On Sun, Sep 24, 2017 at 03:27:39PM +0100, Al Viro wrote: > At the very least, we need bmd->iter = *iter; bmd->iter.iov = bmd->iov; > instead of that iov_iter_init() in there. I'm not sure how far back does > it go; looks like "block: support large requests in blk_rq_map_user_iov" > is the earliest possible point, but it might need more digging to make > sure. v4.5+, if that's when the problems began... > > Anyway, I'd added the obvious fix to #work.iov_iter, reordered it and > force-pushed the result. While we are at it, calculation of nr_pages in bio_copy_user_iov() is bloody odd - why, in the name of everything unholy, does it care about the iovec boundaries in there? We are copying data anyway; why does allocation of bio care about the fragmentation of the other end of copying? Shouldn't it be simply max(DIV_ROUND_UP(offset + len, PAGE_SIZE), BIO_MAX_PAGES)?
