[PATCH] brd: prevent overflow caused by too large rd_size parameter

[PATCH] brd: prevent overflow caused by too large rd_size parameter

[Satoru Takeuchi]

The max value of rd_size parameter is ULONG_MAX from the following commit.

Commit 366f4aea649a65c3735d91b4409d84c771811290 ("brd: Switch rd_size
to unsigned long")

However, this parameter * 1024 will be set as inode->i_size corresponding
to brd devices and it's a signed value. To prevent overflow, this parameter
should be equal to or smaller than the max value of sector_t >> 11, 10 bits
are for 1024 and 1 bit is for sign bit.

Signed-off-by: Satoru Takeuchi <satoru.takeuchi@gmail.com>
---
 drivers/block/brd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 104b71c..2b00e7d 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -546,6 +546,14 @@ static int __init brd_init(void)
 	 *	dynamically.
 	 */
 
+	/*
+	 * rd_size * 1024 will be set as its inode->i_size and it's a signed
+	 * value. So rd_size should be equal to or smaller than the max value
+	 * of sector_t >> 11, 10 bits are for 1024 and 1 bit is for sign bit.
+	 */
+	if (rd_size >> (sizeof(sector_t) * 8 - 11))
+		return -EINVAL;
+
 	if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
 		return -EIO;
 
-- 
2.7.4