netdev - Re: [PATCH] libceph: use 64-bit arithmetic instead of 32-bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 31 Jan 2018 06:02:53 -0600
From:   "Gustavo A. R. Silva" <garsilva@...eddedor.com>
To:     Ilya Dryomov <idryomov@...il.com>
Cc:     "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        "Yan, Zheng" <zyan@...hat.com>, Sage Weil <sage@...hat.com>,
        "David S. Miller" <davem@...emloft.net>,
        Ceph Development <ceph-devel@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] libceph: use 64-bit arithmetic instead of 32-bit

Hello Ilya,

Quoting Ilya Dryomov <idryomov@...il.com>:

> On Wed, Jan 31, 2018 at 6:29 AM, Gustavo A. R. Silva
> <gustavo@...eddedor.com> wrote:
>> Cast objsetno to u64 in order to give the compiler complete
>> information about the proper arithmetic to use. Notice
>> that this variable is used in a context that expects an
>> expression of type u64 (64 bits, unsigned).
>>
>> The expression objsetno * sc + stripepos is currently
>> being evaluated using 32-bit arithmetic.
>>
>> In general, the use of incorrect arithmetic has security
>> implications.
>>
>> Addresses-Coverity-ID: 200686
>> Signed-off-by: Gustavo A. R. Silva <gustavo@...eddedor.com>
>> ---
>>  net/ceph/osdmap.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
>> index 0da27c6..58dc965 100644
>> --- a/net/ceph/osdmap.c
>> +++ b/net/ceph/osdmap.c
>> @@ -2183,7 +2183,7 @@ int ceph_calc_file_object_mapping(struct  
>> ceph_file_layout *layout,
>>         stripepos = bl % sc;
>>         objsetno = stripeno / su_per_object;
>>
>> -       *ono = objsetno * sc + stripepos;
>> +       *ono = (u64)objsetno * sc + stripepos;
>>         dout("objset %u * sc %u = ono %u\n", objsetno, sc,  
>> (unsigned int)*ono);
>>
>>         /* *oxoff = *off % layout->fl_stripe_unit;  # offset in su */
>
> Hi Gustavo,
>
> This (and other u32/u64 issues in this function, is this the only
> warning?) is fixed in my striping v2 work branch.  I wasn't going to
> push that patch separately, but I guess I should post it.
>

Yeah, this was the only one warning reported by Coverity in this  
particular module.

Thanks
--
Gustavo