[GIT PULL] Fixes for 5.4-rc8/final

[GIT PULL] Fixes for 5.4-rc8/final

[Jens Axboe]

Hi Linus,

We have a few fixes that should make it into this release. This pull
request contains:

- io_uring:
	- The timeout command assumes sequence == 0 means that we want
	  one completion, but this kind of overloading is unfortunate as
	  it prevents users from doing a pure time based wait. Since
	  this operation was introduced in this cycle, let's correct it
	  now, while we can. (me)
	- One-liner to fix an issue with dependent links and fixed
	  buffer reads. The actual IO completed fine, but the link got
	  severed since we stored the wrong expected value. (me)
	- Add TIMEOUT to list of opcodes that don't need a file. (Pavel)

- rsxx missing workqueue destry calls. Old bug. (Chuhong)

- Fix blk-iocost active list check (Jiufei)

- Fix impossible-to-hit overflow merge condition, that still hit some
  folks very rarely (Junichi)

- Fix bfq hang issue from 5.3. This didn't get marked for stable, but
  will go into stable post this merge (Paolo)

Please pull!


  git://git.kernel.dk/linux-block.git tags/for-linus-20191115


----------------------------------------------------------------
Chuhong Yuan (1):
      rsxx: add missed destroy_workqueue calls in remove

Jens Axboe (2):
      io_uring: make timeout sequence == 0 mean no sequence
      io_uring: ensure registered buffer import returns the IO length

Jiufei Xue (1):
      iocost: check active_list of all the ancestors in iocg_activate()

Junichi Nomura (1):
      block: check bi_size overflow before merge

Paolo Valente (1):
      block, bfq: deschedule empty bfq_queues not referred by any process

Pavel Begunkov (1):
      io_uring: Fix getting file for timeout

 block/bfq-iosched.c       | 32 ++++++++++++++++++++++++++------
 block/bio.c               |  2 +-
 block/blk-iocost.c        |  8 ++++++--
 drivers/block/rsxx/core.c |  2 ++
 fs/io_uring.c             | 32 ++++++++++++++++++++++++--------
 5 files changed, 59 insertions(+), 17 deletions(-)

-- 
Jens Axboe

Re: [GIT PULL] Fixes for 5.4-rc8/final

[Linus Torvalds]

On Fri, Nov 15, 2019 at 11:40 AM Jens Axboe <axboe@kernel.dk> wrote:
>
> - Fix impossible-to-hit overflow merge condition, that still hit some
>   folks very rarely (Junichi)

Hmm. This sounded intriguing, so I looked at it.

It sounds like the 32-bit "bi_size" overflowed, which is one of the
things that bio_full() checks for.

However.

Looking at the *users* of bio_full(), it's not obvious that everything
is ok. For example, in __bio_add_pc_page(), the code does that

        if (((bio->bi_iter.bi_size + len) >> 9) > queue_max_hw_sectors(q))
                return 0;

*before* checking for the overflow condition.

So it could cause that bio_try_merge_pc_page() to be done despite the
overflow, and happily that path ends up having the bio_full() test
later anyway, but it does look a bit worrisome.

There's also __bio_add_page(), which does have a WARN_ON_ONCE(), but
then goes on and does the bi_size update regardless. Hmm.. It does
look like all callers either check bio_full() before, or do it with a
newly allocated bio.

             Linus

Re: [GIT PULL] Fixes for 5.4-rc8/final

[Jens Axboe]

On 11/15/19 2:17 PM, Linus Torvalds wrote:
> On Fri, Nov 15, 2019 at 11:40 AM Jens Axboe <axboe@kernel.dk> wrote:
>>
>> - Fix impossible-to-hit overflow merge condition, that still hit some
>>    folks very rarely (Junichi)
> 
> Hmm. This sounded intriguing, so I looked at it.
> 
> It sounds like the 32-bit "bi_size" overflowed, which is one of the
> things that bio_full() checks for.
> 
> However.
> 
> Looking at the *users* of bio_full(), it's not obvious that everything
> is ok. For example, in __bio_add_pc_page(), the code does that
> 
>          if (((bio->bi_iter.bi_size + len) >> 9) > queue_max_hw_sectors(q))
>                  return 0;
> 
> *before* checking for the overflow condition.
> 
> So it could cause that bio_try_merge_pc_page() to be done despite the
> overflow, and happily that path ends up having the bio_full() test
> later anyway, but it does look a bit worrisome.
> 
> There's also __bio_add_page(), which does have a WARN_ON_ONCE(), but
> then goes on and does the bi_size update regardless. Hmm.. It does
> look like all callers either check bio_full() before, or do it with a
> newly allocated bio.

We'll go over these asap. As a note, the 'pc' variants are not for
normal file system IO, they are only for requests submitted through some
sort of packet command, generally ioctls and such. Should of course be
correct, but it's not as critical as the normal IO path.

-- 
Jens Axboe

Re: [GIT PULL] Fixes for 5.4-rc8/final

[pr-tracker-bot]

The pull request you sent on Fri, 15 Nov 2019 12:40:46 -0700:

> git://git.kernel.dk/linux-block.git tags/for-linus-20191115

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/b226c9e1f4cb23bf6fa6c74af361e5136cb5804c

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker