| Message ID | 1480915598-10169-1-git-send-email-bmarzins@redhat.com (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Delegated to: | Mike Snitzer |
| Headers | show |
ack On Sun, Dec 04, 2016 at 11:26:38PM -0600, Benjamin Marzinski wrote: > If no block was allocated or freed, sm_ll_mutate() wasn't setting > *ev, leaving the variable unitialized. sm_ll_insert(), > sm_disk_inc_block(), and sm_disk_new_block() all check ev to see > if there was an allocation event in sm_ll_mutate(), possibly > reading unitialized data. > > If no allocation event occured, sm_ll_mutate() should set *ev > to SM_NONE. > > Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> > --- > drivers/md/persistent-data/dm-space-map-common.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c > index 10978ba..4c28608 100644 > --- a/drivers/md/persistent-data/dm-space-map-common.c > +++ b/drivers/md/persistent-data/dm-space-map-common.c > @@ -464,7 +464,8 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b, > ll->nr_allocated--; > le32_add_cpu(&ie_disk.nr_free, 1); > ie_disk.none_free_before = cpu_to_le32(min(le32_to_cpu(ie_disk.none_free_before), bit)); > - } > + } else > + *ev = SM_NONE; > > return ll->save_ie(ll, index, &ie_disk); > } > -- > 2.1.0 > -- dm-devel mailing list dm-devel@redhat.com https://www.redhat.com/mailman/listinfo/dm-devel
diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c index 10978ba..4c28608 100644 --- a/drivers/md/persistent-data/dm-space-map-common.c +++ b/drivers/md/persistent-data/dm-space-map-common.c @@ -464,7 +464,8 @@ static int sm_ll_mutate(struct ll_disk *ll, dm_block_t b, ll->nr_allocated--; le32_add_cpu(&ie_disk.nr_free, 1); ie_disk.none_free_before = cpu_to_le32(min(le32_to_cpu(ie_disk.none_free_before), bit)); - } + } else + *ev = SM_NONE; return ll->save_ie(ll, index, &ie_disk); }
If no block was allocated or freed, sm_ll_mutate() wasn't setting *ev, leaving the variable unitialized. sm_ll_insert(), sm_disk_inc_block(), and sm_disk_new_block() all check ev to see if there was an allocation event in sm_ll_mutate(), possibly reading unitialized data. If no allocation event occured, sm_ll_mutate() should set *ev to SM_NONE. Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> --- drivers/md/persistent-data/dm-space-map-common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)