From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5491FC33CB3 for ; Thu, 30 Jan 2020 18:49:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2CC2B205F4 for ; Thu, 30 Jan 2020 18:49:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1580410156; bh=wTJKfnahA9dRh4GuTokx+sUYQydd9BTA3cBAE6sWKVo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=x09b95KNcSlOtIu0tsjcwOHs/tK1LByyA1sc8XxEVwvKahg7eIrKeiVcV/g7UTDuI +UXejOwcDMyqRUh0uX+mKMfpkiHflpX9w3GZbKcJtbG5+jblup4Ze/QB5t2iU1E/eE Iynzmvhee0TvRSIY9s1RuPcna7WJE+DKtUHNPZbQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731671AbgA3StP (ORCPT ); Thu, 30 Jan 2020 13:49:15 -0500 Received: from mail.kernel.org ([198.145.29.99]:60228 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728018AbgA3Ss5 (ORCPT ); Thu, 30 Jan 2020 13:48:57 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 467A920CC7; Thu, 30 Jan 2020 18:48:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1580410136; bh=wTJKfnahA9dRh4GuTokx+sUYQydd9BTA3cBAE6sWKVo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JjbmkMJpWr9aEAc9dJslD4KjHQL3MtTT1SjMFLxn0QyNyIaFzjb85WbK7GBG3vGRd Z9Y4Qek0+1vw/8Xun2JOpvhXyRz2sR+VIhKrcpiqDazG6kyvgsiKfb9Tq0c3DwlGTp 2cIRCMqxp+LuYJS2tiK6mCrIpP72JhTBUEapSrcI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Darrick J. Wong" , Dave Chinner , Jens Axboe , Konstantin Khlebnikov Subject: [PATCH 4.19 54/55] block: fix 32 bit overflow in __blkdev_issue_discard() Date: Thu, 30 Jan 2020 19:39:35 +0100 Message-Id: <20200130183618.177984182@linuxfoundation.org> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200130183608.563083888@linuxfoundation.org> References: <20200130183608.563083888@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Chinner commit 4800bf7bc8c725e955fcbc6191cc872f43f506d3 upstream. A discard cleanup merged into 4.20-rc2 causes fstests xfs/259 to fall into an endless loop in the discard code. The test is creating a device that is exactly 2^32 sectors in size to test mkfs boundary conditions around the 32 bit sector overflow region. mkfs issues a discard for the entire device size by default, and hence this throws a sector count of 2^32 into blkdev_issue_discard(). It takes the number of sectors to discard as a sector_t - a 64 bit value. The commit ba5d73851e71 ("block: cleanup __blkdev_issue_discard") takes this sector count and casts it to a 32 bit value before comapring it against the maximum allowed discard size the device has. This truncates away the upper 32 bits, and so if the lower 32 bits of the sector count is zero, it starts issuing discards of length 0. This causes the code to fall into an endless loop, issuing a zero length discards over and over again on the same sector. Fixes: ba5d73851e71 ("block: cleanup __blkdev_issue_discard") Tested-by: Darrick J. Wong Reviewed-by: Darrick J. Wong Signed-off-by: Dave Chinner Killed pointless WARN_ON(). Signed-off-by: Jens Axboe Signed-off-by: Konstantin Khlebnikov Signed-off-by: Greg Kroah-Hartman --- block/blk-lib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/block/blk-lib.c +++ b/block/blk-lib.c @@ -56,9 +56,11 @@ int __blkdev_issue_discard(struct block_ return -EINVAL; while (nr_sects) { - unsigned int req_sects = min_t(unsigned int, nr_sects, + sector_t req_sects = min_t(sector_t, nr_sects, bio_allowed_max_sectors(q)); + WARN_ON_ONCE((req_sects << 9) > UINT_MAX); + bio = next_bio(bio, 0, gfp_mask); bio->bi_iter.bi_sector = sector; bio_set_dev(bio, bdev);