block: fix infinite loop in badblocks_clear()#770
block: fix infinite loop in badblocks_clear()#770blktests-ci[bot] wants to merge 1 commit intolinus-master_basefrom
Conversation
|
Upstream branch: dd6c438 |
|
Upstream branch: dd6c438 |
02d2577 to
b27d89c
Compare
857ada9 to
482ce5b
Compare
|
Upstream branch: dca922e |
b27d89c to
ded6f5d
Compare
482ce5b to
5a9f7c7
Compare
|
Upstream branch: e75a43c |
ded6f5d to
6fdf687
Compare
5a9f7c7 to
25a041f
Compare
|
Upstream branch: 66edb90 |
6fdf687 to
d15b186
Compare
25a041f to
6f75bd1
Compare
|
Upstream branch: 6d35786 |
d15b186 to
b9f253f
Compare
6f75bd1 to
1f0d33a
Compare
|
Upstream branch: 6d35786 |
b9f253f to
6fe6147
Compare
1f0d33a to
b1870f6
Compare
An infinite loop can occur in _badblocks_clear() when BB_OFFSET(p[prev + 1])
equals bad.start, resulting in len = 0. This causes the update_sectors loop
to spin forever without making progress:
s += 0; // no advancement
sectors -= 0; // stays positive
goto re_clear; // infinite loop
The bug exists in two code paths:
1. _badblocks_clear() at line 1153 (behind overlap check)
2. _badblocks_check() at line 1240 (behind overlap check)
Add checks in both functions to ensure len is non-zero before entering
the loop.
Signed-off-by: Ramesh Adhikari <adhikari.resume@gmail.com>
|
Upstream branch: aa54b1d |
6fe6147 to
0416c2f
Compare
Pull request for series with
subject: block: fix infinite loop in badblocks_clear()
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1085681