Requests to the mmc layer usually come through a block device IO.
The exceptions are the ioctl interface, RPMB chardev ioctl
and debugfs, which issue their own blk_mq requests through
blk_execute_rq and do not query the BLK_STS error but the
mmcblk-internal drv_op_result. This patch ensures that drv_op_result
defaults to an error and has to be overwritten by the operation
to be considered successful.
The behavior leads to a bug where the request never propagates
the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if
mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then
can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged)
and thus may assume that their call executed successfully when it did not.
While always checking the blk_execute_rq return value would be
advised, let's eliminate the error by always setting
drv_op_result as -EIO to be overwritten on success (or other error)
Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests")
Signed-off-by: Christian Loehle <[email protected]>
---
v2: Adopted Adrians suggestions to set the error before calling
and rewrote commit message
drivers/mmc/core/block.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 672ab90c4b2d..0ff294f07465 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -266,6 +266,7 @@ static ssize_t power_ro_lock_store(struct device *dev,
goto out_put;
}
req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
blk_execute_rq(req, false);
ret = req_to_mmc_queue_req(req)->drv_op_result;
blk_mq_free_request(req);
@@ -653,6 +654,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
idatas[0] = idata;
req_to_mmc_queue_req(req)->drv_op =
rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
req_to_mmc_queue_req(req)->drv_op_data = idatas;
req_to_mmc_queue_req(req)->ioc_count = 1;
blk_execute_rq(req, false);
@@ -724,6 +726,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
}
req_to_mmc_queue_req(req)->drv_op =
rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
req_to_mmc_queue_req(req)->drv_op_data = idata;
req_to_mmc_queue_req(req)->ioc_count = n;
blk_execute_rq(req, false);
@@ -2808,6 +2811,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
if (IS_ERR(req))
return PTR_ERR(req);
req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
blk_execute_rq(req, false);
ret = req_to_mmc_queue_req(req)->drv_op_result;
if (ret >= 0) {
@@ -2846,6 +2850,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
goto out_free;
}
req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
+ req_to_mmc_queue_req(req)->drv_op_result = -EIO;
req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
blk_execute_rq(req, false);
err = req_to_mmc_queue_req(req)->drv_op_result;
--
2.37.3
Hyperstone GmbH | Reichenaustr. 39a | 78467 Konstanz
Managing Director: Dr. Jan Peter Berns.
Commercial register of local courts: Freiburg HRB381782
On 26/04/23 19:59, Christian Loehle wrote:
> Requests to the mmc layer usually come through a block device IO.
> The exceptions are the ioctl interface, RPMB chardev ioctl
> and debugfs, which issue their own blk_mq requests through
> blk_execute_rq and do not query the BLK_STS error but the
> mmcblk-internal drv_op_result. This patch ensures that drv_op_result
> defaults to an error and has to be overwritten by the operation
> to be considered successful.
>
> The behavior leads to a bug where the request never propagates
> the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if
> mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then
> can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged)
> and thus may assume that their call executed successfully when it did not.
>
> While always checking the blk_execute_rq return value would be
> advised, let's eliminate the error by always setting
> drv_op_result as -EIO to be overwritten on success (or other error)
>
> Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests")
> Signed-off-by: Christian Loehle <[email protected]>
Acked-by: Adrian Hunter <[email protected]>
> ---
> v2: Adopted Adrians suggestions to set the error before calling
> and rewrote commit message
> drivers/mmc/core/block.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
> index 672ab90c4b2d..0ff294f07465 100644
> --- a/drivers/mmc/core/block.c
> +++ b/drivers/mmc/core/block.c
> @@ -266,6 +266,7 @@ static ssize_t power_ro_lock_store(struct device *dev,
> goto out_put;
> }
> req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> blk_execute_rq(req, false);
> ret = req_to_mmc_queue_req(req)->drv_op_result;
> blk_mq_free_request(req);
> @@ -653,6 +654,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
> idatas[0] = idata;
> req_to_mmc_queue_req(req)->drv_op =
> rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> req_to_mmc_queue_req(req)->drv_op_data = idatas;
> req_to_mmc_queue_req(req)->ioc_count = 1;
> blk_execute_rq(req, false);
> @@ -724,6 +726,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
> }
> req_to_mmc_queue_req(req)->drv_op =
> rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> req_to_mmc_queue_req(req)->drv_op_data = idata;
> req_to_mmc_queue_req(req)->ioc_count = n;
> blk_execute_rq(req, false);
> @@ -2808,6 +2811,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
> if (IS_ERR(req))
> return PTR_ERR(req);
> req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> blk_execute_rq(req, false);
> ret = req_to_mmc_queue_req(req)->drv_op_result;
> if (ret >= 0) {
> @@ -2846,6 +2850,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
> goto out_free;
> }
> req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
> blk_execute_rq(req, false);
> err = req_to_mmc_queue_req(req)->drv_op_result;
On Wed, 26 Apr 2023 at 18:59, Christian Loehle <[email protected]> wrote:
>
> Requests to the mmc layer usually come through a block device IO.
> The exceptions are the ioctl interface, RPMB chardev ioctl
> and debugfs, which issue their own blk_mq requests through
> blk_execute_rq and do not query the BLK_STS error but the
> mmcblk-internal drv_op_result. This patch ensures that drv_op_result
> defaults to an error and has to be overwritten by the operation
> to be considered successful.
>
> The behavior leads to a bug where the request never propagates
> the error, e.g. by directly erroring out at mmc_blk_mq_issue_rq if
> mmc_blk_part_switch fails. The ioctl caller of the rpmb chardev then
> can never see an error (BLK_STS_IOERR, but drv_op_result is unchanged)
> and thus may assume that their call executed successfully when it did not.
>
> While always checking the blk_execute_rq return value would be
> advised, let's eliminate the error by always setting
> drv_op_result as -EIO to be overwritten on success (or other error)
>
> Fixes: 614f0388f580 ("mmc: block: move single ioctl() commands to block requests")
> Signed-off-by: Christian Loehle <[email protected]>
Applied for fixes and by adding a stable tag, thanks!
Kind regards
Uffe
> ---
> v2: Adopted Adrians suggestions to set the error before calling
> and rewrote commit message
> drivers/mmc/core/block.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
> index 672ab90c4b2d..0ff294f07465 100644
> --- a/drivers/mmc/core/block.c
> +++ b/drivers/mmc/core/block.c
> @@ -266,6 +266,7 @@ static ssize_t power_ro_lock_store(struct device *dev,
> goto out_put;
> }
> req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_BOOT_WP;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> blk_execute_rq(req, false);
> ret = req_to_mmc_queue_req(req)->drv_op_result;
> blk_mq_free_request(req);
> @@ -653,6 +654,7 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md,
> idatas[0] = idata;
> req_to_mmc_queue_req(req)->drv_op =
> rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> req_to_mmc_queue_req(req)->drv_op_data = idatas;
> req_to_mmc_queue_req(req)->ioc_count = 1;
> blk_execute_rq(req, false);
> @@ -724,6 +726,7 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md,
> }
> req_to_mmc_queue_req(req)->drv_op =
> rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> req_to_mmc_queue_req(req)->drv_op_data = idata;
> req_to_mmc_queue_req(req)->ioc_count = n;
> blk_execute_rq(req, false);
> @@ -2808,6 +2811,7 @@ static int mmc_dbg_card_status_get(void *data, u64 *val)
> if (IS_ERR(req))
> return PTR_ERR(req);
> req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_CARD_STATUS;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> blk_execute_rq(req, false);
> ret = req_to_mmc_queue_req(req)->drv_op_result;
> if (ret >= 0) {
> @@ -2846,6 +2850,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp)
> goto out_free;
> }
> req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_GET_EXT_CSD;
> + req_to_mmc_queue_req(req)->drv_op_result = -EIO;
> req_to_mmc_queue_req(req)->drv_op_data = &ext_csd;
> blk_execute_rq(req, false);
> err = req_to_mmc_queue_req(req)->drv_op_result;
> --
> 2.37.3
>
>
> Hyperstone GmbH | Reichenaustr. 39a | 78467 Konstanz
> Managing Director: Dr. Jan Peter Berns.
> Commercial register of local courts: Freiburg HRB381782
>