From: Mikulas Patocka <mpatocka@redhat.com> To: Jens Axboe <axboe@kernel.dk>, Christoph Hellwig <hch@lst.de>, linux-block@vger.kernel.org, dm-devel@redhat.com Cc: "Martin K. Petersen" <martin.petersen@oracle.com>, "Christoph Böhmwalder" <christoph.boehmwalder@linbit.com>, "Ryusuke Konishi" <konishi.ryusuke@gmail.com>, "Jaegeuk Kim" <jaegeuk@kernel.org>, "Coly Li" <colyli@suse.de>, "David Sterba" <dsterba@suse.com>, "Chao Yu" <chao@kernel.org>, "Chaitanya Kulkarni" <kch@nvidia.com> Subject: [PATCH] blk-lib: fix blkdev_issue_secure_erase Date: Wed, 14 Sep 2022 16:55:51 -0400 (EDT) [thread overview] Message-ID: <alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com> (raw) There's a bug in blkdev_issue_secure_erase. The statement "unsigned int len = min_t(sector_t, nr_sects, max_sectors);" sets the variable "len" to the length in sectors, but the statement "bio->bi_iter.bi_size = len" treats it as if it were in bytes. The statements "sector += len << SECTOR_SHIFT" and "nr_sects -= len << SECTOR_SHIFT" are thinko. This patch fixes it. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org # v5.19 Fixes: 44abff2c0b97 ("block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD") --- block/blk-lib.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) Index: linux-2.6/block/blk-lib.c =================================================================== --- linux-2.6.orig/block/blk-lib.c +++ linux-2.6/block/blk-lib.c @@ -309,6 +309,11 @@ int blkdev_issue_secure_erase(struct blo struct blk_plug plug; int ret = 0; + /* make sure that "len << SECTOR_SHIFT" doesn't overflow */ + if (max_sectors > UINT_MAX >> SECTOR_SHIFT) + max_sectors = UINT_MAX >> SECTOR_SHIFT; + max_sectors &= ~bs_mask; + if (max_sectors == 0) return -EOPNOTSUPP; if ((sector | nr_sects) & bs_mask) @@ -322,10 +327,10 @@ int blkdev_issue_secure_erase(struct blo bio = blk_next_bio(bio, bdev, 0, REQ_OP_SECURE_ERASE, gfp); bio->bi_iter.bi_sector = sector; - bio->bi_iter.bi_size = len; + bio->bi_iter.bi_size = len << SECTOR_SHIFT; - sector += len << SECTOR_SHIFT; - nr_sects -= len << SECTOR_SHIFT; + sector += len; + nr_sects -= len; if (!nr_sects) { ret = submit_bio_wait(bio); bio_put(bio);
WARNING: multiple messages have this Message-ID (diff)
From: Mikulas Patocka <mpatocka@redhat.com> To: Jens Axboe <axboe@kernel.dk>, Christoph Hellwig <hch@lst.de>, linux-block@vger.kernel.org, dm-devel@redhat.com Cc: "Chaitanya Kulkarni" <kch@nvidia.com>, "Martin K. Petersen" <martin.petersen@oracle.com>, "Chao Yu" <chao@kernel.org>, "Coly Li" <colyli@suse.de>, "Christoph Böhmwalder" <christoph.boehmwalder@linbit.com>, "David Sterba" <dsterba@suse.com>, "Jaegeuk Kim" <jaegeuk@kernel.org>, "Ryusuke Konishi" <konishi.ryusuke@gmail.com> Subject: [dm-devel] [PATCH] blk-lib: fix blkdev_issue_secure_erase Date: Wed, 14 Sep 2022 16:55:51 -0400 (EDT) [thread overview] Message-ID: <alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com> (raw) There's a bug in blkdev_issue_secure_erase. The statement "unsigned int len = min_t(sector_t, nr_sects, max_sectors);" sets the variable "len" to the length in sectors, but the statement "bio->bi_iter.bi_size = len" treats it as if it were in bytes. The statements "sector += len << SECTOR_SHIFT" and "nr_sects -= len << SECTOR_SHIFT" are thinko. This patch fixes it. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org # v5.19 Fixes: 44abff2c0b97 ("block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD") --- block/blk-lib.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) Index: linux-2.6/block/blk-lib.c =================================================================== --- linux-2.6.orig/block/blk-lib.c +++ linux-2.6/block/blk-lib.c @@ -309,6 +309,11 @@ int blkdev_issue_secure_erase(struct blo struct blk_plug plug; int ret = 0; + /* make sure that "len << SECTOR_SHIFT" doesn't overflow */ + if (max_sectors > UINT_MAX >> SECTOR_SHIFT) + max_sectors = UINT_MAX >> SECTOR_SHIFT; + max_sectors &= ~bs_mask; + if (max_sectors == 0) return -EOPNOTSUPP; if ((sector | nr_sects) & bs_mask) @@ -322,10 +327,10 @@ int blkdev_issue_secure_erase(struct blo bio = blk_next_bio(bio, bdev, 0, REQ_OP_SECURE_ERASE, gfp); bio->bi_iter.bi_sector = sector; - bio->bi_iter.bi_size = len; + bio->bi_iter.bi_size = len << SECTOR_SHIFT; - sector += len << SECTOR_SHIFT; - nr_sects -= len << SECTOR_SHIFT; + sector += len; + nr_sects -= len; if (!nr_sects) { ret = submit_bio_wait(bio); bio_put(bio); -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel
next reply other threads:[~2022-09-14 20:56 UTC|newest] Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-09-14 20:55 Mikulas Patocka [this message] 2022-09-14 20:55 ` [dm-devel] [PATCH] blk-lib: fix blkdev_issue_secure_erase Mikulas Patocka 2022-09-15 6:26 ` Jens Axboe 2022-09-20 7:41 ` Christoph Hellwig 2022-09-20 7:41 ` Christoph Hellwig
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com \ --to=mpatocka@redhat.com \ --cc=axboe@kernel.dk \ --cc=chao@kernel.org \ --cc=christoph.boehmwalder@linbit.com \ --cc=colyli@suse.de \ --cc=dm-devel@redhat.com \ --cc=dsterba@suse.com \ --cc=hch@lst.de \ --cc=jaegeuk@kernel.org \ --cc=kch@nvidia.com \ --cc=konishi.ryusuke@gmail.com \ --cc=linux-block@vger.kernel.org \ --cc=martin.petersen@oracle.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.