Re: [PATCH] zonefs: handle integer overflow in zonefs_fname_to_fno

[Damien Le Moal <dlemoal@kernel.org>]

On 4/30/26 05:58, Johannes Thumshirn wrote:
> In zonefs the file name in one of the two directories corresponds to the
> zone number.
> 
> Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(),
> where the parsing of the zone number from the file name can overflow the
> 'long' data type.
> 
> Add a check for integer overflows and if the fno 'long' did overflow
> return -ENOENT.
> 
> Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>

Applied to for-7.1-fixes, with the Fixes tag added.

> ---
>  fs/zonefs/super.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
> index 9b646cb5335d..c3b497707f82 100644
> --- a/fs/zonefs/super.c
> +++ b/fs/zonefs/super.c
> @@ -610,11 +610,15 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
>  		return c - '0';
>  
>  	for (i = 0, rname = name + len - 1; i < len; i++, rname--) {
> +		long digit;
> +
>  		c = *rname;
>  		if (!isdigit(c))
>  			return -ENOENT;
> -		fno += (c - '0') * shift;
> +		digit = (c - '0') * shift;
>  		shift *= 10;
> +		if (check_add_overflow(fno, digit, &fno))
> +			return -ENOENT;

Note: I moved this hunk one line up, keeping "shift *= 10;" as the last line of
the loop.

>  	}
>  
>  	return fno;


-- 
Damien Le Moal
Western Digital Research