[PATCH] bcache: fix NULL pointer deref in blk_add_request_payload

[Lars Ellenberg]

bch_generic_make_request_hack() tries to be smart,
and fake a bi_max_bvecs = bi_vcnt.

If those bios have been REQ_DISCARD, and get submitted to a driver
(md raid) that uses bio_clone, the clone will end up with bi_io_vec == NULL,
passed down the stack, end up in sd_prep_fn and blk_add_request_payload,
which then tries to use bio->bi_io_vec->page.

Fix: try to be even smarter in bch_generic_make_request_hack(),
and always pretend to have at least bi_max_vecs of 1,
unless the incoming bio was already created without a single bvec.

Signed-off-by: Lars Ellenberg <***@linbit.com>
---
drivers/md/bcache/io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index 9056632..a638ac6 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -47,7 +47,7 @@ static void bch_generic_make_request_hack(struct bio *bio)
*
* To be taken out once immutable bvec stuff is in.
*/
- bio->bi_max_vecs = bio->bi_vcnt;
+ bio->bi_max_vecs = bio->bi_vcnt ?: (bio->bi_io_vec ? 1 : 0);

generic_make_request(bio);
}

[Lars Ellenberg]

Post by Lars Ellenberg
bch_generic_make_request_hack() tries to be smart,
and fake a bi_max_bvecs = bi_vcnt.

I meant to include a cover letter with the Oops backtrace,
and this:

Note that this patch is relevant for 3.13 and before.

With 3.14,
this whole bch_generic_make_request_hack() function has been dropped already.

Thanks,

Lars

Post by Lars Ellenberg
If those bios have been REQ_DISCARD, and get submitted to a driver
(md raid) that uses bio_clone, the clone will end up with bi_io_vec == NULL,
passed down the stack, end up in sd_prep_fn and blk_add_request_payload,
which then tries to use bio->bi_io_vec->page.
Fix: try to be even smarter in bch_generic_make_request_hack(),
and always pretend to have at least bi_max_vecs of 1,
unless the incoming bio was already created without a single bvec.
---
drivers/md/bcache/io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index 9056632..a638ac6 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -47,7 +47,7 @@ static void bch_generic_make_request_hack(struct bio *bio)
*
* To be taken out once immutable bvec stuff is in.
*/
- bio->bi_max_vecs = bio->bi_vcnt;
+ bio->bi_max_vecs = bio->bi_vcnt ?: (bio->bi_io_vec ? 1 : 0);
generic_make_request(bio);
}
--
1.7.10.4