md: check that internal bitmap does not overlap other data

[deliverable/linux.git] / drivers / md / bitmap.c

diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 5554adaa58f9be01d37bc5623f63384c084e69de..ae94f3beb5fc89c1a9e31b2851fd82588c667bb4 100644 (file)
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -255,19 +255,50 @@ static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long inde
 
 }
 
-static int write_sb_page(mddev_t *mddev, long offset, struct page *page, int wait)
+static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 {
        mdk_rdev_t *rdev;
        struct list_head *tmp;
+       mddev_t *mddev = bitmap->mddev;
 
        ITERATE_RDEV(mddev, rdev, tmp)
                if (test_bit(In_sync, &rdev->flags)
-                   && !test_bit(Faulty, &rdev->flags))
+                   && !test_bit(Faulty, &rdev->flags)) {
+                       int size = PAGE_SIZE;
+                       if (page->index == bitmap->file_pages-1)
+                               size = roundup(bitmap->last_page_size,
+                                              bdev_hardsect_size(rdev->bdev));
+                       /* Just make sure we aren't corrupting data or
+                        * metadata
+                        */
+                       if (bitmap->offset < 0) {
+                               /* DATA  BITMAP METADATA  */
+                               if (bitmap->offset
+                                   + page->index * (PAGE_SIZE/512)
+                                   + size/512 > 0)
+                                       /* bitmap runs in to metadata */
+                                       return -EINVAL;
+                               if (rdev->data_offset + mddev->size*2
+                                   > rdev->sb_offset*2 + bitmap->offset)
+                                       /* data runs in to bitmap */
+                                       return -EINVAL;
+                       } else if (rdev->sb_offset*2 < rdev->data_offset) {
+                               /* METADATA BITMAP DATA */
+                               if (rdev->sb_offset*2
+                                   + bitmap->offset
+                                   + page->index*(PAGE_SIZE/512) + size/512
+                                   > rdev->data_offset)
+                                       /* bitmap runs in to data */
+                                       return -EINVAL;
+                       } else {
+                               /* DATA METADATA BITMAP - no problems */
+                       }
                        md_super_write(mddev, rdev,
-                                      (rdev->sb_offset<<1) + offset
+                                      (rdev->sb_offset<<1) + bitmap->offset
                                       + page->index * (PAGE_SIZE/512),
-                                      PAGE_SIZE,
+                                      size,
                                       page);
+               }
 
        if (wait)
                md_super_wait(mddev);
@@ -281,8 +312,14 @@ static int write_page(struct bitmap *bitmap, struct page *page, int wait)
 {
        struct buffer_head *bh;
 
-       if (bitmap->file == NULL)
-               return write_sb_page(bitmap->mddev, bitmap->offset, page, wait);
+       if (bitmap->file == NULL) {
+               switch (write_sb_page(bitmap, page, wait)) {
+               case -EINVAL:
+                       bitmap->flags |= BITMAP_WRITE_ERROR;
+                       return -EIO;
+               }
+               return 0;
+       }
 
        bh = page_buffers(page);
 
@@ -863,9 +900,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 
        /* We need 4 bits per page, rounded up to a multiple of sizeof(unsigned long) */
        bitmap->filemap_attr = kzalloc(
-               (((num_pages*4/8)+sizeof(unsigned long)-1)
-                /sizeof(unsigned long))
-               *sizeof(unsigned long),
+               roundup( DIV_ROUND_UP(num_pages*4, 8), sizeof(unsigned long)),
                GFP_KERNEL);
        if (!bitmap->filemap_attr)
                goto out;
@@ -925,6 +960,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                        }
 
                        bitmap->filemap[bitmap->file_pages++] = page;
+                       bitmap->last_page_size = count;
                }
                paddr = kmap_atomic(page, KM_USER0);
                if (bitmap->flags & BITMAP_HOSTENDIAN)
@@ -1458,10 +1494,10 @@ int bitmap_create(mddev_t *mddev)
        bitmap->offset = mddev->bitmap_offset;
        if (file) {
                get_file(file);
-               do_sync_file_range(file, 0, LLONG_MAX,
-                                  SYNC_FILE_RANGE_WAIT_BEFORE |
-                                  SYNC_FILE_RANGE_WRITE |
-                                  SYNC_FILE_RANGE_WAIT_AFTER);
+               do_sync_mapping_range(file->f_mapping, 0, LLONG_MAX,
+                                     SYNC_FILE_RANGE_WAIT_BEFORE |
+                                     SYNC_FILE_RANGE_WRITE |
+                                     SYNC_FILE_RANGE_WAIT_AFTER);
        }
        /* read superblock from bitmap file (this sets bitmap->chunksize) */
        err = bitmap_read_sb(bitmap);