From: Sagi Grimberg <sagi@grimberg.me>

Date: Wed, 13 Jan 2021 13:56:57 -0800

Subject: [PATCH] nvme-tcp: fix possible data corruption with bio merges

Git-commit: ca1ff67d0fb14f39cf0cc5102b1fbcc3b14f6fb9

Patch-mainline: v5.11-rc1

References: git-fixes

When a bio merges, we can get a request that spans multiple

bios, and the overall request payload size is the sum of

all bios. When we calculate how much we need to send

from the existing bio (and bvec), we did not take into

account the iov_iter byte count cap.

Since multipage bvecs support, bvecs can split in the middle

which means that when we account for the last bvec send we

should also take the iov_iter byte count cap as it might be

lower than the last bvec size.

Reported-by: Hao Wang <pkuwangh@gmail.com>

Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")

Tested-by: Hao Wang <pkuwangh@gmail.com>

Signed-off-by: Sagi Grimberg <sagi@grimberg.me>

Signed-off-by: Christoph Hellwig <hch@lst.de>

Acked-by: Hannes Reinecke <hare@suse.com>

---

 drivers/nvme/host/tcp.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c

index b2e0865785ef..216619926563 100644

--- a/drivers/nvme/host/tcp.c

+++ b/drivers/nvme/host/tcp.c

@@ -201,7 +201,7 @@ static inline size_t nvme_tcp_req_cur_offset(struct nvme_tcp_request *req)

 static inline size_t nvme_tcp_req_cur_length(struct nvme_tcp_request *req)

 {

-	return min_t(size_t, req->iter.bvec->bv_len - req->iter.iov_offset,

+	return min_t(size_t, iov_iter_single_seg_count(&req->iter),

 			req->pdu_len - req->pdu_sent);

 }

-- 

2.29.2