This driver assumes that bio vectors are memory aligned to the logical block size, so set the queue limit to reflect that. Unless we set up the limit based on the logical block size, we will go out of page bounds in copy_to_nullb / copy_from_nullb. Apparently this wasn't noticed so far because none of the tests generate such buffers, but since commit 851c4c96db00 ("xfs: implement XFS_IOC_DIOINFO in terms of vfs_getattr") xfstests generates unaligned I/O, which now lead to memory corruption when using null_blk devices with 4k block size.
Unified · Split
| @@ -1949,6 +1949,7 @@ static int null_add_dev(struct nullb_device *dev) · 1948 unmodified lines | |||
| 1949 | .logical_block_size = dev->blocksize, | 1949 | .logical_block_size = dev->blocksize, |
| 1950 | .physical_block_size = dev->blocksize, | 1950 | .physical_block_size = dev->blocksize, |
| 1951 | .max_hw_sectors = dev->max_sectors, | 1951 | .max_hw_sectors = dev->max_sectors, |
| 1952 | .dma_alignment = dev->blocksize - 1, | ||
| 1952 | }; | 1953 | }; |
| 1953 | 1954 | ||
| 1954 | struct nullb *nullb; | 1955 | struct nullb *nullb; |