[dm-devel] [PATCH v4 1/2] block: Fix a buffer overrun in bio_integrity_split()

[Vivek Goyal]

On Fri, Oct 19, 2012 at 01:30:15PM -0700, Tejun Heo wrote:
> On Mon, Oct 15, 2012 at 01:09:01PM -0700, Kent Overstreet wrote:
> > bio_integrity_split() seemed to be confusing pointers and arrays -
> > bip_vec in bio_integrity_payload was an array appended to the end of the
> > payload, so the bio_vecs in struct bio_pair should have come after the
> > bio_integrity_payload they're for.
> > 
> > Fix it by making bip_vec a pointer to the inline vecs - a later patch is
> > going to make more use of this pointer.
> > 
> > Signed-off-by: Kent Overstreet <koverstreet at google.com>
> > CC: Jens Axboe <axboe at kernel.dk>
> > CC: Martin K. Petersen <martin.petersen at oracle.com>
> 
> This being an apparent bug, I think it would be better to create a
> patch to simply reorder bio_pair fields to fix it and mark it w/ Cc:
> stable and introduce bip_vec pointer separately.

Initially he had reordered the bio_pair fields but there were couple of
issues. We could not assume that there is no padding between fields and
secondly some of the initializtion of looked plain ugly.

IMHO, introduction of bip_vec to fix this issue is small and cleaner
then reordering fields.

Thanks
Vivek