From: Christoph Hellwig hch@lst.de

mainline inclusion from mainline-v5.13-rc1 commit 85c8c3c1f8d9e31f626c93435dd91c2f85603e07 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8O6NL CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

-------------------------------------------------

Split out a self contained helper to find a free minor for the md "unit" number.

Signed-off-by: Christoph Hellwig hch@lst.de Signed-off-by: Song Liu song@kernel.org Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- drivers/md/md.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c index b9065f26d3d2..572925c215fc 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -723,6 +723,27 @@ static struct mddev *mddev_find_locked(dev_t unit) return NULL; }

+/* find an unused unit number */ +static dev_t mddev_alloc_unit(void) +{ + static int next_minor = 512; + int start = next_minor; + bool is_free = 0; + dev_t dev = 0; + + while (!is_free) { + dev = MKDEV(MD_MAJOR, next_minor); + next_minor++; + if (next_minor > MINORMASK) + next_minor = 0; + if (next_minor == start) + return 0; /* Oh dear, all in use. */ + is_free = !mddev_find_locked(dev); + } + + return dev; +} + static struct mddev *mddev_find(dev_t unit) { struct mddev *mddev; @@ -765,27 +786,13 @@ static struct mddev *mddev_find_or_alloc(dev_t unit) return new; } } else if (new) { - /* find an unused unit number */ - static int next_minor = 512; - int start = next_minor; - int is_free = 0; - int dev = 0; - while (!is_free) { - dev = MKDEV(MD_MAJOR, next_minor); - next_minor++; - if (next_minor > MINORMASK) - next_minor = 0; - if (next_minor == start) { - /* Oh dear, all in use. */ - spin_unlock(&all_mddevs_lock); - kfree(new); - return NULL; - } - - is_free = !mddev_find_locked(dev); + new->unit = mddev_alloc_unit(); + if (!new->unit) { + spin_unlock(&all_mddevs_lock); + kfree(new); + return NULL; } - new->unit = dev; - new->md_minor = MINOR(dev); + new->md_minor = MINOR(new->unit); new->hold_active = UNTIL_STOP; list_add(&new->all_mddevs, &all_mddevs); spin_unlock(&all_mddevs_lock);

From: Christoph Hellwig hch@lst.de

mainline inclusion from mainline-v5.13-rc1 commit 0d809b3837a0bede8f58a67e303e339585777bf4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8O6NL CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

-------------------------------------------------

Instead of returning an existing mddev, just for it to be discarded later directly return -EEXIST. Rename the function to mddev_alloc now that it doesn't find an existing mddev.

Signed-off-by: Christoph Hellwig hch@lst.de Signed-off-by: Song Liu song@kernel.org

Conflicts: Commit 4ad5f208c38f ("md: Flush workqueue md_rdev_misc_wq in md_alloc()") add flushing md_rdev_misc_wq in md_alloc(). Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- drivers/md/md.c | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c index 8cc2f2debf97..39ff6f0d0aab 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -760,26 +760,24 @@ static struct mddev *mddev_find(dev_t unit) return mddev; }

-static struct mddev *mddev_find_or_alloc(dev_t unit) +static struct mddev *mddev_alloc(dev_t unit) { - struct mddev *mddev = NULL, *new; + struct mddev *new; + int error;

if (unit && MAJOR(unit) != MD_MAJOR) unit &= ~((1 << MdpMinorShift) - 1);

new = kzalloc(sizeof(*new), GFP_KERNEL); if (!new) - return NULL; + return ERR_PTR(-ENOMEM); mddev_init(new);

spin_lock(&all_mddevs_lock); if (unit) { - mddev = mddev_find_locked(unit); - if (mddev) { - mddev_get(mddev); + error = -EEXIST; + if (mddev_find_locked(unit)) goto out_free_new; - } - new->unit = unit; if (MAJOR(unit) == MD_MAJOR) new->md_minor = MINOR(unit); @@ -787,6 +785,7 @@ static struct mddev *mddev_find_or_alloc(dev_t unit) new->md_minor = MINOR(unit) >> MdpMinorShift; new->hold_active = UNTIL_IOCTL; } else { + error = -ENODEV; new->unit = mddev_alloc_unit(); if (!new->unit) goto out_free_new; @@ -800,7 +799,7 @@ static struct mddev *mddev_find_or_alloc(dev_t unit) out_free_new: spin_unlock(&all_mddevs_lock); kfree(new); - return mddev; + return ERR_PTR(error); }

static struct attribute_group md_redundancy_group; @@ -5734,30 +5733,30 @@ static int md_alloc(dev_t dev, char *name) * writing to /sys/module/md_mod/parameters/new_array. */ static DEFINE_MUTEX(disks_mutex); - struct mddev *mddev = mddev_find_or_alloc(dev); + struct mddev *mddev; struct gendisk *disk; int partitioned; int shift; int unit; - int error; - - if (!mddev) - return -ENODEV; + int error ;

- partitioned = (MAJOR(mddev->unit) != MD_MAJOR); - shift = partitioned ? MdpMinorShift : 0; - unit = MINOR(mddev->unit) >> shift; - - /* wait for any previous instance of this device to be - * completely removed (mddev_delayed_delete). + /* + * Wait for any previous instance of this device to be completely + * removed (mddev_delayed_delete). */ flush_workqueue(md_misc_wq); flush_workqueue(md_rdev_misc_wq);

mutex_lock(&disks_mutex); - error = -EEXIST; - if (mddev->gendisk) - goto abort; + mddev = mddev_alloc(dev); + if (IS_ERR(mddev)) { + mutex_unlock(&disks_mutex); + return PTR_ERR(mddev); + } + + partitioned = (MAJOR(mddev->unit) != MD_MAJOR); + shift = partitioned ? MdpMinorShift : 0; + unit = MINOR(mddev->unit) >> shift;

if (name && !dev) { /* Need to ensure that 'name' is not a duplicate. @@ -5769,6 +5768,7 @@ static int md_alloc(dev_t dev, char *name) if (mddev2->gendisk && strcmp(mddev2->gendisk->disk_name, name) == 0) { spin_unlock(&all_mddevs_lock); + error = -EEXIST; goto abort; } spin_unlock(&all_mddevs_lock);