2022-04-10 10:00:20

by Khazhismel Kumykov

Subject: [PATCH] block/compat_ioctl: fix range check in BLKGETSIZE

kernel ulong and compat_ulong_t may not be same width. Use type directly
to eliminate mismatches.

This would result in truncation rather than EFBIG for 32bit mode for
large disks.

Signed-off-by: Khazhismel Kumykov <[email protected]>
---
block/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Noticed this one was sitting in my "not landed yet" pile, third time's
the charm? :)

diff --git a/block/ioctl.c b/block/ioctl.c
index 4a86340133e4..959e93a90b29 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -629,7 +629,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
return compat_put_long(argp,
(bdev->bd_disk->bdi->ra_pages * PAGE_SIZE) / 512);
case BLKGETSIZE:
- if (bdev_nr_sectors(bdev) > ~0UL)
+ if (bdev_nr_sectors(bdev) > ~((compat_ulong_t)0UL))
return -EFBIG;
return compat_put_ulong(argp, bdev_nr_sectors(bdev));

--
2.35.1.1178.g4f1659d476-goog

2022-04-11 13:26:55

by Bart Van Assche

Subject: Re: [PATCH] block/compat_ioctl: fix range check in BLKGETSIZE

On 4/8/22 16:47, Khazhismel Kumykov wrote:
> kernel ulong and compat_ulong_t may not be same width. Use type directly
> to eliminate mismatches.
>
> This would result in truncation rather than EFBIG for 32bit mode for
> large disks.
>
> Signed-off-by: Khazhismel Kumykov <[email protected]>
> ---
> block/ioctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Noticed this one was sitting in my "not landed yet" pile, third time's
> the charm? :)
>
> diff --git a/block/ioctl.c b/block/ioctl.c
> index 4a86340133e4..959e93a90b29 100644
> --- a/block/ioctl.c
> +++ b/block/ioctl.c
> @@ -629,7 +629,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
> return compat_put_long(argp,
> (bdev->bd_disk->bdi->ra_pages * PAGE_SIZE) / 512);
> case BLKGETSIZE:
> - if (bdev_nr_sectors(bdev) > ~0UL)
> + if (bdev_nr_sectors(bdev) > ~((compat_ulong_t)0UL))
> return -EFBIG;
> return compat_put_ulong(argp, bdev_nr_sectors(bdev));

A nit: the "UL" and two parentheses can be left out. Anyway:

Reviewed-by: Bart Van Assche <[email protected]>

2022-04-16 02:24:02

by Khazhismel Kumykov

Subject: [PATCH v2] block/compat_ioctl: fix range check in BLKGETSIZE

kernel ulong and compat_ulong_t may not be same width. Use type directly
to eliminate mismatches.

This would result in truncation rather than EFBIG for 32bit mode for
large disks.

Reviewed-by: Bart Van Assche <[email protected]>
Signed-off-by: Khazhismel Kumykov <[email protected]>
---
block/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

v2: addressed bart's comment

diff --git a/block/ioctl.c b/block/ioctl.c
index 4a86340133e4..f8703db99c73 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -629,7 +629,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
return compat_put_long(argp,
(bdev->bd_disk->bdi->ra_pages * PAGE_SIZE) / 512);
case BLKGETSIZE:
- if (bdev_nr_sectors(bdev) > ~0UL)
+ if (bdev_nr_sectors(bdev) > ~(compat_ulong_t)0)
return -EFBIG;
return compat_put_ulong(argp, bdev_nr_sectors(bdev));

--
2.36.0.rc0.470.gd361397f0d-goog