[Devel] [PATCH hci-8.1 v6 03/12] dm-ploop: reject a delta header whose BAT does not cover the target

[Alexander Ivanov]

ploop_setup_metadata() takes the number of BAT entries from m_Size of
the top delta header, but checks only m_SizeInSectors_v2 against the
target length. A header with a small m_Size (including zero) and a large
enough m_SizeInSectors_v2 passes all checks. Requests past the last BAT
entry then hit WARN_ONCE() in ploop_rq_valid(), which panics the host
with panic_on_warn.

Reject the header if the BAT does not cover the target, taking the
skip_off shift of request positions into account.

https://virtuozzo.atlassian.net/browse/VSTOR-148171
Feature: dm-ploop: ploop target driver

Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/md/dm-ploop-bat.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
index 5ddb8ffdff07..7b12b0f9fe81 100644
--- a/drivers/md/dm-ploop-bat.c
+++ b/drivers/md/dm-ploop-bat.c
@@ -10,6 +10,7 @@
 #include <linux/uio.h>
 #include <linux/error-injection.h>
 #include <linux/mm.h>
+#include <linux/overflow.h>
 #include "dm-ploop.h"
 
 struct md_page *ploop_md_page_find(struct ploop *ploop, u32 id)
@@ -189,6 +190,7 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page)
 	struct ploop_pvd_header *m_hdr = NULL;
 	u32 bat_clusters, offset_clusters;
 	struct dm_target *ti = ploop->ti;
+	u64 end;
 	int ret;
 
 	m_hdr = kmap(page);
@@ -229,6 +231,11 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page)
 		PL_ERR("Too short BAT");
 		goto out;
 	}
+	if (check_add_overflow((u64)ti->len, ploop->skip_off, &end) ||
+	    SEC_TO_CLU(ploop, end - 1) >= ploop->nr_bat_entries) {
+		PL_ERR("BAT does not cover the target");
+		goto out;
+	}
 	kunmap(page);
 	m_hdr = NULL;
 
-- 
2.53.0