Commit 3eb96946 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Jens Axboe

block: make bio_check_eod work for zero sized devices

Since the dawn of time bio_check_eod has a check for a non-zero size of
the device.  This doesn't really make any sense as we never want to send
I/O to a device that's been set to zero size, or never moved out of that.

I am a bit surprised we haven't caught this for a long time, but the
removal of the extra validation inside of zram caused syzbot to trip
over this issue recently.  I've added a Fixes tag for that commit, but
the issue really goes back way before git history.

Fixes: 9fe95bab ("zram: remove valid_io_request")
Reported-by: syzbot+b8d61a58b7c7ebd2c8e0@syzkaller.appspotmail.com
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230524060538.1593686-1-hch@lst.deSigned-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 46930b7c
...@@ -520,7 +520,7 @@ static inline int bio_check_eod(struct bio *bio) ...@@ -520,7 +520,7 @@ static inline int bio_check_eod(struct bio *bio)
sector_t maxsector = bdev_nr_sectors(bio->bi_bdev); sector_t maxsector = bdev_nr_sectors(bio->bi_bdev);
unsigned int nr_sectors = bio_sectors(bio); unsigned int nr_sectors = bio_sectors(bio);
if (nr_sectors && maxsector && if (nr_sectors &&
(nr_sectors > maxsector || (nr_sectors > maxsector ||
bio->bi_iter.bi_sector > maxsector - nr_sectors)) { bio->bi_iter.bi_sector > maxsector - nr_sectors)) {
pr_info_ratelimited("%s: attempt to access beyond end of device\n" pr_info_ratelimited("%s: attempt to access beyond end of device\n"
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment