2021-06-22 16:11:19

by Shreyansh Chouhan

Subject: [PATCH] loop: fix setting arbitrarily large block size

loop_validate_block_size took an unsigned short argument. Passing an
argument with size greater than the size of unsigned short would cause
an overflow and could potentially render the upper bound check on the
block size useless, allowing to set an arbitrarily large block size.

Reproted-by: [email protected]
Signed-off-by: Shreyansh Chouhan <[email protected]>
---
drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 9a758cf66507..635baff0dd66 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
* @bsize: size to validate
*/
static int
-loop_validate_block_size(unsigned short bsize)
+loop_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.31.1

2021-06-23 05:12:10

by Shreyansh Chouhan

Subject: [RESEND PATCH] loop: fix setting arbitrarily large block size

REASON FOR RESEND: Fixed spelling of the Reported-by tag.

loop_validate_block_size took an unsigned short argument. Passing an
argument with size greater than the size of unsigned short would cause
an overflow and could potentially render the upper bound check on the
block size useless, allowing to set an arbitrarily large block size.

Reported-by: [email protected]
Signed-off-by: Shreyansh Chouhan <[email protected]>
---
drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 9a758cf66507..635baff0dd66 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
* @bsize: size to validate
*/
static int
-loop_validate_block_size(unsigned short bsize)
+loop_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.31.1

2021-06-24 06:16:54

by Christoph Hellwig

Subject: Re: [RESEND PATCH] loop: fix setting arbitrarily large block size

On Wed, Jun 23, 2021 at 10:39:33AM +0530, Shreyansh Chouhan wrote:
> REASON FOR RESEND: Fixed spelling of the Reported-by tag.

That goes under a "---" deliminator.

Except for that:

Reviewed-by: Christoph Hellwig <[email protected]>

2021-06-26 08:25:29

by Shreyansh Chouhan

Subject: [PATCH v2] loop: fix setting arbitrarily large block size

loop_validate_block_size took an unsigned short argument. Passing an
argument with size greater than the size of unsigned short would cause
an overflow and could potentially render the upper bound check on the
block size useless, allowing to set an arbitrarily large block size.

Reported-by: [email protected]
Signed-off-by: Shreyansh Chouhan <[email protected]>
---

Changes from v1: Fixed the spelling of reported-by tag. Fixed the
commit message.

drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 9a758cf66507..635baff0dd66 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
* @bsize: size to validate
*/
static int
-loop_validate_block_size(unsigned short bsize)
+loop_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.31.1

2021-06-28 05:36:55

by Christoph Hellwig

Subject: Re: [PATCH v2] loop: fix setting arbitrarily large block size

Looks good,

Reviewed-by: Christoph Hellwig <[email protected]>

2021-07-14 20:40:22

by Shreyansh Chouhan

Subject: Re: [PATCH v2] loop: fix setting arbitrarily large block size

Hi,

Just a ping so that this patch doesn't get lost.

Regards,
Shreyansh Chouhan.

2021-07-20 07:26:59

by Shreyansh Chouhan

Subject: Re: [PATCH v2] loop: fix setting arbitrarily large block size

Hi,

Pinging for review since there has been no activity on this
patch for some time.

Thank you,
Shreyansh Chouhan

On Sat, Jun 26, 2021 at 01:54:06PM +0530, Shreyansh Chouhan wrote:
>
> loop_validate_block_size took an unsigned short argument. Passing an
> argument with size greater than the size of unsigned short would cause
> an overflow and could potentially render the upper bound check on the
> block size useless, allowing to set an arbitrarily large block size.
>
> Reported-by: [email protected]
> Signed-off-by: Shreyansh Chouhan <[email protected]>
> ---
>
> Changes from v1: Fixed the spelling of reported-by tag. Fixed the
> commit message.
>
> drivers/block/loop.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/block/loop.c b/drivers/block/loop.c
> index 9a758cf66507..635baff0dd66 100644
> --- a/drivers/block/loop.c
> +++ b/drivers/block/loop.c
> @@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
> * @bsize: size to validate
> */
> static int
> -loop_validate_block_size(unsigned short bsize)
> +loop_validate_block_size(unsigned long bsize)
> {
> if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
> return -EINVAL;
> --
> 2.31.1
>