]>
Commit | Line | Data |
---|---|---|
45f76c82 GKH |
1 | From 0914bb965e38a055e9245637aed117efbe976e91 Mon Sep 17 00:00:00 2001 |
2 | From: Dan Carpenter <dan.carpenter@oracle.com> | |
3 | Date: Wed, 4 Jul 2018 12:59:58 +0300 | |
4 | Subject: pnfs/blocklayout: off by one in bl_map_stripe() | |
5 | ||
6 | From: Dan Carpenter <dan.carpenter@oracle.com> | |
7 | ||
8 | commit 0914bb965e38a055e9245637aed117efbe976e91 upstream. | |
9 | ||
10 | "dev->nr_children" is the number of children which were parsed | |
11 | successfully in bl_parse_stripe(). It could be all of them and then, in | |
12 | that case, it is equal to v->stripe.volumes_count. Either way, the > | |
13 | should be >= so that we don't go beyond the end of what we're supposed | |
14 | to. | |
15 | ||
16 | Fixes: 5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing") | |
17 | Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> | |
18 | Reviewed-by: Christoph Hellwig <hch@lst.de> | |
19 | Cc: stable@vger.kernel.org # 3.17+ | |
20 | Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> | |
21 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
22 | ||
23 | --- | |
24 | fs/nfs/blocklayout/dev.c | 2 +- | |
25 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
26 | ||
27 | --- a/fs/nfs/blocklayout/dev.c | |
28 | +++ b/fs/nfs/blocklayout/dev.c | |
29 | @@ -204,7 +204,7 @@ static bool bl_map_stripe(struct pnfs_bl | |
30 | chunk = div_u64(offset, dev->chunk_size); | |
31 | div_u64_rem(chunk, dev->nr_children, &chunk_idx); | |
32 | ||
33 | - if (chunk_idx > dev->nr_children) { | |
34 | + if (chunk_idx >= dev->nr_children) { | |
35 | dprintk("%s: invalid chunk idx %d (%lld/%lld)\n", | |
36 | __func__, chunk_idx, offset, dev->chunk_size); | |
37 | /* error, should not happen */ |