Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 76d5fac0 authored by Lee Jones's avatar Lee Jones Committed by Lee Jones
Browse files

ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree 



Bug: 195565510
Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
Change-Id: Ic8134eb902aa7d929e3121b2f69b1d258f570652
(cherry picked from commit 98c15b2bad1a277da43c65c642f8c3c3ee07bacc)
parent b6d1b4b4

drivers/md/dm-bow.c

+11 −4
Original line number Diff line number Diff line
@@ -599,6 +599,7 @@ static void dm_bow_dtr(struct dm_target *ti) 
	struct bow_context *bc = (struct bow_context *) ti->private;

	struct kobject *kobj;



	mutex_lock(&bc->ranges_lock);

	while (rb_first(&bc->ranges)) {

		struct bow_range *br = container_of(rb_first(&bc->ranges),

						    struct bow_range, node);
@@ -606,6 +607,8 @@ static void dm_bow_dtr(struct dm_target *ti) 
		rb_erase(&br->node, &bc->ranges);

		kfree(br);

	}

	mutex_unlock(&bc->ranges_lock);



	if (bc->workqueue)

		destroy_workqueue(bc->workqueue);

	if (bc->bufio)
@@ -1182,6 +1185,7 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result, 
		return;

	}



	mutex_lock(&bc->ranges_lock);

	for (i = rb_first(&bc->ranges); i; i = rb_next(i)) {

		struct bow_range *br = container_of(i, struct bow_range, node);
@@ -1189,11 +1193,11 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result, 
				    readable_type[br->type],

				    (unsigned long long)br->sector);

		if (result >= end)

			return;

			goto unlock;



		result += scnprintf(result, end - result, "\n");

		if (result >= end)

			return;

			goto unlock;



		if (br->type == TRIMMED)

			++trimmed_range_count;
@@ -1215,19 +1219,22 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result, 
		if (!rb_next(i)) {

			scnprintf(result, end - result,

				  "\nERROR: Last range not of type TOP");

			return;

			goto unlock;

		}



		if (br->sector > range_top(br)) {

			scnprintf(result, end - result,

				  "\nERROR: sectors out of order");

			return;

			goto unlock;

		}

	}



	if (trimmed_range_count != trimmed_list_length)

		scnprintf(result, end - result,

			  "\nERROR: not all trimmed ranges in trimmed list");



unlock:

	mutex_unlock(&bc->ranges_lock);

}



static void dm_bow_status(struct dm_target *ti, status_type_t type,