[SRU,Artful] virtio_blk: Fix an SG_IO regression

Message ID 20171102172906.a7bvzzpr2iqpxszp@xps13.dannf
State New
Headers show
Series
  • [SRU,Artful] virtio_blk: Fix an SG_IO regression
Related show

Commit Message

dann frazier Nov. 2, 2017, 5:29 p.m.
From: Bart Van Assche <bart.vanassche@wdc.com>

BugLink: https://bugs.launchpad.net/bugs/1720229

Avoid that submitting an SG_IO ioctl triggers a kernel oops that
is preceded by:

usercopy: kernel memory overwrite attempt detected to (null) (<null>) (6 bytes)
kernel BUG at mm/usercopy.c:72!

Reported-by: Dann Frazier <dann.frazier@canonical.com>
Fixes: commit ca18d6f769d2 ("block: Make most scsi_req_init() calls implicit")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Dann Frazier <dann.frazier@canonical.com>
Cc: <stable@vger.kernel.org> # v4.13
Reviewed-by: Christoph Hellwig <hch@lst.de>

Moved virtblk_initialize_rq() inside CONFIG_VIRTIO_BLK_SCSI.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry picked from commit efea2abcb03215f2efadfe994ff7f652aaff196b)
Signed-off-by: dann frazier <dann.frazier@canonical.com>
---
 drivers/block/virtio_blk.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

Comments

Stefan Bader Nov. 13, 2017, 10:47 a.m. | #1
On 02.11.2017 18:29, dann frazier wrote:
> From: Bart Van Assche <bart.vanassche@wdc.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/1720229
> 
> Avoid that submitting an SG_IO ioctl triggers a kernel oops that
> is preceded by:
> 
> usercopy: kernel memory overwrite attempt detected to (null) (<null>) (6 bytes)
> kernel BUG at mm/usercopy.c:72!
> 
> Reported-by: Dann Frazier <dann.frazier@canonical.com>
> Fixes: commit ca18d6f769d2 ("block: Make most scsi_req_init() calls implicit")
> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Dann Frazier <dann.frazier@canonical.com>
> Cc: <stable@vger.kernel.org> # v4.13
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> 
> Moved virtblk_initialize_rq() inside CONFIG_VIRTIO_BLK_SCSI.
> 
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> (cherry picked from commit efea2abcb03215f2efadfe994ff7f652aaff196b)
> Signed-off-by: dann frazier <dann.frazier@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>

> ---
>  drivers/block/virtio_blk.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index d3d5523862c2..b49952b5a189 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -593,10 +593,22 @@ static int virtblk_map_queues(struct blk_mq_tag_set *set)
>  	return blk_mq_virtio_map_queues(set, vblk->vdev, 0);
>  }
>  
> +#ifdef CONFIG_VIRTIO_BLK_SCSI
> +static void virtblk_initialize_rq(struct request *req)
> +{
> +	struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
> +
> +	scsi_req_init(&vbr->sreq);
> +}
> +#endif
> +
>  static const struct blk_mq_ops virtio_mq_ops = {
>  	.queue_rq	= virtio_queue_rq,
>  	.complete	= virtblk_request_done,
>  	.init_request	= virtblk_init_request,
> +#ifdef CONFIG_VIRTIO_BLK_SCSI
> +	.initialize_rq_fn = virtblk_initialize_rq,
> +#endif
>  	.map_queues	= virtblk_map_queues,
>  };
>  
>
Kleber Souza Nov. 15, 2017, 1:15 p.m. | #2
On 11/02/17 18:29, dann frazier wrote:
> From: Bart Van Assche <bart.vanassche@wdc.com>
> 
> BugLink: https://bugs.launchpad.net/bugs/1720229
> 
> Avoid that submitting an SG_IO ioctl triggers a kernel oops that
> is preceded by:
> 
> usercopy: kernel memory overwrite attempt detected to (null) (<null>) (6 bytes)
> kernel BUG at mm/usercopy.c:72!
> 
> Reported-by: Dann Frazier <dann.frazier@canonical.com>
> Fixes: commit ca18d6f769d2 ("block: Make most scsi_req_init() calls implicit")
> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Dann Frazier <dann.frazier@canonical.com>
> Cc: <stable@vger.kernel.org> # v4.13
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> 
> Moved virtblk_initialize_rq() inside CONFIG_VIRTIO_BLK_SCSI.
> 
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> (cherry picked from commit efea2abcb03215f2efadfe994ff7f652aaff196b)
> Signed-off-by: dann frazier <dann.frazier@canonical.com>

Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

> ---
>  drivers/block/virtio_blk.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index d3d5523862c2..b49952b5a189 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -593,10 +593,22 @@ static int virtblk_map_queues(struct blk_mq_tag_set *set)
>  	return blk_mq_virtio_map_queues(set, vblk->vdev, 0);
>  }
>  
> +#ifdef CONFIG_VIRTIO_BLK_SCSI
> +static void virtblk_initialize_rq(struct request *req)
> +{
> +	struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
> +
> +	scsi_req_init(&vbr->sreq);
> +}
> +#endif
> +
>  static const struct blk_mq_ops virtio_mq_ops = {
>  	.queue_rq	= virtio_queue_rq,
>  	.complete	= virtblk_request_done,
>  	.init_request	= virtblk_init_request,
> +#ifdef CONFIG_VIRTIO_BLK_SCSI
> +	.initialize_rq_fn = virtblk_initialize_rq,
> +#endif
>  	.map_queues	= virtblk_map_queues,
>  };
>  
>
Stefan Bader Nov. 20, 2017, 10:33 a.m. | #3
On 02.11.2017 18:29, dann frazier wrote:
> From: Bart Van Assche <bart.vanassche@wdc.com>

This patch is already applied as part of the 4.13.12 upstream stable update.


> 
> BugLink: https://bugs.launchpad.net/bugs/1720229
> 
> Avoid that submitting an SG_IO ioctl triggers a kernel oops that
> is preceded by:
> 
> usercopy: kernel memory overwrite attempt detected to (null) (<null>) (6 bytes)
> kernel BUG at mm/usercopy.c:72!
> 
> Reported-by: Dann Frazier <dann.frazier@canonical.com>
> Fixes: commit ca18d6f769d2 ("block: Make most scsi_req_init() calls implicit")
> Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Dann Frazier <dann.frazier@canonical.com>
> Cc: <stable@vger.kernel.org> # v4.13
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> 
> Moved virtblk_initialize_rq() inside CONFIG_VIRTIO_BLK_SCSI.
> 
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> (cherry picked from commit efea2abcb03215f2efadfe994ff7f652aaff196b)
> Signed-off-by: dann frazier <dann.frazier@canonical.com>
> ---
>  drivers/block/virtio_blk.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index d3d5523862c2..b49952b5a189 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -593,10 +593,22 @@ static int virtblk_map_queues(struct blk_mq_tag_set *set)
>  	return blk_mq_virtio_map_queues(set, vblk->vdev, 0);
>  }
>  
> +#ifdef CONFIG_VIRTIO_BLK_SCSI
> +static void virtblk_initialize_rq(struct request *req)
> +{
> +	struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
> +
> +	scsi_req_init(&vbr->sreq);
> +}
> +#endif
> +
>  static const struct blk_mq_ops virtio_mq_ops = {
>  	.queue_rq	= virtio_queue_rq,
>  	.complete	= virtblk_request_done,
>  	.init_request	= virtblk_init_request,
> +#ifdef CONFIG_VIRTIO_BLK_SCSI
> +	.initialize_rq_fn = virtblk_initialize_rq,
> +#endif
>  	.map_queues	= virtblk_map_queues,
>  };
>  
>

Patch

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index d3d5523862c2..b49952b5a189 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -593,10 +593,22 @@  static int virtblk_map_queues(struct blk_mq_tag_set *set)
 	return blk_mq_virtio_map_queues(set, vblk->vdev, 0);
 }
 
+#ifdef CONFIG_VIRTIO_BLK_SCSI
+static void virtblk_initialize_rq(struct request *req)
+{
+	struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);
+
+	scsi_req_init(&vbr->sreq);
+}
+#endif
+
 static const struct blk_mq_ops virtio_mq_ops = {
 	.queue_rq	= virtio_queue_rq,
 	.complete	= virtblk_request_done,
 	.init_request	= virtblk_init_request,
+#ifdef CONFIG_VIRTIO_BLK_SCSI
+	.initialize_rq_fn = virtblk_initialize_rq,
+#endif
 	.map_queues	= virtblk_map_queues,
 };