linux-kernel - [PATCH] brd: fix integer overflow in brd_check_and_reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <99e9da32-9372-ada2-8197-26602fe242c8@huawei.com>
Date:   Thu, 25 Mar 2021 19:45:02 +0800
From:   lixiaokeng <lixiaokeng@...wei.com>
To:     <axboe@...nel.dk>, <linux-block@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
CC:     linfeilong <linfeilong@...wei.com>,
        "liuzhiqiang (I)" <liuzhiqiang26@...wei.com>
Subject: [PATCH] brd: fix integer overflow in brd_check_and_reset_par

The max_part may overflow. For example,

modprobe brd rd_nr=3 rd_size=102400 max_part=1073741824(2^30)

Expected result
NAME             MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
ram0               1:0    0   100M  0 disk
ram1               1:256  0   100M  0 disk
ram2               1:512  0   100M  0 disk

Actual result
NAME             MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
ram0             259:0    0   100M  0 disk
ram1             259:1    0   100M  0 disk
ram2             259:2    0   100M  0 disk

Fix it.

Signed-off-by: Lixiaokeng <lixiaokeng@...wei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@...wei.com>
---
 drivers/block/brd.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index c43a6ab4b1f3..c91831cd5d2a 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -457,21 +457,19 @@ static void brd_del_one(struct brd_device *brd)

 static inline void brd_check_and_reset_par(void)
 {
-	if (unlikely(!max_part))
+	if (unlikely(max_part <= 0))
 		max_part = 1;

 	/*
 	 * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
 	 * otherwise, it is possiable to get same dev_t when adding partitions.
 	 */
-	if ((1U << MINORBITS) % max_part != 0)
-		max_part = 1UL << fls(max_part);
-
 	if (max_part > DISK_MAX_PARTS) {
 		pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
 			DISK_MAX_PARTS, DISK_MAX_PARTS);
 		max_part = DISK_MAX_PARTS;
-	}
+	} else if ((1U << MINORBITS) % max_part != 0)
+		max_part = 1UL << fls(max_part);
 }

 static int __init brd_init(void)
--