diff options
| author | Lars Ellenberg <lars.ellenberg@linbit.com> | 2013-10-23 12:59:18 +0400 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2013-11-08 20:10:28 +0400 |
| commit | d2da5b0cb522c48f8e2f311e6e9b212535371b56 (patch) | |
| tree | b2d883aa031c9ed894a0dc797400e312226e8251 /drivers/block | |
| parent | 57737adc965e45fcb03662fe6f93f6efb19e2c0a (diff) | |
| download | linux-d2da5b0cb522c48f8e2f311e6e9b212535371b56.tar.xz | |
drbd: fix decoding of bitmap vli rle for device sizes > 64 TB
Symptoms: disconnect after bitmap exchange due to
bitmap overflow (e:49731075554) while decoding bm RLE packet
In the decoding step of the variable length integer run length encoding
there was potentially an uncatched bitshift by wordsize (variable >> 64).
The result of which is "undefined" :(
(only "sometimes" the result is the desired 0)
Fix: don't do any bit shift magic for shift == 64, just assign.
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/drbd/drbd_receiver.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c index 12c59eb3b127..6fa6673b36b3 100644 --- a/drivers/block/drbd/drbd_receiver.c +++ b/drivers/block/drbd/drbd_receiver.c @@ -4125,7 +4125,11 @@ recv_bm_rle_bits(struct drbd_conf *mdev, (unsigned int)bs.buf_len); return -EIO; } - look_ahead >>= bits; + /* if we consumed all 64 bits, assign 0; >> 64 is "undefined"; */ + if (likely(bits < 64)) + look_ahead >>= bits; + else + look_ahead = 0; have -= bits; bits = bitstream_get_bits(&bs, &tmp, 64 - have); |