Unverified Commit c9ff9cba authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5473 jfs: fix array-index-out-of-bounds in dbAdjTree 

Merge Pull Request from: @ci-robot 
 
PR sync from: ZhaoLong Wang <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/J5KJPPBRINI6O5QZBN5D2PPQSIQM7CZM/ 
 
https://gitee.com/src-openeuler/kernel/issues/I96GQ3 
 
Link:https://gitee.com/openeuler/kernel/pulls/5473

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents e9ed7f86 232e392a

fs/jfs/jfs_dmap.c

+31 −29
Original line number Diff line number Diff line
@@ -63,10 +63,10 @@ 
 */

static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,

			int nblocks);

static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval);

static int dbBackSplit(dmtree_t * tp, int leafno);

static int dbJoin(dmtree_t * tp, int leafno, int newval);

static void dbAdjTree(dmtree_t * tp, int leafno, int newval);

static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl);

static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl);

static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl);

static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl);

static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc,

		    int level);

static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results);
@@ -2164,7 +2164,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, 
		 * system.

		 */

		if (dp->tree.stree[word] == NOFREE)

			dbBackSplit((dmtree_t *) & dp->tree, word);

			dbBackSplit((dmtree_t *)&dp->tree, word, false);



		dbAllocBits(bmp, dp, blkno, nblocks);

	}
@@ -2250,7 +2250,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, 
			 * the binary system of the leaves if need be.

			 */

			dbSplit(tp, word, BUDMIN,

				dbMaxBud((u8 *) & dp->wmap[word]));

				dbMaxBud((u8 *)&dp->wmap[word]), false);



			word += 1;

		} else {
@@ -2290,7 +2290,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno, 
				 * system of the leaves to reflect the current

				 * allocation (size).

				 */

				dbSplit(tp, word, size, NOFREE);

				dbSplit(tp, word, size, NOFREE, false);



				/* get the number of dmap words handled */

				nw = BUDSIZE(size, BUDMIN);
@@ -2397,7 +2397,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, 
			/* update the leaf for this dmap word.

			 */

			rc = dbJoin(tp, word,

				    dbMaxBud((u8 *) & dp->wmap[word]));

				    dbMaxBud((u8 *)&dp->wmap[word]), false);

			if (rc)

				return rc;
@@ -2430,7 +2430,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, 


				/* update the leaf.

				 */

				rc = dbJoin(tp, word, size);

				rc = dbJoin(tp, word, size, false);

				if (rc)

					return rc;
@@ -2582,14 +2582,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) 
		 * that it is at the front of a binary buddy system.

		 */

		if (oldval == NOFREE) {

			rc = dbBackSplit((dmtree_t *) dcp, leafno);

			rc = dbBackSplit((dmtree_t *)dcp, leafno, true);

			if (rc)

				return rc;

			oldval = dcp->stree[ti];

		}

		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);

		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true);

	} else {

		rc = dbJoin((dmtree_t *) dcp, leafno, newval);

		rc = dbJoin((dmtree_t *) dcp, leafno, newval, true);

		if (rc)

			return rc;

	}
@@ -2618,7 +2618,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) 
				 */

				if (alloc) {

					dbJoin((dmtree_t *) dcp, leafno,

					       oldval);

					       oldval, true);

				} else {

					/* the dbJoin() above might have

					 * caused a larger binary buddy system
@@ -2628,9 +2628,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) 
					 */

					if (dcp->stree[ti] == NOFREE)

						dbBackSplit((dmtree_t *)

							    dcp, leafno);

							    dcp, leafno, true);

					dbSplit((dmtree_t *) dcp, leafno,

						dcp->budmin, oldval);

						dcp->budmin, oldval, true);

				}



				/* release the buffer and return the error.
@@ -2678,7 +2678,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) 
 *

 * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;

 */

static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)

static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl)

{

	int budsz;

	int cursz;
@@ -2700,7 +2700,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) 
		while (cursz >= splitsz) {

			/* update the buddy's leaf with its new value.

			 */

			dbAdjTree(tp, leafno ^ budsz, cursz);

			dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl);



			/* on to the next size and buddy.

			 */
@@ -2712,7 +2712,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) 
	/* adjust the dmap tree to reflect the specified leaf's new

	 * value.

	 */

	dbAdjTree(tp, leafno, newval);

	dbAdjTree(tp, leafno, newval, is_ctl);

}
@@ -2743,7 +2743,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval) 
 *

 * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;

 */

static int dbBackSplit(dmtree_t * tp, int leafno)

static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl)

{

	int budsz, bud, w, bsz, size;

	int cursz;
@@ -2794,7 +2794,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) 
				 * system in two.

				 */

				cursz = leaf[bud] - 1;

				dbSplit(tp, bud, cursz, cursz);

				dbSplit(tp, bud, cursz, cursz, is_ctl);

				break;

			}

		}
@@ -2822,7 +2822,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno) 
 *

 * RETURN VALUES: none

 */

static int dbJoin(dmtree_t * tp, int leafno, int newval)

static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)

{

	int budsz, buddy;

	s8 *leaf;
@@ -2877,12 +2877,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) 
			if (leafno < buddy) {

				/* leafno is the left buddy.

				 */

				dbAdjTree(tp, buddy, NOFREE);

				dbAdjTree(tp, buddy, NOFREE, is_ctl);

			} else {

				/* buddy is the left buddy and becomes

				 * leafno.

				 */

				dbAdjTree(tp, leafno, NOFREE);

				dbAdjTree(tp, leafno, NOFREE, is_ctl);

				leafno = buddy;

			}
@@ -2895,7 +2895,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) 


	/* update the leaf value.

	 */

	dbAdjTree(tp, leafno, newval);

	dbAdjTree(tp, leafno, newval, is_ctl);



	return 0;

}
@@ -2916,21 +2916,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval) 
 *

 * RETURN VALUES: none

 */

static void dbAdjTree(dmtree_t * tp, int leafno, int newval)

static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)

{

	int lp, pp, k;

	int max;

	int max, size;



	size = is_ctl ? CTLTREESIZE : TREESIZE;



	/* pick up the index of the leaf for this leafno.

	 */

	lp = leafno + le32_to_cpu(tp->dmt_leafidx);



	if (WARN_ON_ONCE(lp >= size || lp < 0))

		return;



	/* is the current value the same as the old value ?  if so,

	 * there is nothing to do.

	 */

	if (WARN_ON_ONCE(lp >= CTLTREESIZE))

		return;



	if (tp->dmt_stree[lp] == newval)

		return;