forked from Minki/linux
dm: fix casting bug in dm_merge_bvec()
dm_merge_bvec() was originally added in f6fccb ("dm: introduce merge_bvec_fn"). In that commit a value in sectors is converted to bytes using << 9, and then assigned to an int. This code made assumptions about the value of BIO_MAX_SECTORS. A later commit 148e51 ("dm: improve documentation and code clarity in dm_merge_bvec") was meant to have no functional change but it removed the use of BIO_MAX_SECTORS in favor of using queue_max_sectors(). At this point the cast from sector_t to int resulted in a zero value. The fallout being dm_merge_bvec() would only allow a single page to be added to a bio. This interim fix is minimal for the benefit of stable@ because the more comprehensive cleanup of passing a sector_t to all DM targets' merge function will impact quite a few DM targets. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Cc: stable@vger.kernel.org # 3.19+
This commit is contained in:
parent
15b94a6904
commit
1c220c69ce
@ -1723,8 +1723,7 @@ static int dm_merge_bvec(struct request_queue *q,
|
||||
struct mapped_device *md = q->queuedata;
|
||||
struct dm_table *map = dm_get_live_table_fast(md);
|
||||
struct dm_target *ti;
|
||||
sector_t max_sectors;
|
||||
int max_size = 0;
|
||||
sector_t max_sectors, max_size = 0;
|
||||
|
||||
if (unlikely(!map))
|
||||
goto out;
|
||||
@ -1739,8 +1738,16 @@ static int dm_merge_bvec(struct request_queue *q,
|
||||
max_sectors = min(max_io_len(bvm->bi_sector, ti),
|
||||
(sector_t) queue_max_sectors(q));
|
||||
max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size;
|
||||
if (unlikely(max_size < 0)) /* this shouldn't _ever_ happen */
|
||||
max_size = 0;
|
||||
|
||||
/*
|
||||
* FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t
|
||||
* to the targets' merge function since it holds sectors not bytes).
|
||||
* Just doing this as an interim fix for stable@ because the more
|
||||
* comprehensive cleanup of switching to sector_t will impact every
|
||||
* DM target that implements a ->merge hook.
|
||||
*/
|
||||
if (max_size > INT_MAX)
|
||||
max_size = INT_MAX;
|
||||
|
||||
/*
|
||||
* merge_bvec_fn() returns number of bytes
|
||||
@ -1748,7 +1755,7 @@ static int dm_merge_bvec(struct request_queue *q,
|
||||
* max is precomputed maximal io size
|
||||
*/
|
||||
if (max_size && ti->type->merge)
|
||||
max_size = ti->type->merge(ti, bvm, biovec, max_size);
|
||||
max_size = ti->type->merge(ti, bvm, biovec, (int) max_size);
|
||||
/*
|
||||
* If the target doesn't support merge method and some of the devices
|
||||
* provided their merge_bvec method (we know this by looking for the
|
||||
|
Loading…
Reference in New Issue
Block a user