linux-kernel - Re: [PATCH 2/8] mmc: fix max_discard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <516BAA36.9030500@intel.com>
Date:	Mon, 15 Apr 2013 10:20:22 +0300
From:	Adrian Hunter <adrian.hunter@...el.com>
To:	Namjae Jeon <linkinjeon@...il.com>
CC:	dwmw2@...radead.org, axboe@...nel.dk, shli@...nel.org,
	Paul.Clements@...eleye.com, npiggin@...nel.dk, neilb@...e.de,
	cjb@...top.org, linux-mtd@...ts.infradead.org,
	nbd-general@...ts.sourceforge.net, linux-raid@...r.kernel.org,
	linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org,
	Namjae Jeon <namjae.jeon@...sung.com>,
	Vivek Trivedi <t.vivek@...sung.com>
Subject: Re: [PATCH 2/8] mmc: fix max_discard_sectors

On 13/04/13 16:38, Namjae Jeon wrote:
> From: Namjae Jeon <namjae.jeon@...sung.com>
> 
> https://lkml.org/lkml/2013/4/1/292
> As per above discussion, there is possibility that request's __data_len
> field may overflow when max_discard_sectors greater than UINT_MAX >> 9
> 
> If multiple discard requests get merged, merged discard request's
> size exceeds 4GB, there is possibility that merged discard request's
> __data_len field may overflow.
> 
> This patch fixes this issue.
> 
> Reported-by: Max Filippov <jcmvbkbc@...il.com>
> Signed-off-by: Namjae Jeon <namjae.jeon@...sung.com>
> Signed-off-by: Vivek Trivedi <t.vivek@...sung.com>
> Tested-by: Max Filippov <jcmvbkbc@...il.com>
> ---
>  drivers/mmc/card/queue.c |    2 +-
>  drivers/mmc/core/core.c  |    4 ++--
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
> index 9447a0e..54726b7 100644
> --- a/drivers/mmc/card/queue.c
> +++ b/drivers/mmc/card/queue.c
> @@ -166,7 +166,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
>  		return;
>  
>  	queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
> -	q->limits.max_discard_sectors = max_discard;
> +	blk_queue_max_discard_sectors(q, max_discard);
>  	if (card->erased_byte == 0 && !mmc_can_discard(card))
>  		q->limits.discard_zeroes_data = 1;
>  	q->limits.discard_granularity = card->pref_erase << 9;
> diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
> index 7b435a3..6ee530c 100644
> --- a/drivers/mmc/core/core.c
> +++ b/drivers/mmc/core/core.c
> @@ -2058,7 +2058,7 @@ static unsigned int mmc_do_calc_max_discard(struct mmc_card *card,
>  	if (card->erase_shift)
>  		max_qty = UINT_MAX >> card->erase_shift;
>  	else if (mmc_card_sd(card))
> -		max_qty = UINT_MAX;
> +		max_qty = UINT_MAX >> 9;

No.  This function calculates max discard for the card not the block layer.
 Apply the block layer limitation at the block layer interface e.g.
in mmc_queue_setup_discard()

>  	else
>  		max_qty = UINT_MAX / card->erase_size;
>  
> @@ -2100,7 +2100,7 @@ unsigned int mmc_calc_max_discard(struct mmc_card *card)
>  	unsigned int max_discard, max_trim;
>  
>  	if (!host->max_discard_to)
> -		return UINT_MAX;
> +		return UINT_MAX >> 9;

Ditto.

>  
>  	/*
>  	 * Without erase_group_def set, MMC erase timeout depends on clock
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/