Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

dm-stripe: fix a possible integer overflow

There's a possible integer overflow in stripe_io_hints if we have too
large chunk size. Test if the overflow happened, and if it did, don't set
limits->io_min and limits->io_opt;

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Suggested-by: Dongsheng Yang <dongsheng.yang@linux.dev>
Cc: stable@vger.kernel.org

+7 -3
+7 -3
drivers/md/dm-stripe.c
··· 456 456 struct queue_limits *limits) 457 457 { 458 458 struct stripe_c *sc = ti->private; 459 - unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT; 459 + unsigned int io_min, io_opt; 460 460 461 461 limits->chunk_sectors = sc->chunk_size; 462 - limits->io_min = chunk_size; 463 - limits->io_opt = chunk_size * sc->stripes; 462 + 463 + if (!check_shl_overflow(sc->chunk_size, SECTOR_SHIFT, &io_min) && 464 + !check_mul_overflow(io_min, sc->stripes, &io_opt)) { 465 + limits->io_min = io_min; 466 + limits->io_opt = io_opt; 467 + } 464 468 } 465 469 466 470 static struct target_type stripe_target = {