Received-SPF: pass (google.com: domain of linux-kernel+bounces-210138-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Tue, 11 Jun 2024 09:15:32 -0600
From: Keith Busch <kbusch@kernel.org>
To: Roman Smirnov <r.smirnov@omp.ru>
Cc: "axboe@kernel.dk" <axboe@kernel.dk>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
	Karina Yankevich <k.yankevich@omp.ru>,
	"lvc-patches@linuxtesting.org" <lvc-patches@linuxtesting.org>,
	Sergey Shtylyov <s.shtylyov@omp.ru>
Subject: Re: [bug report] block: integer overflow in __bvec_gap_to_prev()
Message-ID: <ZmhqFLdCW6aXriqP@kbusch-mbp.dhcp.thefacebook.com>
References: <9d8ac82ab63a64583f753878dd03e3503c68ffbe.camel@omp.ru>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <9d8ac82ab63a64583f753878dd03e3503c68ffbe.camel@omp.ru>

On Tue, Jun 11, 2024 at 02:23:48PM +0000, Roman Smirnov wrote:
> Hello.
> 
> There is a case of integer overflow in __bvec_gap_to_prev():
> 
> 	((bprv->bv_offset + bprv->bv_len) & lim->virt_boundary_mask);
> 
> bio_vec can cross multiple pages:
> 
> https://lore.kernel.org/lkml/20190215111324.30129-1-ming.lei@redhat.com/t/
> 
> So, in case bio has one bio_vec bv_len can have a maximum value of UINT_MAX.
> The check happens in bio_full(). In the case when bv_len is equal to
> UINT_MAX and bv_offset is greater than zero, an overflow may occur.

Does it matter? The lower bits checked against the mask should be the
same regardless of overflow.