linux-kernel - Re: [PATCH -next v2] nbd: fix possible overflow on 'first_minor' in nbd_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <da58534e-aa43-b163-4c05-190e1e20c0ab@huawei.com>
Date:   Sat, 16 Apr 2022 14:09:09 +0800
From:   "zhangwensheng (E)" <zhangwensheng5@...wei.com>
To:     <josef@...icpanda.com>, <axboe@...nel.dk>
CC:     <linux-block@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <nbd@...er.debian.org>
Subject: Re: [PATCH -next v2] nbd: fix possible overflow on 'first_minor' in
 nbd_dev_add()

friendly ping...

在 2022/4/7 11:25, Zhang Wensheng 写道:
> When 'index' is a big numbers, it may become negative which forced
> to 'int'. then 'index << part_shift' might overflow to a positive
> value that is not greater than '0xfffff', then sysfs might complains
> about duplicate creation. Because of this, move the 'index' judgment
> to the front will fix it and be better.
>
> Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
> Fixes: 940c264984fd ("nbd: fix possible overflow for 'first_minor' in nbd_dev_add()")
> Signed-off-by: Zhang Wensheng <zhangwensheng5@...wei.com>
> ---
> v1->v2:
> - add the line "disk->first_minor = index << part_shift;" which has
> been deleted by mistake in v1.
>
>   drivers/block/nbd.c | 23 ++++++++++++-----------
>   1 file changed, 12 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 5a1f98494ddd..9448aacbcf0f 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -1800,17 +1800,7 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)
>   	refcount_set(&nbd->refs, 0);
>   	INIT_LIST_HEAD(&nbd->list);
>   	disk->major = NBD_MAJOR;
> -
> -	/* Too big first_minor can cause duplicate creation of
> -	 * sysfs files/links, since index << part_shift might overflow, or
> -	 * MKDEV() expect that the max bits of first_minor is 20.
> -	 */
>   	disk->first_minor = index << part_shift;
> -	if (disk->first_minor < index || disk->first_minor > MINORMASK) {
> -		err = -EINVAL;
> -		goto out_free_work;
> -	}
> -
>   	disk->minors = 1 << part_shift;
>   	disk->fops = &nbd_fops;
>   	disk->private_data = nbd;
> @@ -1915,8 +1905,19 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
>   	if (!netlink_capable(skb, CAP_SYS_ADMIN))
>   		return -EPERM;
>   
> -	if (info->attrs[NBD_ATTR_INDEX])
> +	if (info->attrs[NBD_ATTR_INDEX]) {
>   		index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
> +
> +		/*
> +		 * Too big first_minor can cause duplicate creation of
> +		 * sysfs files/links, since index << part_shift might overflow, or
> +		 * MKDEV() expect that the max bits of first_minor is 20.
> +		 */
> +		if (index < 0 || index > MINORMASK >> part_shift) {
> +			printk(KERN_ERR "nbd: illegal input index %d\n", index);
> +			return -EINVAL;
> +		}
> +	}
>   	if (!info->attrs[NBD_ATTR_SOCKETS]) {
>   		printk(KERN_ERR "nbd: must specify at least one socket\n");
>   		return -EINVAL;