Unverified Commit 195d1ba0 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11899 [sync] PR-11849: bcache: fix variable length array abuse in btree_iter 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/11849 
 
PR sync from: Yuan Can <yuancan@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZBUDF3LEI27LXLIWDRK3LCIJU55IUNWA/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAB04K 
 
Link:https://gitee.com/openeuler/kernel/pulls/11899

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents dd875258 ac1a002e

drivers/md/bcache/bset.c

+22 −22
Original line number Diff line number Diff line
@@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) 
int __bch_count_data(struct btree_keys *b)

{

	unsigned int ret = 0;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	struct bkey *k;



	if (b->ops->is_extents)
@@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) 
{

	va_list args;

	struct bkey *k, *p = NULL;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	const char *err;



	for_each_key(b, k, &iter) {
@@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, 
	unsigned int status = BTREE_INSERT_STATUS_NO_INSERT;

	struct bset *i = bset_tree_last(b)->data;

	struct bkey *m, *prev = NULL;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	struct bkey preceding_key_on_stack = ZERO_KEY;

	struct bkey *preceding_key_p = &preceding_key_on_stack;
@@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, 
	else

		preceding_key(k, &preceding_key_p);



	m = bch_btree_iter_init(b, &iter, preceding_key_p);

	m = bch_btree_iter_stack_init(b, &iter, preceding_key_p);



	if (b->ops->insert_fixup(b, k, &iter, replace_key))

	if (b->ops->insert_fixup(b, k, &iter.iter, replace_key))

		return status;



	status = BTREE_INSERT_STATUS_INSERT;
@@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, 
				 btree_iter_cmp));

}



static struct bkey *__bch_btree_iter_init(struct btree_keys *b,

					  struct btree_iter *iter,

static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b,

						struct btree_iter_stack *iter,

						struct bkey *search,

						struct bset_tree *start)

{

	struct bkey *ret = NULL;



	iter->size = ARRAY_SIZE(iter->data);

	iter->used = 0;

	iter->iter.size = ARRAY_SIZE(iter->stack_data);

	iter->iter.used = 0;



#ifdef CONFIG_BCACHE_DEBUG

	iter->b = b;

	iter->iter.b = b;

#endif



	for (; start <= bset_tree_last(b); start++) {

		ret = bch_bset_search(b, start, search);

		bch_btree_iter_push(iter, ret, bset_bkey_last(start->data));

		bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data));

	}



	return ret;

}



struct bkey *bch_btree_iter_init(struct btree_keys *b,

				 struct btree_iter *iter,

struct bkey *bch_btree_iter_stack_init(struct btree_keys *b,

				 struct btree_iter_stack *iter,

				 struct bkey *search)

{

	return __bch_btree_iter_init(b, iter, search, b->set);

	return __bch_btree_iter_stack_init(b, iter, search, b->set);

}



static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter,
@@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, 
			    struct bset_sort_state *state)

{

	size_t order = b->page_order, keys = 0;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	int oldsize = bch_count_data(b);



	__bch_btree_iter_init(b, &iter, NULL, &b->set[start]);

	__bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]);



	if (start) {

		unsigned int i;
@@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, 
		order = get_order(__set_bytes(b->set->data, keys));

	}



	__btree_sort(b, &iter, start, order, false, state);

	__btree_sort(b, &iter.iter, start, order, false, state);



	EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize);

}
@@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, 
			 struct bset_sort_state *state)

{

	uint64_t start_time = local_clock();

	struct btree_iter iter;

	struct btree_iter_stack iter;



	bch_btree_iter_init(b, &iter, NULL);

	bch_btree_iter_stack_init(b, &iter, NULL);



	btree_mergesort(b, new->set->data, &iter, false, true);

	btree_mergesort(b, new->set->data, &iter.iter, false, true);



	bch_time_stats_update(&state->time, start_time);

drivers/md/bcache/bset.h

+18 −10
Original line number Diff line number Diff line
@@ -321,7 +321,14 @@ struct btree_iter { 
#endif

	struct btree_iter_set {

		struct bkey *k, *end;

	} data[MAX_BSETS];

	} data[];

};



/* Fixed-size btree_iter that can be allocated on the stack */



struct btree_iter_stack {

	struct btree_iter iter;

	struct btree_iter_set stack_data[MAX_BSETS];

};



typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k);
@@ -333,8 +340,8 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, 


void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k,

			 struct bkey *end);

struct bkey *bch_btree_iter_init(struct btree_keys *b,

				 struct btree_iter *iter,

struct bkey *bch_btree_iter_stack_init(struct btree_keys *b,

				       struct btree_iter_stack *iter,

				       struct bkey *search);



struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t,
@@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, 
	return search ? __bch_bset_search(b, t, search) : t->data->start;

}



#define for_each_key_filter(b, k, iter, filter)				\

	for (bch_btree_iter_init((b), (iter), NULL);			\

	     ((k) = bch_btree_iter_next_filter((iter), (b), filter));)

#define for_each_key_filter(b, k, stack_iter, filter)                      \

	for (bch_btree_iter_stack_init((b), (stack_iter), NULL);           \

	     ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \

					       filter));)



#define for_each_key(b, k, iter)					\

	for (bch_btree_iter_init((b), (iter), NULL);			\

	     ((k) = bch_btree_iter_next(iter));)

#define for_each_key(b, k, stack_iter)                           \

	for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \

	     ((k) = bch_btree_iter_next(&((stack_iter)->iter)));)



/* Sorting */

drivers/md/bcache/btree.c

+21 −19
Original line number Diff line number Diff line
@@ -1283,7 +1283,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) 
	uint8_t stale = 0;

	unsigned int keys = 0, good_keys = 0;

	struct bkey *k;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	struct bset_tree *t;



	gc->nodes++;
@@ -1544,7 +1544,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, 
static unsigned int btree_gc_count_keys(struct btree *b)

{

	struct bkey *k;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	unsigned int ret = 0;



	for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad)
@@ -1585,17 +1585,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, 
	int ret = 0;

	bool should_rewrite;

	struct bkey *k;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	struct gc_merge_info r[GC_MERGE_NODES];

	struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1;



	bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done);

	bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done);



	for (i = r; i < r + ARRAY_SIZE(r); i++)

		i->b = ERR_PTR(-EINTR);



	while (1) {

		k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad);

		k = bch_btree_iter_next_filter(&iter.iter, &b->keys,

					       bch_ptr_bad);

		if (k) {

			r->b = bch_btree_node_get(b->c, op, k, b->level - 1,

						  true, b);
@@ -1885,7 +1886,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) 
{

	int ret = 0;

	struct bkey *k, *p = NULL;

	struct btree_iter iter;

	struct btree_iter_stack iter;



	for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid)

		bch_initial_mark_key(b->c, b->level, k);
@@ -1893,10 +1894,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) 
	bch_initial_mark_key(b->c, b->level + 1, &b->key);



	if (b->level) {

		bch_btree_iter_init(&b->keys, &iter, NULL);

		bch_btree_iter_stack_init(&b->keys, &iter, NULL);



		do {

			k = bch_btree_iter_next_filter(&iter, &b->keys,

			k = bch_btree_iter_next_filter(&iter.iter, &b->keys,

						       bch_ptr_bad);

			if (k) {

				btree_node_prefetch(b, k);
@@ -1924,7 +1925,7 @@ static int bch_btree_check_thread(void *arg) 
	struct btree_check_info *info = arg;

	struct btree_check_state *check_state = info->state;

	struct cache_set *c = check_state->c;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	struct bkey *k, *p;

	int cur_idx, prev_idx, skip_nr;
@@ -1933,8 +1934,8 @@ static int bch_btree_check_thread(void *arg) 
	ret = 0;



	/* root node keys are checked before thread created */

	bch_btree_iter_init(&c->root->keys, &iter, NULL);

	k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad);

	bch_btree_iter_stack_init(&c->root->keys, &iter, NULL);

	k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad);

	BUG_ON(!k);



	p = k;
@@ -1952,7 +1953,7 @@ static int bch_btree_check_thread(void *arg) 
		skip_nr = cur_idx - prev_idx;



		while (skip_nr) {

			k = bch_btree_iter_next_filter(&iter,

			k = bch_btree_iter_next_filter(&iter.iter,

						       &c->root->keys,

						       bch_ptr_bad);

			if (k)
@@ -2025,7 +2026,7 @@ int bch_btree_check(struct cache_set *c) 
	int ret = 0;

	int i;

	struct bkey *k = NULL;

	struct btree_iter iter;

	struct btree_iter_stack iter;

	struct btree_check_state check_state;



	/* check and mark root node keys */
@@ -2521,11 +2522,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, 


	if (b->level) {

		struct bkey *k;

		struct btree_iter iter;

		struct btree_iter_stack iter;



		bch_btree_iter_init(&b->keys, &iter, from);

		bch_btree_iter_stack_init(&b->keys, &iter, from);



		while ((k = bch_btree_iter_next_filter(&iter, &b->keys,

		while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys,

						       bch_ptr_bad))) {

			ret = bcache_btree(map_nodes_recurse, k, b,

				    op, from, fn, flags);
@@ -2554,11 +2555,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, 
{

	int ret = MAP_CONTINUE;

	struct bkey *k;

	struct btree_iter iter;

	struct btree_iter_stack iter;



	bch_btree_iter_init(&b->keys, &iter, from);

	bch_btree_iter_stack_init(&b->keys, &iter, from);



	while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) {

	while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys,

					       bch_ptr_bad))) {

		ret = !b->level

			? fn(op, b, k)

			: bcache_btree(map_keys_recurse, k,

drivers/md/bcache/super.c

+3 −2
Original line number Diff line number Diff line
@@ -1930,7 +1930,8 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 
	INIT_LIST_HEAD(&c->btree_cache_freed);

	INIT_LIST_HEAD(&c->data_buckets);



	iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) *

	iter_size = sizeof(struct btree_iter) +

		    ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) *

			    sizeof(struct btree_iter_set);



	c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL);

drivers/md/bcache/sysfs.c

+1 −1
Original line number Diff line number Diff line
@@ -660,7 +660,7 @@ static unsigned int bch_root_usage(struct cache_set *c) 
	unsigned int bytes = 0;

	struct bkey *k;

	struct btree *b;

	struct btree_iter iter;

	struct btree_iter_stack iter;



	goto lock_root;