Jens,
Any comment on this patch ?
Note: I tagged the patch with
Fixes: 49f6613632f9 ("nullb: remove leftover legacy request code")
but it the correct tag should probably be:
Fixes: e50b1e327aeb ("null_blk: remove legacy IO path")
On 2019/01/28 8:56, Damien Le Moal wrote:
> When null_blk queue mode is specified together with modprobe/insmod, a
> check to prevent setting the nullb device queue mode to 1 (NULL_Q_RQ) is
> done. However, the same check is not performed when setting up a nullb
> device through configfs, resulting in a oops (NULL pointer dereference
> for the device request queue).
>
> Fix this problem by checking for an invalid queue mode value in
> null_validate_conf(), propagating -EINVAL to null_add_dev() if the queue
> mode is NULL_Q_RQ. While at it, also fix the propagation to user space
> of null_add_dev() return value when a nullb device is created through
> configfs power attribute.
>
> Finally, remove the "1=rq" value from the list of possible values for
> the queue_mode attribute/module argument to make it clear that this is
> no longer a valid setting.
>
> Fixes: 49f6613632f9 ("nullb: remove leftover legacy request code")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Damien Le Moal <damien.lemoal@xxxxxxx>
> ---
>
> Changes from v1:
> * Removed reference to rq mode from queue_mode description
>
> drivers/block/null_blk_main.c | 24 ++++++++++++++++++------
> 1 file changed, 18 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
> index 62c9654b9ce8..155dcef3b21a 100644
> --- a/drivers/block/null_blk_main.c
> +++ b/drivers/block/null_blk_main.c
> @@ -130,7 +130,7 @@ static const struct kernel_param_ops null_queue_mode_param_ops = {
> };
>
> device_param_cb(queue_mode, &null_queue_mode_param_ops, &g_queue_mode, 0444);
> -MODULE_PARM_DESC(queue_mode, "Block interface to use (0=bio,1=rq,2=multiqueue)");
> +MODULE_PARM_DESC(queue_mode, "Block interface to use (0=bio,2=multiqueue)");
>
> static int g_gb = 250;
> module_param_named(gb, g_gb, int, 0444);
> @@ -318,9 +318,10 @@ static ssize_t nullb_device_power_store(struct config_item *item,
> if (!dev->power && newp) {
> if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags))
> return count;
> - if (null_add_dev(dev)) {
> + ret = null_add_dev(dev);
> + if (ret) {
> clear_bit(NULLB_DEV_FL_UP, &dev->flags);
> - return -ENOMEM;
> + return ret;
> }
>
> set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
> @@ -1561,8 +1562,13 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set)
> return blk_mq_alloc_tag_set(set);
> }
>
> -static void null_validate_conf(struct nullb_device *dev)
> +static int null_validate_conf(struct nullb_device *dev)
> {
> + if (dev->queue_mode == NULL_Q_RQ) {
> + pr_err("null_blk: legacy IO path no longer available\n");
> + return -EINVAL;
> + }
> +
> dev->blocksize = round_down(dev->blocksize, 512);
> dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096);
>
> @@ -1588,6 +1594,8 @@ static void null_validate_conf(struct nullb_device *dev)
> /* can not stop a queue */
> if (dev->queue_mode == NULL_Q_BIO)
> dev->mbps = 0;
> +
> + return 0;
> }
>
> #ifdef CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION
> @@ -1620,7 +1628,9 @@ static int null_add_dev(struct nullb_device *dev)
> struct nullb *nullb;
> int rv;
>
> - null_validate_conf(dev);
> + rv = null_validate_conf(dev);
> + if (rv)
> + goto out;
>
> nullb = kzalloc_node(sizeof(*nullb), GFP_KERNEL, dev->home_node);
> if (!nullb) {
> @@ -1648,8 +1658,10 @@ static int null_add_dev(struct nullb_device *dev)
> if (rv)
> goto out_cleanup_queues;
>
> - if (!null_setup_fault())
> + if (!null_setup_fault()) {
> + rv = -EINVAL;
> goto out_cleanup_queues;
> + }
>
> nullb->tag_set->timeout = 5 * HZ;
> nullb->q = blk_mq_init_queue(nullb->tag_set);
>
--
Damien Le Moal
Western Digital Research
