| Message ID | 20230515134808.3936750-2-linan666@huaweicloud.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | md: bugfix of writing raid sysfs | expand |
On Mon, May 15, 2023 at 6:49 AM <linan666@huaweicloud.com> wrote: > > From: Li Nan <linan122@huawei.com> > > If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage() > will return -EINVAL because 'page >= bitmap->pages', but the return value > was not checked immediately in md_bitmap_get_counter() in order to set > *blocks value and slab-out-of-bounds occurs. > > Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and > return directly if true. > > Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.") > Signed-off-by: Li Nan <linan122@huawei.com> > Reviewed-by: Yu Kuai <yukuai3@huawei.com> > --- > drivers/md/md-bitmap.c | 17 +++++++++-------- > 1 file changed, 9 insertions(+), 8 deletions(-) > > diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c > index 920bb68156d2..e122b19c124d 100644 > --- a/drivers/md/md-bitmap.c > +++ b/drivers/md/md-bitmap.c > @@ -46,6 +46,7 @@ static inline char *bmname(struct bitmap *bitmap) > * > * if we find our page, we increment the page's refcount so that it stays > * allocated while we're using it > + * the caller must make sure 'page < bimap->pages' > */ I removed this comment, and added WARN_ON_ONCE(). Thanks, Song > static int md_bitmap_checkpage(struct bitmap_counts *bitmap, > unsigned long page, int create, int no_hijack) > @@ -54,14 +55,6 @@ __acquires(bitmap->lock) > { > unsigned char *mappage; > > - if (page >= bitmap->pages) { > - /* This can happen if bitmap_start_sync goes beyond > - * End-of-device while looking for a whole page. > - * It is harmless. > - */ > - return -EINVAL; > - } > - > if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */ > return 0; > > @@ -1387,6 +1380,14 @@ __acquires(bitmap->lock) > sector_t csize; > int err; > > + if (page >= bitmap->pages) { > + /* > + * This can happen if bitmap_start_sync goes beyond > + * End-of-device while looking for a whole page or > + * user set a huge number to sysfs bitmap_set_bits. > + */ > + return NULL; > + } > err = md_bitmap_checkpage(bitmap, page, create, 0); > > if (bitmap->bp[page].hijacked || > -- > 2.31.1 >
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c index 920bb68156d2..e122b19c124d 100644 --- a/drivers/md/md-bitmap.c +++ b/drivers/md/md-bitmap.c @@ -46,6 +46,7 @@ static inline char *bmname(struct bitmap *bitmap) * * if we find our page, we increment the page's refcount so that it stays * allocated while we're using it + * the caller must make sure 'page < bimap->pages' */ static int md_bitmap_checkpage(struct bitmap_counts *bitmap, unsigned long page, int create, int no_hijack) @@ -54,14 +55,6 @@ __acquires(bitmap->lock) { unsigned char *mappage; - if (page >= bitmap->pages) { - /* This can happen if bitmap_start_sync goes beyond - * End-of-device while looking for a whole page. - * It is harmless. - */ - return -EINVAL; - } - if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */ return 0; @@ -1387,6 +1380,14 @@ __acquires(bitmap->lock) sector_t csize; int err; + if (page >= bitmap->pages) { + /* + * This can happen if bitmap_start_sync goes beyond + * End-of-device while looking for a whole page or + * user set a huge number to sysfs bitmap_set_bits. + */ + return NULL; + } err = md_bitmap_checkpage(bitmap, page, create, 0); if (bitmap->bp[page].hijacked ||