From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2179CC388F7 for ; Tue, 3 Nov 2020 21:17:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CAC6C206DC for ; Tue, 3 Nov 2020 21:17:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604438248; bh=B0VkiF2DkGHzPIcAn8KhAKXcb9vNDKm6Qbf18wDtr1w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=iZ+OZWa6FGffL3j7/eDhTwQr5Qr5Q4IzA7+DE25KqtJK8x9t1uMpXFaC8HzKfjakT A+fusueUiMrQ+s8XqoS9wOrNJiIr8EnU4xRB2tH0AeuZABgWEXUevKV8SKbndUoG1j TyIJV9fVk2ENyp+aCM6HHk4tkMmxV8T6+7EGCoO4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388733AbgKCVRX (ORCPT ); Tue, 3 Nov 2020 16:17:23 -0500 Received: from mail.kernel.org ([198.145.29.99]:51082 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388698AbgKCVKS (ORCPT ); Tue, 3 Nov 2020 16:10:18 -0500 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8376C22226; Tue, 3 Nov 2020 21:10:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1604437818; bh=B0VkiF2DkGHzPIcAn8KhAKXcb9vNDKm6Qbf18wDtr1w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xhZYcaGKQZWVPBi4H/jZ3Uy5D5kwv5S3q3H36ctlFwcCZzXzfPAwBpZmMqS7BiGu9 PVsDt0CwPO4vn/IeJ/MoYYdt9EoPLMZ1TtWYa2dS4Q1FZ7Ov9VZkAo0G0K399hfLIy jiQTHAaWSDQ9NJ0FIQozMhgEOob/OD+VX5uYEs4g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhao Heming , Song Liu , Sasha Levin Subject: [PATCH 4.14 045/125] md/bitmap: md_bitmap_get_counter returns wrong blocks Date: Tue, 3 Nov 2020 21:37:02 +0100 Message-Id: <20201103203203.498308034@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201103203156.372184213@linuxfoundation.org> References: <20201103203156.372184213@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Zhao Heming [ Upstream commit d837f7277f56e70d82b3a4a037d744854e62f387 ] md_bitmap_get_counter() has code: ``` if (bitmap->bp[page].hijacked || bitmap->bp[page].map == NULL) csize = ((sector_t)1) << (bitmap->chunkshift + PAGE_COUNTER_SHIFT - 1); ``` The minus 1 is wrong, this branch should report 2048 bits of space. With "-1" action, this only report 1024 bit of space. This bug code returns wrong blocks, but it doesn't inflence bitmap logic: 1. Most callers focus this function return value (the counter of offset), not the parameter blocks. 2. The bug is only triggered when hijacked is true or map is NULL. the hijacked true condition is very rare. the "map == null" only true when array is creating or resizing. 3. Even the caller gets wrong blocks, current code makes caller just to call md_bitmap_get_counter() one more time. Signed-off-by: Zhao Heming Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- drivers/md/bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c index 7eb76a1a25053..521c13f7929c8 100644 --- a/drivers/md/bitmap.c +++ b/drivers/md/bitmap.c @@ -1369,7 +1369,7 @@ __acquires(bitmap->lock) if (bitmap->bp[page].hijacked || bitmap->bp[page].map == NULL) csize = ((sector_t)1) << (bitmap->chunkshift + - PAGE_COUNTER_SHIFT - 1); + PAGE_COUNTER_SHIFT); else csize = ((sector_t)1) << bitmap->chunkshift; *blocks = csize - (offset & (csize - 1)); -- 2.27.0