md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
authorLi Nan <linan122@huawei.com>
Mon, 15 May 2023 13:48:05 +0000 (21:48 +0800)
committerSong Liu <song@kernel.org>
Tue, 13 Jun 2023 22:13:20 +0000 (15:13 -0700)
commit301867b1c16805aebbc306aafa6ecdc68b73c7e5
tree851e4e5454f9942f1ae5f8c1bd32788cab1ee24e
parent3de13550a20fd570441c0f854abe58c6cc46c0bc
md/raid10: check slab-out-of-bounds in md_bitmap_get_counter

If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage()
will return -EINVAL because 'page >= bitmap->pages', but the return value
was not checked immediately in md_bitmap_get_counter() in order to set
*blocks value and slab-out-of-bounds occurs.

Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and
return directly if true.

Fixes: ef4256733506 ("md/bitmap: optimise scanning of empty bitmaps.")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230515134808.3936750-2-linan666@huaweicloud.com
drivers/md/md-bitmap.c