dm io: fix panic on large request

bio_alloc_bioset() will return NULL if 'num_vecs' is too large.
Use bio_get_nr_vecs() to get estimation of maximum number.

Cc: stable@kernel.org
Signed-off-by: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 352c6fbeac53a19dd82f8ef6994b733da4ad931d..f3a772486437e1ee08608e28835adf85911aaaf8 100644 (file)
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -293,7 +293,10 @@ static void do_region(int rw, unsigned int region, struct io_region *where,
                 * bvec for bio_get/set_region() and decrement bi_max_vecs
                 * to hide it from bio_add_page().
                 */
-               num_bvecs = (remaining / (PAGE_SIZE >> SECTOR_SHIFT)) + 2;
+               num_bvecs = dm_sector_div_up(remaining,
+                                            (PAGE_SIZE >> SECTOR_SHIFT));
+               num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
+                                     num_bvecs);
                bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                bio->bi_sector = where->sector + (where->count - remaining);
                bio->bi_bdev = where->bdev;