[PATCH] zonefs: handle integer overflow in zonefs_fname_to_fno

[PATCH] zonefs: handle integer overflow in zonefs_fname_to_fno

[Johannes Thumshirn]

In zonefs the file name in one of the two directories corresponds to the
zone number.

Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(),
where the parsing of the zone number from the file name can overflow the
'long' data type.

Add a check for integer overflows and if the fno 'long' did overflow
return -ENOENT.

Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
---
 fs/zonefs/super.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index 9b646cb5335d..c3b497707f82 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -610,11 +610,15 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
 		return c - '0';
 
 	for (i = 0, rname = name + len - 1; i < len; i++, rname--) {
+		long digit;
+
 		c = *rname;
 		if (!isdigit(c))
 			return -ENOENT;
-		fno += (c - '0') * shift;
+		digit = (c - '0') * shift;
 		shift *= 10;
+		if (check_add_overflow(fno, digit, &fno))
+			return -ENOENT;
 	}
 
 	return fno;
-- 
2.53.0

Re: [PATCH] zonefs: handle integer overflow in zonefs_fname_to_fno

[Damien Le Moal]

On 4/30/26 05:58, Johannes Thumshirn wrote:
> In zonefs the file name in one of the two directories corresponds to the
> zone number.
> 
> Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(),
> where the parsing of the zone number from the file name can overflow the
> 'long' data type.
> 
> Add a check for integer overflows and if the fno 'long' did overflow
> return -ENOENT.
> 
> Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>

This needs a fixes tag I think.

> ---
>  fs/zonefs/super.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
> index 9b646cb5335d..c3b497707f82 100644
> --- a/fs/zonefs/super.c
> +++ b/fs/zonefs/super.c
> @@ -610,11 +610,15 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
>  		return c - '0';
>  
>  	for (i = 0, rname = name + len - 1; i < len; i++, rname--) {
> +		long digit;
> +
>  		c = *rname;
>  		if (!isdigit(c))
>  			return -ENOENT;
> -		fno += (c - '0') * shift;
> +		digit = (c - '0') * shift;
>  		shift *= 10;
> +		if (check_add_overflow(fno, digit, &fno))
> +			return -ENOENT;
>  	}
>  
>  	return fno;


-- 
Damien Le Moal
Western Digital Research

Re: [PATCH] zonefs: handle integer overflow in zonefs_fname_to_fno

[Johannes Thumshirn]

On 4/30/26 12:41 AM, Damien Le Moal wrote:
> On 4/30/26 05:58, Johannes Thumshirn wrote:
>> In zonefs the file name in one of the two directories corresponds to the
>> zone number.
>>
>> Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(),
>> where the parsing of the zone number from the file name can overflow the
>> 'long' data type.
>>
>> Add a check for integer overflows and if the fno 'long' did overflow
>> return -ENOENT.
>>
>> Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
>> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
> This needs a fixes tag I think.

That would then be:

Fixes: d207794ababe ("zonefs: Dynamically create file inodes when needed")

Can you add it when applying or should I resend?

Re: [PATCH] zonefs: handle integer overflow in zonefs_fname_to_fno

[Damien Le Moal]

On 4/30/26 05:58, Johannes Thumshirn wrote:
> In zonefs the file name in one of the two directories corresponds to the
> zone number.
> 
> Here Alexey reported a possible integer overflow in zonefs_fname_to_fno(),
> where the parsing of the zone number from the file name can overflow the
> 'long' data type.
> 
> Add a check for integer overflows and if the fno 'long' did overflow
> return -ENOENT.
> 
> Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>

Applied to for-7.1-fixes, with the Fixes tag added.

> ---
>  fs/zonefs/super.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
> index 9b646cb5335d..c3b497707f82 100644
> --- a/fs/zonefs/super.c
> +++ b/fs/zonefs/super.c
> @@ -610,11 +610,15 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
>  		return c - '0';
>  
>  	for (i = 0, rname = name + len - 1; i < len; i++, rname--) {
> +		long digit;
> +
>  		c = *rname;
>  		if (!isdigit(c))
>  			return -ENOENT;
> -		fno += (c - '0') * shift;
> +		digit = (c - '0') * shift;
>  		shift *= 10;
> +		if (check_add_overflow(fno, digit, &fno))
> +			return -ENOENT;

Note: I moved this hunk one line up, keeping "shift *= 10;" as the last line of
the loop.

>  	}
>  
>  	return fno;


-- 
Damien Le Moal
Western Digital Research