Revision 59771079c18c44e39106f0f30054025acafadb41 authored by Linus Torvalds on 19 December 2012, 15:18:35 UTC, committed by Linus Torvalds on 19 December 2012, 15:18:35 UTC
Commit 8dd2cb7e880d ("block: discard granularity might not be power of
2") changed a couple of 'binary and' operations into modulus operations.
Which turned the harmless case of a zero discard_granularity into a
possible divide-by-zero.

The code also had a much more subtle bug: it was doing the modulus of a
value in bytes using 'sector_t'.  That was always conceptually wrong,
but didn't actually matter back when the code assumed a power-of-two
granularity: we only looked at the low bits anyway.

But with potentially arbitrary sector numbers, using a 'sector_t' to
express bytes is very very wrong: depending on configuration it limits
the starting offset of the device to just 32 bits, and any overflow
would result in a wrong value if the modulus wasn't a power-of-two.

So re-write the code to not only protect against the divide-by-zero, but
to do the starting sector arithmetic in sectors, and using the proper
types.

[ For any mathematicians out there: it also looks monumentally stupid to
  do the 'modulo granularity' operation *twice*, never mind having a "+
  granularity" in the second modulus op.

  But that's the easiest way to avoid negative values or overflow, and
  it is how the original code was done. ]

Reported-by: Ingo Molnar <mingo@kernel.org>
Reported-by: Doug Anderson <dianders@chromium.org>
Cc: Neil Brown <neilb@suse.de>
Cc: Shaohua Li <shli@fusionio.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 752451f
History
File Mode Size
00-INDEX -rw-r--r-- 2.3 KB
api.txt -rw-r--r-- 11.9 KB
arkfb.txt -rw-r--r-- 2.0 KB
aty128fb.txt -rw-r--r-- 2.1 KB
cirrusfb.txt -rw-r--r-- 1.9 KB
cmap_xfbdev.txt -rw-r--r-- 1.9 KB
deferred_io.txt -rw-r--r-- 3.0 KB
efifb.txt -rw-r--r-- 593 bytes
ep93xx-fb.txt -rw-r--r-- 4.2 KB
fbcon.txt -rw-r--r-- 11.5 KB
framebuffer.txt -rw-r--r-- 14.0 KB
gxfb.txt -rw-r--r-- 1.2 KB
intel810.txt -rw-r--r-- 8.3 KB
intelfb.txt -rw-r--r-- 3.7 KB
internals.txt -rw-r--r-- 2.6 KB
lxfb.txt -rw-r--r-- 1.2 KB
matroxfb.txt -rw-r--r-- 19.1 KB
metronomefb.txt -rw-r--r-- 2.0 KB
modedb.txt -rw-r--r-- 6.7 KB
pvr2fb.txt -rw-r--r-- 2.2 KB
pxafb.txt -rw-r--r-- 4.6 KB
s3fb.txt -rw-r--r-- 2.5 KB
sa1100fb.txt -rw-r--r-- 1.3 KB
sh7760fb.txt -rw-r--r-- 4.4 KB
sisfb.txt -rw-r--r-- 6.3 KB
sm501.txt -rw-r--r-- 291 bytes
sstfb.txt -rw-r--r-- 6.7 KB
tgafb.txt -rw-r--r-- 2.4 KB
tridentfb.txt -rw-r--r-- 2.6 KB
udlfb.txt -rw-r--r-- 7.0 KB
uvesafb.txt -rw-r--r-- 6.9 KB
vesafb.txt -rw-r--r-- 6.1 KB
viafb.modes -rw-r--r-- 30.8 KB
viafb.txt -rw-r--r-- 9.6 KB
vt8623fb.txt -rw-r--r-- 1.8 KB

back to top