Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f49d5e62 authored by NeilBrown's avatar NeilBrown Committed by Linus Torvalds
Browse files

[PATCH] md: avoid reading past the end of a bitmap file 



In most cases we check the size of the bitmap file before reading data from
it.  However when reading the superblock, we always read the first PAGE_SIZE
bytes, which might not always be appropriate.  So limit that read to the size
of the file if appropriate.

Also, we get the count of available bytes wrong in one place, so that too can
read past the end of the file.

Cc: "yang yin" <yinyang801120@gmail.com>
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 1031be7a

drivers/md/bitmap.c

+8 −4
Original line number Diff line number Diff line
@@ -479,9 +479,12 @@ static int bitmap_read_sb(struct bitmap *bitmap) 
	int err = -EINVAL;



	/* page 0 is the superblock, read it... */

	if (bitmap->file)

		bitmap->sb_page = read_page(bitmap->file, 0, bitmap, PAGE_SIZE);

	else {

	if (bitmap->file) {

		loff_t isize = i_size_read(bitmap->file->f_mapping->host);

		int bytes = isize > PAGE_SIZE ? PAGE_SIZE : isize;



		bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);

	} else {

		bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset, 0);

	}

	if (IS_ERR(bitmap->sb_page)) {
@@ -877,7 +880,8 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start) 
			int count;

			/* unmap the old page, we're done with it */

			if (index == num_pages-1)

				count = bytes - index * PAGE_SIZE;

				count = bytes + sizeof(bitmap_super_t)

					- index * PAGE_SIZE;

			else

				count = PAGE_SIZE;

			if (index == 0) {