block: virtio_blk: fix handling single range discard request

1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") starts
to support multi-range discard for virtio-blk. However, the virtio-blk
disk may report max discard segment as 1, at least that is exactly what
qemu is doing.

So far, block layer switches to normal request merge if max discard segment
limit is 1, and multiple bios can be merged to single segment. This way may
cause memory corruption in virtblk_setup_discard_write_zeroes().

Fix the issue by handling single max discard segment in straightforward
way.

Fixes: 1f23816b8eb8 ("virtio_blk: add discard and write zeroes support")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Changpeng Liu <changpeng.liu@intel.com>
Cc: Daniel Verkamp <dverkamp@chromium.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 63b213e00b37525767a70e4e9f6b2c33324941a3..b2e48dac1ebdb88308d59a27cefdf2df853c3dfd 100644 (file)
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -126,16 +126,31 @@ static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap)
        if (!range)
                return -ENOMEM;
 
-       __rq_for_each_bio(bio, req) {
-               u64 sector = bio->bi_iter.bi_sector;
-               u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT;
-
-               range[n].flags = cpu_to_le32(flags);
-               range[n].num_sectors = cpu_to_le32(num_sectors);
-               range[n].sector = cpu_to_le64(sector);
-               n++;
+       /*
+        * Single max discard segment means multi-range discard isn't
+        * supported, and block layer only runs contiguity merge like
+        * normal RW request. So we can't reply on bio for retrieving
+        * each range info.
+        */
+       if (queue_max_discard_segments(req->q) == 1) {
+               range[0].flags = cpu_to_le32(flags);
+               range[0].num_sectors = cpu_to_le32(blk_rq_sectors(req));
+               range[0].sector = cpu_to_le64(blk_rq_pos(req));
+               n = 1;
+       } else {
+               __rq_for_each_bio(bio, req) {
+                       u64 sector = bio->bi_iter.bi_sector;
+                       u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT;
+
+                       range[n].flags = cpu_to_le32(flags);
+                       range[n].num_sectors = cpu_to_le32(num_sectors);
+                       range[n].sector = cpu_to_le64(sector);
+                       n++;
+               }
        }
 
+       WARN_ON_ONCE(n != segments);
+
        req->special_vec.bv_page = virt_to_page(range);
        req->special_vec.bv_offset = offset_in_page(range);
        req->special_vec.bv_len = sizeof(*range) * segments;