diff options
| author | Mikulas Patocka <mpatocka@redhat.com> | 2018-08-16 19:23:19 +0300 |
|---|---|---|
| committer | Mike Snitzer <snitzer@redhat.com> | 2018-08-16 20:43:01 +0300 |
| commit | 1e1132ea21da6d7be92a72195204379c819cb70b (patch) | |
| tree | b983945975d697c37ac0193d18ca022cca4c3fb0 /drivers/md | |
| parent | bc9e9cf0401f18e33b78d4c8a518661b8346baf7 (diff) | |
| download | linux-1e1132ea21da6d7be92a72195204379c819cb70b.tar.xz | |
dm writecache: fix a crash due to reading past end of dirty_bitmap
wc->dirty_bitmap_size is in bytes so must multiply it by 8, not by
BITS_PER_LONG, to get number of bitmap_bits.
Fixes crash in find_next_bit() that was reported:
https://bugzilla.kernel.org/show_bug.cgi?id=200819
Reported-by: edo.rus@gmail.com
Fixes: 48debafe4f2f ("dm: add writecache target")
Cc: stable@vger.kernel.org # 4.18
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Diffstat (limited to 'drivers/md')
| -rw-r--r-- | drivers/md/dm-writecache.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c index e672e1d17bf1..3a28a68f184c 100644 --- a/drivers/md/dm-writecache.c +++ b/drivers/md/dm-writecache.c @@ -457,7 +457,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc) COMPLETION_INITIALIZER_ONSTACK(endio.c), ATOMIC_INIT(1), }; - unsigned bitmap_bits = wc->dirty_bitmap_size * BITS_PER_LONG; + unsigned bitmap_bits = wc->dirty_bitmap_size * 8; unsigned i = 0; while (1) { |