linux-kernel - Re: [PATCH] sd: close hole in > 2T device rejection when !CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Feb 2017 07:53:26 -0600
From:   Steve Magnani <steve.magnani@...idescorp.com>
To:     Bart Van Assche <Bart.VanAssche@...disk.com>,
        "jejb@...ux.vnet.ibm.com" <jejb@...ux.vnet.ibm.com>,
        "martin.petersen@...cle.com" <martin.petersen@...cle.com>
Cc:     "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "steve@...idescorp.com" <steve@...idescorp.com>
Subject: Re: [PATCH] sd: close hole in > 2T device rejection when
 !CONFIG_LBDAF


On 02/27/2017 12:57 PM, Bart Van Assche wrote:
> ...
> How about the (untested) patch below? The approach below avoids that the check is
> duplicated and - at least in my opinion - results in code that is easier to read.
I find lba_too_large() a little dense, but functionally OK. The "shift 
 >= 0" clause could be dropped.
I tested this on my "problem" system (READ CAPACITY(10)) without incident.
>
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index cb6e68dd6df0..3533d1e46bde 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -2082,6 +2082,16 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp,
>   	sdkp->capacity = 0; /* unknown mapped to zero - as usual */
>   }
>   
> +/*
> + * Check whether or not logical_to_sectors(sdp, lba) will overflow.
> + */
> +static bool lba_too_large(u64 lba, u32 logical_block_size)
> +{
> +	int shift = sizeof(sector_t) * 8 + 9 - ilog2(logical_block_size);
> +
> +	return shift >= 0 && shift < 64 && lba >= (1ULL << shift);
> +}
> +
>   #define RC16_LEN 32
>   #if RC16_LEN > SD_BUF_SIZE
>   #error RC16_LEN must not be more than SD_BUF_SIZE
> @@ -2154,7 +2164,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
>   		return -ENODEV;
>   	}
>   
> -	if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
> +	if (lba_too_large(lba + 1, sector_size)) {
>   		sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
>   			"kernel compiled with support for large block "
>   			"devices.\n");
> @@ -2243,7 +2253,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
>   		return sector_size;
>   	}
>   
> -	if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
> +	if (lba_too_large(lba + 1ULL, sector_size)) {
>   		sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
>   			"kernel compiled with support for large block "
>   			"devices.\n");