[Devel] [PATCH RHEL8 COMMIT] ploop: Add sanity check of passed BAT from disk

[Konstantin Khorenko]

The commit is pushed to "branch-rh8-4.18.0-240.1.1.vz8.5.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-240.1.1.vz8.5.51
------>
commit e24a3b9a60225cbf654af903bc27fe6cb86ef1ee
Author: Kirill Tkhai <ktkhai at virtuozzo.com>
Date:   Fri Jul 2 22:48:01 2021 +0300

    ploop: Add sanity check of passed BAT from disk
    
    Check, nobody refer to BAT-related clusters.
    
    In scope of: https://jira.sw.ru/browse/PSBM-131202
    Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
    
    ==========================
    ploop: Split pios in kwork
    
    https://jira.sw.ru/browse/PSBM-131208
    
    Kirill Tkhai (10):
          ploop: Remove debug noinline in create_bvec_from_rq()
          ploop: Manage flush pios in generic way
          ploop: Teach dispatch_pios() work with flush pios
          ploop: Make split_pios_to_list() to add initial pio to the list too
          ploop: Introduce embedded_pio_to_prq()
          ploop: Introduce ploop_prq_valid()
          ploop: Move create_bvec_from_rq() up
          ploop: Split pios from kwork context
          ploop: Add sanity check of passed BAT from disk
          ploop: Reread file size after index update
---
 drivers/md/dm-ploop-bat.c | 13 +++++++++----
 drivers/md/dm-ploop.h     |  2 +-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
index 1ae863043f50..b07dc87cf3e9 100644
--- a/drivers/md/dm-ploop-bat.c
+++ b/drivers/md/dm-ploop-bat.c
@@ -339,15 +339,20 @@ static int ploop_delta_check_header(struct ploop *ploop,
 	return ret;
 }
 
-int convert_bat_entries(u32 *bat_entries, u32 count)
+int convert_bat_entries(struct ploop *ploop, u32 *bat_entries, u32 nr_be)
 {
-	int i;
+	u32 i, bytes, bat_clusters;
 
-	for (i = 0; i < count; i++) {
+	bytes = (PLOOP_MAP_OFFSET + nr_be) * sizeof(map_index_t);
+	bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop));
+
+	for (i = 0; i < nr_be; i++) {
 		if (bat_entries[i] == BAT_ENTRY_NONE)
 			return -EPROTO;
 		if (!bat_entries[i])
 			bat_entries[i] = BAT_ENTRY_NONE;
+		if (bat_entries[i] < bat_clusters)
+			return -EXDEV;
 	}
 
 	return 0;
@@ -387,7 +392,7 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
 		goto out_vfree;
 
 	delta_bat_entries = *d_hdr + PLOOP_MAP_OFFSET * sizeof(map_index_t);
-	ret = convert_bat_entries(delta_bat_entries, delta_nr_be);
+	ret = convert_bat_entries(ploop, delta_bat_entries, delta_nr_be);
 
 	*delta_nr_be_ret = delta_nr_be;
 out_vfree:
diff --git a/drivers/md/dm-ploop.h b/drivers/md/dm-ploop.h
index d26f269e475c..5bc3cb7c78b6 100644
--- a/drivers/md/dm-ploop.h
+++ b/drivers/md/dm-ploop.h
@@ -529,7 +529,7 @@ extern void ploop_free_md_page(struct md_page *md);
 extern void free_md_pages_tree(struct rb_root *root);
 extern bool try_update_bat_entry(struct ploop *ploop, u32 clu,
 				 u8 level, u32 dst_clu);
-extern int convert_bat_entries(u32 *bat_entries, u32 count);
+extern int convert_bat_entries(struct ploop *ploop, u32 *bat_entries, u32 count);
 
 extern int ploop_add_delta(struct ploop *ploop, u32 level, struct file *file, bool is_raw);
 extern void dispatch_pios(struct ploop *ploop, struct pio *pio, struct list_head *pio_list);