* [PATCH] block: fix overflow in blk_ioctl_discard()
@ 2024-03-29 1:23 linan666
2024-04-02 12:32 ` Christoph Hellwig
2024-04-02 13:43 ` Jens Axboe
0 siblings, 2 replies; 4+ messages in thread
From: linan666 @ 2024-03-29 1:23 UTC (permalink / raw)
To: axboe
Cc: hch, linux-block, linux-kernel, linan666, yukuai3, yi.zhang,
houtao1, yangerkun
From: Li Nan <linan122@huawei.com>
There is no check for overflow of 'start + len' in blk_ioctl_discard().
Hung task occurs if submit an discard ioctl with the following param:
start = 0x80000000000ff000, len = 0x8000000000fff000;
Add the overflow validation now.
Signed-off-by: Li Nan <linan122@huawei.com>
---
block/ioctl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/block/ioctl.c b/block/ioctl.c
index 0c76137adcaa..a9028a2c2db5 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -96,7 +96,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode,
unsigned long arg)
{
uint64_t range[2];
- uint64_t start, len;
+ uint64_t start, len, end;
struct inode *inode = bdev->bd_inode;
int err;
@@ -117,7 +117,8 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode,
if (len & 511)
return -EINVAL;
- if (start + len > bdev_nr_bytes(bdev))
+ if (check_add_overflow(start, len, &end) ||
+ end > bdev_nr_bytes(bdev))
return -EINVAL;
filemap_invalidate_lock(inode->i_mapping);
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] block: fix overflow in blk_ioctl_discard()
2024-03-29 1:23 [PATCH] block: fix overflow in blk_ioctl_discard() linan666
@ 2024-04-02 12:32 ` Christoph Hellwig
2024-04-03 1:28 ` Li Nan
2024-04-02 13:43 ` Jens Axboe
1 sibling, 1 reply; 4+ messages in thread
From: Christoph Hellwig @ 2024-04-02 12:32 UTC (permalink / raw)
To: linan666
Cc: axboe, hch, linux-block, linux-kernel, yukuai3, yi.zhang, houtao1,
yangerkun
On Fri, Mar 29, 2024 at 09:23:19AM +0800, linan666@huaweicloud.com wrote:
> From: Li Nan <linan122@huawei.com>
>
> There is no check for overflow of 'start + len' in blk_ioctl_discard().
> Hung task occurs if submit an discard ioctl with the following param:
> start = 0x80000000000ff000, len = 0x8000000000fff000;
> Add the overflow validation now.
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
Can you wire up a testcase in blktests for this condition?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] block: fix overflow in blk_ioctl_discard()
2024-04-02 12:32 ` Christoph Hellwig
@ 2024-04-03 1:28 ` Li Nan
0 siblings, 0 replies; 4+ messages in thread
From: Li Nan @ 2024-04-03 1:28 UTC (permalink / raw)
To: Christoph Hellwig, linan666
Cc: axboe, linux-block, linux-kernel, yukuai3, yi.zhang, houtao1,
yangerkun
在 2024/4/2 20:32, Christoph Hellwig 写道:
> On Fri, Mar 29, 2024 at 09:23:19AM +0800, linan666@huaweicloud.com wrote:
>> From: Li Nan <linan122@huawei.com>
>>
>> There is no check for overflow of 'start + len' in blk_ioctl_discard().
>> Hung task occurs if submit an discard ioctl with the following param:
>> start = 0x80000000000ff000, len = 0x8000000000fff000;
>> Add the overflow validation now.
>
> Looks good:
>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
>
> Can you wire up a testcase in blktests for this condition?
>
It's my pleasure, I will add testcase later.
>
> .
--
Thanks,
Nan
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] block: fix overflow in blk_ioctl_discard()
2024-03-29 1:23 [PATCH] block: fix overflow in blk_ioctl_discard() linan666
2024-04-02 12:32 ` Christoph Hellwig
@ 2024-04-02 13:43 ` Jens Axboe
1 sibling, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2024-04-02 13:43 UTC (permalink / raw)
To: linan666
Cc: hch, linux-block, linux-kernel, yukuai3, yi.zhang, houtao1,
yangerkun
On Fri, 29 Mar 2024 09:23:19 +0800, linan666@huaweicloud.com wrote:
> There is no check for overflow of 'start + len' in blk_ioctl_discard().
> Hung task occurs if submit an discard ioctl with the following param:
> start = 0x80000000000ff000, len = 0x8000000000fff000;
> Add the overflow validation now.
>
>
Applied, thanks!
[1/1] block: fix overflow in blk_ioctl_discard()
commit: 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-04-03 1:28 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-29 1:23 [PATCH] block: fix overflow in blk_ioctl_discard() linan666
2024-04-02 12:32 ` Christoph Hellwig
2024-04-03 1:28 ` Li Nan
2024-04-02 13:43 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox