• Z
    md: Fix undefined behaviour in is_mddev_idle · 406295a3
    zhangwensheng 提交于
    hulk inclusion
    category: bugfix
    bugzilla: https://gitee.com/openeuler/kernel/issues/I4QXS1?from=project-issue
    CVE: NA
    
    --------------------------------
    
    UBSAN reports this problem:
    
    [ 5984.281385] UBSAN: Undefined behaviour in drivers/md/md.c:8175:15
    [ 5984.281390] signed integer overflow:
    [ 5984.281393] -2147483291 - 2072033152 cannot be represented in type 'int'
    [ 5984.281400] CPU: 25 PID: 1854 Comm: md101_resync Kdump: loaded Not tainted 4.19.90
    [ 5984.281404] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDDA
    [ 5984.281406] Call trace:
    [ 5984.281415]  dump_backtrace+0x0/0x310
    [ 5984.281418]  show_stack+0x28/0x38
    [ 5984.281425]  dump_stack+0xec/0x15c
    [ 5984.281430]  ubsan_epilogue+0x18/0x84
    [ 5984.281434]  handle_overflow+0x14c/0x19c
    [ 5984.281439]  __ubsan_handle_sub_overflow+0x34/0x44
    [ 5984.281445]  is_mddev_idle+0x338/0x3d8
    [ 5984.281449]  md_do_sync+0x1bb8/0x1cf8
    [ 5984.281452]  md_thread+0x220/0x288
    [ 5984.281457]  kthread+0x1d8/0x1e0
    [ 5984.281461]  ret_from_fork+0x10/0x18
    
    When the stat aacum of the disk is greater than INT_MAX, its value
    becomes negative after casting to 'int', which may lead to overflow
    after subtracting a positive number. In the same way, when the value
    of sync_io is greater than INT_MAX,overflow may also occur. These
    situations will lead to undefined behavior.
    
    Otherwise, if the stat accum of the disk is close to INT_MAX when
    creating raid arrays, the initial value of last_events would be set
    close to INT_MAX when mddev initializes IO event counters.
    'curr_events - rdev->last_events > 64' will always false during
    synchronization. If all the disks of mddev are in this case,
    is_mddev_idle() will always return 1, which may cause non-sync IO
    is very slow.
    
    To address these problems, need to use 64bit signed integer type
    for sync_io,last_events, and curr_events.
    Signed-off-by: Nzhangwensheng <zhangwensheng5@huawei.com>
    Reviewed-by: NTao Hou <houtao1@huawei.com>
    Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
    406295a3
genhd.h 12.5 KB