diff options
| author | Lars Ellenberg <lars.ellenberg@linbit.com> | 2013-10-23 10:59:18 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2013-11-08 09:10:28 -0700 |
| commit | d2da5b0cb522c48f8e2f311e6e9b212535371b56 (patch) | |
| tree | b2d883aa031c9ed894a0dc797400e312226e8251 /drivers/block | |
| parent | 57737adc965e45fcb03662fe6f93f6efb19e2c0a (diff) | |
| download | op-kernel-dev-d2da5b0cb522c48f8e2f311e6e9b212535371b56.zip op-kernel-dev-d2da5b0cb522c48f8e2f311e6e9b212535371b56.tar.gz | |
drbd: fix decoding of bitmap vli rle for device sizes > 64 TB
Symptoms: disconnect after bitmap exchange due to
bitmap overflow (e:49731075554) while decoding bm RLE packet
In the decoding step of the variable length integer run length encoding
there was potentially an uncatched bitshift by wordsize (variable >> 64).
The result of which is "undefined" :(
(only "sometimes" the result is the desired 0)
Fix: don't do any bit shift magic for shift == 64, just assign.
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/drbd/drbd_receiver.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c index 12c59eb..6fa6673 100644 --- a/drivers/block/drbd/drbd_receiver.c +++ b/drivers/block/drbd/drbd_receiver.c @@ -4125,7 +4125,11 @@ recv_bm_rle_bits(struct drbd_conf *mdev, (unsigned int)bs.buf_len); return -EIO; } - look_ahead >>= bits; + /* if we consumed all 64 bits, assign 0; >> 64 is "undefined"; */ + if (likely(bits < 64)) + look_ahead >>= bits; + else + look_ahead = 0; have -= bits; bits = bitstream_get_bits(&bs, &tmp, 64 - have); |
