Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] brd: fix integer overflow in brd_check_and_reset_par
To:     lixiaokeng <lixiaokeng@huawei.com>, <axboe@kernel.dk>,
        <linux-block@vger.kernel.org>, <linux-kernel@vger.kernel.org>
CC:     linfeilong <linfeilong@huawei.com>
References: <99e9da32-9372-ada2-8197-26602fe242c8@huawei.com>
From:   Zhiqiang Liu <liuzhiqiang26@huawei.com>
Message-ID: <ce64c4a2-e90a-97f9-6334-74912dbcb958@huawei.com>
Date:   Thu, 1 Apr 2021 17:06:52 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.2.2
MIME-Version: 1.0
In-Reply-To: <99e9da32-9372-ada2-8197-26602fe242c8@huawei.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Precedence: bulk

friendly ping.

On 2021/3/25 19:45, lixiaokeng wrote:
> The max_part may overflow. For example,
>
> modprobe brd rd_nr=3 rd_size=102400 max_part=1073741824(2^30)
>
> Expected result
> NAME             MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
> ram0               1:0    0   100M  0 disk
> ram1               1:256  0   100M  0 disk
> ram2               1:512  0   100M  0 disk
>
> Actual result
> NAME             MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
> ram0             259:0    0   100M  0 disk
> ram1             259:1    0   100M  0 disk
> ram2             259:2    0   100M  0 disk
>
> Fix it.
>
> Signed-off-by: Lixiaokeng <lixiaokeng@huawei.com>
> Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
> ---
>  drivers/block/brd.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/block/brd.c b/drivers/block/brd.c
> index c43a6ab4b1f3..c91831cd5d2a 100644
> --- a/drivers/block/brd.c
> +++ b/drivers/block/brd.c
> @@ -457,21 +457,19 @@ static void brd_del_one(struct brd_device *brd)
>
>  static inline void brd_check_and_reset_par(void)
>  {
> -	if (unlikely(!max_part))
> +	if (unlikely(max_part <= 0))
>  		max_part = 1;
>
>  	/*
>  	 * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
>  	 * otherwise, it is possiable to get same dev_t when adding partitions.
>  	 */
> -	if ((1U << MINORBITS) % max_part != 0)
> -		max_part = 1UL << fls(max_part);
> -
>  	if (max_part > DISK_MAX_PARTS) {
>  		pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
>  			DISK_MAX_PARTS, DISK_MAX_PARTS);
>  		max_part = DISK_MAX_PARTS;
> -	}
> +	} else if ((1U << MINORBITS) % max_part != 0)
> +		max_part = 1UL << fls(max_part);
>  }
>
>  static int __init brd_init(void)