From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754576AbcIUVwc (ORCPT <rfc822;w@1wt.eu>);
        Wed, 21 Sep 2016 17:52:32 -0400
Received: from zeniv.linux.org.uk ([195.92.253.2]:48252 "EHLO
        ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753799AbcIUVw2 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 21 Sep 2016 17:52:28 -0400
Date: Wed, 21 Sep 2016 22:52:26 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Jens Axboe <axboe@kernel.dk>
Cc: linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [rfc] weirdness in bio_map_user_iov()
Message-ID: <20160921215226.GU2356@ZenIV.linux.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.6.1 (2016-04-27)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

What happens if we feed it a 3-element iovec array, one page in each?
AFAICS, bio_add_pc_page() is called for each of those pages, even if
the previous calls have failed - break is only out of the inner loop.

Sure, failure due to exceeded request size means that everything after
that one will fail, but what of e.g.
                /*
                 * If the queue doesn't support SG gaps and adding this
                 * offset would create a gap, disallow it.
                 */
                if (bvec_gap_to_prev(q, prev, offset))
                        return 0;
in there?  Won't we risk having the first and the third pages added, with
the second one quietly skipped?  Jens, looks like it had come from you
(by way of jejb).  Am I missing something subtle here?