lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 31 Jan 2018 10:39:09 +0100
From:   Ilya Dryomov <idryomov@...il.com>
To:     "Gustavo A. R. Silva" <gustavo@...eddedor.com>
Cc:     "Yan, Zheng" <zyan@...hat.com>, Sage Weil <sage@...hat.com>,
        "David S. Miller" <davem@...emloft.net>,
        Ceph Development <ceph-devel@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>, linux-kernel@...r.kernel.org,
        "Gustavo A. R. Silva" <garsilva@...eddedor.com>
Subject: Re: [PATCH] libceph: use 64-bit arithmetic instead of 32-bit

On Wed, Jan 31, 2018 at 6:29 AM, Gustavo A. R. Silva
<gustavo@...eddedor.com> wrote:
> Cast objsetno to u64 in order to give the compiler complete
> information about the proper arithmetic to use. Notice
> that this variable is used in a context that expects an
> expression of type u64 (64 bits, unsigned).
>
> The expression objsetno * sc + stripepos is currently
> being evaluated using 32-bit arithmetic.
>
> In general, the use of incorrect arithmetic has security
> implications.
>
> Addresses-Coverity-ID: 200686
> Signed-off-by: Gustavo A. R. Silva <gustavo@...eddedor.com>
> ---
>  net/ceph/osdmap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
> index 0da27c6..58dc965 100644
> --- a/net/ceph/osdmap.c
> +++ b/net/ceph/osdmap.c
> @@ -2183,7 +2183,7 @@ int ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
>         stripepos = bl % sc;
>         objsetno = stripeno / su_per_object;
>
> -       *ono = objsetno * sc + stripepos;
> +       *ono = (u64)objsetno * sc + stripepos;
>         dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned int)*ono);
>
>         /* *oxoff = *off % layout->fl_stripe_unit;  # offset in su */

Hi Gustavo,

This (and other u32/u64 issues in this function, is this the only
warning?) is fixed in my striping v2 work branch.  I wasn't going to
push that patch separately, but I guess I should post it.

Thanks,

                Ilya

Powered by blists - more mailing lists