2021-03-25 11:48:06

by lixiaokeng

Subject: [PATCH] brd: fix integer overflow in brd_check_and_reset_par

The max_part may overflow. For example,

modprobe brd rd_nr=3 rd_size=102400 max_part=1073741824(2^30)

Expected result
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
ram0 1:0 0 100M 0 disk
ram1 1:256 0 100M 0 disk
ram2 1:512 0 100M 0 disk

Actual result
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
ram0 259:0 0 100M 0 disk
ram1 259:1 0 100M 0 disk
ram2 259:2 0 100M 0 disk

Fix it.

Signed-off-by: Lixiaokeng <[email protected]>
Signed-off-by: Zhiqiang Liu <[email protected]>
---
drivers/block/brd.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index c43a6ab4b1f3..c91831cd5d2a 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -457,21 +457,19 @@ static void brd_del_one(struct brd_device *brd)

static inline void brd_check_and_reset_par(void)
{
- if (unlikely(!max_part))
+ if (unlikely(max_part <= 0))
max_part = 1;

/*
* make sure 'max_part' can be divided exactly by (1U << MINORBITS),
* otherwise, it is possiable to get same dev_t when adding partitions.
*/
- if ((1U << MINORBITS) % max_part != 0)
- max_part = 1UL << fls(max_part);
-
if (max_part > DISK_MAX_PARTS) {
pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
DISK_MAX_PARTS, DISK_MAX_PARTS);
max_part = DISK_MAX_PARTS;
- }
+ } else if ((1U << MINORBITS) % max_part != 0)
+ max_part = 1UL << fls(max_part);
}

static int __init brd_init(void)
--

2021-04-01 09:08:32

by Zhiqiang Liu

Subject: Re: [PATCH] brd: fix integer overflow in brd_check_and_reset_par

friendly ping.

On 2021/3/25 19:45, lixiaokeng wrote:
> The max_part may overflow. For example,
>
> modprobe brd rd_nr=3 rd_size=102400 max_part=1073741824(2^30)
>
> Expected result
> NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
> ram0 1:0 0 100M 0 disk
> ram1 1:256 0 100M 0 disk
> ram2 1:512 0 100M 0 disk
>
> Actual result
> NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
> ram0 259:0 0 100M 0 disk
> ram1 259:1 0 100M 0 disk
> ram2 259:2 0 100M 0 disk
>
> Fix it.
>
> Signed-off-by: Lixiaokeng <[email protected]>
> Signed-off-by: Zhiqiang Liu <[email protected]>
> ---
> drivers/block/brd.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/block/brd.c b/drivers/block/brd.c
> index c43a6ab4b1f3..c91831cd5d2a 100644
> --- a/drivers/block/brd.c
> +++ b/drivers/block/brd.c
> @@ -457,21 +457,19 @@ static void brd_del_one(struct brd_device *brd)
>
> static inline void brd_check_and_reset_par(void)
> {
> - if (unlikely(!max_part))
> + if (unlikely(max_part <= 0))
> max_part = 1;
>
> /*
> * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
> * otherwise, it is possiable to get same dev_t when adding partitions.
> */
> - if ((1U << MINORBITS) % max_part != 0)
> - max_part = 1UL << fls(max_part);
> -
> if (max_part > DISK_MAX_PARTS) {
> pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
> DISK_MAX_PARTS, DISK_MAX_PARTS);
> max_part = DISK_MAX_PARTS;
> - }
> + } else if ((1U << MINORBITS) % max_part != 0)
> + max_part = 1UL << fls(max_part);
> }
>
> static int __init brd_init(void)