linux-kernel - Re: btrfs zero divide

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdV-nBbhKbVSAAwh5M45-7kz4RJRqfHrCfudRA5dE2CKoA@mail.gmail.com>
Date:	Wed, 14 Aug 2013 10:56:40 +0200
From:	Geert Uytterhoeven <geert@...ux-m68k.org>
To:	Zach Brown <zab@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Andreas Schwab <schwab@...ux-m68k.org>,
	Josef Bacik <jbacik@...ionio.com>,
	Thorsten Glaser <tg@...bsd.de>, Joe Perches <joe@...ches.com>,
	"Debian GNU/Linux m68k" <debian-68k@...ts.debian.org>,
	linux-btrfs@...r.kernel.org,
	Linux Kernel Development <linux-kernel@...r.kernel.org>,
	David Woodhouse <David.Woodhouse@...el.com>,
	Chris Mason <chris.mason@...ionio.com>,
	scsi <linux-scsi@...r.kernel.org>
Subject: Re: btrfs zero divide

On Wed, Aug 14, 2013 at 10:40 AM, Geert Uytterhoeven
<geert@...ux-m68k.org> wrote:
> On Tue, Aug 13, 2013 at 6:32 PM, Geert Uytterhoeven
> <geert@...ux-m68k.org> wrote:
>> On Fri, 9 Aug 2013, Zach Brown wrote:
>>> On Fri, Aug 09, 2013 at 02:26:36PM +0200, Andreas Schwab wrote:
>>> > Josef Bacik <jbacik@...ionio.com> writes:
>>> >
>>> > > So stripe_len shouldn't be 0, if it is you have bigger problems :).
>>> >
>>> > The bigger problem is that stripe_nr is u64, this is completely bogus.
>>> > The first operand of do_div must be u32.  This goes through the whole
>>> > file.
>>
>> This was introduced by commit 53b381b3abeb86f12787a6c40fee9b2f71edc23b
>> ("Btrfs: RAID5 and RAID6"), which changed the divisor from
>> map->stripe_len (struct map_lookup.stripe_len is int) to a 64-bit
>> temporary.
>>
>>> Definitely.  Can we get some typeof() tricks in the macros to have the
>>> build fail if (when, evidently) someone gets it wrong?
>>
>> Not using typeof, as there are way too many callsites where int is used
>> instead of u32.
>>
>> However, checking that sizeof() equals to 4 seems to work.
>> Below is a patch for asm-generic, which is untested, but it works when
>> adding the same checks to arch/m68k/include/asm/div64.h
>>
>> This is not something we just want to drop in, as it has the potential of
>> breaking lots of things (yes, it breaks btrfs :-)
>
> Found so far:
>   - Several calls to sector_div() in blkdev_issue_discard()
>   - Two calls to do_div() in sd_completed_bytes()
>
> Some of these even operate on dividends that never exceed 32-bit, tss...

Two more:
 drivers/md/dm-cache-target.c:too_many_discard_blocks
 fs/jfs/jfs_dmap.c:dbDiscardAG

These bring in the 64-bit divisor from somewhere else, so they're less
trivial to fix.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/