From: Michael Schmitz <schmitzmic@gmail.com>
To: linux-block@vger.kernel.org, axboe@kernel.dk
Cc: linux-m68k@vger.kernel.org, geert@linux-m68k.org,
Michael Schmitz <schmitzmic@gmail.com>
Subject: [PATCH v8 1/2] block: fix signed int overflow in Amiga partition support
Date: Tue, 26 Jul 2022 16:57:46 +1200 [thread overview]
Message-ID: <20220726045747.4779-2-schmitzmic@gmail.com> (raw)
In-Reply-To: <20220726045747.4779-1-schmitzmic@gmail.com>
The Amiga partition parser module uses signed int for partition sector
address and count, which will overflow for disks larger than 1 TB.
Use sector_t as type for sector address and size to allow using disks
up to 2 TB without LBD support, and disks larger than 2 TB with LBD.
This bug was reported originally in 2012, and the fix was created by
the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been
discussed and reviewed on linux-m68k at that time but never officially
submitted. This patch differs from Joanne's patch only in its use of
sector_t instead of unsigned int. No checking for overflows is done
(see patch 2 of this series for that).
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43511
Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Message-ID: <201206192146.09327.Martin@lichtvoll.de>
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Tested-by: Martin Steigerwald <Martin@lichtvoll.de>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
---
block/partitions/amiga.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c
index 5c8624e26a54..f98191545d9a 100644
--- a/block/partitions/amiga.c
+++ b/block/partitions/amiga.c
@@ -31,7 +31,8 @@ int amiga_partition(struct parsed_partitions *state)
unsigned char *data;
struct RigidDiskBlock *rdb;
struct PartitionBlock *pb;
- int start_sect, nr_sects, blk, part, res = 0;
+ sector_t start_sect, nr_sects;
+ int blk, part, res = 0;
int blksize = 1; /* Multiplier for disk block size */
int slot = 1;
@@ -96,14 +97,14 @@ int amiga_partition(struct parsed_partitions *state)
/* Tell Kernel about it */
- nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 -
- be32_to_cpu(pb->pb_Environment[9])) *
+ nr_sects = ((sector_t) be32_to_cpu(pb->pb_Environment[10])
+ + 1 - be32_to_cpu(pb->pb_Environment[9])) *
be32_to_cpu(pb->pb_Environment[3]) *
be32_to_cpu(pb->pb_Environment[5]) *
blksize;
if (!nr_sects)
continue;
- start_sect = be32_to_cpu(pb->pb_Environment[9]) *
+ start_sect = (sector_t) be32_to_cpu(pb->pb_Environment[9]) *
be32_to_cpu(pb->pb_Environment[3]) *
be32_to_cpu(pb->pb_Environment[5]) *
blksize;
--
2.17.1
next prev parent reply other threads:[~2022-07-26 4:57 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-26 4:57 [PATCH v8 0/2] Amiga RDB partition support fixes Michael Schmitz
2022-07-26 4:57 ` Michael Schmitz [this message]
2022-07-26 11:41 ` [PATCH v8 1/2] block: fix signed int overflow in Amiga partition support Christoph Hellwig
2022-07-26 4:57 ` [PATCH v8 2/2] block: add overflow checks for " Michael Schmitz
2022-07-26 11:42 ` Christoph Hellwig
2022-07-26 22:28 ` Michael Schmitz
2022-08-11 11:40 ` Geert Uytterhoeven
2022-08-22 20:38 ` Michael Schmitz
2022-08-22 21:03 ` Geert Uytterhoeven
2022-08-22 21:09 ` Michael Schmitz
2022-07-26 12:53 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220726045747.4779-2-schmitzmic@gmail.com \
--to=schmitzmic@gmail.com \
--cc=axboe@kernel.dk \
--cc=geert@linux-m68k.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-m68k@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.