lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 31 Jan 2018 10:39:09 +0100 From: Ilya Dryomov <idryomov@...il.com> To: "Gustavo A. R. Silva" <gustavo@...eddedor.com> Cc: "Yan, Zheng" <zyan@...hat.com>, Sage Weil <sage@...hat.com>, "David S. Miller" <davem@...emloft.net>, Ceph Development <ceph-devel@...r.kernel.org>, netdev <netdev@...r.kernel.org>, linux-kernel@...r.kernel.org, "Gustavo A. R. Silva" <garsilva@...eddedor.com> Subject: Re: [PATCH] libceph: use 64-bit arithmetic instead of 32-bit On Wed, Jan 31, 2018 at 6:29 AM, Gustavo A. R. Silva <gustavo@...eddedor.com> wrote: > Cast objsetno to u64 in order to give the compiler complete > information about the proper arithmetic to use. Notice > that this variable is used in a context that expects an > expression of type u64 (64 bits, unsigned). > > The expression objsetno * sc + stripepos is currently > being evaluated using 32-bit arithmetic. > > In general, the use of incorrect arithmetic has security > implications. > > Addresses-Coverity-ID: 200686 > Signed-off-by: Gustavo A. R. Silva <gustavo@...eddedor.com> > --- > net/ceph/osdmap.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c > index 0da27c6..58dc965 100644 > --- a/net/ceph/osdmap.c > +++ b/net/ceph/osdmap.c > @@ -2183,7 +2183,7 @@ int ceph_calc_file_object_mapping(struct ceph_file_layout *layout, > stripepos = bl % sc; > objsetno = stripeno / su_per_object; > > - *ono = objsetno * sc + stripepos; > + *ono = (u64)objsetno * sc + stripepos; > dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned int)*ono); > > /* *oxoff = *off % layout->fl_stripe_unit; # offset in su */ Hi Gustavo, This (and other u32/u64 issues in this function, is this the only warning?) is fixed in my striping v2 work branch. I wasn't going to push that patch separately, but I guess I should post it. Thanks, Ilya
Powered by blists - more mailing lists