Christoph reported that we'll likely trigger the WARN_ON_ONCE() checking
that we're not submitting a bvec with REQ_OP_ZONE_APPEND in
bio_iov_iter_get_pages() some time ago using zoned btrfs, but I couldn't
reproduce it back then.
Now Naohiro was able to trigger the bug as well with xfstests generic/095
on a zoned btrfs.
There is nothing that prevents bvec submissions via REQ_OP_ZONE_APPEND if
the hardware's zone append limit is met.
Reported-by: Naohiro Aota <naohiro.aota@xxxxxxx>
Reported-by: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@xxxxxxx>
---
block/bio.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/block/bio.c b/block/bio.c
index 26b7f721cda8..215fe24a01ee 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1094,8 +1094,14 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter)
int ret = 0;
if (iov_iter_is_bvec(iter)) {
- if (WARN_ON_ONCE(bio_op(bio) == REQ_OP_ZONE_APPEND))
- return -EINVAL;
+ if (bio_op(bio) == REQ_OP_ZONE_APPEND) {
+ struct request_queue *q = bio->bi_bdev->bd_disk->queue;
+ unsigned int max_append =
+ queue_max_zone_append_sectors(q) << 9;
+
+ if (WARN_ON_ONCE(iter->count > max_append))
+ return -EINVAL;
+ }
return bio_iov_bvec_set(bio, iter);
}
--
2.30.0
