From: tang.junhui@zte.com.cn
To: i@coly.li, kent.overstreet@gmail.com
Cc: linux-bcache@vger.kernel.org, tang.junhui@zte.com.cn
Subject: [PATCH 2/2] bcache: fix calling ida_simple_remove() with incorrect minor
Date: Tue, 9 May 2017 14:25:17 +0800
Patch-mainline: Not yet, submitted to maintainer.
References: bsc#1038085
bcache called ida_simple_remove() with minor which have multiplied by
BCACHE_MINORS, it would cause minor wrong release and leakage
Signed-off-by: tang.junhui <tang.junhui@zte.com.cn>
Reviewed-by: Coly Li <colyli@suse.de>
Signed-off-by: Coly Li <colyli@suse.de>
---
drivers/md/bcache/super.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -57,8 +57,11 @@ static DEFINE_IDA(bcache_minor);
static wait_queue_head_t unregister_wait;
struct workqueue_struct *bcache_wq;
-#define BTREE_MAX_PAGES (256 * 1024 / PAGE_SIZE)
-#define BCACHE_MINORS 16 /* partition support */
+#define BTREE_MAX_PAGES (256 * 1024 / PAGE_SIZE)
+#define BCACHE_MINORS_BITS 4 /* bcache partition support */
+#define BCACHE_MINORS (1 << BCACHE_MINORS_BITS)
+#define BCACHE_TO_IDA_MINORS(first_minor) ((first_minor) >> BCACHE_MINORS_BITS)
+#define IDA_TO_BCACHE_MINORS(minor) ((minor) << BCACHE_MINORS_BITS)
/* Superblock */
@@ -733,7 +736,7 @@ static void bcache_device_free(struct bc
if (d->disk && d->disk->queue)
blk_cleanup_queue(d->disk->queue);
if (d->disk) {
- ida_simple_remove(&bcache_minor, d->disk->first_minor);
+ ida_simple_remove(&bcache_minor, BCACHE_TO_IDA_MINORS(d->disk->first_minor));
put_disk(d->disk);
}
@@ -778,11 +781,10 @@ static int bcache_device_init(struct bca
if (!d->full_dirty_stripes)
return -ENOMEM;
- minor = ida_simple_get(&bcache_minor, 0, MINORMASK + 1, GFP_KERNEL);
+ minor = ida_simple_get(&bcache_minor, 0, BCACHE_TO_IDA_MINORS(MINORMASK) + 1, GFP_KERNEL);
if (minor < 0)
return minor;
- minor *= BCACHE_MINORS;
if (!(d->bio_split = bioset_create(4, offsetof(struct bbio, bio))) ||
!(d->disk = alloc_disk(BCACHE_MINORS))) {
@@ -794,7 +796,7 @@ static int bcache_device_init(struct bca
snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", minor);
d->disk->major = bcache_major;
- d->disk->first_minor = minor;
+ d->disk->first_minor = IDA_TO_BCACHE_MINORS(minor);
d->disk->fops = &bcache_ops;
d->disk->private_data = d;