Commit 0202ef33 authored by Damien Le Moal's avatar Damien Le Moal Committed by Xie XiuQi
Browse files

null_blk: Fix zone size initialization 



stable inclusion
from stable-5.10.4
commit 92ee9b9fa8a463fc4053f3053efc49357023e133
bugzilla: 46903

--------------------------------

commit 0ebcdd70 upstream.

For a null_blk device with zoned mode enabled is currently initialized
with a number of zones equal to the device capacity divided by the zone
size, without considering if the device capacity is a multiple of the
zone size. If the zone size is not a divisor of the capacity, the zones
end up not covering the entire capacity, potentially resulting is out
of bounds accesses to the zone array.

Fix this by adding one last smaller zone with a size equal to the
remainder of the disk capacity divided by the zone size if the capacity
is not a multiple of the zone size. For such smaller last zone, the zone
capacity is also checked so that it does not exceed the smaller zone
size.

Reported-by: default avatarNaohiro Aota <naohiro.aota@wdc.com>
Fixes: ca4b2a01 ("null_blk: add zone support")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
parent 214afae5

drivers/block/null_blk_zoned.c

+15 −8
Original line number Diff line number Diff line
@@ -6,8 +6,7 @@ 
#define CREATE_TRACE_POINTS

#include "null_blk_trace.h"



/* zone_size in MBs to sectors. */

#define ZONE_SIZE_SHIFT		11

#define MB_TO_SECTS(mb) (((sector_t)mb * SZ_1M) >> SECTOR_SHIFT)



static inline unsigned int null_zone_no(struct nullb_device *dev, sector_t sect)

{
@@ -16,7 +15,7 @@ static inline unsigned int null_zone_no(struct nullb_device *dev, sector_t sect) 


int null_init_zoned_dev(struct nullb_device *dev, struct request_queue *q)

{

	sector_t dev_size = (sector_t)dev->size * 1024 * 1024;

	sector_t dev_capacity_sects, zone_capacity_sects;

	sector_t sector = 0;

	unsigned int i;
@@ -38,9 +37,13 @@ int null_init_zoned_dev(struct nullb_device *dev, struct request_queue *q) 
		return -EINVAL;

	}



	dev->zone_size_sects = dev->zone_size << ZONE_SIZE_SHIFT;

	dev->nr_zones = dev_size >>

				(SECTOR_SHIFT + ilog2(dev->zone_size_sects));

	zone_capacity_sects = MB_TO_SECTS(dev->zone_capacity);

	dev_capacity_sects = MB_TO_SECTS(dev->size);

	dev->zone_size_sects = MB_TO_SECTS(dev->zone_size);

	dev->nr_zones = dev_capacity_sects >> ilog2(dev->zone_size_sects);

	if (dev_capacity_sects & (dev->zone_size_sects - 1))

		dev->nr_zones++;



	dev->zones = kvmalloc_array(dev->nr_zones, sizeof(struct blk_zone),

			GFP_KERNEL | __GFP_ZERO);

	if (!dev->zones)
@@ -101,8 +104,12 @@ int null_init_zoned_dev(struct nullb_device *dev, struct request_queue *q) 
		struct blk_zone *zone = &dev->zones[i];



		zone->start = zone->wp = sector;

		if (zone->start + dev->zone_size_sects > dev_capacity_sects)

			zone->len = dev_capacity_sects - zone->start;

		else

			zone->len = dev->zone_size_sects;

		zone->capacity = dev->zone_capacity << ZONE_SIZE_SHIFT;

		zone->capacity =

			min_t(sector_t, zone->len, zone_capacity_sects);

		zone->type = BLK_ZONE_TYPE_SEQWRITE_REQ;

		zone->cond = BLK_ZONE_COND_EMPTY;