardware can operate on without reverting to read-modify-write
operations" (from the comment on blk_queue_physical_block_size()). Since
loop does buffered I/O on the backing file by default, the RMW unit is a
page. This isn't the case for direct I/O mode, but let's keep it simple.

Reviewed-by: Ming Lei 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Omar Sandoval 
Signed-off-by: Jens Axboe

loop: get rid of lo_blocksize

2017-08-31T19:51:10+00:00

This is only used for setting the soft block size on the struct
block_device once and then never used again.

Reviewed-by: Ming Lei 
Reviewed-by: Hannes Reinecke 
Signed-off-by: Omar Sandoval 
Signed-off-by: Jens Axboe