Re: [PATCH v2] block: Improve limiting the bio size

[Jens Axboe <axboe@kernel.dk>]

On 4/24/21 10:30 PM, Bart Van Assche wrote:
> bio_max_size() may get called before device_add_disk() and hence needs to
> check whether or not the block device pointer is NULL. Additionally, more
> code needs to be modified than __bio_try_merge_page() to limit the bio size
> to bio_max_size().
> 
> This patch prevents that bio_max_size() triggers the following kernel
> crash during a SCSI LUN scan:
> 
> BUG: KASAN: null-ptr-deref in bio_add_hw_page+0xa6/0x310
> Read of size 8 at addr 00000000000005a8 by task kworker/u16:0/7
> Workqueue: events_unbound async_run_entry_fn
> Call Trace:
>  show_stack+0x52/0x58
>  dump_stack+0x9d/0xcf
>  kasan_report.cold+0x4b/0x50
>  __asan_load8+0x69/0x90
>  bio_add_hw_page+0xa6/0x310
>  bio_add_pc_page+0xaa/0xe0
>  bio_map_kern+0xdc/0x1a0
>  blk_rq_map_kern+0xcd/0x2d0
>  __scsi_execute+0x9a/0x290 [scsi_mod]
>  scsi_probe_lun.constprop.0+0x17c/0x660 [scsi_mod]
>  scsi_probe_and_add_lun+0x178/0x750 [scsi_mod]
>  __scsi_add_device+0x18c/0x1a0 [scsi_mod]
>  ata_scsi_scan_host+0xe5/0x260 [libata]
>  async_port_probe+0x94/0xb0 [libata]
>  async_run_entry_fn+0x7d/0x2d0
>  process_one_work+0x582/0xac0
>  worker_thread+0x8f/0x5a0
>  kthread+0x222/0x250
>  ret_from_fork+0x1f/0x30
> 
> This patch also fixes the following kernel warning:
> 
> WARNING: CPU: 1 PID: 15449 at block/bio.c:1034
> __bio_iov_iter_get_pages+0x324/0x350
> Call Trace:
>  bio_iov_iter_get_pages+0x6c/0x360
>  __blkdev_direct_IO_simple+0x291/0x580
>  blkdev_direct_IO+0xb5/0xc0
>  generic_file_direct_write+0x10d/0x290
>  __generic_file_write_iter+0x120/0x290
>  blkdev_write_iter+0x16e/0x280
>  new_sync_write+0x268/0x380
>  vfs_write+0x3e0/0x4f0
>  ksys_write+0xd9/0x180
>  __x64_sys_write+0x43/0x50
>  do_syscall_64+0x32/0x80
>  entry_SYSCALL_64_after_hwframe+0x44/0xae

Since I had to shuffle patches anyway, I folded in this fix. Thanks
Bart.

-- 
Jens Axboe