bcache integer overflow for large devices w/small io_opt

[Ken Raeburn <raeburn@redhat.com>]

The long version is written up at
https://bugzilla.redhat.com/show_bug.cgi?id=1783075 but the short
version:

There are devices out there which set q->limits.io_opt to small values
like 4096 bytes, causing bcache to use that for the stripe size, but the
device size could still be large enough that the computed stripe count
is 2**32 or more. That value gets stuffed into a 32-bit (unsigned int)
field, throwing away the high bits, and then that truncated value is
range-checked and used. This can result in memory corruption or faults
in some cases.

The problem was brought up with us on Red Hat's VDO driver team by a
bcache user on a 4.17.8 kernel, has been demonstrated in the Fedora
5.3.15-300.fc31 kernel, and by inspection appears to be present in
Linus's tree as of this morning.

The easy fix would be to keep the quotient in a 64-bit variable until
it's validated, but that would simply limit the size of such devices as
bcache backing storage (in this case, limiting VDO volumes to under 8
TB). Is there a way to still be able to use larger devices? Perhaps
scale up the stripe size from io_opt to the point where the stripe count
falls in the allowed range?

Ken Raeburn
(Red Hat VDO driver developer)