From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from mail.linuxfoundation.org ([140.211.169.12]:42055 "EHLO
	mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751712AbcDVCI1 (ORCPT
	<rfc822;stable@vger.kernel.org>); Thu, 21 Apr 2016 22:08:27 -0400
Date: Fri, 22 Apr 2016 11:08:14 +0900
From: Greg KH <gregkh@linuxfoundation.org>
To: =?utf-8?B?0JzQsNGA0Log0JrQvtGA0LXQvdCx0LXRgNCz?=
	<socketpair@gmail.com>
Cc: Mike Christie <mchristi@redhat.com>, stable@vger.kernel.org,
	Nicholas Bellinger <nab@linux-iscsi.org>
Subject: Re: Integer overflow in target_core_device.c in Linux Kernel
Message-ID: <20160422020814.GA14159@kroah.com>
References: <CAEmTpZGWqmSgxxExd7e-VSQeCvsF=EKz_7EWQ0nuju7N+yG2Fw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAEmTpZGWqmSgxxExd7e-VSQeCvsF=EKz_7EWQ0nuju7N+yG2Fw@mail.gmail.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Fri, Apr 22, 2016 at 03:13:58AM +0500, Марк Коренберг wrote:
> Linux kernel commit 8a9ebe717a133ba7bc90b06047f43cc6b8bcb8b3
> 
> attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9)
> 
> Since max_discard_sectors is 32-bit, there may be integer overflow,
> making wrong max_unmap_lba_count.
> 
> For example, LVM Thin provisioning reports that it have 16 GB maximal
> discard block.
> 
> Exactly the same bug in DRBD9, I have already reported.

Please report this to the mailing list for the subsystem, stable@
doesn't care about stuff like this until it is resolved.

thanks,

greg k-h