@@ -519,10 +519,22 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
* smaller I/O, just to be safe.
*/
- if (q->merge_bvec_fn && !ti->type->merge)
+ if (q->merge_bvec_fn && !ti->type->merge) {
limits->max_sectors =
min_not_zero(limits->max_sectors,
(unsigned int) (PAGE_SIZE >> 9));
+
+ /* Restricting max_sectors is not enough.
+ * If someone uses bio_add_page to add 8 disjunct 512 byte
+ * partial pages to a bio, it would succeed,
+ * but could still cross a border of whatever restrictions
+ * are below us (raid0 stripe boundary). An attempted
+ * bio_split would not succeed, because bi_vcnt is 8.
+ * E.g. the xen io layer is known to trigger this.
+ */
+ limits->max_segments = 1;
+ }
+
return 0;
}
EXPORT_SYMBOL_GPL(dm_set_device_limits);