blk-lib: fix blkdev_issue_secure_erase

commit c4fa368466cc1b60bb92f867741488930ddd6034 upstream.

There's a bug in blkdev_issue_secure_erase. The statement
"unsigned int len = min_t(sector_t, nr_sects, max_sectors);"
sets the variable "len" to the length in sectors, but the statement
"bio->bi_iter.bi_size = len" treats it as if it were in bytes.
The statements "sector += len << SECTOR_SHIFT" and "nr_sects -= len <<
SECTOR_SHIFT" are thinko.

This patch fixes it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org	# v5.19
Fixes: 44abff2c0b97 ("block: decouple REQ_OP_SECURE_ERASE from REQ_OP_DISCARD")
Link: https://lore.kernel.org/r/alpine.LRH.2.02.2209141549480.28100@file01.intranet.prod.int.rdu2.redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/block/blk-lib.c b/block/blk-lib.c
index 09b7e1200c0f40fb0d539ba889db9b8aa553b668..20e42144065b83492a887ed2332b607be534cc63 100644 (file)
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -311,6 +311,11 @@ int blkdev_issue_secure_erase(struct block_device *bdev, sector_t sector,
        struct blk_plug plug;
        int ret = 0;
 
+       /* make sure that "len << SECTOR_SHIFT" doesn't overflow */
+       if (max_sectors > UINT_MAX >> SECTOR_SHIFT)
+               max_sectors = UINT_MAX >> SECTOR_SHIFT;
+       max_sectors &= ~bs_mask;
+
        if (max_sectors == 0)
                return -EOPNOTSUPP;
        if ((sector | nr_sects) & bs_mask)
@@ -324,10 +329,10 @@ int blkdev_issue_secure_erase(struct block_device *bdev, sector_t sector,
 
                bio = blk_next_bio(bio, bdev, 0, REQ_OP_SECURE_ERASE, gfp);
                bio->bi_iter.bi_sector = sector;
-               bio->bi_iter.bi_size = len;
+               bio->bi_iter.bi_size = len << SECTOR_SHIFT;
 
-               sector += len << SECTOR_SHIFT;
-               nr_sects -= len << SECTOR_SHIFT;
+               sector += len;
+               nr_sects -= len;
                if (!nr_sects) {
                        ret = submit_bio_wait(bio);
                        bio_put(bio);