Commit 1e1132ea authored by Mikulas Patocka's avatar Mikulas Patocka Committed by Mike Snitzer

dm writecache: fix a crash due to reading past end of dirty_bitmap

wc->dirty_bitmap_size is in bytes so must multiply it by 8, not by
BITS_PER_LONG, to get number of bitmap_bits.

Fixes crash in find_next_bit() that was reported:
https://bugzilla.kernel.org/show_bug.cgi?id=200819

Reported-by: edo.rus@gmail.com
Fixes: 48debafe ("dm: add writecache target")
Cc: stable@vger.kernel.org # 4.18
Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
parent bc9e9cf0
...@@ -457,7 +457,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc) ...@@ -457,7 +457,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc)
COMPLETION_INITIALIZER_ONSTACK(endio.c), COMPLETION_INITIALIZER_ONSTACK(endio.c),
ATOMIC_INIT(1), ATOMIC_INIT(1),
}; };
unsigned bitmap_bits = wc->dirty_bitmap_size * BITS_PER_LONG; unsigned bitmap_bits = wc->dirty_bitmap_size * 8;
unsigned i = 0; unsigned i = 0;
while (1) { while (1) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment