Commit 7cbc51de authored by Tejun Heo's avatar Tejun Heo Committed by Luis Henriques

writeback: use |1 instead of +1 to protect against div by zero

commit 464d1387 upstream.

mm/page-writeback.c has several places where 1 is added to the divisor
to prevent division by zero exceptions; however, if the original
divisor is equivalent to -1, adding 1 leads to division by zero.

There are three places where +1 is used for this purpose - one in
pos_ratio_polynom() and two in bdi_position_ratio().  The second one
in bdi_position_ratio() actually triggered div-by-zero oops on a
machine running a 3.10 kernel.  The divisor is

  x_intercept - bdi_setpoint + 1 == span + 1

span is confirmed to be (u32)-1.  It isn't clear how it ended up that
but it could be from write bandwidth calculation underflow fixed by
c72efb65 ("writeback: fix possible underflow in write bandwidth
calculation").

At any rate, +1 isn't a proper protection against div-by-zero.  This
patch converts all +1 protections to |1.  Note that
bdi_update_dirty_ratelimit() was already using |1 before this patch.
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent f96626be
...@@ -583,7 +583,7 @@ static long long pos_ratio_polynom(unsigned long setpoint, ...@@ -583,7 +583,7 @@ static long long pos_ratio_polynom(unsigned long setpoint,
long x; long x;
x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT, x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
limit - setpoint + 1); (limit - setpoint) | 1);
pos_ratio = x; pos_ratio = x;
pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT; pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
...@@ -810,7 +810,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, ...@@ -810,7 +810,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
* scale global setpoint to bdi's: * scale global setpoint to bdi's:
* bdi_setpoint = setpoint * bdi_thresh / thresh * bdi_setpoint = setpoint * bdi_thresh / thresh
*/ */
x = div_u64((u64)bdi_thresh << 16, thresh + 1); x = div_u64((u64)bdi_thresh << 16, thresh | 1);
bdi_setpoint = setpoint * (u64)x >> 16; bdi_setpoint = setpoint * (u64)x >> 16;
/* /*
* Use span=(8*write_bw) in single bdi case as indicated by * Use span=(8*write_bw) in single bdi case as indicated by
...@@ -825,7 +825,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi, ...@@ -825,7 +825,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
if (bdi_dirty < x_intercept - span / 4) { if (bdi_dirty < x_intercept - span / 4) {
pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty), pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
x_intercept - bdi_setpoint + 1); (x_intercept - bdi_setpoint) | 1);
} else } else
pos_ratio /= 4; pos_ratio /= 4;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment