From patchwork Sat Apr 13 13:38:29 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Namjae Jeon X-Patchwork-Id: 236348 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:770:15f::2]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 8437B2C008F for ; Sat, 13 Apr 2013 23:40:02 +1000 (EST) Received: from merlin.infradead.org ([2001:4978:20e::2]) by casper.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1UR0fZ-0006gA-Rk; Sat, 13 Apr 2013 13:39:06 +0000 Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1UR0fD-0004Uq-7K; Sat, 13 Apr 2013 13:38:43 +0000 Received: from mail-da0-x22c.google.com ([2607:f8b0:400e:c00::22c]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1UR0fB-0004UG-03 for linux-mtd@lists.infradead.org; Sat, 13 Apr 2013 13:38:41 +0000 Received: by mail-da0-f44.google.com with SMTP id z20so1494684dae.31 for ; Sat, 13 Apr 2013 06:38:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer; bh=Fc+QgofSrJrWKJ8JMBUoVZBrwy+VwLKWhEUSK0V2VmY=; b=h+Mj+vGwrvIb+S1ftKhN++vWop+eZwQkh95LlDXdv2x8BkG3NQjLF7nxlQKrAM6por 71rP8yzJL33iXIqYWjV8+wcwaK3FuMlyJdDsZYfk+BV+sZNJlWR9P2Sa1LAyiQcpVPLA /1tzqbT8m1/h9V/qtDn8DsV7eIrzg/94sk3zm54K9/iE8iqxGFyoGZ2yLuxm/BOPm7ka aketsRBl8c20rfz53e4LRXK9pUbMiqvuzqVMI+PHsyAL/OfiuraPUy/unRZOCfaL4g4i zFvlBYEF3w8fpI05F4c72dvBSGrzyPuIHLpRtr5Xp/w2/rjAuFgVW8y8jOmFWN/NR0j5 jdLA== X-Received: by 10.68.105.5 with SMTP id gi5mr19439845pbb.180.1365860319226; Sat, 13 Apr 2013 06:38:39 -0700 (PDT) Received: from linkinjeon-Aspire-One-522.kornet ([121.143.184.70]) by mx.google.com with ESMTPS id qh4sm13898236pac.8.2013.04.13.06.38.35 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 13 Apr 2013 06:38:38 -0700 (PDT) From: Namjae Jeon To: dwmw2@infradead.org, axboe@kernel.dk, shli@kernel.org, Paul.Clements@steeleye.com, npiggin@kernel.dk, neilb@suse.de, cjb@laptop.org, adrian.hunter@intel.com Subject: [PATCH 2/8] mmc: fix max_discard_sectors Date: Sat, 13 Apr 2013 22:38:29 +0900 Message-Id: <1365860309-21261-1-git-send-email-linkinjeon@gmail.com> X-Mailer: git-send-email 1.7.9.5 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20130413_093841_325926_75A462C0 X-CRM114-Status: GOOD ( 11.87 ) X-Spam-Score: -0.3 (/) X-Spam-Report: SpamAssassin version 3.3.2 on merlin.infradead.org summary: Content analysis details: (-0.3 points) pts rule name description ---- ---------------------- -------------------------------------------------- 1.7 KHOP_BIG_TO_CC Sent to 10+ recipients instaed of Bcc or a list 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (linkinjeon[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Cc: nbd-general@lists.sourceforge.net, Namjae Jeon , Vivek Trivedi , Namjae Jeon , linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org From: Namjae Jeon https://lkml.org/lkml/2013/4/1/292 As per above discussion, there is possibility that request's __data_len field may overflow when max_discard_sectors greater than UINT_MAX >> 9 If multiple discard requests get merged, merged discard request's size exceeds 4GB, there is possibility that merged discard request's __data_len field may overflow. This patch fixes this issue. Reported-by: Max Filippov Signed-off-by: Namjae Jeon Signed-off-by: Vivek Trivedi Tested-by: Max Filippov --- drivers/mmc/card/queue.c | 2 +- drivers/mmc/core/core.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c index 9447a0e..54726b7 100644 --- a/drivers/mmc/card/queue.c +++ b/drivers/mmc/card/queue.c @@ -166,7 +166,7 @@ static void mmc_queue_setup_discard(struct request_queue *q, return; queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q); - q->limits.max_discard_sectors = max_discard; + blk_queue_max_discard_sectors(q, max_discard); if (card->erased_byte == 0 && !mmc_can_discard(card)) q->limits.discard_zeroes_data = 1; q->limits.discard_granularity = card->pref_erase << 9; diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c index 7b435a3..6ee530c 100644 --- a/drivers/mmc/core/core.c +++ b/drivers/mmc/core/core.c @@ -2058,7 +2058,7 @@ static unsigned int mmc_do_calc_max_discard(struct mmc_card *card, if (card->erase_shift) max_qty = UINT_MAX >> card->erase_shift; else if (mmc_card_sd(card)) - max_qty = UINT_MAX; + max_qty = UINT_MAX >> 9; else max_qty = UINT_MAX / card->erase_size; @@ -2100,7 +2100,7 @@ unsigned int mmc_calc_max_discard(struct mmc_card *card) unsigned int max_discard, max_trim; if (!host->max_discard_to) - return UINT_MAX; + return UINT_MAX >> 9; /* * Without erase_group_def set, MMC erase timeout depends on clock