On 18/04/19 04:19, Ming Lei wrote: > Hi Paolo, > > On Wed, Apr 17, 2019 at 01:52:07PM +0200, Paolo Bonzini wrote: >> Because bio_kmalloc uses inline iovecs, the limit on the number of entries >> is not BIO_MAX_PAGES but rather UIO_MAXIOV, which indeed is already checked >> in bio_kmalloc. This could cause SG_IO requests to be truncated and the HBA >> to report a DMA overrun. > > BIO_MAX_PAGES only limits the single bio's max vector number, if one bio > can't hold all user space request, new bio will be allocated and appended > to the passthrough request if queue limits aren't reached. Stupid question: where? I don't see any place starting at blk_rq_map_user_iov (and then __blk_rq_map_user_iov->bio_map_user_iov) that would allocate a second bio. The only bio_kmalloc in that path is the one I'm patching. > So I understand SG_IO request shouldn't be truncated because of > BIO_MAX_PAGES, or could you explain it in a bit detail or provide > a reproducer? Unfortunately I don't have a reproducer. Actually any userspace SG_IO above 4 MB triggers it, but you need the right HBA to ensure that it reaches bio_kmalloc. Paolo
