]> git.kernelconcepts.de Git - karo-tx-linux.git/commit
lib/string_helpers.c: fix infinite loop in string_get_size()
authorVitaly Kuznetsov <vkuznets@redhat.com>
Thu, 17 Sep 2015 23:01:51 +0000 (16:01 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 18 Sep 2015 04:16:07 +0000 (21:16 -0700)
commit62bef58a55dfa8ada2a22b2496c6340468ecd98a
treec621a5bddd37e100da55522c242c3b66d0277b8c
parent14b97deddf8ddecce9f35165b667c55c73e14638
lib/string_helpers.c: fix infinite loop in string_get_size()

Some string_get_size() calls (e.g.:
 string_get_size(1, 512, STRING_UNITS_10, ..., ...)
 string_get_size(15, 64, STRING_UNITS_10, ..., ...)
) result in an infinite loop. The problem is that if size is equal to
divisor[units]/blk_size and is smaller than divisor[units] we'll end
up with size == 0 when we start doing sf_cap calculations:

For string_get_size(1, 512, STRING_UNITS_10, ..., ...) case:
   ...
   remainder = do_div(size, divisor[units]); -> size is 0, remainder is 1
   remainder *= blk_size; -> remainder is 512
   ...
   size *= blk_size; -> size is still 0
   size += remainder / divisor[units]; -> size is still 0

The caller causing the issue is sd_read_capacity(), the problem was
noticed on Hyper-V, such weird size was reported by host when scanning
collides with device removal.  This is probably a separate issue worth
fixing, this patch is intended to prevent the library routine from
infinite looping.

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: James Bottomley <JBottomley@Odin.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
lib/string_helpers.c