Commit fd9876bb authored by Li Nan's avatar Li Nan Committed by Jialin Zhang
Browse files

md/raid10: fix slab-out-of-bounds in md_bitmap_get_counter 

hulk inclusion
category: bugfix
bugzilla: 188270, https://gitee.com/openeuler/kernel/issues/I6ECES


CVE: NA

--------------------------------

There is a bug if we write a large number to md/bitmap_set_bits.
md_bitmap_checkpage() returned -EINVAL if "page >= bitmap->pages", but the
return value was not checked immediately in md_bitmap_get_counter() in
order to set *blocks value. fix it by checking page before operate
bitmap.

Signed-off-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarHou Tao <houtao1@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 8b849f6e

drivers/md/md-bitmap.c

+3 −0
Original line number Diff line number Diff line
@@ -1365,6 +1365,9 @@ __acquires(bitmap->lock) 
	sector_t csize;

	int err;



	if (page >= bitmap->pages)

		return NULL;



	err = md_bitmap_checkpage(bitmap, page, create, 0);



	if (bitmap->bp[page].hijacked ||