* [PATCH 2/8] mmc: fix max_discard_sectors
@ 2013-04-13 13:38 Namjae Jeon
2013-04-15 7:20 ` Adrian Hunter
0 siblings, 1 reply; 3+ messages in thread
From: Namjae Jeon @ 2013-04-13 13:38 UTC (permalink / raw)
To: dwmw2, axboe, shli, Paul.Clements, npiggin, neilb, cjb,
adrian.hunter
Cc: linux-mtd, nbd-general, linux-raid, linux-mmc, linux-kernel,
Namjae Jeon, Namjae Jeon, Vivek Trivedi
From: Namjae Jeon <namjae.jeon@samsung.com>
https://lkml.org/lkml/2013/4/1/292
As per above discussion, there is possibility that request's __data_len
field may overflow when max_discard_sectors greater than UINT_MAX >> 9
If multiple discard requests get merged, merged discard request's
size exceeds 4GB, there is possibility that merged discard request's
__data_len field may overflow.
This patch fixes this issue.
Reported-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Vivek Trivedi <t.vivek@samsung.com>
Tested-by: Max Filippov <jcmvbkbc@gmail.com>
---
drivers/mmc/card/queue.c | 2 +-
drivers/mmc/core/core.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index 9447a0e..54726b7 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -166,7 +166,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
return;
queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
- q->limits.max_discard_sectors = max_discard;
+ blk_queue_max_discard_sectors(q, max_discard);
if (card->erased_byte == 0 && !mmc_can_discard(card))
q->limits.discard_zeroes_data = 1;
q->limits.discard_granularity = card->pref_erase << 9;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 7b435a3..6ee530c 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2058,7 +2058,7 @@ static unsigned int mmc_do_calc_max_discard(struct mmc_card *card,
if (card->erase_shift)
max_qty = UINT_MAX >> card->erase_shift;
else if (mmc_card_sd(card))
- max_qty = UINT_MAX;
+ max_qty = UINT_MAX >> 9;
else
max_qty = UINT_MAX / card->erase_size;
@@ -2100,7 +2100,7 @@ unsigned int mmc_calc_max_discard(struct mmc_card *card)
unsigned int max_discard, max_trim;
if (!host->max_discard_to)
- return UINT_MAX;
+ return UINT_MAX >> 9;
/*
* Without erase_group_def set, MMC erase timeout depends on clock
--
1.7.9.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 2/8] mmc: fix max_discard_sectors
2013-04-13 13:38 [PATCH 2/8] mmc: fix max_discard_sectors Namjae Jeon
@ 2013-04-15 7:20 ` Adrian Hunter
2013-04-15 7:52 ` Namjae Jeon
0 siblings, 1 reply; 3+ messages in thread
From: Adrian Hunter @ 2013-04-15 7:20 UTC (permalink / raw)
To: Namjae Jeon
Cc: dwmw2, axboe, shli, Paul.Clements, npiggin, neilb, cjb, linux-mtd,
nbd-general, linux-raid, linux-mmc, linux-kernel, Namjae Jeon,
Vivek Trivedi
On 13/04/13 16:38, Namjae Jeon wrote:
> From: Namjae Jeon <namjae.jeon@samsung.com>
>
> https://lkml.org/lkml/2013/4/1/292
> As per above discussion, there is possibility that request's __data_len
> field may overflow when max_discard_sectors greater than UINT_MAX >> 9
>
> If multiple discard requests get merged, merged discard request's
> size exceeds 4GB, there is possibility that merged discard request's
> __data_len field may overflow.
>
> This patch fixes this issue.
>
> Reported-by: Max Filippov <jcmvbkbc@gmail.com>
> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
> Signed-off-by: Vivek Trivedi <t.vivek@samsung.com>
> Tested-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
> drivers/mmc/card/queue.c | 2 +-
> drivers/mmc/core/core.c | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
> index 9447a0e..54726b7 100644
> --- a/drivers/mmc/card/queue.c
> +++ b/drivers/mmc/card/queue.c
> @@ -166,7 +166,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
> return;
>
> queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
> - q->limits.max_discard_sectors = max_discard;
> + blk_queue_max_discard_sectors(q, max_discard);
> if (card->erased_byte == 0 && !mmc_can_discard(card))
> q->limits.discard_zeroes_data = 1;
> q->limits.discard_granularity = card->pref_erase << 9;
> diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
> index 7b435a3..6ee530c 100644
> --- a/drivers/mmc/core/core.c
> +++ b/drivers/mmc/core/core.c
> @@ -2058,7 +2058,7 @@ static unsigned int mmc_do_calc_max_discard(struct mmc_card *card,
> if (card->erase_shift)
> max_qty = UINT_MAX >> card->erase_shift;
> else if (mmc_card_sd(card))
> - max_qty = UINT_MAX;
> + max_qty = UINT_MAX >> 9;
No. This function calculates max discard for the card not the block layer.
Apply the block layer limitation at the block layer interface e.g.
in mmc_queue_setup_discard()
> else
> max_qty = UINT_MAX / card->erase_size;
>
> @@ -2100,7 +2100,7 @@ unsigned int mmc_calc_max_discard(struct mmc_card *card)
> unsigned int max_discard, max_trim;
>
> if (!host->max_discard_to)
> - return UINT_MAX;
> + return UINT_MAX >> 9;
Ditto.
>
> /*
> * Without erase_group_def set, MMC erase timeout depends on clock
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 2/8] mmc: fix max_discard_sectors
2013-04-15 7:20 ` Adrian Hunter
@ 2013-04-15 7:52 ` Namjae Jeon
0 siblings, 0 replies; 3+ messages in thread
From: Namjae Jeon @ 2013-04-15 7:52 UTC (permalink / raw)
To: Adrian Hunter
Cc: dwmw2, axboe, shli, Paul.Clements, npiggin, neilb, cjb, linux-mtd,
nbd-general, linux-raid, linux-mmc, linux-kernel, Namjae Jeon,
Vivek Trivedi
2013/4/15, Adrian Hunter <adrian.hunter@intel.com>:
> On 13/04/13 16:38, Namjae Jeon wrote:
>> From: Namjae Jeon <namjae.jeon@samsung.com>
>>
>> https://lkml.org/lkml/2013/4/1/292
>> As per above discussion, there is possibility that request's __data_len
>> field may overflow when max_discard_sectors greater than UINT_MAX >> 9
>>
>> If multiple discard requests get merged, merged discard request's
>> size exceeds 4GB, there is possibility that merged discard request's
>> __data_len field may overflow.
>>
>> This patch fixes this issue.
>>
>> Reported-by: Max Filippov <jcmvbkbc@gmail.com>
>> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
>> Signed-off-by: Vivek Trivedi <t.vivek@samsung.com>
>> Tested-by: Max Filippov <jcmvbkbc@gmail.com>
>> ---
>> drivers/mmc/card/queue.c | 2 +-
>> drivers/mmc/core/core.c | 4 ++--
>> 2 files changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
>> index 9447a0e..54726b7 100644
>> --- a/drivers/mmc/card/queue.c
>> +++ b/drivers/mmc/card/queue.c
>> @@ -166,7 +166,7 @@ static void mmc_queue_setup_discard(struct
>> request_queue *q,
>> return;
>>
>> queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
>> - q->limits.max_discard_sectors = max_discard;
>> + blk_queue_max_discard_sectors(q, max_discard);
>> if (card->erased_byte == 0 && !mmc_can_discard(card))
>> q->limits.discard_zeroes_data = 1;
>> q->limits.discard_granularity = card->pref_erase << 9;
>> diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
>> index 7b435a3..6ee530c 100644
>> --- a/drivers/mmc/core/core.c
>> +++ b/drivers/mmc/core/core.c
>> @@ -2058,7 +2058,7 @@ static unsigned int mmc_do_calc_max_discard(struct
>> mmc_card *card,
>> if (card->erase_shift)
>> max_qty = UINT_MAX >> card->erase_shift;
>> else if (mmc_card_sd(card))
>> - max_qty = UINT_MAX;
>> + max_qty = UINT_MAX >> 9;
>
> No. This function calculates max discard for the card not the block layer.
> Apply the block layer limitation at the block layer interface e.g.
> in mmc_queue_setup_discard()
Hi Adrian,
Okay, I will remove change in mmc_do_calc_max_discard and mmc_calc_max_discard.
>> @@ -166,7 +166,7 @@ static void mmc_queue_setup_discard(struct
>> request_queue *q,
>> return;
>>
>> queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
>> - q->limits.max_discard_sectors = max_discard;
>> + blk_queue_max_discard_sectors(q, max_discard);
>> if (card->erased_byte == 0 && !mmc_can_discard(card))
>> q->limits.discard_zeroes_data = 1;
Above change will handle max discard sectors as we have updated
blk_queue_max_discard_sectors to check upper limit of max discard
sectors as UINT_MAX >> 9.
Thanks.
>
>> else
>> max_qty = UINT_MAX / card->erase_size;
>>
>> @@ -2100,7 +2100,7 @@ unsigned int mmc_calc_max_discard(struct mmc_card
>> *card)
>> unsigned int max_discard, max_trim;
>>
>> if (!host->max_discard_to)
>> - return UINT_MAX;
>> + return UINT_MAX >> 9;
>
> Ditto.
>
>>
>> /*
>> * Without erase_group_def set, MMC erase timeout depends on clock
>>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-04-15 7:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-04-13 13:38 [PATCH 2/8] mmc: fix max_discard_sectors Namjae Jeon
2013-04-15 7:20 ` Adrian Hunter
2013-04-15 7:52 ` Namjae Jeon
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox