[PATCH] bio: fix argument of __bio_add_page() for max_sectors > 0xffff

[PATCH] bio: fix argument of __bio_add_page() for max_sectors > 0xffff

[Akinobu Mita]

The data type of max_sectors and max_hw_sectors in queue settings are
unsigned int.  But these values are passed to __bio_add_page() as an
argument whose data type is unsigned short.  In the worst case such as
max_sectors is 0x10000, bio_add_page() can't add a page and IOs can't
proceed.

Cc: Jens Axboe <axboe@kernel.dk>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
---
 fs/bio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/bio.c b/fs/bio.c
index 2bdb4e2..33d79a4 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -601,7 +601,7 @@ EXPORT_SYMBOL(bio_get_nr_vecs);
 
 static int __bio_add_page(struct request_queue *q, struct bio *bio, struct page
 			  *page, unsigned int len, unsigned int offset,
-			  unsigned short max_sectors)
+			  unsigned int max_sectors)
 {
 	int retried_segments = 0;
 	struct bio_vec *bvec;
-- 
1.8.3.2

Re: [PATCH] bio: fix argument of __bio_add_page() for max_sectors > 0xffff

[Jens Axboe]

On 11/18/2013 06:11 AM, Akinobu Mita wrote:
> The data type of max_sectors and max_hw_sectors in queue settings are
> unsigned int.  But these values are passed to __bio_add_page() as an
> argument whose data type is unsigned short.  In the worst case such as
> max_sectors is 0x10000, bio_add_page() can't add a page and IOs can't
> proceed.

Thanks, added. Even at 512b sectors, 0xffff sectors would be a huuuuge
page. So I don't think we'd ever see this bug hit, iirc huge pages are
still broken down for IO. But it's better to be safe...
-- 
Jens Axboe

Re: [PATCH] bio: fix argument of __bio_add_page() for max_sectors > 0xffff

[Akinobu Mita]

2013/11/19 Jens Axboe <axboe@kernel.dk>:
> On 11/18/2013 06:11 AM, Akinobu Mita wrote:
>> The data type of max_sectors and max_hw_sectors in queue settings are
>> unsigned int.  But these values are passed to __bio_add_page() as an
>> argument whose data type is unsigned short.  In the worst case such as
>> max_sectors is 0x10000, bio_add_page() can't add a page and IOs can't
>> proceed.
>
> Thanks, added. Even at 512b sectors, 0xffff sectors would be a huuuuge
> page. So I don't think we'd ever see this bug hit, iirc huge pages are
> still broken down for IO. But it's better to be safe...

I hit this when I was trying to change the data type of max_sectors in
scsi host settings from 16-bit to 32-bit.

BTW, I found that BLKSECTGET only returns 16-bit of max_sectors.  Should
we need the change like below?

        case BLKSECTGET:
-               return put_ushort(arg, queue_max_sectors(bdev_get_queue(bdev)));
+               max_sectors = min(0xffff,
+                                 queue_max_sectors(bdev_get_queue(bdev)));
+               return put_ushort(arg, max_sectors);