From: Bart Van Assche <bvanassche@acm.org>
To: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
Bart Van Assche <bvanassche@acm.org>,
Ming Lei <ming.lei@redhat.com>,
Changheun Lee <nanich.lee@samsung.com>,
Jaegeuk Kim <jaegeuk@kernel.org>
Subject: [PATCH v2] block: Improve limiting the bio size
Date: Sat, 24 Apr 2021 21:30:20 -0700 [thread overview]
Message-ID: <20210425043020.30065-1-bvanassche@acm.org> (raw)
bio_max_size() may get called before device_add_disk() and hence needs to
check whether or not the block device pointer is NULL. Additionally, more
code needs to be modified than __bio_try_merge_page() to limit the bio size
to bio_max_size().
This patch prevents that bio_max_size() triggers the following kernel
crash during a SCSI LUN scan:
BUG: KASAN: null-ptr-deref in bio_add_hw_page+0xa6/0x310
Read of size 8 at addr 00000000000005a8 by task kworker/u16:0/7
Workqueue: events_unbound async_run_entry_fn
Call Trace:
show_stack+0x52/0x58
dump_stack+0x9d/0xcf
kasan_report.cold+0x4b/0x50
__asan_load8+0x69/0x90
bio_add_hw_page+0xa6/0x310
bio_add_pc_page+0xaa/0xe0
bio_map_kern+0xdc/0x1a0
blk_rq_map_kern+0xcd/0x2d0
__scsi_execute+0x9a/0x290 [scsi_mod]
scsi_probe_lun.constprop.0+0x17c/0x660 [scsi_mod]
scsi_probe_and_add_lun+0x178/0x750 [scsi_mod]
__scsi_add_device+0x18c/0x1a0 [scsi_mod]
ata_scsi_scan_host+0xe5/0x260 [libata]
async_port_probe+0x94/0xb0 [libata]
async_run_entry_fn+0x7d/0x2d0
process_one_work+0x582/0xac0
worker_thread+0x8f/0x5a0
kthread+0x222/0x250
ret_from_fork+0x1f/0x30
This patch also fixes the following kernel warning:
WARNING: CPU: 1 PID: 15449 at block/bio.c:1034
__bio_iov_iter_get_pages+0x324/0x350
Call Trace:
bio_iov_iter_get_pages+0x6c/0x360
__blkdev_direct_IO_simple+0x291/0x580
blkdev_direct_IO+0xb5/0xc0
generic_file_direct_write+0x10d/0x290
__generic_file_write_iter+0x120/0x290
blkdev_write_iter+0x16e/0x280
new_sync_write+0x268/0x380
vfs_write+0x3e0/0x4f0
ksys_write+0xd9/0x180
__x64_sys_write+0x43/0x50
do_syscall_64+0x32/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Changheun Lee <nanich.lee@samsung.com>
Cc: Jaegeuk Kim <jaegeuk@kernel.org>
Fixes: 15050b63567c ("bio: limit bio max size")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
block/bio.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
Changes compared to v1: included a fix for direct I/O.
diff --git a/block/bio.c b/block/bio.c
index d718c63b3533..221dc56ba22f 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -257,9 +257,9 @@ EXPORT_SYMBOL(bio_init);
unsigned int bio_max_size(struct bio *bio)
{
- struct request_queue *q = bio->bi_bdev->bd_disk->queue;
+ struct block_device *bdev = bio->bi_bdev;
- return q->limits.bio_max_bytes;
+ return bdev ? bdev->bd_disk->queue->limits.bio_max_bytes : UINT_MAX;
}
/**
@@ -1002,6 +1002,7 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
{
unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt;
unsigned short entries_left = bio->bi_max_vecs - bio->bi_vcnt;
+ unsigned int bytes_left = bio_max_size(bio) - bio->bi_iter.bi_size;
struct bio_vec *bv = bio->bi_io_vec + bio->bi_vcnt;
struct page **pages = (struct page **)bv;
bool same_page = false;
@@ -1017,7 +1018,8 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
BUILD_BUG_ON(PAGE_PTRS_PER_BVEC < 2);
pages += entries_left * (PAGE_PTRS_PER_BVEC - 1);
- size = iov_iter_get_pages(iter, pages, LONG_MAX, nr_pages, &offset);
+ size = iov_iter_get_pages(iter, pages, bytes_left, nr_pages,
+ &offset);
if (unlikely(size <= 0))
return size ? size : -EFAULT;
next reply other threads:[~2021-04-25 4:30 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-25 4:30 Bart Van Assche [this message]
2021-04-25 7:36 ` [PATCH v2] block: Improve limiting the bio size Yi Zhang
2021-04-25 16:19 ` Jens Axboe
2021-04-26 6:32 ` Yi Zhang
[not found] ` <CGME20210426085241epcas1p46ed8de18a98c40218dacd58fc4b25ff9@epcas1p4.samsung.com>
2021-04-26 8:34 ` Changheun Lee
2021-04-26 16:17 ` Bart Van Assche
[not found] ` <CGME20210427004655epcas1p15cc4b2be6312c4762272474908607722@epcas1p1.samsung.com>
2021-04-27 0:28 ` Changheun Lee
2021-04-27 2:46 ` Bart Van Assche
[not found] ` <CGME20210427043022epcas1p47f11139bc1e08925bcbbdca79e5c8e36@epcas1p4.samsung.com>
2021-04-27 4:12 ` Changheun Lee
2021-04-27 14:59 ` Bart Van Assche
[not found] ` <CGME20210428073921epcas1p2b161b5ccc9d7ec61c1200155da95c5b9@epcas1p2.samsung.com>
2021-04-28 7:21 ` Changheun Lee
2021-04-28 15:52 ` Bart Van Assche
[not found] ` <CGME20210429065701epcas1p363667a6f0c598f27bb5afde32473ea39@epcas1p3.samsung.com>
2021-04-29 6:39 ` Changheun Lee
[not found] ` <CGME20210503094654epcas1p3ce7761e2f0fc304d1c08a9b0bf0485ff@epcas1p3.samsung.com>
2021-05-03 9:28 ` Changheun Lee
2021-05-03 16:35 ` Bart Van Assche
2021-04-26 12:54 ` Jens Axboe
[not found] ` <CGME20210427000106epcas1p3f39e318e9211bf3378b3e4afad2de56e@epcas1p3.samsung.com>
2021-04-26 23:43 ` Changheun Lee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210425043020.30065-1-bvanassche@acm.org \
--to=bvanassche@acm.org \
--cc=axboe@kernel.dk \
--cc=hch@lst.de \
--cc=jaegeuk@kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=ming.lei@redhat.com \
--cc=nanich.lee@samsung.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).