Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fda981c authored by Kent Overstreet's avatar Kent Overstreet
Browse files

block: Fix a buffer overrun in bio_integrity_split() 



bio_integrity_split() seemed to be confusing pointers and arrays -
bip_vec in bio_integrity_payload was an array appended to the end of the
payload, so the bio_vecs in struct bio_pair should have come after the
bio_integrity_payload they're for.

Fix it by making bip_vec a pointer to the inline vecs - a later patch is
going to make more use of this pointer.

Signed-off-by: default avatarKent Overstreet <koverstreet@google.com>
CC: Jens Axboe <axboe@kernel.dk>
CC: Martin K. Petersen <martin.petersen@oracle.com>
parent df2cb6da

fs/bio-integrity.c

+3 −2
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio, 


	bip->bip_slab = idx;

	bip->bip_bio = bio;

	bip->bip_vec = bip->bip_inline_vecs;

	bio->bi_integrity = bip;



	return bip;
@@ -697,8 +698,8 @@ void bio_integrity_split(struct bio *bio, struct bio_pair *bp, int sectors) 
	bp->iv1 = bip->bip_vec[0];

	bp->iv2 = bip->bip_vec[0];



	bp->bip1.bip_vec[0] = bp->iv1;

	bp->bip2.bip_vec[0] = bp->iv2;

	bp->bip1.bip_vec = &bp->iv1;

	bp->bip2.bip_vec = &bp->iv2;



	bp->iv1.bv_len = sectors * bi->tuple_size;

	bp->iv2.bv_offset += sectors * bi->tuple_size;

include/linux/bio.h

+3 −1
Original line number Diff line number Diff line
@@ -182,7 +182,9 @@ struct bio_integrity_payload { 
	unsigned short		bip_idx;	/* current bip_vec index */



	struct work_struct	bip_work;	/* I/O completion */

	struct bio_vec		bip_vec[0];	/* embedded bvec array */



	struct bio_vec		*bip_vec;

	struct bio_vec		bip_inline_vecs[0];/* embedded bvec array */

};

#endif /* CONFIG_BLK_DEV_INTEGRITY */