[PATCH] zonefs: check multiplication overflow in zonefs_fname_to_fno()

[PATCH] zonefs: check multiplication overflow in zonefs_fname_to_fno()

[Guangshuo Li]

The change referenced by the Fixes tag added overflow checking for the
addition used while converting a zone file name to a zone number.

However, the digit value and decimal shift are still computed with
unchecked signed long multiplications. For sufficiently long numeric
names, shift or digit can overflow before check_add_overflow() sees the
value, leaving the parser with an already corrupted intermediate result.

Check the digit and shift multiplications as well. Only advance the shift
when another digit remains, so valid boundary values are not rejected due
to an unused final shift update.

Fixes: 3a8389d42bdf ("zonefs: handle integer overflow in zonefs_fname_to_fno")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 fs/zonefs/super.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index ff43d6d1ea30..106cf304348b 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -615,10 +615,12 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
 		c = *rname;
 		if (!isdigit(c))
 			return -ENOENT;
-		digit = (c - '0') * shift;
+		if (check_mul_overflow((long)(c - '0'), shift, &digit))
+			return -ENOENT;
 		if (check_add_overflow(fno, digit, &fno))
 			return -ENOENT;
-		shift *= 10;
+		if (i + 1 < len && check_mul_overflow(shift, 10L, &shift))
+			return -ENOENT;
 	}
 
 	return fno;
-- 
2.43.0

Re: [PATCH] zonefs: check multiplication overflow in zonefs_fname_to_fno()

[Damien Le Moal]

On 7/8/26 19:46, Guangshuo Li wrote:
> The change referenced by the Fixes tag added overflow checking for the
> addition used while converting a zone file name to a zone number.
> 
> However, the digit value and decimal shift are still computed with
> unchecked signed long multiplications. For sufficiently long numeric
> names, shift or digit can overflow before check_add_overflow() sees the
> value, leaving the parser with an already corrupted intermediate result.
> 
> Check the digit and shift multiplications as well. Only advance the shift
> when another digit remains, so valid boundary values are not rejected due
> to an unused final shift update.
> 
> Fixes: 3a8389d42bdf ("zonefs: handle integer overflow in zonefs_fname_to_fno")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Please check your email setup. This one was in my Junk folder.

The patch looks OK to me.

> ---
>  fs/zonefs/super.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
> index ff43d6d1ea30..106cf304348b 100644
> --- a/fs/zonefs/super.c
> +++ b/fs/zonefs/super.c
> @@ -615,10 +615,12 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
>  		c = *rname;
>  		if (!isdigit(c))
>  			return -ENOENT;
> -		digit = (c - '0') * shift;
> +		if (check_mul_overflow((long)(c - '0'), shift, &digit))
> +			return -ENOENT;
>  		if (check_add_overflow(fno, digit, &fno))
>  			return -ENOENT;
> -		shift *= 10;
> +		if (i + 1 < len && check_mul_overflow(shift, 10L, &shift))
> +			return -ENOENT;
>  	}
>  
>  	return fno;


-- 
Damien Le Moal
Western Digital Research