diff options
| author | Zichen Xie <zichenxie0106@gmail.com> | 2024-10-21 14:54:45 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-11-14 13:15:16 +0100 |
| commit | 80342c5876cd55dd1b755d62d728c2267eca948b (patch) | |
| tree | 0d50f2694a2cebeb5d9a75d4a2967dca6720f05a | |
| parent | c52ec00cb2f9bebfada22edcc0db385b910a1cdb (diff) | |
| download | linux-80342c5876cd55dd1b755d62d728c2267eca948b.tar.gz linux-80342c5876cd55dd1b755d62d728c2267eca948b.tar.bz2 linux-80342c5876cd55dd1b755d62d728c2267eca948b.zip | |
dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
commit 5a4510c762fc04c74cff264cd4d9e9f5bf364bae upstream.
This was found by a static analyzer.
There may be a potential integer overflow issue in
unstripe_ctr(). uc->unstripe_offset and uc->unstripe_width are
defined as "sector_t"(uint64_t), while uc->unstripe,
uc->chunk_size and uc->stripes are all defined as "uint32_t".
The result of the calculation will be limited to "uint32_t"
without correct casting.
So, we recommend adding an extra cast to prevent potential
integer overflow.
Fixes: 18a5bf270532 ("dm: add unstriped target")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/md/dm-unstripe.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/md/dm-unstripe.c b/drivers/md/dm-unstripe.c index fdc8921e5c19..e69d297b9122 100644 --- a/drivers/md/dm-unstripe.c +++ b/drivers/md/dm-unstripe.c @@ -84,8 +84,8 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv) } uc->physical_start = start; - uc->unstripe_offset = uc->unstripe * uc->chunk_size; - uc->unstripe_width = (uc->stripes - 1) * uc->chunk_size; + uc->unstripe_offset = (sector_t)uc->unstripe * uc->chunk_size; + uc->unstripe_width = (sector_t)(uc->stripes - 1) * uc->chunk_size; uc->chunk_shift = is_power_of_2(uc->chunk_size) ? fls(uc->chunk_size) - 1 : 0; tmp_len = ti->len; |