Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c220c69 authored by Joe Thornber's avatar Joe Thornber Committed by Mike Snitzer
Browse files

dm: fix casting bug in dm_merge_bvec() 



dm_merge_bvec() was originally added in f6fccb ("dm: introduce
merge_bvec_fn").  In that commit a value in sectors is converted to
bytes using << 9, and then assigned to an int.  This code made
assumptions about the value of BIO_MAX_SECTORS.

A later commit 148e51 ("dm: improve documentation and code clarity in
dm_merge_bvec") was meant to have no functional change but it removed
the use of BIO_MAX_SECTORS in favor of using queue_max_sectors().  At
this point the cast from sector_t to int resulted in a zero value.  The
fallout being dm_merge_bvec() would only allow a single page to be added
to a bio.

This interim fix is minimal for the benefit of stable@ because the more
comprehensive cleanup of passing a sector_t to all DM targets' merge
function will impact quite a few DM targets.

Signed-off-by: default avatarJoe Thornber <ejt@redhat.com>
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org # 3.19+
parent 15b94a69

drivers/md/dm.c

+12 −5
Original line number Diff line number Diff line
@@ -1723,8 +1723,7 @@ static int dm_merge_bvec(struct request_queue *q, 
	struct mapped_device *md = q->queuedata;

	struct dm_table *map = dm_get_live_table_fast(md);

	struct dm_target *ti;

	sector_t max_sectors;

	int max_size = 0;

	sector_t max_sectors, max_size = 0;



	if (unlikely(!map))

		goto out;
@@ -1739,8 +1738,16 @@ static int dm_merge_bvec(struct request_queue *q, 
	max_sectors = min(max_io_len(bvm->bi_sector, ti),

			  (sector_t) queue_max_sectors(q));

	max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size;

	if (unlikely(max_size < 0)) /* this shouldn't _ever_ happen */

		max_size = 0;



	/*

	 * FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t

	 * to the targets' merge function since it holds sectors not bytes).

	 * Just doing this as an interim fix for stable@ because the more

	 * comprehensive cleanup of switching to sector_t will impact every

	 * DM target that implements a ->merge hook.

	 */

	if (max_size > INT_MAX)

		max_size = INT_MAX;



	/*

	 * merge_bvec_fn() returns number of bytes
@@ -1748,7 +1755,7 @@ static int dm_merge_bvec(struct request_queue *q, 
	 * max is precomputed maximal io size

	 */

	if (max_size && ti->type->merge)

		max_size = ti->type->merge(ti, bvm, biovec, max_size);

		max_size = ti->type->merge(ti, bvm, biovec, (int) max_size);

	/*

	 * If the target doesn't support merge method and some of the devices

	 * provided their merge_bvec method (we know this by looking for the