Coly Li
c573e8673d
bcache: fix overflow in offset_to_stripe() ...
commit 7a1481267999c02abf4a624515c1b5c7c1fccbd6 upstream.
offset_to_stripe() returns the stripe number (in type unsigned int) from
an offset (in type uint64_t) by the following calculation,
do_div(offset, d->stripe_size);
For large capacity backing device (e.g. 18TB) with small stripe size
(e.g. 4KB), the result is 4831838208 and exceeds UINT_MAX. The actual
returned value which caller receives is 536870912, due to the overflow.
Indeed in bcache_device_init(), bcache_device->nr_stripes is limited in
range [1, INT_MAX]. Therefore all valid stripe numbers in bcache are
in range [0, bcache_dev->nr_stripes - 1].
This patch adds a upper limition check in offset_to_stripe(): the max
valid stripe number should be less than bcache_device->nr_stripes. If
the calculated stripe number from do_div() is equal to or larger than
bcache_device->nr_stripe, -EINVAL will be returned. (Normally nr_stripes
is less than INT_MAX, exceeding upper limitation doesn't mean overflow,
therefore -EOVERFLOW is not used as error code.)
This patch also changes nr_stripes' type of struct bcache_device from
'unsigned int' to 'int', and return value type of offset_to_stripe()
from 'unsigned int' to 'int', to match their exact data ranges.
All locations where bcache_device->nr_stripes and offset_to_stripe() are
referenced also get updated for the above type change.
Reported-and-tested-by: Ken Raeburn <raeburn@redhat.com>
Signed-off-by: Coly Li <colyli@suse.de>
Cc: stable@vger.kernel.org
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1783075
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-21 13:05:25 +02:00
bcache: fix overflow in offset_to_stripe()
2020-08-21 13:05:25 +02:00
dm space map common: fix to ensure new block isn't already in use
2020-02-11 04:35:26 -08:00
dm bio record: save/restore bi_end_io and bi_integrity
2020-03-25 08:25:48 +01:00
dm bufio: introduce a global cache replacement
2019-09-13 17:00:21 -04:00
dm cache: fix a crash due to incorrect work item cancelling
2020-03-12 13:00:23 +01:00
dm clone: Fix handling of partial region discards
2020-04-17 10:50:24 +02:00
dm clone: replace spin_lock_irqsave with spin_lock_irq
2020-04-17 10:50:23 +02:00
dm clone: Add missing casts to prevent overflows and data corruption
2020-04-17 10:50:24 +02:00
dm crypt: avoid truncating the logical block size
2020-06-22 09:31:21 +02:00
dm dust: use dust block size for badblocklist index
2019-08-21 11:27:17 -04:00
dm integrity: fix integrity recalculation that is improperly skipped
2020-07-29 10:18:45 +02:00
dm: introduce DM_GET_TARGET_VERSION
2019-09-16 10:18:01 -04:00
dm kcopyd: always complete failed jobs
2019-08-15 15:57:39 -04:00
dm mpath: switch paths in dm_blk_ioctl() code path
2020-06-24 17:50:13 +02:00
dm raid: fix updating of max_discard_sectors limit
2019-09-11 16:18:23 -04:00
dm raid1: use struct_size() with kzalloc()
2019-08-26 11:05:32 -04:00
block: Delay default elevator initialization
2019-09-05 19:52:34 -06:00
block: fix an integer overflow in logical block size
2020-01-23 08:22:32 +01:00
dm snapshot: rework COW throttling to fix deadlock
2019-10-10 09:46:05 -04:00
dm stats: use struct_size() helper
2019-09-04 09:39:22 -04:00
dm: make dm_table_find_target return NULL
2019-08-23 10:13:12 -04:00
dm thin metadata: fix lockdep complaint
2020-03-12 13:00:09 +01:00
dm thin metadata: Add support for a pre-commit callback
2019-12-21 11:05:01 +01:00
dm thin: don't allow changing data device during thin-pool reload
2020-02-24 08:36:49 +01:00
dm verity fec: fix hash block number in verity_fec_decode
2020-05-06 08:15:10 +02:00
dm verity: add root hash pkcs#7 signature verification
2019-08-23 10:13:14 -04:00
dm verity: add root hash pkcs#7 signature verification
2019-08-23 10:13:14 -04:00
dm verity: add root hash pkcs#7 signature verification
2019-08-23 10:13:14 -04:00
dm verity: add root hash pkcs#7 signature verification
2019-08-23 10:13:14 -04:00
dm writecache: reject asynchronous pmem devices
2020-07-16 08:16:47 +02:00
dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone
2020-06-24 17:50:31 +02:00
dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone
2020-06-24 17:50:31 +02:00
dm zoned: assign max_io_len correctly
2020-07-09 09:37:57 +02:00
dm zoned: reduce overhead of backing device checks
2019-12-17 19:56:12 +01:00
dm integrity: fix integrity recalculation that is improperly skipped
2020-07-29 10:18:45 +02:00
dm: make dm_table_find_target return NULL
2019-08-23 10:13:12 -04:00
dm: add clone target
2019-09-12 09:32:31 -04:00
dm: add clone target
2019-09-12 09:32:31 -04:00
md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit
2019-12-31 16:44:20 +01:00
md-cluster: fix wild pointer of unlock_all_bitmaps()
2020-08-19 08:16:01 +02:00
md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
2019-12-17 19:56:14 +01:00
md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
2019-12-17 19:56:14 +01:00
md: raid0/linear: fix dereference before null check on pointer mddev
2020-08-19 08:15:58 +02:00
md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
2019-12-17 19:56:14 +01:00
block: fix an integer overflow in logical block size
2020-01-23 08:22:32 +01:00
md/raid0: avoid RAID0 data corruption due to layout confusion.
2019-09-13 13:10:05 -07:00
md: raid1: check rdev before reference in raid1_sync_request func
2020-01-09 10:19:48 +01:00
md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
2020-08-21 13:05:25 +02:00
raid5: use bio_end_sector in r5_next_bio
2019-09-13 13:14:43 -07:00
md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
2019-12-17 19:56:14 +01:00
c573e8673d