2006-08-04 16:22:26

by Eric Sandeen

Subject: [PATCH] fix sun partition overflow over 1T

Although sun partition labels aren't supposed to support > 1T, apparently
linux partition editors will allow up to 2T. This can cause problems
in the kernel when these larger partitions are read, due to a signed
int container.

num_sectors in the sun_disklabel struct is marked as __u32 in 2.4, and
as __be32 in 2.6. However, this is assigned to a signed int in
sun_partition():

int num_sectors;

st_sector = be32_to_cpu(p->start_cylinder) * spc;
num_sectors = be32_to_cpu(p->num_sectors);

Changing num_sectors to an unsigned int avoids this problem.

Thanks,

-Eric

Signed-off-by: Eric Sandeen <[email protected]>

Index: linux-2.6.17/fs/partitions/sun.c
===================================================================
--- linux-2.6.17.orig/fs/partitions/sun.c
+++ linux-2.6.17/fs/partitions/sun.c
@@ -74,7 +74,7 @@ int sun_partition(struct parsed_partitio
spc = be16_to_cpu(label->ntrks) * be16_to_cpu(label->nsect);
for (i = 0; i < 8; i++, p++) {
unsigned long st_sector;
- int num_sectors;
+ unsigned int num_sectors;

st_sector = be32_to_cpu(p->start_cylinder) * spc;
num_sectors = be32_to_cpu(p->num_sectors);

2006-08-04 16:37:13

by Alan

Subject: Re: [PATCH] fix sun partition overflow over 1T

Ar Gwe, 2006-08-04 am 11:22 -0500, ysgrifennodd Eric Sandeen:
> Although sun partition labels aren't supposed to support > 1T, apparently
> linux partition editors will allow up to 2T. This can cause problems
> in the kernel when these larger partitions are read, due to a signed
> int container.
>
> num_sectors in the sun_disklabel struct is marked as __u32 in 2.4, and
> as __be32 in 2.6. However, this is assigned to a signed int in
> sun_partition():
>
> int num_sectors;
>
> st_sector = be32_to_cpu(p->start_cylinder) * spc;
> num_sectors = be32_to_cpu(p->num_sectors);
>
> Changing num_sectors to an unsigned int avoids this problem.
>

> Signed-off-by: Eric Sandeen <[email protected]>

Acked-by: Alan Cox <[email protected]>

2006-08-04 23:35:43

by David Miller

Subject: Re: [PATCH] fix sun partition overflow over 1T

From: Alan Cox <[email protected]>
Date: Fri, 04 Aug 2006 17:56:30 +0100

> Ar Gwe, 2006-08-04 am 11:22 -0500, ysgrifennodd Eric Sandeen:
> > Although sun partition labels aren't supposed to support > 1T, apparently
> > linux partition editors will allow up to 2T. This can cause problems
> > in the kernel when these larger partitions are read, due to a signed
> > int container.
> >
> > num_sectors in the sun_disklabel struct is marked as __u32 in 2.4, and
> > as __be32 in 2.6. However, this is assigned to a signed int in
> > sun_partition():
> >
> > int num_sectors;
> >
> > st_sector = be32_to_cpu(p->start_cylinder) * spc;
> > num_sectors = be32_to_cpu(p->num_sectors);
> >
> > Changing num_sectors to an unsigned int avoids this problem.
> >
>
> > Signed-off-by: Eric Sandeen <[email protected]>
>
> Acked-by: Alan Cox <[email protected]>

Applied, thanks a lot.