From: David Laight <David.Laight@ACULAB.COM>
To: "'libaokun (A)'" <libaokun1@huawei.com>,
Nick Desaulniers <ndesaulniers@google.com>,
Linus Torvalds <torvalds@linux-foundation.org>
Cc: Arnd Bergmann <arnd@kernel.org>,
Sedat Dilek <sedat.dilek@gmail.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Naresh Kamboju <naresh.kamboju@linaro.org>,
Nathan Chancellor <natechancellor@gmail.com>,
open list <linux-kernel@vger.kernel.org>,
linux-stable <stable@vger.kernel.org>,
Hulk Robot <hulkci@huawei.com>,
Josef Bacik <josef@toxicpanda.com>, Jens Axboe <axboe@kernel.dk>,
Sasha Levin <sashal@kernel.org>,
clang-built-linux <clang-built-linux@googlegroups.com>,
"lkft-triage@lists.linaro.org" <lkft-triage@lists.linaro.org>,
"llvm@lists.linux.dev" <llvm@lists.linux.dev>,
Kees Cook <keescook@chromium.org>
Subject: RE: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
Date: Tue, 14 Sep 2021 08:14:10 +0000 [thread overview]
Message-ID: <27e1c6de36354620aaf8ed5a5fa944de@AcuMS.aculab.com> (raw)
In-Reply-To: <db321a38-f5f6-34cd-2f4f-37fc82201798@huawei.com>
...
> case NBD_SET_SIZE:
> return nbd_set_size(nbd, arg, config->blksize);
> case NBD_SET_SIZE_BLOCKS:
> - if (check_mul_overflow((loff_t)arg, config->blksize,
> &bytesize))
> + if (arg && (LLONG_MAX / arg <= config->blksize))
> return -EINVAL;
> - return nbd_set_size(nbd, bytesize, config->blksize);
> + return nbd_set_size(nbd, arg * config->blksize,
> + config->blksize);
Shouldn't there just be sanity bound checks on 'config->blksize' and
'arg' so that the product is never going to overflow?
It isn't as though any values near the overflow limit are sane.
I suspect you could check config->blksize <= 64k && arg <= 32k
and even that would be generous.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
prev parent reply other threads:[~2021-09-14 8:14 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210913131113.390368911@linuxfoundation.org>
[not found] ` <20210913131114.028340332@linuxfoundation.org>
2021-09-13 16:22 ` [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl() Naresh Kamboju
2021-09-13 17:58 ` Greg Kroah-Hartman
2021-09-13 18:39 ` Nick Desaulniers
2021-09-13 19:53 ` Nick Desaulniers
2021-09-13 19:57 ` Sedat Dilek
2021-09-13 20:02 ` Nick Desaulniers
2021-09-13 20:10 ` Linus Torvalds
2021-09-13 20:16 ` Nick Desaulniers
2021-09-13 20:36 ` Nick Desaulniers
2021-09-13 20:42 ` Linus Torvalds
2021-09-13 20:50 ` Nick Desaulniers
2021-09-13 21:13 ` Nick Desaulniers
2021-09-13 21:15 ` Nick Desaulniers
2021-09-13 23:00 ` Linus Torvalds
2021-09-13 23:23 ` Nick Desaulniers
2021-09-14 2:13 ` libaokun (A)
2021-09-14 3:30 ` Nick Desaulniers
2021-09-14 8:14 ` David Laight [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=27e1c6de36354620aaf8ed5a5fa944de@AcuMS.aculab.com \
--to=david.laight@aculab.com \
--cc=arnd@kernel.org \
--cc=axboe@kernel.dk \
--cc=clang-built-linux@googlegroups.com \
--cc=gregkh@linuxfoundation.org \
--cc=hulkci@huawei.com \
--cc=josef@toxicpanda.com \
--cc=keescook@chromium.org \
--cc=libaokun1@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkft-triage@lists.linaro.org \
--cc=llvm@lists.linux.dev \
--cc=naresh.kamboju@linaro.org \
--cc=natechancellor@gmail.com \
--cc=ndesaulniers@google.com \
--cc=sashal@kernel.org \
--cc=sedat.dilek@gmail.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox