[Devel] [PATCH RHEL8 COMMIT] ploop: Fix off-by-one in early check of cluster is outside max size

Konstantin Khorenko khorenko at virtuozzo.com
Fri Apr 30 12:11:05 MSK 2021


The commit is pushed to "branch-rh8-4.18.0-240.1.1.vz8.5.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-240.1.1.vz8.5.23
------>
commit c84053e7e29454e0939740fdb9f974081d18c26f
Author: Kirill Tkhai <ktkhai at virtuozzo.com>
Date:   Fri Apr 30 12:11:05 2021 +0300

    ploop: Fix off-by-one in early check of cluster is outside max size
    
    There fired a warning about incomming bio's cluster index is too big.
    It's aimed to catch such the bios early in ploop_bio_cluster(),
    but it does not handle == case (see patch).
    Replenish the check with that case (like in cluster_is_in_top_delta()).
    
    It looks like there is also some userspace problem, since we shouldn't
    receive such the bios. There was a resize, which changed dm device size,
    while target was not reloaded, or resize ioctl() was not called.
    
    [ 3616.225467] EXT4-fs (dm-25478): resizing filesystem from 17039360 to 17039872 blocks
    [ 3616.229738] EXT4-fs (dm-25478): resizing filesystem from 17039360 to 17039360 blocks
    [ 3769.686132] WARNING: CPU: 3 PID: 26495 at drivers/md/dm-ploop.h:408 ploop_map+0x401/0x460 [ploop]
    
    https://jira.sw.ru/browse/PSBM-128679
    
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 drivers/md/dm-ploop-map.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-ploop-map.c b/drivers/md/dm-ploop-map.c
index ea515d928bd7..9dcfe138dc54 100644
--- a/drivers/md/dm-ploop-map.c
+++ b/drivers/md/dm-ploop-map.c
@@ -103,7 +103,7 @@ static int ploop_bio_cluster(struct ploop *ploop, struct bio *bio,
 	end_byte = ((sector << 9) + bio->bi_iter.bi_size - 1);
 	end_cluster = end_byte >> (ploop->cluster_log + 9);
 
-	if (unlikely(cluster > ploop->nr_bat_entries) ||
+	if (unlikely(cluster >= ploop->nr_bat_entries) ||
 		     cluster != end_cluster) {
 		/*
 		 * This mustn't happen, since we set max_io_len


More information about the Devel mailing list