dm: bounce_pfn limit added

Device mapper uses its own bounce_pfn that may differ from one on underlying
device. In that way dm can build incorrect requests that contain sg elements
greater than underlying device is able to handle.

This is the cause of slab corruption in i2o layer, occurred on i386 arch when
very long direct IO requests are addressed to dm-over-i2o device.

Signed-off-by: Vasily Averin <vvs@sw.ru>
Cc: <stable@kernel.org>
Cc: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 8939e61050884cd81cda3cdcbf7126b5b55e3dad..5a7eb650181e140b85d0ba8367e9f82c0e492923 100644 (file)
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -102,6 +102,8 @@ static void combine_restrictions_low(struct io_restrictions *lhs,
        lhs->seg_boundary_mask =
                min_not_zero(lhs->seg_boundary_mask, rhs->seg_boundary_mask);
 
+       lhs->bounce_pfn = min_not_zero(lhs->bounce_pfn, rhs->bounce_pfn);
+
        lhs->no_cluster |= rhs->no_cluster;
 }
 
@@ -566,6 +568,8 @@ void dm_set_device_limits(struct dm_target *ti, struct block_device *bdev)
                min_not_zero(rs->seg_boundary_mask,
                             q->seg_boundary_mask);
 
+       rs->bounce_pfn = min_not_zero(rs->bounce_pfn, q->bounce_pfn);
+
        rs->no_cluster |= !test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
 }
 EXPORT_SYMBOL_GPL(dm_set_device_limits);
@@ -707,6 +711,8 @@ static void check_for_valid_limits(struct io_restrictions *rs)
                rs->max_segment_size = MAX_SEGMENT_SIZE;
        if (!rs->seg_boundary_mask)
                rs->seg_boundary_mask = -1;
+       if (!rs->bounce_pfn)
+               rs->bounce_pfn = -1;
 }
 
 int dm_table_add_target(struct dm_table *t, const char *type,
@@ -891,6 +897,7 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q)
        q->hardsect_size = t->limits.hardsect_size;
        q->max_segment_size = t->limits.max_segment_size;
        q->seg_boundary_mask = t->limits.seg_boundary_mask;
+       q->bounce_pfn = t->limits.bounce_pfn;
        if (t->limits.no_cluster)
                q->queue_flags &= ~(1 << QUEUE_FLAG_CLUSTER);
        else

diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 37c66d1254b5383795f3f559a7a232325dd16c13..b8b7c51389fe0ecff2608f63b928140601347a3f 100644 (file)
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -116,6 +116,7 @@ struct io_restrictions {
        unsigned short          hardsect_size;
        unsigned int            max_segment_size;
        unsigned long           seg_boundary_mask;
+       unsigned long           bounce_pfn;
        unsigned char           no_cluster; /* inverted so that 0 is default */
 };