On Sat, Dec 03, 2016 at 11:22:26AM +0300, Dmitry Monakhov wrote:
>
> Pavel Tikhomirov writes:
>
> > https://jira.sw.ru/browse/PSBM-55105
> >
> > In bug we crashed in zero_fill_bio when trying to zero memset bio_vec:
> >
> > struct bio_vec {
> > bv_page = 0xea0004437500,
> > bv_len = 4294
Pavel Tikhomirov writes:
> https://jira.sw.ru/browse/PSBM-55105
>
> In bug we crashed in zero_fill_bio when trying to zero memset bio_vec:
>
> struct bio_vec {
> bv_page = 0xea0004437500,
> bv_len = 4294948864,
> bv_offset = 0
> }
>
> which is bigger than its bio->bi_size = 104448, gua
https://jira.sw.ru/browse/PSBM-55105
In bug we crashed in zero_fill_bio when trying to zero memset bio_vec:
struct bio_vec {
bv_page = 0xea0004437500,
bv_len = 4294948864,
bv_offset = 0
}
which is bigger than its bio->bi_size = 104448, guard_bio_eod might
lead to these bv_len overflow
