Commit 6bedf00e authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe

block: make sure that bvec length can't be overflow

bvec->bv_offset may be bigger than PAGE_SIZE sometimes, such as,
when one bio is splitted in the middle of one bvec via bio_split(),
and bi_iter.bi_bvec_done is used to build offset of the 1st bvec of
remained bio. And the remained bio's bvec may be re-submitted to fs
layer via ITER_IBVEC, such as loop and nvme-loop.

So we have to make sure that every bvec's offset is less than
PAGE_SIZE from bio_for_each_segment_all() because some drivers(loop,
nvme-loop) passes the splitted bvec to fs layer via ITER_BVEC.

This patch fixes this issue reported by Zhang Yi When running nvme/011.

Cc: Christoph Hellwig <hch@lst.de>
Cc: Yi Zhang <yi.zhang@redhat.com>
Reported-by: default avatarYi Zhang <yi.zhang@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Fixes: 6dc4f100 ("block: allow bio_for_each_segment_all() to iterate over multi-page bvec")
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent b40fabc0
...@@ -160,8 +160,9 @@ static inline void bvec_advance(const struct bio_vec *bvec, ...@@ -160,8 +160,9 @@ static inline void bvec_advance(const struct bio_vec *bvec,
bv->bv_page = nth_page(bv->bv_page, 1); bv->bv_page = nth_page(bv->bv_page, 1);
bv->bv_offset = 0; bv->bv_offset = 0;
} else { } else {
bv->bv_page = bvec->bv_page; bv->bv_page = bvec_nth_page(bvec->bv_page, bvec->bv_offset /
bv->bv_offset = bvec->bv_offset; PAGE_SIZE);
bv->bv_offset = bvec->bv_offset & ~PAGE_MASK;
} }
bv->bv_len = min_t(unsigned int, PAGE_SIZE - bv->bv_offset, bv->bv_len = min_t(unsigned int, PAGE_SIZE - bv->bv_offset,
bvec->bv_len - iter_all->done); bvec->bv_len - iter_all->done);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment