Re: [PATCH] dm-stripe: fix a possible integer overflow

[Dongsheng Yang <dongsheng.yang@linux.dev>]

在 7/7/2025 6:39 PM, Mikulas Patocka 写道:
> There's a possible integer overflow in stripe_io_hints if we have too
> large chunk size. Test if the overflow happened, and if it did, don't set
> limits->io_min and limits->io_opt;
>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Cc: stable@vger.kernel.org
>
> ---
>   drivers/md/dm-stripe.c |   10 +++++++---
>   1 file changed, 7 insertions(+), 3 deletions(-)
>
> Index: linux-2.6/drivers/md/dm-stripe.c
> ===================================================================
> --- linux-2.6.orig/drivers/md/dm-stripe.c	2025-07-06 15:02:23.000000000 +0200
> +++ linux-2.6/drivers/md/dm-stripe.c	2025-07-07 12:32:49.000000000 +0200
> @@ -456,10 +456,14 @@ static void stripe_io_hints(struct dm_ta
>   			    struct queue_limits *limits)
>   {
>   	struct stripe_c *sc = ti->private;
> -	unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT;
> +	unsigned int io_min = sc->chunk_size << SECTOR_SHIFT;
> +	unsigned int io_opt = io_min * sc->stripes;
>   
> -	limits->io_min = chunk_size;
> -	limits->io_opt = chunk_size * sc->stripes;
> +	if (io_min >> SECTOR_SHIFT == sc->chunk_size &&
> +	    io_opt / sc->stripes == io_min) {
> +		limits->io_min = io_min;
> +		limits->io_opt = io_opt;
> +	}


Hi Mikulas,

     What about using check_xxx_overflow() ? something like:


     if (check_shl_overflow(sc->chunk_size, SECTOR_SHIFT, &io_min))
         return;


     if (check_mul_overflow(io_min, sc->stripes, &io_opt))
         return;

     limits->io_min = io_min;
     limits->io_opt = io_opt;

>   }
>   
>   static struct target_type stripe_target = {
>
>