lkml.org 
[lkml]   [2021]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 119/152] nvme-tcp: fix possible data corruption with bio merges
    Date
    From: Sagi Grimberg <sagi@grimberg.me>

    commit ca1ff67d0fb14f39cf0cc5102b1fbcc3b14f6fb9 upstream.

    When a bio merges, we can get a request that spans multiple
    bios, and the overall request payload size is the sum of
    all bios. When we calculate how much we need to send
    from the existing bio (and bvec), we did not take into
    account the iov_iter byte count cap.

    Since multipage bvecs support, bvecs can split in the middle
    which means that when we account for the last bvec send we
    should also take the iov_iter byte count cap as it might be
    lower than the last bvec size.

    Reported-by: Hao Wang <pkuwangh@gmail.com>
    Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
    Tested-by: Hao Wang <pkuwangh@gmail.com>
    Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/nvme/host/tcp.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/nvme/host/tcp.c
    +++ b/drivers/nvme/host/tcp.c
    @@ -201,7 +201,7 @@ static inline size_t nvme_tcp_req_cur_of

    static inline size_t nvme_tcp_req_cur_length(struct nvme_tcp_request *req)
    {
    - return min_t(size_t, req->iter.bvec->bv_len - req->iter.iov_offset,
    + return min_t(size_t, iov_iter_single_seg_count(&req->iter),
    req->pdu_len - req->pdu_sent);
    }


    \
     
     \ /
      Last update: 2021-01-18 13:36    [W:4.013 / U:1.640 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site