[Devel] [PATCH RHEL7 COMMIT] ms/target: Fix max_unmap_lba_count calc overflow

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.21.1.vz7.46.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.21.1.vz7.46.2
------>
commit bab559039e31f0ed70e17b39c93a11e320bce84a
Author: Mike Christie <mchristi at redhat.com>
Date:   Mon Apr 2 17:28:31 2018 +0300

    ms/target: Fix max_unmap_lba_count calc overflow
    
    ML: ea263c7fada4af8ec7fe5fcfd6e7d7705a89351b
    
    max_discard_sectors only 32bits, and some non scsi backend
    devices will set this to the max 0xffffffff, so we can end up
    overflowing during the max_unmap_lba_count calculation.
    
    This fixes a regression caused by my patch:
    
    commit 8a9ebe717a133ba7bc90b06047f43cc6b8bcb8b3
    Author: Mike Christie <mchristi at redhat.com>
    Date:   Mon Jan 18 14:09:27 2016 -0600
    
        target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors
    
    which can result in extra discards being sent to due the overflow
    causing max_unmap_lba_count to be smaller than what the backing
    device can actually support.
    
    Signed-off-by: Mike Christie <mchristi at redhat.com>
    Reviewed-by: Bart Van Assche <bart.vanassche at sandisk.com>
    Cc: stable at vger.kernel.org
    Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
    Signed-off-by: Andrei Vagin <avagin at openvz.org>
---
 drivers/target/target_core_device.c  | 8 +++++---
 drivers/target/target_core_file.c    | 3 +--
 drivers/target/target_core_iblock.c  | 3 +--
 include/target/target_core_backend.h | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 7dfe9641b640..cb17aeb1d7ac 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1573,13 +1573,15 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
  * in ATA and we need to set TPE=1
  */
 bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
-				       struct request_queue *q, int block_size)
+				       struct request_queue *q)
 {
+	int block_size = queue_logical_block_size(q);
+
 	if (!blk_queue_discard(q))
 		return false;
 
-	attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) /
-								block_size;
+	attrib->max_unmap_lba_count =
+		q->limits.max_discard_sectors >> (ilog2(block_size) - 9);
 	/*
 	 * Currently hardcoded to 1 in Linux/SCSI code..
 	 */
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 4e87701792a8..ef5ea7105248 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -166,8 +166,7 @@ static int fd_configure_device(struct se_device *dev)
 			dev_size, div_u64(dev_size, fd_dev->fd_block_size),
 			fd_dev->fd_block_size);
 
-		if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
-						      fd_dev->fd_block_size))
+		if (target_configure_unmap_from_queue(&dev->dev_attrib, q))
 			pr_debug("IFILE: BLOCK Discard support available,"
 				 " disabled by default\n");
 		/*
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 00bfe975ac72..55be98bb964b 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -127,8 +127,7 @@ static int iblock_configure_device(struct se_device *dev)
 	dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
 	dev->dev_attrib.hw_queue_depth = q->nr_requests;
 
-	if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
-					      dev->dev_attrib.hw_block_size))
+	if (target_configure_unmap_from_queue(&dev->dev_attrib, q))
 		pr_debug("IBLOCK: BLOCK Discard support available,"
 			 " disabled by default\n");
 
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index 3905c1c7ab75..5e1124d24587 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -145,6 +145,6 @@ int	se_dev_set_block_size(struct se_device *, u32);
 
 sector_t target_to_linux_sector(struct se_device *dev, sector_t lb);
 bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
-				       struct request_queue *q, int block_size);
+				       struct request_queue *q);
 
 #endif /* TARGET_CORE_BACKEND_H */