blk-lib: fix blkdev_issue_secure_erase
commitc4fa368466
upstream. There's a bug in blkdev_issue_secure_erase. The statement "unsigned int len = min_t(sector_t, nr_sects, max_sectors);" sets the variable "len" to the length in sectors, but the statement "bio->bi_iter.bi_size = len" treats it as if it were in bytes. The statements "sector += len << SECTOR_SHIFT" and "nr_sects -= len << SECTOR_SHIFT" are thinko. This patch fixes it. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org # v5.19 Fixes:44abff2c0b
("block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD") Link: https://lore.kernel.org/r/alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
c2c7f67fd1
commit
46c716a31f
|
@ -311,6 +311,11 @@ int blkdev_issue_secure_erase(struct block_device *bdev, sector_t sector,
|
|||
struct blk_plug plug;
|
||||
int ret = 0;
|
||||
|
||||
/* make sure that "len << SECTOR_SHIFT" doesn't overflow */
|
||||
if (max_sectors > UINT_MAX >> SECTOR_SHIFT)
|
||||
max_sectors = UINT_MAX >> SECTOR_SHIFT;
|
||||
max_sectors &= ~bs_mask;
|
||||
|
||||
if (max_sectors == 0)
|
||||
return -EOPNOTSUPP;
|
||||
if ((sector | nr_sects) & bs_mask)
|
||||
|
@ -324,10 +329,10 @@ int blkdev_issue_secure_erase(struct block_device *bdev, sector_t sector,
|
|||
|
||||
bio = blk_next_bio(bio, bdev, 0, REQ_OP_SECURE_ERASE, gfp);
|
||||
bio->bi_iter.bi_sector = sector;
|
||||
bio->bi_iter.bi_size = len;
|
||||
bio->bi_iter.bi_size = len << SECTOR_SHIFT;
|
||||
|
||||
sector += len << SECTOR_SHIFT;
|
||||
nr_sects -= len << SECTOR_SHIFT;
|
||||
sector += len;
|
||||
nr_sects -= len;
|
||||
if (!nr_sects) {
|
||||
ret = submit_bio_wait(bio);
|
||||
bio_put(bio);
|
||||
|
|
Loading…
Reference in New Issue