Commit c4fa3684 authored by Mikulas Patocka's avatar Mikulas Patocka Committed by Jens Axboe
Browse files

blk-lib: fix blkdev_issue_secure_erase 



There's a bug in blkdev_issue_secure_erase. The statement
"unsigned int len = min_t(sector_t, nr_sects, max_sectors);"
sets the variable "len" to the length in sectors, but the statement
"bio->bi_iter.bi_size = len" treats it as if it were in bytes.
The statements "sector += len << SECTOR_SHIFT" and "nr_sects -= len <<
SECTOR_SHIFT" are thinko.

This patch fixes it.

Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org	# v5.19
Fixes: 44abff2c ("block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD")
Link: https://lore.kernel.org/r/alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 56f99b8d

block/blk-lib.c

+8 −3
Original line number Diff line number Diff line
@@ -309,6 +309,11 @@ int blkdev_issue_secure_erase(struct block_device *bdev, sector_t sector, 
	struct blk_plug plug;

	int ret = 0;



	/* make sure that "len << SECTOR_SHIFT" doesn't overflow */

	if (max_sectors > UINT_MAX >> SECTOR_SHIFT)

		max_sectors = UINT_MAX >> SECTOR_SHIFT;

	max_sectors &= ~bs_mask;



	if (max_sectors == 0)

		return -EOPNOTSUPP;

	if ((sector | nr_sects) & bs_mask)
@@ -322,10 +327,10 @@ int blkdev_issue_secure_erase(struct block_device *bdev, sector_t sector, 


		bio = blk_next_bio(bio, bdev, 0, REQ_OP_SECURE_ERASE, gfp);

		bio->bi_iter.bi_sector = sector;

		bio->bi_iter.bi_size = len;

		bio->bi_iter.bi_size = len << SECTOR_SHIFT;



		sector += len << SECTOR_SHIFT;

		nr_sects -= len << SECTOR_SHIFT;

		sector += len;

		nr_sects -= len;

		if (!nr_sects) {

			ret = submit_bio_wait(bio);

			bio_put(bio);