Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <da58534e-aa43-b163-4c05-190e1e20c0ab@huawei.com>
Date:   Sat, 16 Apr 2022 14:09:09 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.4.1
Subject: Re: [PATCH -next v2] nbd: fix possible overflow on 'first_minor' in
 nbd_dev_add()
From:   "zhangwensheng (E)" <zhangwensheng5@huawei.com>
To:     <josef@toxicpanda.com>, <axboe@kernel.dk>
CC:     <linux-block@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <nbd@other.debian.org>
References: <20220407032505.3797948-1-zhangwensheng5@huawei.com>
In-Reply-To: <20220407032505.3797948-1-zhangwensheng5@huawei.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

friendly ping...

在 2022/4/7 11:25, Zhang Wensheng 写道:
> When 'index' is a big numbers, it may become negative which forced
> to 'int'. then 'index << part_shift' might overflow to a positive
> value that is not greater than '0xfffff', then sysfs might complains
> about duplicate creation. Because of this, move the 'index' judgment
> to the front will fix it and be better.
>
> Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
> Fixes: 940c264984fd ("nbd: fix possible overflow for 'first_minor' in nbd_dev_add()")
> Signed-off-by: Zhang Wensheng <zhangwensheng5@huawei.com>
> ---
> v1->v2:
> - add the line "disk->first_minor = index << part_shift;" which has
> been deleted by mistake in v1.
>
>   drivers/block/nbd.c | 23 ++++++++++++-----------
>   1 file changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 5a1f98494ddd..9448aacbcf0f 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -1800,17 +1800,7 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)
>   	refcount_set(&nbd->refs, 0);
>   	INIT_LIST_HEAD(&nbd->list);
>   	disk->major = NBD_MAJOR;
> -
> -	/* Too big first_minor can cause duplicate creation of
> -	 * sysfs files/links, since index << part_shift might overflow, or
> -	 * MKDEV() expect that the max bits of first_minor is 20.
> -	 */
>   	disk->first_minor = index << part_shift;
> -	if (disk->first_minor < index || disk->first_minor > MINORMASK) {
> -		err = -EINVAL;
> -		goto out_free_work;
> -	}
> -
>   	disk->minors = 1 << part_shift;
>   	disk->fops = &nbd_fops;
>   	disk->private_data = nbd;
> @@ -1915,8 +1905,19 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
>   	if (!netlink_capable(skb, CAP_SYS_ADMIN))
>   		return -EPERM;
>   
> -	if (info->attrs[NBD_ATTR_INDEX])
> +	if (info->attrs[NBD_ATTR_INDEX]) {
>   		index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
> +
> +		/*
> +		 * Too big first_minor can cause duplicate creation of
> +		 * sysfs files/links, since index << part_shift might overflow, or
> +		 * MKDEV() expect that the max bits of first_minor is 20.
> +		 */
> +		if (index < 0 || index > MINORMASK >> part_shift) {
> +			printk(KERN_ERR "nbd: illegal input index %d\n", index);
> +			return -EINVAL;
> +		}
> +	}
>   	if (!info->attrs[NBD_ATTR_SOCKETS]) {
>   		printk(KERN_ERR "nbd: must specify at least one socket\n");
>   		return -EINVAL;