Bartlomiej Zolnierkiewicz 655a064b05 blk-mq: fix undefined behaviour in order_to_size() ...

commit b3a834b1596ac668df206aa2bb1f191c31f5f5e4 upstream.

When this_order variable in blk_mq_init_rq_map() becomes zero
the code incorrectly decrements the variable and passes the result
to order_to_size() helper causing undefined behaviour:

 UBSAN: Undefined behaviour in block/blk-mq.c:1459:27
 shift exponent 4294967295 is too large for 32-bit type 'unsigned int'
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc6-00072-g33656a1 #22

Fix the code by checking this_order variable for not having the zero
value first.

Reported-by: Meelis Roos <mroos@linux.ee>
Fixes: 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism")
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2020-05-10 10:26:24 +02:00

..

partitions

partitions/aix: fix usage of uninitialized lv_info and lvname structures

2018-09-19 22:48:59 +02:00

bio-integrity.c

bio-integrity: Do not allocate integrity context for bio w/o data

2018-04-13 19:50:17 +02:00

bio.c

block: do not leak memory in bio_copy_user_iov()

2019-04-27 09:33:55 +02:00

blk-cgroup.c

block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg

2018-09-19 22:48:56 +02:00

blk-core.c

block: blk_init_allocated_queue() set q->fq as NULL in the fail case

2019-08-11 12:20:46 +02:00

blk-exec.c

block: move PM request support to IDE

2015-05-05 13:40:42 -06:00

blk-flush.c

Revert "blk-flush: Queue through IO scheduler when flush not required"

2015-11-25 10:12:54 -07:00

blk-integrity.c

block: fix blk_integrity_register to use template's interval_exp if not 0

2017-05-20 14:27:00 +02:00

blk-ioc.c

mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd

2015-11-06 17:50:42 -08:00

blk-iopoll.c

Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next

2014-06-03 12:57:53 -07:00

blk-lib.c

block: re-add discard_granularity and alignment checks

2015-10-28 09:12:58 +09:00

blk-map.c

Don't feed anything but regular iovec's to blk_rq_map_user_iov

2016-12-10 19:07:26 +01:00

blk-merge.c

block: don't use bio->bi_vcnt to figure out segment number

2020-01-29 10:21:40 +01:00

blk-mq-cpu.c

blk-mq: add file comments and update copyright notices

2014-05-28 10:15:41 -06:00

blk-mq-cpumap.c

blk-mq: avoid inserting requests before establishing new mapping

2015-09-29 11:32:50 -06:00

blk-mq-sysfs.c

blk-mq: make sure that line break can be printed

2019-12-21 10:35:37 +01:00

blk-mq-tag.c

mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd

2015-11-06 17:50:42 -08:00

blk-mq-tag.h

blk-mq: factor out a helper to iterate all tags for a request_queue

2015-10-01 10:10:57 +02:00

blk-mq.c

blk-mq: fix undefined behaviour in order_to_size()

2020-05-10 10:26:24 +02:00

blk-mq.h

blk-mq: mark __blk_mq_complete_request() static

2015-11-11 09:36:56 -07:00

blk-settings.c

block: fix an integer overflow in logical block size

2020-01-23 08:18:38 +01:00

blk-softirq.c

block: fix regression with block enabled tagging

2014-04-09 21:54:06 -06:00

blk-sysfs.c

Merge branch 'mkp-fixes' into fixes

2015-12-03 09:32:33 -08:00

blk-tag.c

block: support different tag allocation policy

2015-01-23 14:15:46 -07:00

blk-throttle.c

blk-throttle: make sure expire time isn't too big

2018-03-22 09:23:22 +01:00

blk-timeout.c

block: fix blk_abort_request for blk-mq drivers

2015-11-24 15:24:10 -07:00

blk.h

block: protect rw_page against device teardown

2015-11-19 13:47:10 -08:00

bounce.c

Merge branch 'for-linus' of git://git.kernel.dk/linux-block

2015-09-19 18:57:09 -07:00

bsg-lib.c

Revert "bsg-lib: don't free job in bsg_prepare_job"

2017-10-21 17:09:03 +02:00

bsg.c

sg_write()/bsg_write() is not fit to be called under KERNEL_DS

2017-01-09 08:07:53 +01:00

cfq-iosched.c

block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg

2018-09-19 22:48:56 +02:00

cmdline-parser.c

block: remove unrelated header files and export symbol

2014-01-21 20:18:26 -08:00

compat_ioctl.c

compat_ioctl: block: handle Persistent Reservations

2020-01-12 11:22:42 +01:00

deadline-iosched.c

block: Stop abusing csd.list for fifo_time

2014-02-24 14:46:32 -08:00

elevator.c

block: check bio_mergeable() early before merging

2015-10-21 15:00:54 -06:00

genhd.c

block: fix del_gendisk() vs blkdev_ioctl crash

2017-04-27 09:09:34 +02:00

ioctl.c

block: add an API for Persistent Reservations

2015-10-21 14:46:56 -06:00

ioprio.c

block: fix use-after-free in sys_ioprio_get()

2016-08-10 11:49:28 +02:00

Kconfig

block: Add T10 Protection Information functions

2014-09-27 09:14:59 -06:00

Kconfig.iosched

blkcg: make CONFIG_BLK_CGROUP bool

2012-03-06 21:27:21 +01:00

Makefile

block: Add T10 Protection Information functions

2014-09-27 09:14:59 -06:00

noop-iosched.c

elevator: use list_{first,prev,next}_entry

2015-11-16 15:21:48 -07:00

partition-generic.c

block: fix an error code in add_partition()

2018-04-13 19:50:10 +02:00

scsi_ioctl.c

block: allow WRITE_SAME commands with the SG_IO ioctl

2017-03-30 09:35:20 +02:00

t10-pi.c

block: Consolidate static integrity profile properties

2015-10-21 14:42:38 -06:00