From patchwork Mon Nov 9 12:54:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 322590 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C555C4741F for ; Mon, 9 Nov 2020 13:42:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 48581206B2 for ; Mon, 9 Nov 2020 13:42:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604929320; bh=MW71FPmZW5Ca5FPc/9Ef/m/b2yP0brzYxoz94zH+3XI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OxHF0LkdxOQykJ0B7tyo7kyLsBbId+6epsbAr7AOXSsa5To2lvhFLXLlkQUXG6OQL 2ecNxpNe3Y8GNVsAL1x6FbnL/6SyDYyGYY191QCmssk0/wMD+7APAhwHTiW8PNEEmB gR56KkYlhiMnRGVEYEttrlH3GqrS+9k2BFqvnSqw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731778AbgKINly (ORCPT ); Mon, 9 Nov 2020 08:41:54 -0500 Received: from mail.kernel.org ([198.145.29.99]:55376 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730483AbgKINBU (ORCPT ); Mon, 9 Nov 2020 08:01:20 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DC61B206C0; Mon, 9 Nov 2020 13:01:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604926880; bh=MW71FPmZW5Ca5FPc/9Ef/m/b2yP0brzYxoz94zH+3XI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WMZwf9cm493cz9nc29S5gTiivYcxMxwpLd/76NMN9QZBu1huI3qmgx3IMVYtDkOYz Fhx9xenxN6/oeK9x5iBUS+jGwhStB6JH5mGzfFMdIfs6g0KiN4/ReK0QyO2P2Qzk4G kwCxAVQJ/b12ytZWDZM9cmeYvgIYN2gzDDs9mblM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhao Heming , Song Liu , Sasha Levin Subject: [PATCH 4.9 035/117] md/bitmap: md_bitmap_get_counter returns wrong blocks Date: Mon, 9 Nov 2020 13:54:21 +0100 Message-Id: <20201109125027.317940407@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201109125025.630721781@linuxfoundation.org> References: <20201109125025.630721781@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Zhao Heming [ Upstream commit d837f7277f56e70d82b3a4a037d744854e62f387 ] md_bitmap_get_counter() has code: ``` if (bitmap->bp[page].hijacked || bitmap->bp[page].map == NULL) csize = ((sector_t)1) << (bitmap->chunkshift + PAGE_COUNTER_SHIFT - 1); ``` The minus 1 is wrong, this branch should report 2048 bits of space. With "-1" action, this only report 1024 bit of space. This bug code returns wrong blocks, but it doesn't inflence bitmap logic: 1. Most callers focus this function return value (the counter of offset), not the parameter blocks. 2. The bug is only triggered when hijacked is true or map is NULL. the hijacked true condition is very rare. the "map == null" only true when array is creating or resizing. 3. Even the caller gets wrong blocks, current code makes caller just to call md_bitmap_get_counter() one more time. Signed-off-by: Zhao Heming Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- drivers/md/bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c index 63bff4cc70984..863fe19e906e6 100644 --- a/drivers/md/bitmap.c +++ b/drivers/md/bitmap.c @@ -1339,7 +1339,7 @@ __acquires(bitmap->lock) if (bitmap->bp[page].hijacked || bitmap->bp[page].map == NULL) csize = ((sector_t)1) << (bitmap->chunkshift + - PAGE_COUNTER_SHIFT - 1); + PAGE_COUNTER_SHIFT); else csize = ((sector_t)1) << bitmap->chunkshift; *blocks = csize - (offset & (csize - 1));