[PATCH v6 0/2] badblocks: fix infinite loop and validate sector range/shift

[Ramesh Adhikari <adhikari.resume@gmail.com>]

This replaces the single-patch v5 with a two-patch series, per Coly's
review.

v1-v4 chased symptoms of the same underlying bug (an RCU stall found
by syzkaller through the nvdimm ioctl path, in _badblocks_check() /
badblocks_check() looping with a non-advancing range) before landing
on the root cause in v4: rounddown()/roundup() don't modify their
argument in place, so 's'/'next'/'target' were never actually
rounded.

v5 folded the round_down()/round_up() fix together with overflow and
zero-length guards into one patch. Coly's review on v5 pointed out
that:

  - the overflow check that was there wasn't sufficient on its own
    (only one of several range-validity conditions), and
  - the round fix and the validation should be separate patches,
    since they're independently useful and one is safe to backport
    on its own.

This series:

  1/2 is exactly the round_down()/round_up() fix, nothing else. This
      is what actually stops the infinite loop and also fixes the
      32-bit build breakage kernel test robot reported on v1
      (rounddown()/roundup() do 64-bit division/modulo on sector_t,
      requiring libgcc helpers not linked into the kernel).

  2/2 adds the range/shift validation Coly asked for: s+sectors
      overflow, bb->shift too large to shift a sector_t by (bb->shift
      is populated in drivers/md/md.c straight from an unvalidated
      on-disk superblock byte), and detecting when round_up()/
      round_down() themselves wrap near ULLONG_MAX.

Both are tagged Fixes: aa511ff8218b ("badblocks: switch to the
improved badblock handling code") and Cc: stable, since that's the
commit that introduced this code path.

Ramesh Adhikari (2):
  badblocks: fix in-place round_up/round_down usage bug
  badblocks: validate sector range and shift before rounding

 block/badblocks.c | 52 ++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 45 insertions(+), 7 deletions(-)

--
2.43.0