From patchwork Mon May 15 13:48:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Nan X-Patchwork-Id: 94156 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp6937666vqo; Mon, 15 May 2023 06:54:31 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4/tdGYQ1KwJ2tEmJRuuj/4amejl5oweDSH4ay+4aBW/QvgPY9bmyOnFHAgodk12HqtKoKu X-Received: by 2002:a17:902:e80b:b0:1aa:ffed:652c with SMTP id u11-20020a170902e80b00b001aaffed652cmr45707372plg.64.1684158870793; Mon, 15 May 2023 06:54:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684158870; cv=none; d=google.com; s=arc-20160816; b=C25zh7UpkOKsUEeuTwXD8k5UTisluKlmfxxXM92DQhq6xjgwx3cHbAkuOwH36sMZoX 90ykEpVhv+4YGyiFnV74mSGUJlE1oshWB5CiBOkWId3H6gdsQrDL1HvR4cpGzpAnJxuz 1ZgdGY550Ix7LRHtE1Glj4TbFqBb45XDMMYZ05Kp2jk0dZu56Ay503k1XMFVrzEAneVF Vt+AjOJSILvblkQgmxdcL2XyDI0AdL1OZ81HjhkqvlFPL/5j3Bo6k4KHyyubNFhmk0qg kvd6N1bYT2oDWgvvUB/fJJCxwEYYAiZgjWqZZ7CKGCAt6IzSkn4yJiHWxiiWntfteLs3 9ZFQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=6J+/jhiYgx/DgGTCzGUlbKhAhmxU/TkdSZWnMWdtUbY=; b=m3cZ8dBX2r2+/FiLTG0BBv+pXiKImJ0wvM4XV4Qs8iSQ33sxzL/F4vKq10XTewpE92 FYl9dzuaKd8ae84+O8Xa407n2qY5lNUrHIYzy4UpfowNeKao2Vz6GScHxZtoJZGJ0RoJ tbW1kdXxiTtn/539C5SKwXZ7gyupmF2cp4p1ZtC11wX1ssfjsTca7/mJTq5NgKLMR9Zs CCAEdNvZbAryozPem5tip/2EugMSBM00d3puTvaJfbi6MGk1o3cjdZxMBeVPkNuZSEBM no/yHbpzkCSfiOePINViLSGMkLi4ZVKXLMrI7bJKqqWsfuQjdP5ZfH0w3AVLSwZ9p4Jw XClQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id iy9-20020a170903130900b001a9265e6fdasi14615796plb.268.2023.05.15.06.54.17; Mon, 15 May 2023 06:54:30 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235698AbjEONtr (ORCPT + 99 others); Mon, 15 May 2023 09:49:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56128 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232241AbjEONtg (ORCPT ); Mon, 15 May 2023 09:49:36 -0400 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C6F81BFB; Mon, 15 May 2023 06:49:35 -0700 (PDT) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4QKghn40Hbz4f3p0w; Mon, 15 May 2023 21:49:29 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgCnD7NoOGJkNcUBJg--.7104S5; Mon, 15 May 2023 21:49:30 +0800 (CST) From: linan666@huaweicloud.com To: song@kernel.org, neilb@suse.de, Rob.Becker@riverbed.com Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, linan122@huawei.com, yukuai3@huawei.com, yi.zhang@huawei.com, houtao1@huawei.com, yangerkun@huawei.com Subject: [PATCH OLK-5.10 v3 1/4] md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter Date: Mon, 15 May 2023 21:48:05 +0800 Message-Id: <20230515134808.3936750-2-linan666@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20230515134808.3936750-1-linan666@huaweicloud.com> References: <20230515134808.3936750-1-linan666@huaweicloud.com> MIME-Version: 1.0 X-CM-TRANSID: gCh0CgCnD7NoOGJkNcUBJg--.7104S5 X-Coremail-Antispam: 1UD129KBjvJXoW7urWDGFWxWw17CFy5AFWDJwb_yoW8Cw4fpF sxG343Kr95JF47uF1qyr95CFyrG3Z8tFZrJFWIk345C3WUJFnxWrWkKF1jq3Z09ryfAF45 Xr45G34ruF4DXa7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPEb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUGw A2048vs2IY020Ec7CjxVAFwI0_JFI_Gr1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV WxJVW8Jr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_ GcCE3s1lnxkEFVAIw20F6cxK64vIFxWle2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64 xvF2IEw4CE5I8CrVC2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j 6r4UMcvjeVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2 kIc2xKxwAKzVCY07xG64k0F24l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_ Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17 CE14v26r1q6r43MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0 I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I 8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73 UjIFyTuYvjxU7D73DUUUU X-CM-SenderInfo: polqt0awwwqx5xdzvxpfor3voofrz/ X-CFilter-Loop: Reflected X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,KHOP_HELO_FCRDNS, MAY_BE_FORGED,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765968571850359759?= X-GMAIL-MSGID: =?utf-8?q?1765968571850359759?= From: Li Nan If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage() will return -EINVAL because 'page >= bitmap->pages', but the return value was not checked immediately in md_bitmap_get_counter() in order to set *blocks value and slab-out-of-bounds occurs. Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and return directly if true. Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.") Signed-off-by: Li Nan Reviewed-by: Yu Kuai --- drivers/md/md-bitmap.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c index 920bb68156d2..e122b19c124d 100644 --- a/drivers/md/md-bitmap.c +++ b/drivers/md/md-bitmap.c @@ -46,6 +46,7 @@ static inline char *bmname(struct bitmap *bitmap) * * if we find our page, we increment the page's refcount so that it stays * allocated while we're using it + * the caller must make sure 'page < bimap->pages' */ static int md_bitmap_checkpage(struct bitmap_counts *bitmap, unsigned long page, int create, int no_hijack) @@ -54,14 +55,6 @@ __acquires(bitmap->lock) { unsigned char *mappage; - if (page >= bitmap->pages) { - /* This can happen if bitmap_start_sync goes beyond - * End-of-device while looking for a whole page. - * It is harmless. - */ - return -EINVAL; - } - if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */ return 0; @@ -1387,6 +1380,14 @@ __acquires(bitmap->lock) sector_t csize; int err; + if (page >= bitmap->pages) { + /* + * This can happen if bitmap_start_sync goes beyond + * End-of-device while looking for a whole page or + * user set a huge number to sysfs bitmap_set_bits. + */ + return NULL; + } err = md_bitmap_checkpage(bitmap, page, create, 0); if (bitmap->bp[page].hijacked ||