Re: [PATCH 7/7] Guard bvec iteration logic v2

2017-04-04 Thread Ming Lei
On Tue, Apr 4, 2017 at 11:19 PM, Dmitry Monakhov wrote: > Ming Lei writes: > >> On Mon, Apr 3, 2017 at 3:23 PM, Dmitry Monakhov wrote: >>> Currently if some one try to advance bvec beyond it's size we simply >>> dump WARN_ONCE and continue to iterate beyond bvec array boundaries. >>> This simply

Re: [PATCH 7/7] Guard bvec iteration logic v2

2017-04-04 Thread Dmitry Monakhov
Ming Lei writes: > On Mon, Apr 3, 2017 at 3:23 PM, Dmitry Monakhov wrote: >> Currently if some one try to advance bvec beyond it's size we simply >> dump WARN_ONCE and continue to iterate beyond bvec array boundaries. >> This simply means that we endup dereferencing/corrupting random memory >> r

Re: [PATCH 7/7] Guard bvec iteration logic v2

2017-04-04 Thread Ming Lei
On Mon, Apr 3, 2017 at 3:23 PM, Dmitry Monakhov wrote: > Currently if some one try to advance bvec beyond it's size we simply > dump WARN_ONCE and continue to iterate beyond bvec array boundaries. > This simply means that we endup dereferencing/corrupting random memory > region. > > Sane reaction

Re: [PATCH 7/7] Guard bvec iteration logic v2

2017-04-03 Thread Jens Axboe
On 04/03/2017 01:23 AM, Dmitry Monakhov wrote: > @@ -66,12 +67,15 @@ struct bvec_iter { > .bv_offset = bvec_iter_offset((bvec), (iter)), \ > }) > > -static inline void bvec_iter_advance(const struct bio_vec *bv, > +static inline int bvec_iter_advance(const struct bio_vec *bv, >

[PATCH 7/7] Guard bvec iteration logic v2

2017-04-03 Thread Dmitry Monakhov
Currently if some one try to advance bvec beyond it's size we simply dump WARN_ONCE and continue to iterate beyond bvec array boundaries. This simply means that we endup dereferencing/corrupting random memory region. Sane reaction would be to propagate error back to calling context But bvec_iter_a