Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...

[karo-tx-linux.git] / drivers / md / dm-log.c

diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 691cb9c22b5643381783fe22979eb39acf85f700..737961f275c196f9b6aa41957dd08c72457c597b 100644 (file)
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -360,6 +360,17 @@ static int read_header(struct log_c *log)
        return 0;
 }
 
+static int _check_region_size(struct dm_target *ti, uint32_t region_size)
+{
+       if (region_size < 2 || region_size > ti->len)
+               return 0;
+
+       if (!is_power_of_2(region_size))
+               return 0;
+
+       return 1;
+}
+
 /*----------------------------------------------------------------
  * core log constructor/destructor
  *
@@ -395,8 +406,9 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
                }
        }
 
-       if (sscanf(argv[0], "%u", &region_size) != 1) {
-               DMWARN("invalid region size string");
+       if (sscanf(argv[0], "%u", &region_size) != 1 ||
+           !_check_region_size(ti, region_size)) {
+               DMWARN("invalid region size %s", argv[0]);
                return -EINVAL;
        }
 
@@ -445,6 +457,14 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
                 */
                buf_size = dm_round_up((LOG_OFFSET << SECTOR_SHIFT) +
                                       bitset_size, ti->limits.hardsect_size);
+
+               if (buf_size > dev->bdev->bd_inode->i_size) {
+                       DMWARN("log device %s too small: need %llu bytes",
+                               dev->name, (unsigned long long)buf_size);
+                       kfree(lc);
+                       return -EINVAL;
+               }
+
                lc->header_location.count = buf_size >> SECTOR_SHIFT;
 
                lc->io_req.mem.type = DM_IO_VMA;