linux-kernel - Patch regression - Re: [PATCH 5.10 070/104] dm snapshot: fix a crash when an origin has no snapshots

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 May 2021 07:36:57 -0400 (EDT)
From:   Mikulas Patocka <mpatocka@...hat.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Michael Tokarev <mjt@....msk.ru>,
        Mike Snitzer <snitzer@...hat.com>,
        Zdenek Kabelac <zkabelac@...hat.com>
Subject: Patch regression - Re: [PATCH 5.10 070/104] dm snapshot: fix a crash
 when an origin has no snapshots

Hi Greg

I'd like to ask you to drop this patch from all stable branches.

It causes regression with snapshot merging and the regression is much 
worse than the bug that it fixes.

Mikulas



On Mon, 24 May 2021, Greg Kroah-Hartman wrote:

> From: Mikulas Patocka <mpatocka@...hat.com>
> 
> commit 7ee06ddc4038f936b0d4459d37a7d4d844fb03db upstream.
> 
> If an origin target has no snapshots, o->split_boundary is set to 0.
> This causes BUG_ON(sectors <= 0) in block/bio.c:bio_split().
> 
> Fix this by initializing chunk_size, and in turn split_boundary, to
> rounddown_pow_of_two(UINT_MAX) -- the largest power of two that fits
> into "unsigned" type.
> 
> Reported-by: Michael Tokarev <mjt@....msk.ru>
> Tested-by: Michael Tokarev <mjt@....msk.ru>
> Cc: stable@...r.kernel.org
> Signed-off-by: Mikulas Patocka <mpatocka@...hat.com>
> Signed-off-by: Mike Snitzer <snitzer@...hat.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> ---
>  drivers/md/dm-snap.c |    5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> --- a/drivers/md/dm-snap.c
> +++ b/drivers/md/dm-snap.c
> @@ -854,12 +854,11 @@ static int dm_add_exception(void *contex
>  static uint32_t __minimum_chunk_size(struct origin *o)
>  {
>  	struct dm_snapshot *snap;
> -	unsigned chunk_size = 0;
> +	unsigned chunk_size = rounddown_pow_of_two(UINT_MAX);
>  
>  	if (o)
>  		list_for_each_entry(snap, &o->snapshots, list)
> -			chunk_size = min_not_zero(chunk_size,
> -						  snap->store->chunk_size);
> +			chunk_size = min(chunk_size, snap->store->chunk_size);
>  
>  	return (uint32_t) chunk_size;
>  }
> 
>