linux-kernel - Re: [PATCH] block: fix splitting segments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 7 Jan 2020 10:11:45 -0800
From:   Guenter Roeck <linux@...ck-us.net>
To:     Ming Lei <ming.lei@...hat.com>
Cc:     Jens Axboe <axboe@...nel.dk>, linux-block@...r.kernel.org,
        linux-kernel@...r.kernel.org, Chris Mason <clm@...com>
Subject: Re: [PATCH] block: fix splitting segments

On Tue, Jan 07, 2020 at 11:23:39PM +0800, Ming Lei wrote:
> On Tue, Jan 07, 2020 at 04:47:08AM -0800, Guenter Roeck wrote:
> > Hi,
> > 
> > On Sun, Dec 29, 2019 at 10:32:30AM +0800, Ming Lei wrote:
> > > There are two issues in get_max_segment_size():
> > > 
> > > 1) the default segment boudary mask is bypassed, and some devices still
> > > require segment to not cross the default 4G boundary
> > > 
> > > 2) the segment start address isn't taken into account when checking
> > > segment boundary limit
> > > 
> > > Fixes the two issues.
> > > 
> > > Fixes: dcebd755926b ("block: use bio_for_each_bvec() to compute multi-page bvec count")
> > > Signed-off-by: Ming Lei <ming.lei@...hat.com>
> > 
> > This patch, pushed into mainline as "block: fix splitting segments on
> > boundary masks", results in the following crash when booting 'versatilepb'
> > in qemu from disk. Bisect log is attached. Detailed log is at
> > https://kerneltests.org/builders/qemu-arm-master/builds/1410/steps/qemubuildcommand/logs/stdio
> > 
> > Guenter
> > 
> > ---
> > Crash:
> > 
> > kernel BUG at block/bio.c:1885!
> > Internal error: Oops - BUG: 0 [#1] ARM
> 
> Please apply the following debug patch, and post the log.
> 

Here you are:

max_sectors 2560 max_segs 96 max_seg_size 65536 mask ffffffff
c738da80: 8c80/0 2416 28672, 0
         total sectors 56

(I replaced %p with %px).

Guenter

> diff --git a/block/blk-merge.c b/block/blk-merge.c
> index 347782a24a35..c4aa683a1c20 100644
> --- a/block/blk-merge.c
> +++ b/block/blk-merge.c
> @@ -217,6 +217,33 @@ static bool bvec_split_segs(const struct request_queue *q,
>  	return len > 0 || bv->bv_len > max_len;
>  }
>  
> +static void blk_dump_bio(struct request_queue *q, struct bio *bio,
> +		unsigned secs)
> +{
> +	struct bvec_iter iter;
> +	struct bio_vec bvec;
> +	int i = 0;
> +	unsigned sectors = 0;
> +
> +	printk("max_sectors %u max_segs %u max_seg_size %u mask %lx\n",
> +			get_max_io_size(q, bio), queue_max_segments(q),
> +			queue_max_segment_size(q), queue_segment_boundary(q));
> +	printk("%p: %hx/%hx %llu %u, %u\n",
> +                       bio,
> +                       bio->bi_flags, bio->bi_opf,
> +                       (unsigned long long)bio->bi_iter.bi_sector,
> +                       bio->bi_iter.bi_size, secs);
> +	bio_for_each_bvec(bvec, bio, iter) {
> +		sectors += bvec.bv_len >> 9;
> +		trace_printk("\t %d: %lu %u %u(%u)\n", i++,
> +				(unsigned long)page_to_pfn(bvec.bv_page),
> +				bvec.bv_offset,
> +				bvec.bv_len, bvec.bv_len >> 12);
> +	}
> +	printk("\t total sectors %u\n", sectors);
> +}
> +
> +
>  /**
>   * blk_bio_segment_split - split a bio in two bios
>   * @q:    [in] request queue pointer
> @@ -273,6 +300,9 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
>  	return NULL;
>  split:
>  	*segs = nsegs;
> +
> +	if (sectors <= 0 || sectors >= bio_sectors(bio))
> +		blk_dump_bio(q, bio, sectors);
>  	return bio_split(bio, sectors, GFP_NOIO, bs);
>  }
>  
> 
> Thanks,
> Ming
>