Unverified Commit 083359e7 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9783 CVE-2024-38598 

Merge Pull Request from: @ci-robot 
 
PR sync from: Li Nan <linan122@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/JLQJZOQ2QQYTGU255SLRAYUF4D2GVU6I/ 
Li Nan (2):
  Revert "md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter"
  md/raid10: check slab-out-of-bounds in md_bitmap_get_counter

Yu Kuai (1):
  md: fix resync softlockup when bitmap size is less than array size


-- 
2.39.2
 
https://gitee.com/src-openeuler/kernel/issues/IA6SH1 
 
Link:https://gitee.com/openeuler/kernel/pulls/9783

 

Reviewed-by: default avatarYu Kuai <yukuai3@huawei.com>
Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 406a4071 efbec3f1

drivers/md/md-bitmap.c

+11 −13
Original line number Diff line number Diff line
@@ -54,14 +54,7 @@ __acquires(bitmap->lock) 
{

	unsigned char *mappage;



	if (page >= bitmap->pages) {

		/* This can happen if bitmap_start_sync goes beyond

		 * End-of-device while looking for a whole page.

		 * It is harmless.

		 */

		return -EINVAL;

	}



	WARN_ON_ONCE(page >= bitmap->pages);

	if (bitmap->bp[page].hijacked) /* it's hijacked, don't try to alloc */

		return 0;
@@ -1405,20 +1398,25 @@ __acquires(bitmap->lock) 
	sector_t chunk = offset >> bitmap->chunkshift;

	unsigned long page = chunk >> PAGE_COUNTER_SHIFT;

	unsigned long pageoff = (chunk & PAGE_COUNTER_MASK) << COUNTER_BYTE_SHIFT;

	sector_t csize;

	sector_t csize = ((sector_t)1) << bitmap->chunkshift;

	int err;



	if (page >= bitmap->pages)

	if (page >= bitmap->pages) {

		/*

		 * This can happen if bitmap_start_sync goes beyond

		 * End-of-device while looking for a whole page or

		 * user set a huge number to sysfs bitmap_set_bits.

		 */

		*blocks = csize - (offset & (csize - 1));

		return NULL;



	}

	err = md_bitmap_checkpage(bitmap, page, create, 0);



	if (bitmap->bp[page].hijacked ||

	    bitmap->bp[page].map == NULL)

		csize = ((sector_t)1) << (bitmap->chunkshift +

					  PAGE_COUNTER_SHIFT);

	else

		csize = ((sector_t)1) << bitmap->chunkshift;



	*blocks = csize - (offset & (csize - 1));



	if (err < 0)