2014-12-09 19:30:25

by Dmitry Monakhov

Subject: [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range

bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
populated filesystems

TESTCASE: xfstest ext4/004

Signed-off-by: Dmitry Monakhov <[email protected]>
---
lib/ext2fs/blkmap64_rb.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/ext2fs/blkmap64_rb.c b/lib/ext2fs/blkmap64_rb.c
index 8d1778d..e290ade 100644
--- a/lib/ext2fs/blkmap64_rb.c
+++ b/lib/ext2fs/blkmap64_rb.c
@@ -733,7 +733,7 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
struct rb_node *parent = NULL, *next, **n;
struct ext2fs_rb_private *bp;
struct bmap_rb_extent *ext;
- int count;
+ __u64 count;
__u64 pos;

bp = (struct ext2fs_rb_private *) bitmap->private;
@@ -765,9 +765,9 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
if (pos >= start + num)
break;
if (pos < start) {
- count -= start - pos;
- if (count < 0)
+ if (pos + count < start)
continue;
+ count -= start - pos;
pos = start;
}
if (pos + count > start + num)
--
1.8.3.1

2014-12-09 19:48:44

by Dmitry Monakhov

Subject: Re: [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range

Dmitry Monakhov <[email protected]> writes:

This is the patch for the issue which I complain you about prev
Friday. It takes longer than I expect, but now all my resize tests
succeeded. In fact issue may be triggered in real life situation
if someone use ballooning technique (consume space via fallocate)
> bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
> populated filesystems
>
> TESTCASE: xfstest ext4/004
>
> Signed-off-by: Dmitry Monakhov <[email protected]>
> ---
> lib/ext2fs/blkmap64_rb.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lib/ext2fs/blkmap64_rb.c b/lib/ext2fs/blkmap64_rb.c
> index 8d1778d..e290ade 100644
> --- a/lib/ext2fs/blkmap64_rb.c
> +++ b/lib/ext2fs/blkmap64_rb.c
> @@ -733,7 +733,7 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
> struct rb_node *parent = NULL, *next, **n;
> struct ext2fs_rb_private *bp;
> struct bmap_rb_extent *ext;
> - int count;
> + __u64 count;
> __u64 pos;
>
> bp = (struct ext2fs_rb_private *) bitmap->private;
> @@ -765,9 +765,9 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
> if (pos >= start + num)
> break;
> if (pos < start) {
> - count -= start - pos;
> - if (count < 0)
> + if (pos + count < start)
> continue;
> + count -= start - pos;
> pos = start;
> }
> if (pos + count > start + num)
> --
> 1.8.3.1

2014-12-11 22:58:30

by Theodore Ts'o

Subject: Re: [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range

On Tue, Dec 09, 2014 at 11:30:16PM +0400, Dmitry Monakhov wrote:
> bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
> populated filesystems
>
> TESTCASE: xfstest ext4/004
>
> Signed-off-by: Dmitry Monakhov <[email protected]>

Applied, thanks.

- Ted