[bug report] ceph: decode interval_sets for delegated inos

[Dan Carpenter <dan.carpenter@linaro.org>]

Hello Jeff Layton,

Commit d48464878708 ("ceph: decode interval_sets for delegated inos")
from Nov 15, 2019 (linux-next), leads to the following Smatch static
checker warning:

	fs/ceph/mds_client.c:644 ceph_parse_deleg_inos()
	warn: potential user controlled sizeof overflow 'sets * 2 * 8' '0-u32max * 8'

fs/ceph/mds_client.c
    637 static int ceph_parse_deleg_inos(void **p, void *end,
    638                                  struct ceph_mds_session *s)
    639 {
    640         u32 sets;
    641 
    642         ceph_decode_32_safe(p, end, sets, bad);
                                            ^^^^
set to user data here.

    643         if (sets)
--> 644                 ceph_decode_skip_n(p, end, sets * 2 * sizeof(__le64), bad);
                                                   ^^^^^^^^^^^^^^^^^^^^^^^^^
This is safe on 64bit but on 32bit systems it can integer overflow/wrap.

    645         return 0;
    646 bad:
    647         return -EIO;
    648 }
    649 
    650 u64 ceph_get_deleg_ino(struct ceph_mds_session *s)
    651 {
    652         return 0;
    653 }
    654 

regards,
dan carpenter