Commit 6607cd31 authored by Guoqing Jiang's avatar Guoqing Jiang Committed by Song Liu
Browse files

raid1: ensure write behind bio has less than BIO_MAX_VECS sectors 

We can't split write behind bio with more than BIO_MAX_VECS sectors,
otherwise the below call trace was triggered because we could allocate
oversized write behind bio later.

[ 8.097936] bvec_alloc+0x90/0xc0
[ 8.098934] bio_alloc_bioset+0x1b3/0x260
[ 8.099959] raid1_make_request+0x9ce/0xc50 [raid1]
[ 8.100988] ? __bio_clone_fast+0xa8/0xe0
[ 8.102008] md_handle_request+0x158/0x1d0 [md_mod]
[ 8.103050] md_submit_bio+0xcd/0x110 [md_mod]
[ 8.104084] submit_bio_noacct+0x139/0x530
[ 8.105127] submit_bio+0x78/0x1d0
[ 8.106163] ext4_io_submit+0x48/0x60 [ext4]
[ 8.107242] ext4_writepages+0x652/0x1170 [ext4]
[ 8.108300] ? do_writepages+0x41/0x100
[ 8.109338] ? __ext4_mark_inode_dirty+0x240/0x240 [ext4]
[ 8.110406] do_writepages+0x41/0x100
[ 8.111450] __filemap_fdatawrite_range+0xc5/0x100
[ 8.112513] file_write_and_wait_range+0x61/0xb0
[ 8.113564] ext4_sync_file+0x73/0x370 [ext4]
[ 8.114607] __x64_sys_fsync+0x33/0x60
[ 8.115635] do_syscall_64+0x33/0x40
[ 8.116670] entry_SYSCALL_64_after_hwframe+0x44/0xae

Thanks for the comment from Christoph.

[1]. https://bugs.archlinux.org/task/70992



Cc: stable@vger.kernel.org # v5.12+
Reported-by: default avatarJens Stutte <jens@chianterastutte.eu>
Tested-by: default avatarJens Stutte <jens@chianterastutte.eu>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarGuoqing Jiang <jiangguoqing@kylinos.cn>
Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
parent 46d4703b

drivers/md/raid1.c

+19 −0
Original line number Diff line number Diff line
@@ -1331,6 +1331,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, 
	struct raid1_plug_cb *plug = NULL;

	int first_clone;

	int max_sectors;

	bool write_behind = false;



	if (mddev_is_clustered(mddev) &&

	     md_cluster_ops->area_resyncing(mddev, WRITE,
@@ -1383,6 +1384,15 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, 
	max_sectors = r1_bio->sectors;

	for (i = 0;  i < disks; i++) {

		struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);



		/*

		 * The write-behind io is only attempted on drives marked as

		 * write-mostly, which means we could allocate write behind

		 * bio later.

		 */

		if (rdev && test_bit(WriteMostly, &rdev->flags))

			write_behind = true;



		if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) {

			atomic_inc(&rdev->nr_pending);

			blocked_rdev = rdev;
@@ -1456,6 +1466,15 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, 
		goto retry_write;

	}



	/*

	 * When using a bitmap, we may call alloc_behind_master_bio below.

	 * alloc_behind_master_bio allocates a copy of the data payload a page

	 * at a time and thus needs a new bio that can fit the whole payload

	 * this bio in page sized chunks.

	 */

	if (write_behind && bitmap)

		max_sectors = min_t(int, max_sectors,

				    BIO_MAX_VECS * (PAGE_SIZE >> 9));

	if (max_sectors < bio_sectors(bio)) {

		struct bio *split = bio_split(bio, max_sectors,

					      GFP_NOIO, &conf->bio_split);