[PATCH 08/13] block: split encrypted bios at data unit boundaries

[Baokun Li <libaokun@linux.alibaba.com>]

Splitting a bio advances the remaining bio's data unit number by the
number of whole data units that were split off:

  bio_split()
   └─ bio_advance()
      └─ bio_crypt_advance()
         └─ bio_crypt_dun_increment(dun, bytes >> data_unit_size_bits)

The shift truncates, so splitting inside a data unit leaves the
remainder with the wrong data unit number and silently corrupts data.

The split size is already rounded down to the logical block size, so
this is only possible when the data unit size is larger than it, e.g.
a fscrypt filesystem with a 4K block size on a device with a 512-byte
logical block size.

Fix this by rounding the split size down to a data unit boundary.  The
split alignment becomes the maximum of the logical block size, the
data unit size, and the zone write granularity, so a zoned write still
meets all three requirements.

Split bios can be up to one data unit smaller than the queue limits
allow, so a bio can be split a little more often.  The number of
segments for the split bio is still counted up to the size before the
rounding, so it can be larger than needed; it is only used for
accounting.

Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq")
Cc: stable@vger.kernel.org
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
---
 block/blk-merge.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/block/blk-merge.c b/block/blk-merge.c
index 258a726071d1..f92460c283e7 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -308,9 +308,20 @@ static bool bvec_split_segs(const struct queue_limits *lim,
 static unsigned int bio_split_alignment(struct bio *bio,
 		const struct queue_limits *lim)
 {
+	const struct bio_crypt_ctx *bc = bio_crypt_ctx(bio);
+	unsigned int align = lim->logical_block_size;
+
+	/*
+	 * A split advances the remaining bio's data unit number by whole
+	 * data units only (see bio_crypt_advance()), so a split inside a
+	 * data unit would make it use the wrong data unit numbers.
+	 */
+	if (bc)
+		align = max(align, bc->bc_key->crypto_cfg.data_unit_size);
 	if (op_is_write(bio_op(bio)) && lim->zone_write_granularity)
-		return lim->zone_write_granularity;
-	return lim->logical_block_size;
+		align = max(align, lim->zone_write_granularity);
+
+	return align;
 }
 
 static inline unsigned int bvec_seg_gap(struct bio_vec *bvprv,
-- 
2.43.7