md: check that internal bitmap does not overlap other data

[deliverable/linux.git] / drivers / md / bitmap.c

diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 5a4a74c1097c6ce80eb38e726954304dbb25bc53..ae94f3beb5fc89c1a9e31b2851fd82588c667bb4 100644 (file)
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -255,19 +255,50 @@ static struct page *read_sb_page(mddev_t *mddev, long offset, unsigned long inde
 
 }
 
-static int write_sb_page(mddev_t *mddev, long offset, struct page *page, int wait)
+static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 {
        mdk_rdev_t *rdev;
        struct list_head *tmp;
+       mddev_t *mddev = bitmap->mddev;
 
        ITERATE_RDEV(mddev, rdev, tmp)
                if (test_bit(In_sync, &rdev->flags)
-                   && !test_bit(Faulty, &rdev->flags))
+                   && !test_bit(Faulty, &rdev->flags)) {
+                       int size = PAGE_SIZE;
+                       if (page->index == bitmap->file_pages-1)
+                               size = roundup(bitmap->last_page_size,
+                                              bdev_hardsect_size(rdev->bdev));
+                       /* Just make sure we aren't corrupting data or
+                        * metadata
+                        */
+                       if (bitmap->offset < 0) {
+                               /* DATA  BITMAP METADATA  */
+                               if (bitmap->offset
+                                   + page->index * (PAGE_SIZE/512)
+                                   + size/512 > 0)
+                                       /* bitmap runs in to metadata */
+                                       return -EINVAL;
+                               if (rdev->data_offset + mddev->size*2
+                                   > rdev->sb_offset*2 + bitmap->offset)
+                                       /* data runs in to bitmap */
+                                       return -EINVAL;
+                       } else if (rdev->sb_offset*2 < rdev->data_offset) {
+                               /* METADATA BITMAP DATA */
+                               if (rdev->sb_offset*2
+                                   + bitmap->offset
+                                   + page->index*(PAGE_SIZE/512) + size/512
+                                   > rdev->data_offset)
+                                       /* bitmap runs in to data */
+                                       return -EINVAL;
+                       } else {
+                               /* DATA METADATA BITMAP - no problems */
+                       }
                        md_super_write(mddev, rdev,
-                                      (rdev->sb_offset<<1) + offset
+                                      (rdev->sb_offset<<1) + bitmap->offset
                                       + page->index * (PAGE_SIZE/512),
-                                      PAGE_SIZE,
+                                      size,
                                       page);
+               }
 
        if (wait)
                md_super_wait(mddev);
@@ -281,8 +312,14 @@ static int write_page(struct bitmap *bitmap, struct page *page, int wait)
 {
        struct buffer_head *bh;
 
-       if (bitmap->file == NULL)
-               return write_sb_page(bitmap->mddev, bitmap->offset, page, wait);
+       if (bitmap->file == NULL) {
+               switch (write_sb_page(bitmap, page, wait)) {
+               case -EINVAL:
+                       bitmap->flags |= BITMAP_WRITE_ERROR;
+                       return -EIO;
+               }
+               return 0;
+       }
 
        bh = page_buffers(page);
 
@@ -923,6 +960,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                        }
 
                        bitmap->filemap[bitmap->file_pages++] = page;
+                       bitmap->last_page_size = count;
                }
                paddr = kmap_atomic(page, KM_USER0);
                if (bitmap->flags & BITMAP_HOSTENDIAN)