Re: [PATCH] ext2fs: fix integer overflow in rb_get_bmap_range

[Dmitry Monakhov <dmonakhov@openvz.org>]

Dmitry Monakhov <dmonakhov@openvz.org> writes:

This is the patch for the issue which I complain you about prev
Friday. It takes longer than I expect, but now all my resize tests
succeeded. In fact issue may be triggered in real life situation
if someone use ballooning technique (consume space via fallocate)
> bmap_rb_extent is defined as __u64:blk __u64:count. So count can exceed INT_MAX on
> populated filesystems
>
> TESTCASE: xfstest ext4/004
>
> Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
> ---
>  lib/ext2fs/blkmap64_rb.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lib/ext2fs/blkmap64_rb.c b/lib/ext2fs/blkmap64_rb.c
> index 8d1778d..e290ade 100644
> --- a/lib/ext2fs/blkmap64_rb.c
> +++ b/lib/ext2fs/blkmap64_rb.c
> @@ -733,7 +733,7 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
>  	struct rb_node *parent = NULL, *next, **n;
>  	struct ext2fs_rb_private *bp;
>  	struct bmap_rb_extent *ext;
> -	int count;
> +	__u64 count;
>  	__u64 pos;
>  
>  	bp = (struct ext2fs_rb_private *) bitmap->private;
> @@ -765,9 +765,9 @@ static errcode_t rb_get_bmap_range(ext2fs_generic_bitmap bitmap,
>  		if (pos >= start + num)
>  			break;
>  		if (pos < start) {
> -			count -= start - pos;
> -			if (count < 0)
> +			if (pos + count <  start)
>  				continue;
> +			count -= start - pos;
>  			pos = start;
>  		}
>  		if (pos + count > start + num)
> -- 
> 1.8.3.1