nvme: refuse an unsolicited format change on a namespace that is in use - #1123
nvme: refuse an unsolicited format change on a namespace that is in use#1123blktests-ci-kpd[bot] wants to merge 1 commit into
Conversation
|
Upstream branch: d58772d |
29ac21d to
ea2c39d
Compare
|
Upstream branch: f5bbbfe |
359de19 to
e0856cc
Compare
ea2c39d to
4082a30
Compare
|
Upstream branch: 3d6d817 |
e0856cc to
02cdf03
Compare
4082a30 to
36bd7eb
Compare
|
Upstream branch: 3aa1dca |
02cdf03 to
694d1db
Compare
d89ab11 to
fdba928
Compare
|
Upstream branch: fd923b3 |
694d1db to
4fef557
Compare
fdba928 to
60442a3
Compare
|
Upstream branch: 8d3ae59 |
4fef557 to
b6b19ff
Compare
60442a3 to
3df366e
Compare
|
Upstream branch: bd5f485 |
b6b19ff to
bd4d930
Compare
3df366e to
5dd70cb
Compare
|
Upstream branch: 66498c7 |
bd4d930 to
87f6880
Compare
5dd70cb to
055a766
Compare
|
Upstream branch: 502d457 |
87f6880 to
fdab42b
Compare
055a766 to
341ae8c
Compare
|
Upstream branch: cf72cbb |
fdab42b to
8020848
Compare
341ae8c to
940e422
Compare
|
Upstream branch: cee9395 |
8020848 to
b3b99dd
Compare
940e422 to
3cab524
Compare
|
Upstream branch: 89a3129 |
b3b99dd to
20e32f8
Compare
3cab524 to
8242bf1
Compare
|
Upstream branch: bc35965 |
20e32f8 to
9b3646e
Compare
8242bf1 to
5b28f57
Compare
|
Upstream branch: df29080 Pull request is NOT updated. Failed to apply https://patchwork.kernel.org/series/1144288/ conflict: |
5b28f57 to
4ddd216
Compare
|
Upstream branch: 28924df |
9b3646e to
1c1da3b
Compare
4ddd216 to
00cc4ca
Compare
|
Upstream branch: 893e117 |
A namespace can report a new LBA format or metadata size on revalidation. The host still holds cached data, queued bios and integrity buffers built for the old geometry. Adopting the new one reinterprets all of it. Freezing the queue does not help. The request is already complete when the integrity verify is handed to kintegrityd, so the freeze drains while that work is still pending. The verify then walks a buffer sized for the old metadata_size using the new step size. That is the reported KASAN slab-out-of-bounds read in t10_pi_verify(). Christoph suggested failing such a revalidation rather than handling the fallout. Do that. Compare the new LBA data size and metadata size against the live ones, before the queue is frozen. If they differ while the disk is open, return INVALID_NS/DNR. nvme_validate_ns() turns that into nvme_ns_remove(), as it already does for changed identifiers. Host-initiated format and namespace management are exempt. They arrive through nvme_passthru_end(), where the host asked for the change. NVME_CTRL_SELF_RESCAN marks that window. Link: https://lore.kernel.org/linux-block/ah03bXpgFLQjOUt8@infradead.org/ Link: https://lore.kernel.org/linux-block/20260531-blk-integrity-fix-v1-1-cc7084f42cf1@outlook.com/ Found by FuzzNvme. Signed-off-by: Chao Shi <coshi036@gmail.com>
1c1da3b to
4ed3bfb
Compare
Pull request for series with
subject: nvme: refuse an unsolicited format change on a namespace that is in use
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1144288