Commit 4800bf7b authored by Dave Chinner's avatar Dave Chinner Committed by Jens Axboe

block: fix 32 bit overflow in __blkdev_issue_discard()

A discard cleanup merged into 4.20-rc2 causes fstests xfs/259 to
fall into an endless loop in the discard code. The test is creating
a device that is exactly 2^32 sectors in size to test mkfs boundary
conditions around the 32 bit sector overflow region.

mkfs issues a discard for the entire device size by default, and
hence this throws a sector count of 2^32 into
blkdev_issue_discard(). It takes the number of sectors to discard as
a sector_t - a 64 bit value.

The commit ba5d7385 ("block: cleanup __blkdev_issue_discard")
takes this sector count and casts it to a 32 bit value before
comapring it against the maximum allowed discard size the device
has. This truncates away the upper 32 bits, and so if the lower 32
bits of the sector count is zero, it starts issuing discards of
length 0. This causes the code to fall into an endless loop, issuing
a zero length discards over and over again on the same sector.

Fixes: ba5d7385 ("block: cleanup __blkdev_issue_discard")
Tested-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>

Killed pointless WARN_ON().
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 410b5c7b
...@@ -55,9 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, ...@@ -55,9 +55,11 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
return -EINVAL; return -EINVAL;
while (nr_sects) { while (nr_sects) {
unsigned int req_sects = min_t(unsigned int, nr_sects, sector_t req_sects = min_t(sector_t, nr_sects,
bio_allowed_max_sectors(q)); bio_allowed_max_sectors(q));
WARN_ON_ONCE((req_sects << 9) > UINT_MAX);
bio = blk_next_bio(bio, 0, gfp_mask); bio = blk_next_bio(bio, 0, gfp_mask);
bio->bi_iter.bi_sector = sector; bio->bi_iter.bi_sector = sector;
bio_set_dev(bio, bdev); bio_set_dev(bio, bdev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment