lkml.org 
[lkml]   [2020]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 214/228] fs/ufs: avoid potential u32 multiplication overflow
    Date
    From: Colin Ian King <colin.king@canonical.com>

    [ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ]

    The 64 bit ino is being compared to the product of two u32 values,
    however, the multiplication is being performed using a 32 bit multiply so
    there is a potential of an overflow. To be fully safe, cast uspi->s_ncg
    to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of
    overflow.

    Fixes: f3e2a520f5fb ("ufs: NFS support")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Evgeniy Dushistov <dushistov@mail.ru>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Link: http://lkml.kernel.org/r/20200715170355.1081713-1-colin.king@canonical.com
    Addresses-Coverity: ("Unintentional integer overflow")
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ufs/super.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/fs/ufs/super.c b/fs/ufs/super.c
    index 6440003f8ddc6..e3f3a0df60276 100644
    --- a/fs/ufs/super.c
    +++ b/fs/ufs/super.c
    @@ -99,7 +99,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene
    struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
    struct inode *inode;

    - if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg)
    + if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg)
    return ERR_PTR(-ESTALE);

    inode = ufs_iget(sb, ino);
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-08-20 12:48    [W:4.088 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site