[Devel] [PATCH RHEL7 COMMIT] cbt: endless loop on rollback in ploop_pb_map_alloc()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1127.8.2.vz7.151.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1127.8.2.vz7.151.9
------>
commit 280cfc5f90ca1604d12bef0cafe2f1a57cd05b2c
Author: Vasily Averin <vvs at virtuozzo.com>
Date:   Mon Jun 1 14:54:08 2020 +0300

    cbt: endless loop on rollback in ploop_pb_map_alloc()
    
    found by smatch:
    drivers/block/ploop/push_backup.c:96 ploop_pb_map_alloc() warn:
     always true condition '(--i >= 0) => (0-u64max >= 0)'
    
    it leads to endless loop on rollback.
    
    https://jira.sw.ru/browse/PSBM-104530
    
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
    Reviewed-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 drivers/block/ploop/push_backup.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/block/ploop/push_backup.c b/drivers/block/ploop/push_backup.c
index 168fa24fb0d86..ac07919fb8d34 100644
--- a/drivers/block/ploop/push_backup.c
+++ b/drivers/block/ploop/push_backup.c
@@ -81,9 +81,9 @@ int ploop_pb_get_uuid(struct ploop_pushbackup_desc *pbd, __u8 *uuid)
 
 static struct page **ploop_pb_map_alloc(unsigned long block_max)
 {
-	unsigned long npages = NR_PAGES(block_max);
+	long npages = NR_PAGES(block_max);
 	struct page **map = vmalloc(npages * sizeof(void *));
-	unsigned long i;
+	long i;
 
 	if (!map)
 		return NULL;
@@ -106,7 +106,7 @@ static struct page **ploop_pb_map_alloc(unsigned long block_max)
 static void ploop_pb_map_free(struct page **map, unsigned long block_max)
 {
 	if (map) {
-		unsigned long i;
+		long i;
 		for (i = 0; i < NR_PAGES(block_max); i++)
 			if (map[i])
 				__free_page(map[i]);