linux-kernel - Re: [PATCH 7/7] btrfs: Promote to unsigned long long before multiplying

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201026162139.GO6756@twin.jikos.cz>
Date:   Mon, 26 Oct 2020 17:21:39 +0100
From:   David Sterba <dsterba@...e.cz>
To:     "Matthew Wilcox (Oracle)" <willy@...radead.org>
Cc:     linux-fsdevel@...r.kernel.org, ericvh@...il.com, lucho@...kov.net,
        viro@...iv.linux.org.uk, jlayton@...nel.org, idryomov@...il.com,
        mark@...heh.com, jlbec@...lplan.org, joseph.qi@...ux.alibaba.com,
        v9fs-developer@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
        ceph-devel@...r.kernel.org, ocfs2-devel@....oracle.com,
        linux-btrfs@...r.kernel.org, clm@...com, josef@...icpanda.com,
        dsterba@...e.com, stable@...r.kernel.org
Subject: Re: [PATCH 7/7] btrfs: Promote to unsigned long long before
 multiplying

On Sun, Oct 04, 2020 at 07:04:28PM +0100, Matthew Wilcox (Oracle) wrote:
> On 32-bit systems, these shifts will overflow for files larger than 4GB.
> Add helper functions to avoid this problem coming back.
> 
> Cc: stable@...r.kernel.org
> Fixes: 73ff61dbe5ed ("Btrfs: fix device replace of a missing RAID 5/6 device")
> Fixes: be50a8ddaae1 ("Btrfs: Simplify scrub_setup_recheck_block()'s argument")
> Fixes: ff023aac3119 ("Btrfs: add code to scrub to copy read data to another disk")
> Fixes: b5d67f64f9bc ("Btrfs: change scrub to support big blocks")
> Fixes: a2de733c78fa ("btrfs: scrub")
> Signed-off-by: Matthew Wilcox (Oracle) <willy@...radead.org>
> ---
>  fs/btrfs/scrub.c | 25 ++++++++++++++++---------
>  1 file changed, 16 insertions(+), 9 deletions(-)
> 
> diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
> index 354ab9985a34..ccbaf9c6e87a 100644
> --- a/fs/btrfs/scrub.c
> +++ b/fs/btrfs/scrub.c
> @@ -1262,12 +1262,17 @@ static inline void scrub_stripe_index_and_offset(u64 logical, u64 map_type,
>  	}
>  }
>  
> +static u64 sblock_length(struct scrub_block *sblock)
> +{
> +	return (u64)sblock->page_count * PAGE_SIZE;

page_count will be 32 at most, the type is int and this will never
overflow. The value is usualy number of pages in the arrays scrub_bio::pagev or
scrub_block::pagev bounded by SCRUB_PAGES_PER_WR_BIO (32) or
SCRUB_MAX_PAGES_PER_BLOCK (16).  The scrub code does not use mappings
and it reads raw blocks to own pages and does the checksum verification.