[Devel] [PATCH hci-8.1 2/2] dm-ploop: fix flip_upper_deltas walking past the BAT of the lower delta

[Denis V. Lunev]

From: Denis V. Lunev <den at openvz.org>

ploop_check_delta_before_flip() walks the live BAT pages together with
the BAT pages of the lower delta, and means to stop at the page that
holds the last entry of the lower delta. It takes that entry from i
after the scan of the page, when i is already one past end, so the stop
never matches. Once the live BAT has more pages than the lower delta, as
after a grow of the device, the walk runs off the md tree of the lower
delta and dereferences a NULL page: the flip oopses. The reverse merge
of the ploop library grows the lower delta to the size of the top before
it flips, so only a flip outside the library gets there.

Take the last entry of the page from end.

Fixes: 6ddad5a4d226 ("dm-ploop: Add ploop target driver")
https://virtuozzo.atlassian.net/browse/VSTOR-153445
Feature: dm-ploop: ploop target driver
Signed-off-by: Denis V. Lunev <den at openvz.org>
---
 drivers/md/dm-ploop-cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c
index d6abbdc3c7e3..74674011a888 100644
--- a/drivers/md/dm-ploop-cmd.c
+++ b/drivers/md/dm-ploop-cmd.c
@@ -1154,7 +1154,7 @@ static int ploop_check_delta_before_flip(struct ploop *ploop, struct file *file)
 		if (stop)
 			break;
 
-		clu = ploop_page_clu_idx_to_bat_clu(md->id, i);
+		clu = ploop_page_clu_idx_to_bat_clu(md->id, end);
 		if (clu == nr_be - 1) {
 			stop = true;
 			goto unmap;
-- 
2.53.0