Merge tag 'block-6.3-2023-03-09' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

 - Fix a regression in exclusive mode handling of the partition code,
   introduced in this merge windoe (Yu)

 - Fix for a use-after-free in BFQ (Yu)

 - Add sysfs documentation for the 'hidden' attribute (Sagi)

* tag 'block-6.3-2023-03-09' of git://git.kernel.dk/linux:
  block, bfq: fix uaf for 'stable_merge_bfqq'
  docs: sysfs-block: document hidden sysfs entry
  block: fix wrong mode for blkdev_put() from disk_scan_partitions()

diff --git a/Documentation/ABI/stable/sysfs-block b/Documentation/ABI/stable/sysfs-block
index ac1e519..282de36 100644 (file)
--- a/Documentation/ABI/stable/sysfs-block
+++ b/Documentation/ABI/stable/sysfs-block
@@ -705,6 +705,15 @@ Description:
                zoned will report "none".
 
 
+What:          /sys/block/<disk>/hidden
+Date:          March 2023
+Contact:       linux-block@vger.kernel.org
+Description:
+               [RO] the block device is hidden. it doesn’t produce events, and
+               can’t be opened from userspace or using blkdev_get*.
+               Used for the underlying components of multipath devices.
+
+
 What:          /sys/block/<disk>/stat
 Date:          February 2008
 Contact:       Jerome Marchand <jmarchan@redhat.com>

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 8a8d444..d9ed310 100644 (file)
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2854,11 +2854,11 @@ bfq_setup_stable_merge(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 {
        int proc_ref = min(bfqq_process_refs(bfqq),
                           bfqq_process_refs(stable_merge_bfqq));
-       struct bfq_queue *new_bfqq;
+       struct bfq_queue *new_bfqq = NULL;
 
-       if (idling_boosts_thr_without_issues(bfqd, bfqq) ||
-           proc_ref == 0)
-               return NULL;
+       bfqq_data->stable_merge_bfqq = NULL;
+       if (idling_boosts_thr_without_issues(bfqd, bfqq) || proc_ref == 0)
+               goto out;
 
        /* next function will take at least one ref */
        new_bfqq = bfq_setup_merge(bfqq, stable_merge_bfqq);
@@ -2873,6 +2873,11 @@ bfq_setup_stable_merge(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                        new_bfqq_data->stably_merged = true;
                }
        }
+
+out:
+       /* deschedule stable merge, because done or aborted here */
+       bfq_put_stable_ref(stable_merge_bfqq);
+
        return new_bfqq;
 }
 
@@ -2933,11 +2938,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                        struct bfq_queue *stable_merge_bfqq =
                                bfqq_data->stable_merge_bfqq;
 
-                       /* deschedule stable merge, because done or aborted here */
-                       bfq_put_stable_ref(stable_merge_bfqq);
-
-                       bfqq_data->stable_merge_bfqq = NULL;
-
                        return bfq_setup_stable_merge(bfqd, bfqq,
                                                      stable_merge_bfqq,
                                                      bfqq_data);

diff --git a/block/genhd.c b/block/genhd.c
index 3ee5577..02d9cfb 100644 (file)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -385,7 +385,7 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode)
        if (IS_ERR(bdev))
                ret =  PTR_ERR(bdev);
        else
-               blkdev_put(bdev, mode);
+               blkdev_put(bdev, mode & ~FMODE_EXCL);
 
        if (!(mode & FMODE_EXCL))
                bd_abort_claiming(disk->part0, disk_scan_partitions);