[Drbd-dev] [patch] __bio_clone() behaviour

[Lars Marowsky-Bree]

With the __bio_clone() bugfix by Jens Axboe (in the recent 2.6.10-ac
kernels or SLES9 SP1) which causes __bio_clone() to copy the bi_io_vec,
it would always try to copy the _maximum_ size, as defined by
bio_src->bi_max_vecs:

inline void __bio_clone(struct bio *bio, struct bio *bio_src)
{
        request_queue_t *q = bdev_get_queue(bio_src->bi_bdev);
        memcpy(bio->bi_io_vec, bio_src->bi_io_vec, bio_src->bi_max_vecs * sizeof(struct bio_vec));
...

drbd however only has space for a single iovec (because it's all
statically allocated right now), and so the memcpy would silently
overwrite memory.

The attached patch 'fixes' this up.

Note that it is a bit ugly but safe, as drbd already asserts that
bi_vcnt == 1 anyway.

FWIW, drbd seems to be the only user of __bio_clone() I could find,
there's no in-tree users, everything goes through bio_clone() otherwise,
which would have dynamically allocated the properly sized structures.


Sincerely,
    Lars Marowsky-Brée <lmb at suse.de>

-- 
High Availability & Clustering
SUSE Labs, Research and Development
SUSE LINUX Products GmbH - A Novell Business

-------------- next part --------------
Index: drbd_compat_wrappers.h
===================================================================
--- drbd_compat_wrappers.h	(revision 1736)
+++ drbd_compat_wrappers.h	(working copy)
@@ -538,7 +538,9 @@
 	bio_init(bio); // bio->bi_flags   = 0;
 	bio->bi_io_vec = bvec;
 	bio->bi_max_vecs = 1;
-
+	
+	/* FIXME: __bio_clone() workaround, fix me properly later! */
+	bio_src->bi_max_vecs = 1;
 	__bio_clone(bio,bio_src);
 	bio->bi_bdev    = mdev->backing_bdev;
 	bio->bi_private = mdev;
@@ -559,6 +561,8 @@
 	bio->bi_io_vec = bvec;
 	bio->bi_max_vecs = 1;
 
+	/* FIXME: __bio_clone() workaround, fix me properly later! */
+	bio_src->bi_max_vecs = 1;
 	__bio_clone(bio,bio_src);
 	bio->bi_bdev    = mdev->backing_bdev;
 	bio->bi_private = mdev;