• Lars Ellenberg's avatar
    drbd: fix potential data corruption and protocol error · 001a8868
    Lars Ellenberg authored
    We assumed only bios with bi_idx == 0 would end up
    in drbd_make_request().
    
    That is wrong.
    
    At least device mapper, in __clone_and_map(), may submit
    clones only covering a partial bio, but sharing
    the original bvec, by adjusting bi_idx and relevant
    other bio members of the clone.
    
    We used __bio_for_each_segment() in various places,
    even though that is documented as
     * drivers should not use the __ version unless they _really_ want to
     * run through the entire bio and not just pending pieces
    
    Impact: we would send the full bio bvec, even for the clone
    with bi_idx > 0, which will cause data corruption on the
    peer (because we submit wrong data at the clone offset),
    and will cause a DRBD protocol error, disconnect/reconnect
    and resync (thus fixing the corruption),
    because the next package header would be expected right
    in the middle of the sent data, causing DRBD magic mismatch.
    
    Fix: drop the assert, and use bio_for_each_segment()
    instead of the __ version.
    
    Conflicts:
    
    	drbd/drbd_tracing.c
    Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
    Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
    001a8868
drbd_main.c 118 KB