shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 20:07:46 +09:00
Code Issues Packages Projects Releases Wiki Activity

ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree

Browse Source 
Bug: 195565510
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Ic8134eb902aa7d929e3121b2f69b1d258f570652
(cherry picked from commit 98c15b2bad)
Signed-off-by: Lee Jones <joneslee@google.com>
This commit is contained in:
Lee Jones
2022-03-11 14:19:59 +00:00
committed by Treehugger Robot
parent b88b3d3664
commit 53c38ebc4e
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/md/dm-bow.c
View File

@@ -611,6 +611,7 @@ static void dm_bow_dtr(struct dm_target *ti)
wait_for_completion(dm_get_completion_from_kobject(kobj)); wait_for_completion(dm_get_completion_from_kobject(kobj));
} }
mutex_lock(&bc->ranges_lock);
while (rb_first(&bc->ranges)) { while (rb_first(&bc->ranges)) {
struct bow_range *br = container_of(rb_first(&bc->ranges), struct bow_range *br = container_of(rb_first(&bc->ranges),
struct bow_range, node); struct bow_range, node);
@@ -618,6 +619,7 @@ static void dm_bow_dtr(struct dm_target *ti)
rb_erase(&br->node, &bc->ranges); rb_erase(&br->node, &bc->ranges);
kfree(br); kfree(br);
} }
mutex_unlock(&bc->ranges_lock);
mutex_destroy(&bc->ranges_lock); mutex_destroy(&bc->ranges_lock);
kfree(bc->log_sector); kfree(bc->log_sector);
@@ -1191,6 +1193,7 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
return; return;
} }
mutex_lock(&bc->ranges_lock);
for (i = rb_first(&bc->ranges); i; i = rb_next(i)) { for (i = rb_first(&bc->ranges); i; i = rb_next(i)) {
struct bow_range *br = container_of(i, struct bow_range, node); struct bow_range *br = container_of(i, struct bow_range, node);
@@ -1198,11 +1201,11 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
readable_type[br->type], readable_type[br->type],
(unsigned long long)br->sector); (unsigned long long)br->sector);
if (result >= end) if (result >= end)
return; goto unlock;
result += scnprintf(result, end - result, "\n"); result += scnprintf(result, end - result, "\n");
if (result >= end) if (result >= end)
return; goto unlock;
if (br->type == TRIMMED) if (br->type == TRIMMED)
++trimmed_range_count; ++trimmed_range_count;
@@ -1224,19 +1227,22 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result,
if (!rb_next(i)) { if (!rb_next(i)) {
scnprintf(result, end - result, scnprintf(result, end - result,
"\nERROR: Last range not of type TOP"); "\nERROR: Last range not of type TOP");
return; goto unlock;
} }
if (br->sector > range_top(br)) { if (br->sector > range_top(br)) {
scnprintf(result, end - result, scnprintf(result, end - result,
"\nERROR: sectors out of order"); "\nERROR: sectors out of order");
return; goto unlock;
} }
} }
if (trimmed_range_count != trimmed_list_length) if (trimmed_range_count != trimmed_list_length)
scnprintf(result, end - result, scnprintf(result, end - result,
"\nERROR: not all trimmed ranges in trimmed list"); "\nERROR: not all trimmed ranges in trimmed list");
unlock:
mutex_unlock(&bc->ranges_lock);
} }
static void dm_bow_status(struct dm_target *ti, status_type_t type, static void dm_bow_status(struct dm_target *ti, status_type_t type,