On 18/04/19 04:19, Ming Lei wrote:
Hi Paolo,
On Wed, Apr 17, 2019 at 01:52:07PM +0200, Paolo Bonzini wrote:
Because bio_kmalloc uses inline iovecs, the limit on the number of entries is not BIO_MAX_PAGES but rather UIO_MAXIOV, which indeed is already checked in bio_kmalloc. This could cause SG_IO requests to be truncated and the HBA to report a DMA overrun.
BIO_MAX_PAGES only limits the single bio's max vector number, if one bio can't hold all user space request, new bio will be allocated and appended to the passthrough request if queue limits aren't reached.
Stupid question: where? I don't see any place starting at blk_rq_map_user_iov (and then __blk_rq_map_user_iov->bio_map_user_iov) that would allocate a second bio. The only bio_kmalloc in that path is the one I'm patching.
So I understand SG_IO request shouldn't be truncated because of BIO_MAX_PAGES, or could you explain it in a bit detail or provide a reproducer?
Unfortunately I don't have a reproducer. Actually any userspace SG_IO above 4 MB triggers it, but you need the right HBA to ensure that it reaches bio_kmalloc.
Paolo