[dm-devel] [PATCH] dm-writecache: fix a crash when over-reading dirty_bitmap

[Mikulas Patocka]

This patch fixes a crash in find_next_bit reported in
https://bugzilla.kernel.org/show_bug.cgi?id=200819 . wc->dirty_bitmap_size
is in bytes, so we must multiply it by 8, not by BITS_PER_LONG.


Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
Cc: stable at vger.kernel.org	# 4.18+
Fixes: 48debafe4f2f ("dm: add writecache target")

---
 drivers/md/dm-writecache.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-2.6/drivers/md/dm-writecache.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-writecache.c	2018-08-13 16:52:31.000000000 +0200
+++ linux-2.6/drivers/md/dm-writecache.c	2018-08-16 18:06:35.000000000 +0200
@@ -457,7 +457,7 @@ static void ssd_commit_flushed(struct dm
 		COMPLETION_INITIALIZER_ONSTACK(endio.c),
 		ATOMIC_INIT(1),
 	};
-	unsigned bitmap_bits = wc->dirty_bitmap_size * BITS_PER_LONG;
+	unsigned bitmap_bits = wc->dirty_bitmap_size * 8;
 	unsigned i = 0;
 
 	while (1) {