The patch titled Subject: block/bio.c: update bi_iter.bi_size before recounting segments has been removed from the -mm tree. Its filename was bio-modify-__bio_add_page-to-accept-pages-that-dont-start-a-new-segment-fix.patch This patch was dropped because it was folded into bio-modify-__bio_add_page-to-accept-pages-that-dont-start-a-new-segment.patch ------------------------------------------------------ From: Ming Lei <ming.lei@xxxxxxxxxxxxx> Subject: block/bio.c: update bi_iter.bi_size before recounting segments The patch of "bio: modify __bio_add_page() to accept pages that don't start a new segment" changes the way for adding one page to bio: - previously by adding page after checking successfully - now by trying to add page and recover if it fails Unfortunately the patch forgets to update bio->bi_iter.bi_size before trying to add page, then the last vector for holding the added page may not be covered if recouning segments is needed, so bio->bi_phys_segments may become not consistent with the actual bio page buffers after the page is added successfully to the bio(after bi_iter.bi_size is added by 'len') Suppose the page in the last vector can't be merged to bio, tragedy will happen when __bio_add_page() is called to add another page: - blk_recount_segments() is called and the actual segments get figured out correctly - the actual segments may become queue_max_segments(q) plus one in failure path - driver will find the segment count is too big to handle. The patch fixes the virtio-blk oops bug reported from Jet Chen in below link: http://marc.info/?l=linux-kernel&m=140113053817095&w=2 Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxxxxx> Reported-by: Jet Chen <jet.chen@xxxxxxxxx> Tested-by: Jet Chen <jet.chen@xxxxxxxxx> Cc: Jens Axboe <axboe@xxxxxxxxx> Cc: Maurizio Lombardi <mlombard@xxxxxxxxxx> Tested-by: Dongsu Park <dongsu.park@xxxxxxxxxxxxxxxx> Cc: Christoph Hellwig <hch@xxxxxx> Cc: Kent Overstreet <kmo@xxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- block/bio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff -puN block/bio.c~bio-modify-__bio_add_page-to-accept-pages-that-dont-start-a-new-segment-fix block/bio.c --- a/block/bio.c~bio-modify-__bio_add_page-to-accept-pages-that-dont-start-a-new-segment-fix +++ a/block/bio.c @@ -744,6 +744,7 @@ static int __bio_add_page(struct request } } + bio->bi_iter.bi_size += len; goto done; } } @@ -761,6 +762,7 @@ static int __bio_add_page(struct request bvec->bv_offset = offset; bio->bi_vcnt++; bio->bi_phys_segments++; + bio->bi_iter.bi_size += len; /* * Perform a recount if the number of segments is greater @@ -802,7 +804,6 @@ static int __bio_add_page(struct request bio->bi_flags &= ~(1 << BIO_SEG_VALID); done: - bio->bi_iter.bi_size += len; return len; failed: @@ -810,6 +811,7 @@ static int __bio_add_page(struct request bvec->bv_len = 0; bvec->bv_offset = 0; bio->bi_vcnt--; + bio->bi_iter.bi_size -= len; blk_recount_segments(q, bio); return 0; } _ Patches currently in -mm which might be from ming.lei@xxxxxxxxxxxxx are block-bioc-update-bi_iterbi_size-before-recounting-segments.patch bio-modify-__bio_add_page-to-accept-pages-that-dont-start-a-new-segment.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html