linux-kernel - Re: [PATCH 1/4] lightnvm: double-clear of dev->lun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Apr 2017 12:41:21 +0200
From:   Matias Bjørling <mb@...htnvm.io>
To:     Javier González <jg@...htnvm.io>
Cc:     linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
        Javier González <javier@...xlabs.com>,
        Matias Bjørling <matias@...xlabs.com>
Subject: Re: [PATCH 1/4] lightnvm: double-clear of dev->lun_map on target init
 error

On 04/07/2017 08:31 PM, Javier González wrote:
> The dev->lun_map bits are cleared twice if an target init error occurs.
> First in the target clean routine, and then next in the nvm_tgt_create
> error function. Make sure that it is only cleared once by extending
> nvm_remove_tgt_devi() with a clear bit, such that clearing of bits can
> ignored when cleaning up a successful initialized target.
>
> Signed-off-by: Javier González <javier@...xlabs.com>
> Signed-off-by: Matias Bjørling <matias@...xlabs.com>
> ---
>  drivers/lightnvm/core.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> index 2122922..da4c082 100644
> --- a/drivers/lightnvm/core.c
> +++ b/drivers/lightnvm/core.c
> @@ -89,7 +89,7 @@ static void nvm_release_luns_err(struct nvm_dev *dev, int lun_begin,
>  		WARN_ON(!test_and_clear_bit(i, dev->lun_map));
>  }
>
> -static void nvm_remove_tgt_dev(struct nvm_tgt_dev *tgt_dev)
> +static void nvm_remove_tgt_dev(struct nvm_tgt_dev *tgt_dev, int clear)
>  {
>  	struct nvm_dev *dev = tgt_dev->parent;
>  	struct nvm_dev_map *dev_map = tgt_dev->map;
> @@ -100,11 +100,13 @@ static void nvm_remove_tgt_dev(struct nvm_tgt_dev *tgt_dev)
>  		int *lun_offs = ch_map->lun_offs;
>  		int ch = i + ch_map->ch_off;
>
> -		for (j = 0; j < ch_map->nr_luns; j++) {
> -			int lun = j + lun_offs[j];
> -			int lunid = (ch * dev->geo.luns_per_chnl) + lun;
> +		if (clear) {
> +			for (j = 0; j < ch_map->nr_luns; j++) {
> +				int lun = j + lun_offs[j];
> +				int lunid = (ch * dev->geo.luns_per_chnl) + lun;
>
> -			WARN_ON(!test_and_clear_bit(lunid, dev->lun_map));
> +				WARN_ON(!test_and_clear_bit(lunid, dev->lun_map));
> +			}
>  		}
>
>  		kfree(ch_map->lun_offs);
> @@ -309,7 +311,7 @@ static int nvm_create_tgt(struct nvm_dev *dev, struct nvm_ioctl_create *create)
>  err_queue:
>  	blk_cleanup_queue(tqueue);
>  err_dev:
> -	nvm_remove_tgt_dev(tgt_dev);
> +	nvm_remove_tgt_dev(tgt_dev, 0);
>  err_t:
>  	kfree(t);
>  err_reserve:
> @@ -332,7 +334,7 @@ static void __nvm_remove_target(struct nvm_target *t)
>  	if (tt->exit)
>  		tt->exit(tdisk->private_data);
>
> -	nvm_remove_tgt_dev(t->dev);
> +	nvm_remove_tgt_dev(t->dev, 1);
>  	put_disk(tdisk);
>
>  	list_del(&t->list);
>

Thanks. Applied for 4.12.