[PATCH] partitions: atari: fix overflow in the partition sanity check

[PATCH] partitions: atari: fix overflow in the partition sanity check

[Guanglei Zhu]

VALID_PARTITION() adds the 32-bit start and size fields before
comparing the sum against the disk size, so a table entry whose
st + siz wraps to a small value passes the check.  An entry with
st = 0x1000 and siz = 0xfffff000, for example, is accepted on a
32 MiB disk even though the partition ends far beyond it.

Widening the addition to sector_t rejects such entries, so the
table is no longer mistaken for a valid Atari table based on an
overflowing entry.

No Fixes tag: the check dates back to the initial git import and
predates any in-tree stable branch that would still carry it.

Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>

Verified in a QEMU guest with a crafted Atari root sector holding
that single entry: the unpatched kernel accepts the table and
reports

  vda: p1 size 4294963200 extends beyond EOD, truncated

with this change the entry fails the check, the table is rejected
as non-Atari, and no partition device is created.
---
 block/partitions/atari.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/partitions/atari.c b/block/partitions/atari.c
index 2438d1448f..de6d9b1b68 100644
--- a/block/partitions/atari.c
+++ b/block/partitions/atari.c
@@ -22,7 +22,7 @@
     (((pi)->flg & 1) &&							     \
      isalnum((pi)->id[0]) && isalnum((pi)->id[1]) && isalnum((pi)->id[2]) && \
      be32_to_cpu((pi)->st) <= (hdsiz) &&				     \
-     be32_to_cpu((pi)->st) + be32_to_cpu((pi)->siz) <= (hdsiz))
+     (sector_t)be32_to_cpu((pi)->st) + be32_to_cpu((pi)->siz) <= (hdsiz))
 
 static inline int OK_id(char *s)
 {
-- 
2.43.0