Commit 0e215a7c authored by Keith Busch's avatar Keith Busch Committed by Yong Hu
Browse files

nvme-pci: fix mempool alloc size

stable inclusion
from stable-v5.10.188
commit dfb6d54893d544151e7f480bc44cfe7823f5ad23
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=dfb6d54893d544151e7f480bc44cfe7823f5ad23



--------------------------------

[ Upstream commit c89a529e ]

Convert the max size to bytes to match the units of the divisor that
calculates the worst-case number of PRP entries.

The result is used to determine how many PRP Lists are required. The
code was previously rounding this to 1 list, but we can require 2 in the
worst case. In that scenario, the driver would corrupt memory beyond the
size provided by the mempool.

While unlikely to occur (you'd need a 4MB in exactly 127 phys segments
on a queue that doesn't support SGLs), this memory corruption has been
observed by kfence.

Cc: Jens Axboe <axboe@kernel.dk>
Fixes: 943e942e ("nvme-pci: limit max IO size and segments to avoid high order allocations")
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
Reviewed-by: default avatarJens Axboe <axboe@kernel.dk>
Reviewed-by: default avatarKanchan Joshi <joshi.k@samsung.com>
Reviewed-by: default avatarChaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYong Hu <yong.hu@windriver.com>
parent 30640988
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment