linux-toradex.git/drivers/memstick, branch v5.14 Linux kernel for Apalis and Colibri modules Merge tag 'for-5.14/block-2021-06-29' of git://git.kernel.dk/linux-block 2021-06-30T19:12:56+00:00 Linus Torvalds torvalds@linux-foundation.org 2021-06-30T19:12:56+00:00 df668a5fe461bb9d7e899c538acc7197746038f4 Pull core block updates from Jens Axboe: - disk events cleanup (Christoph) - gendisk and request queue allocation simplifications (Christoph) - bdev_disk_changed cleanups (Christoph) - IO priority improvements (Bart) - Chained bio completion trace fix (Edward) - blk-wbt fixes (Jan) - blk-wbt enable/disable fix (Zhang) - Scheduler dispatch improvements (Jan, Ming) - Shared tagset scheduler improvements (John) - BFQ updates (Paolo, Luca, Pietro) - BFQ lock inversion fix (Jan) - Documentation improvements (Kir) - CLONE_IO block cgroup fix (Tejun) - Remove of ancient and deprecated block dump feature (zhangyi) - Discard merge fix (Ming) - Misc fixes or followup fixes (Colin, Damien, Dan, Long, Max, Thomas, Yang) * tag 'for-5.14/block-2021-06-29' of git://git.kernel.dk/linux-block: (129 commits) block: fix discard request merge block/mq-deadline: Remove a WARN_ON_ONCE() call blk-mq: update hctx->dispatch_busy in case of real scheduler blk: Fix lock inversion between ioc lock and bfqd lock bfq: Remove merged request already in bfq_requests_merged() block: pass a gendisk to bdev_disk_changed block: move bdev_disk_changed block: add the events* attributes to disk_attrs block: move the disk events code to a separate file block: fix trace completion for chained bio block/partitions/msdos: Fix typo inidicator -> indicator block, bfq: reset waker pointer with shared queues block, bfq: check waker only for queues with no in-flight I/O block, bfq: avoid delayed merge of async queues block, bfq: boost throughput by extending queue-merging times block, bfq: consider also creation time in delayed stable merge block, bfq: fix delayed stable merge check block, bfq: let also stably merged queues enjoy weight raising blk-wbt: make sure throttle is enabled properly blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() ... 
Pull core block updates from Jens Axboe:

 - disk events cleanup (Christoph)

 - gendisk and request queue allocation simplifications (Christoph)

 - bdev_disk_changed cleanups (Christoph)

 - IO priority improvements (Bart)

 - Chained bio completion trace fix (Edward)

 - blk-wbt fixes (Jan)

 - blk-wbt enable/disable fix (Zhang)

 - Scheduler dispatch improvements (Jan, Ming)

 - Shared tagset scheduler improvements (John)

 - BFQ updates (Paolo, Luca, Pietro)

 - BFQ lock inversion fix (Jan)

 - Documentation improvements (Kir)

 - CLONE_IO block cgroup fix (Tejun)

 - Remove of ancient and deprecated block dump feature (zhangyi)

 - Discard merge fix (Ming)

 - Misc fixes or followup fixes (Colin, Damien, Dan, Long, Max, Thomas,
   Yang)

* tag 'for-5.14/block-2021-06-29' of git://git.kernel.dk/linux-block: (129 commits)
  block: fix discard request merge
  block/mq-deadline: Remove a WARN_ON_ONCE() call
  blk-mq: update hctx->dispatch_busy in case of real scheduler
  blk: Fix lock inversion between ioc lock and bfqd lock
  bfq: Remove merged request already in bfq_requests_merged()
  block: pass a gendisk to bdev_disk_changed
  block: move bdev_disk_changed
  block: add the events* attributes to disk_attrs
  block: move the disk events code to a separate file
  block: fix trace completion for chained bio
  block/partitions/msdos: Fix typo inidicator -> indicator
  block, bfq: reset waker pointer with shared queues
  block, bfq: check waker only for queues with no in-flight I/O
  block, bfq: avoid delayed merge of async queues
  block, bfq: boost throughput by extending queue-merging times
  block, bfq: consider also creation time in delayed stable merge
  block, bfq: fix delayed stable merge check
  block, bfq: let also stably merged queues enjoy weight raising
  blk-wbt: make sure throttle is enabled properly
  blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled()
  ...
memstick: rtsx_usb_ms: fix UAF 2021-06-14T11:57:39+00:00 Tong Zhang ztong0001@gmail.com 2021-05-11T16:39:45+00:00 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 This patch fixes the following issues: 1. memstick_free_host() will free the host, so the use of ms_dev(host) after it will be a problem. To fix this, move memstick_free_host() after when we are done with ms_dev(host). 2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove and free host otherwise memstick_check will be called and UAF will happen. [ 11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] [ 11.357077] rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] [ 11.357376] platform_remove+0x2a/0x50 [ 11.367531] Freed by task 298: [ 11.368537] kfree+0xa4/0x2a0 [ 11.368711] device_release+0x51/0xe0 [ 11.368905] kobject_put+0xa2/0x120 [ 11.369090] rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms] [ 11.369386] platform_remove+0x2a/0x50 [ 12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0 [ 12.045432] mutex_lock+0xc9/0xd0 [ 12.046080] memstick_check+0x6a/0x578 [memstick] [ 12.046509] process_one_work+0x46d/0x750 [ 12.052107] Freed by task 297: [ 12.053115] kfree+0xa4/0x2a0 [ 12.053272] device_release+0x51/0xe0 [ 12.053463] kobject_put+0xa2/0x120 [ 12.053647] rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms] [ 12.053939] platform_remove+0x2a/0x50 Signed-off-by: Tong Zhang <ztong0001@gmail.com> Co-developed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 
This patch fixes the following issues:
1. memstick_free_host() will free the host, so the use of ms_dev(host) after
it will be a problem. To fix this, move memstick_free_host() after when we
are done with ms_dev(host).
2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove
and free host otherwise memstick_check will be called and UAF will
happen.

[   11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357077]  rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms]
[   11.357376]  platform_remove+0x2a/0x50
[   11.367531] Freed by task 298:
[   11.368537]  kfree+0xa4/0x2a0
[   11.368711]  device_release+0x51/0xe0
[   11.368905]  kobject_put+0xa2/0x120
[   11.369090]  rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms]
[   11.369386]  platform_remove+0x2a/0x50

[   12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0
[   12.045432]  mutex_lock+0xc9/0xd0
[   12.046080]  memstick_check+0x6a/0x578 [memstick]
[   12.046509]  process_one_work+0x46d/0x750
[   12.052107] Freed by task 297:
[   12.053115]  kfree+0xa4/0x2a0
[   12.053272]  device_release+0x51/0xe0
[   12.053463]  kobject_put+0xa2/0x120
[   12.053647]  rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms]
[   12.053939]  platform_remove+0x2a/0x50

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Co-developed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
drivers: memstick: core:ms_block.c: Fix alignment of block comment 2021-06-14T11:57:37+00:00 Shubhankar Kuranagatti shubhankarvk@gmail.com 2021-05-07T06:35:28+00:00 3ae613765851cc2a651a42ce9d586078a899d8c8 A * has been added to subsequent lines of block comment The closing */ has been shifted to a new line A new line has been give after declaration This is done to maintain code uniformity. Signed-off-by: Shubhankar Kuranagatti <shubhankarvk@gmail.com> Link: https://lore.kernel.org/r/20210507063528.tvlbu2cwnlczgbga@kewl-virtual-machine Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 
A * has been added to subsequent lines of block comment
The closing */ has been shifted to a new line
A new line has been give after declaration
This is done to maintain code uniformity.

Signed-off-by: Shubhankar Kuranagatti <shubhankarvk@gmail.com>
Link: https://lore.kernel.org/r/20210507063528.tvlbu2cwnlczgbga@kewl-virtual-machine
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
mspro: use blk_mq_alloc_disk 2021-06-11T17:53:02+00:00 Christoph Hellwig hch@lst.de 2021-06-02T06:53:23+00:00 51ed5bd55eb602fd8b3531bb919bcb59849fa569 Use the blk_mq_alloc_disk API to simplify the gendisk and request_queue allocation. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Ulf Hansson <ulf.hansson@linaro.org> Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Link: https://lore.kernel.org/r/20210602065345.355274-9-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> 
Use the blk_mq_alloc_disk API to simplify the gendisk and request_queue
allocation.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Link: https://lore.kernel.org/r/20210602065345.355274-9-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
ms_block: use blk_mq_alloc_disk 2021-06-11T17:53:02+00:00 Christoph Hellwig hch@lst.de 2021-06-02T06:53:22+00:00 f368b7d7fa77768026d439ec9c32fe16a2d5eb52 Use the blk_mq_alloc_disk API to simplify the gendisk and request_queue allocation. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Ulf Hansson <ulf.hansson@linaro.org> Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Link: https://lore.kernel.org/r/20210602065345.355274-8-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> 
Use the blk_mq_alloc_disk API to simplify the gendisk and request_queue
allocation.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Link: https://lore.kernel.org/r/20210602065345.355274-8-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
block: automatically enable GENHD_FL_EXT_DEVT 2021-06-01T13:42:23+00:00 Christoph Hellwig hch@lst.de 2021-05-21T05:50:53+00:00 0d1feb72ffd8578f6f167ca15b2096c276c1f6df Automatically set the GENHD_FL_EXT_DEVT flag for all disks allocated without an explicit number of minors. This is what all new block drivers should do, so make sure it is the default without boilerplate code. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Luis Chamberlain <mcgrof@kernel.org> Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Link: https://lore.kernel.org/r/20210521055116.1053587-4-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> 
Automatically set the GENHD_FL_EXT_DEVT flag for all disks allocated
without an explicit number of minors.  This is what all new block
drivers should do, so make sure it is the default without boilerplate
code.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20210521055116.1053587-4-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
memstick: r592: ignore kfifo_out() return code again 2021-04-26T09:08:23+00:00 Arnd Bergmann arnd@arndb.de 2021-04-21T13:51:58+00:00 2f156712be4ab4c2707e096d619dc8bfbd01d388 A minor cleanup to address a clang warning removed an assigned but unused local variable, but this now caused a gcc warning as kfifo_out() is annotated to require checking its return code: In file included from drivers/memstick/host/r592.h:13, from drivers/memstick/host/r592.c:21: drivers/memstick/host/r592.c: In function 'r592_flush_fifo_write': include/linux/kfifo.h:588:1: error: ignoring return value of '__kfifo_uint_must_check_helper' declared with attribute 'warn_unused_result' [-Werror=unused-result] 588 | __kfifo_uint_must_check_helper( \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 589 | ({ \ | ~~~~ 590 | typeof((fifo) + 1) __tmp = (fifo); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 591 | typeof(__tmp->ptr) __buf = (buf); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 592 | unsigned long __n = (n); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 593 | const size_t __recsize = sizeof(*__tmp->rectype); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 594 | struct __kfifo *__kfifo = &__tmp->kfifo; \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 595 | (__recsize) ?\ | ~~~~~~~~~~~~~~ 596 | __kfifo_out_r(__kfifo, __buf, __n, __recsize) : \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 597 | __kfifo_out(__kfifo, __buf, __n); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 598 | }) \ | ~~~~ 599 | ) | ~ drivers/memstick/host/r592.c:367:9: note: in expansion of macro 'kfifo_out' 367 | kfifo_out(&dev->pio_fifo, buffer, 4); | ^~~~~~~~~ The value was never checked here, and the purpose of the function is only to flush the contents, so restore the old behavior but add a cast to void and a comment, which hopefully warns with neither gcc nor clang now. If anyone has an idea for how to fix it without ignoring the return code, that is probably better. Fixes: 4b00ed3c5072 ("memstick: r592: remove unused variable") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20210421135215.3414589-1-arnd@kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 
A minor cleanup to address a clang warning removed an assigned
but unused local variable, but this now caused a gcc warning as
kfifo_out() is annotated to require checking its return code:

In file included from drivers/memstick/host/r592.h:13,
                 from drivers/memstick/host/r592.c:21:
drivers/memstick/host/r592.c: In function 'r592_flush_fifo_write':
include/linux/kfifo.h:588:1: error: ignoring return value of '__kfifo_uint_must_check_helper' declared with attribute 'warn_unused_result' [-Werror=unused-result]
  588 | __kfifo_uint_must_check_helper( \
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  589 | ({ \
      | ~~~~
  590 |         typeof((fifo) + 1) __tmp = (fifo); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  591 |         typeof(__tmp->ptr) __buf = (buf); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  592 |         unsigned long __n = (n); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~
  593 |         const size_t __recsize = sizeof(*__tmp->rectype); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  594 |         struct __kfifo *__kfifo = &__tmp->kfifo; \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  595 |         (__recsize) ?\
      |         ~~~~~~~~~~~~~~
  596 |         __kfifo_out_r(__kfifo, __buf, __n, __recsize) : \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  597 |         __kfifo_out(__kfifo, __buf, __n); \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  598 | }) \
      | ~~~~
  599 | )
      | ~
drivers/memstick/host/r592.c:367:9: note: in expansion of macro 'kfifo_out'
  367 |         kfifo_out(&dev->pio_fifo, buffer, 4);
      |         ^~~~~~~~~

The value was never checked here, and the purpose of the function
is only to flush the contents, so restore the old behavior but
add a cast to void and a comment, which hopefully warns with neither
gcc nor clang now.

If anyone has an idea for how to fix it without ignoring the return
code, that is probably better.

Fixes: 4b00ed3c5072 ("memstick: r592: remove unused variable")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210421135215.3414589-1-arnd@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
memstick: r592: remove unused variable 2021-04-15T09:00:03+00:00 Jiapeng Chong jiapeng.chong@linux.alibaba.com 2021-04-14T02:21:43+00:00 4b00ed3c5072751fc46677970f4d84683b555969 Fix the following clang warning: drivers/memstick/host/r592.c:363:6: warning: variable ‘len’ set but not used [-Wunused-but-set-variable]. Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Link: https://lore.kernel.org/r/1618366903-94346-1-git-send-email-jiapeng.chong@linux.alibaba.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 
Fix the following clang warning:

drivers/memstick/host/r592.c:363:6: warning: variable ‘len’ set but not
used [-Wunused-but-set-variable].

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Link: https://lore.kernel.org/r/1618366903-94346-1-git-send-email-jiapeng.chong@linux.alibaba.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
memstick: Remove useless else branch 2021-03-30T09:42:04+00:00 Joey Pabalan jpabalanb@gmail.com 2021-03-13T17:37:40+00:00 9a8a369bd0b0c172b880f3393bb0322de98dc97c Remove else branch on line 334 of memstick.c, after the return of the previous branch. Found by checkpatch. Signed-off-by: Joey Pabalan <jpabalanb@gmail.com> Link: https://lore.kernel.org/r/20210313173740.GA580681@joeylaptop Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 
Remove else branch on line 334 of memstick.c, after the return of the
previous branch. Found by checkpatch.

Signed-off-by: Joey Pabalan <jpabalanb@gmail.com>
Link: https://lore.kernel.org/r/20210313173740.GA580681@joeylaptop
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
memstick: core: Assign error code of mspro_block_resume() 2021-03-30T09:42:02+00:00 Jia-Ju Bai baijiaju1990@gmail.com 2021-03-05T02:14:45+00:00 8c87dab92f90c4c8f45d7ac302da878e269d3695 When mspro_block_init_card() fails, no error return code of mspro_block_resume() is assigned/propagated. Let's fix this. Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Link: https://lore.kernel.org/r/20210305021445.3435-1-baijiaju1990@gmail.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> 
When mspro_block_init_card() fails, no error return code of
mspro_block_resume() is assigned/propagated. Let's fix this.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Link: https://lore.kernel.org/r/20210305021445.3435-1-baijiaju1990@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>