dm io: fix panic on large request

bio_alloc_bioset() will return NULL if 'num_vecs' is too large.
Use bio_get_nr_vecs() to get estimation of maximum number.

Cc: stable@kernel.org
Signed-off-by: "Jun'ichi Nomura" <j-nomura@ce.jp.nec.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 352c6fbeac53..f3a772486437 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -293,7 +293,10 @@ static void do_region(int rw, unsigned int region, struct io_region *where,
                  * bvec for bio_get/set_region() and decrement bi_max_vecs
                  * to hide it from bio_add_page().
                  */
-                num_bvecs = (remaining / (PAGE_SIZE >> SECTOR_SHIFT)) + 2;
+                num_bvecs = dm_sector_div_up(remaining,
+                                             (PAGE_SIZE >> SECTOR_SHIFT));
+                num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
+                                      num_bvecs);
                 bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                 bio->bi_sector = where->sector + (where->count - remaining);
                 bio->bi_bdev = where->bdev;