linux-kernel - RE: [PATCH][next] fs/ntfs3: Fix integer overflow in multiplication

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ef78885ed7b3462a91ca0081588e3917@paragon-software.com>
Date:   Fri, 27 Aug 2021 16:11:25 +0000
From:   Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
To:     Colin King <colin.king@...onical.com>,
        "ntfs3@...ts.linux.dev" <ntfs3@...ts.linux.dev>
CC:     "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH][next] fs/ntfs3: Fix integer overflow in multiplication

> From: Colin King <colin.king@...onical.com>
> Sent: Monday, August 16, 2021 7:30 PM
> To: Konstantin Komarov <almaz.alexandrovich@...agon-software.com>; ntfs3@...ts.linux.dev
> Cc: kernel-janitors@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: [PATCH][next] fs/ntfs3: Fix integer overflow in multiplication
> 
> From: Colin Ian King <colin.king@...onical.com>
> 
> The multiplication of the u32 data_size with a int is being performed
> using 32 bit arithmetic however the results is being assigned to the
> variable nbits that is a size_t (64 bit) value. Fix a potential
> integer overflow by casting the u32 value to a size_t before the
> multiply to use a size_t sized bit multiply operation.
> 
> Addresses-Coverity: ("Unintentional integer overflow")
> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  fs/ntfs3/index.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
> index 6aa9540ece47..9386c551e208 100644
> --- a/fs/ntfs3/index.c
> +++ b/fs/ntfs3/index.c
> @@ -2012,7 +2012,7 @@ static int indx_shrink(struct ntfs_index *indx, struct ntfs_inode *ni,
>  		unsigned long pos;
>  		const unsigned long *bm = resident_data(b);
> 
> -		nbits = le32_to_cpu(b->res.data_size) * 8;
> +		nbits = (size_t)le32_to_cpu(b->res.data_size) * 8;
> 
>  		if (bit >= nbits)
>  			return 0;
> --
> 2.32.0

Hi again, Colin! Applied, thanks.

Best regards,
Konstantin