Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1224108 > unrolled thread
| Started by | Vitaly Kuznetsov <vkuznets@redhat.com> |
|---|---|
| First post | 2015-09-14 15:00 +0200 |
| Last post | 2015-09-14 17:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH v2] lib/string_helpers.c: fix infinite loop in string_get_size() Vitaly Kuznetsov <vkuznets@redhat.com> - 2015-09-14 15:00 +0200
Re: [PATCH v2] lib/string_helpers.c: fix infinite loop in string_get_size() James Bottomley <jbottomley@odin.com> - 2015-09-14 17:20 +0200
| From | Vitaly Kuznetsov <vkuznets@redhat.com> |
|---|---|
| Date | 2015-09-14 15:00 +0200 |
| Subject | [PATCH v2] lib/string_helpers.c: fix infinite loop in string_get_size() |
| Message-ID | <q8Bwt-6Es-5@gated-at.bofh.it> |
Some string_get_size() calls (e.g.:
string_get_size(1, 512, STRING_UNITS_10, ..., ...)
string_get_size(15, 64, STRING_UNITS_10, ..., ...)
) result in an infinite loop. The problem is that if size is equal to
divisor[units]/blk_size and is smaller than divisor[units] we'll end
up with size == 0 when we start doing sf_cap calculations:
For string_get_size(1, 512, STRING_UNITS_10, ..., ...) case:
...
remainder = do_div(size, divisor[units]); -> size is 0, remainder is 1
remainder *= blk_size; -> remainder is 512
...
size *= blk_size; -> size is still 0
size += remainder / divisor[units]; -> size is still 0
The caller causing the issue is sd_read_capacity(), the problem was noticed
on Hyper-V, such weird size was reported by host when scanning collides
with device removal. This is probably a separate issue worth fixing, this
patch is intended to prevent the library routing from infinite looping.
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
---
lib/string_helpers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/string_helpers.c b/lib/string_helpers.c
index c98ae81..d0e607c 100644
--- a/lib/string_helpers.c
+++ b/lib/string_helpers.c
@@ -59,7 +59,7 @@ void string_get_size(u64 size, u64 blk_size, const enum string_size_units units,
}
exp = divisor[units] / (u32)blk_size;
- if (size >= exp) {
+ if (size > exp) {
remainder = do_div(size, divisor[units]);
remainder *= blk_size;
i++;
--
2.4.3
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | James Bottomley <jbottomley@odin.com> |
|---|---|
| Date | 2015-09-14 17:20 +0200 |
| Subject | Re: [PATCH v2] lib/string_helpers.c: fix infinite loop in string_get_size() |
| Message-ID | <q8DHZ-1xe-37@gated-at.bofh.it> |
| In reply to | #1224108 |
T24gTW9uLCAyMDE1LTA5LTE0IGF0IDE0OjU3ICswMjAwLCBWaXRhbHkgS3V6bmV0c292IHdyb3Rl Og0KPiBTb21lIHN0cmluZ19nZXRfc2l6ZSgpIGNhbGxzIChlLmcuOg0KPiAgc3RyaW5nX2dldF9z aXplKDEsIDUxMiwgU1RSSU5HX1VOSVRTXzEwLCAuLi4sIC4uLikNCj4gIHN0cmluZ19nZXRfc2l6 ZSgxNSwgNjQsIFNUUklOR19VTklUU18xMCwgLi4uLCAuLi4pDQo+ICkgcmVzdWx0IGluIGFuIGlu ZmluaXRlIGxvb3AuIFRoZSBwcm9ibGVtIGlzIHRoYXQgaWYgc2l6ZSBpcyBlcXVhbCB0bw0KPiBk aXZpc29yW3VuaXRzXS9ibGtfc2l6ZSBhbmQgaXMgc21hbGxlciB0aGFuIGRpdmlzb3JbdW5pdHNd IHdlJ2xsIGVuZA0KPiB1cCB3aXRoIHNpemUgPT0gMCB3aGVuIHdlIHN0YXJ0IGRvaW5nIHNmX2Nh cCBjYWxjdWxhdGlvbnM6DQo+IA0KPiBGb3Igc3RyaW5nX2dldF9zaXplKDEsIDUxMiwgU1RSSU5H X1VOSVRTXzEwLCAuLi4sIC4uLikgY2FzZToNCj4gICAgLi4uDQo+ICAgIHJlbWFpbmRlciA9IGRv X2RpdihzaXplLCBkaXZpc29yW3VuaXRzXSk7IC0+IHNpemUgaXMgMCwgcmVtYWluZGVyIGlzIDEN Cj4gICAgcmVtYWluZGVyICo9IGJsa19zaXplOyAtPiByZW1haW5kZXIgaXMgNTEyDQo+ICAgIC4u Lg0KPiAgICBzaXplICo9IGJsa19zaXplOyAtPiBzaXplIGlzIHN0aWxsIDANCj4gICAgc2l6ZSAr PSByZW1haW5kZXIgLyBkaXZpc29yW3VuaXRzXTsgLT4gc2l6ZSBpcyBzdGlsbCAwDQo+IA0KPiBU aGUgY2FsbGVyIGNhdXNpbmcgdGhlIGlzc3VlIGlzIHNkX3JlYWRfY2FwYWNpdHkoKSwgdGhlIHBy b2JsZW0gd2FzIG5vdGljZWQNCj4gb24gSHlwZXItViwgc3VjaCB3ZWlyZCBzaXplIHdhcyByZXBv cnRlZCBieSBob3N0IHdoZW4gc2Nhbm5pbmcgY29sbGlkZXMNCj4gd2l0aCBkZXZpY2UgcmVtb3Zh bC4gVGhpcyBpcyBwcm9iYWJseSBhIHNlcGFyYXRlIGlzc3VlIHdvcnRoIGZpeGluZywgdGhpcw0K PiBwYXRjaCBpcyBpbnRlbmRlZCB0byBwcmV2ZW50IHRoZSBsaWJyYXJ5IHJvdXRpbmcgZnJvbSBp bmZpbml0ZSBsb29waW5nLg0KPiANCj4gU2lnbmVkLW9mZi1ieTogVml0YWx5IEt1em5ldHNvdiA8 dmt1em5ldHNAcmVkaGF0LmNvbT4NCj4gLS0tDQo+ICBsaWIvc3RyaW5nX2hlbHBlcnMuYyB8IDIg Ky0NCj4gIDEgZmlsZSBjaGFuZ2VkLCAxIGluc2VydGlvbigrKSwgMSBkZWxldGlvbigtKQ0KPiAN Cj4gZGlmZiAtLWdpdCBhL2xpYi9zdHJpbmdfaGVscGVycy5jIGIvbGliL3N0cmluZ19oZWxwZXJz LmMNCj4gaW5kZXggYzk4YWU4MS4uZDBlNjA3YyAxMDA2NDQNCj4gLS0tIGEvbGliL3N0cmluZ19o ZWxwZXJzLmMNCj4gKysrIGIvbGliL3N0cmluZ19oZWxwZXJzLmMNCj4gQEAgLTU5LDcgKzU5LDcg QEAgdm9pZCBzdHJpbmdfZ2V0X3NpemUodTY0IHNpemUsIHU2NCBibGtfc2l6ZSwgY29uc3QgZW51 bSBzdHJpbmdfc2l6ZV91bml0cyB1bml0cywNCj4gIAl9DQo+ICANCj4gIAlleHAgPSBkaXZpc29y W3VuaXRzXSAvICh1MzIpYmxrX3NpemU7DQoNCkFkZCBhIGNvbW1lbnQgaGVyZSBleHBsYWluaW5n IHRvIHRob3NlIHdobyBjb21lIGFmdGVyIHdoeSBzdHJpY3QgZ3JlYXRlcg0KdGhhbiBpcyBuZWNl c3NhcnkuICBTb21ldGhpbmcgbGlrZToNCg0KLyogc2l6ZSBtdXN0IGJlIHN0cmljdGx5IGdyZWF0 ZXIgdGhhbiBleHAgaGVyZSB0byBlbnN1cmUNCiAqIHRoYXQgcmVtYWluZGVyIGlzIGdyZWF0ZXIg dGhhbiBkaXZpc29yW3VuaXRzXSBjb21pbmcgb3V0IG9mIHRoZSBpZiAqLw0KDQo+IC0JaWYgKHNp emUgPj0gZXhwKSB7DQo+ICsJaWYgKHNpemUgPiBleHApIHsNCj4gIAkJcmVtYWluZGVyID0gZG9f ZGl2KHNpemUsIGRpdmlzb3JbdW5pdHNdKTsNCj4gIAkJcmVtYWluZGVyICo9IGJsa19zaXplOw0K PiAgCQlpKys7DQoNClNvIHdoZW4gcHVzaGVkLCB5b3UgZmluYWxseSBmb3VuZCB0aGUgYWxnb3Jp dGhtaWMgcHJvYmxlbS4gIFdlbGwgZG9uZS4NCg0KQWNrZWQtYnk6IEphbWVzIEJvdHRvbWxleSA8 SkJvdHRvbWxleUBPZGluLmNvbT4NCg0KSmFtZXMNCg0K -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web