| Message ID | 59c17ada35664b818b7bd83752119b2d@hyperstone.com |
|---|---|
| State | New |
| Headers | show |
| Series | [PATCHv2] mmc: block: ensure error propagation for non-blk | expand |
On 26/04/23 19:59, Christian Loehle wrote: > Requests to the mmc layer usually come through a block device IO. > The exceptions are the ioctl interface, RPMB chardev ioctl > and debugfs, which issue their own blk_mq requests through > blk_execute_rq and do not query the BLK_STS error but the > mmcblk-internal drv_op_result. This patch ensures that drv_op_result > defaults to an error and has to be overwritten by the operation > to be considered successful. > > The behavior leads to a bug where the request never propagates > the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if > mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then > can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged) > and thus may assume that their call executed successfully when it did not. > > While always checking the blk_execute_rq return value would be > advised, let's eliminate the error by always setting > drv_op_result as -EIO to be overwritten on success (or other error) > > Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests") > Signed-off-by: Christian Loehle <cloehle@hyperstone.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> > --- > v2: Adopted Adrians suggestions to set the error before calling > and rewrote commit message > drivers/mmc/core/block.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c > index 672ab90c4b2d..0ff294f07465 100644 > --- a/drivers/mmc/core/block.c > +++ b/drivers/mmc/core/block.c > @@ -266,6 +266,7 @@ static ssize_t power_ro_lock_store(struct device *dev, > goto out_put; > } > req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > blk_execute_rq(req, false); > ret = req_to_mmc_queue_req(req)->drv_op_result; > blk_mq_free_request(req); > @@ -653,6 +654,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, > idatas[0] = idata; > req_to_mmc_queue_req(req)->drv_op = > rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > req_to_mmc_queue_req(req)->drv_op_data = idatas; > req_to_mmc_queue_req(req)->ioc_count = 1; > blk_execute_rq(req, false); > @@ -724,6 +726,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, > } > req_to_mmc_queue_req(req)->drv_op = > rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > req_to_mmc_queue_req(req)->drv_op_data = idata; > req_to_mmc_queue_req(req)->ioc_count = n; > blk_execute_rq(req, false); > @@ -2808,6 +2811,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val) > if (IS_ERR(req)) > return PTR_ERR(req); > req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > blk_execute_rq(req, false); > ret = req_to_mmc_queue_req(req)->drv_op_result; > if (ret >= 0) { > @@ -2846,6 +2850,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp) > goto out_free; > } > req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > req_to_mmc_queue_req(req)->drv_op_data = &ext_csd; > blk_execute_rq(req, false); > err = req_to_mmc_queue_req(req)->drv_op_result;
On Wed, 26 Apr 2023 at 18:59, Christian Loehle <CLoehle@hyperstone.com> wrote: > > Requests to the mmc layer usually come through a block device IO. > The exceptions are the ioctl interface, RPMB chardev ioctl > and debugfs, which issue their own blk_mq requests through > blk_execute_rq and do not query the BLK_STS error but the > mmcblk-internal drv_op_result. This patch ensures that drv_op_result > defaults to an error and has to be overwritten by the operation > to be considered successful. > > The behavior leads to a bug where the request never propagates > the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if > mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then > can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged) > and thus may assume that their call executed successfully when it did not. > > While always checking the blk_execute_rq return value would be > advised, let's eliminate the error by always setting > drv_op_result as -EIO to be overwritten on success (or other error) > > Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests") > Signed-off-by: Christian Loehle <cloehle@hyperstone.com> Applied for fixes and by adding a stable tag, thanks! Kind regards Uffe > --- > v2: Adopted Adrians suggestions to set the error before calling > and rewrote commit message > drivers/mmc/core/block.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c > index 672ab90c4b2d..0ff294f07465 100644 > --- a/drivers/mmc/core/block.c > +++ b/drivers/mmc/core/block.c > @@ -266,6 +266,7 @@ static ssize_t power_ro_lock_store(struct device *dev, > goto out_put; > } > req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > blk_execute_rq(req, false); > ret = req_to_mmc_queue_req(req)->drv_op_result; > blk_mq_free_request(req); > @@ -653,6 +654,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, > idatas[0] = idata; > req_to_mmc_queue_req(req)->drv_op = > rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > req_to_mmc_queue_req(req)->drv_op_data = idatas; > req_to_mmc_queue_req(req)->ioc_count = 1; > blk_execute_rq(req, false); > @@ -724,6 +726,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, > } > req_to_mmc_queue_req(req)->drv_op = > rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > req_to_mmc_queue_req(req)->drv_op_data = idata; > req_to_mmc_queue_req(req)->ioc_count = n; > blk_execute_rq(req, false); > @@ -2808,6 +2811,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val) > if (IS_ERR(req)) > return PTR_ERR(req); > req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > blk_execute_rq(req, false); > ret = req_to_mmc_queue_req(req)->drv_op_result; > if (ret >= 0) { > @@ -2846,6 +2850,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp) > goto out_free; > } > req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD; > + req_to_mmc_queue_req(req)->drv_op_result = -EIO; > req_to_mmc_queue_req(req)->drv_op_data = &ext_csd; > blk_execute_rq(req, false); > err = req_to_mmc_queue_req(req)->drv_op_result; > -- > 2.37.3 > > > Hyperstone GmbH | Reichenaustr. 39a | 78467 Konstanz > Managing Director: Dr. Jan Peter Berns. > Commercial register of local courts: Freiburg HRB381782 >
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c index 672ab90c4b2d..0ff294f07465 100644 --- a/drivers/mmc/core/block.c +++ b/drivers/mmc/core/block.c @@ -266,6 +266,7 @@ static ssize_t power_ro_lock_store(struct device *dev, goto out_put; } req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP; + req_to_mmc_queue_req(req)->drv_op_result = -EIO; blk_execute_rq(req, false); ret = req_to_mmc_queue_req(req)->drv_op_result; blk_mq_free_request(req); @@ -653,6 +654,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, idatas[0] = idata; req_to_mmc_queue_req(req)->drv_op = rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; + req_to_mmc_queue_req(req)->drv_op_result = -EIO; req_to_mmc_queue_req(req)->drv_op_data = idatas; req_to_mmc_queue_req(req)->ioc_count = 1; blk_execute_rq(req, false); @@ -724,6 +726,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, } req_to_mmc_queue_req(req)->drv_op = rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; + req_to_mmc_queue_req(req)->drv_op_result = -EIO; req_to_mmc_queue_req(req)->drv_op_data = idata; req_to_mmc_queue_req(req)->ioc_count = n; blk_execute_rq(req, false); @@ -2808,6 +2811,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val) if (IS_ERR(req)) return PTR_ERR(req); req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS; + req_to_mmc_queue_req(req)->drv_op_result = -EIO; blk_execute_rq(req, false); ret = req_to_mmc_queue_req(req)->drv_op_result; if (ret >= 0) { @@ -2846,6 +2850,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp) goto out_free; } req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD; + req_to_mmc_queue_req(req)->drv_op_result = -EIO; req_to_mmc_queue_req(req)->drv_op_data = &ext_csd; blk_execute_rq(req, false); err = req_to_mmc_queue_req(req)->drv_op_result;
Requests to the mmc layer usually come through a block device IO. The exceptions are the ioctl interface, RPMB chardev ioctl and debugfs, which issue their own blk_mq requests through blk_execute_rq and do not query the BLK_STS error but the mmcblk-internal drv_op_result. This patch ensures that drv_op_result defaults to an error and has to be overwritten by the operation to be considered successful. The behavior leads to a bug where the request never propagates the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged) and thus may assume that their call executed successfully when it did not. While always checking the blk_execute_rq return value would be advised, let's eliminate the error by always setting drv_op_result as -EIO to be overwritten on success (or other error) Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests") Signed-off-by: Christian Loehle <cloehle@hyperstone.com> --- v2: Adopted Adrians suggestions to set the error before calling and rewrote commit message drivers/mmc/core/block.c | 5 +++++ 1 file changed, 5 insertions(+)