| Message ID | 20230616110557.12106-1-min15.li@samsung.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] block: add capacity validation in bdev_add_partition() | expand |
On Fri, Jun 16, 2023 at 11:05:57AM +0000, min15.li wrote: > In the function bdev_add_partition(),there is no check that the start > and end sectors exceed the size of the disk before calling add_partition. > When we call the block's ioctl interface directly to add a partition, > and the capacity of the disk is set to 0 by driver,the command will > continue to execute. > v1->v2: check for overflows of the start + length value and put > the capacity check at the beginning of the function. > > Signed-off-by: min15.li <min15.li@samsung.com> > --- > block/partitions/core.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/block/partitions/core.c b/block/partitions/core.c > index 49e0496ff23c..3546b43d5124 100644 > --- a/block/partitions/core.c > +++ b/block/partitions/core.c > @@ -438,8 +438,20 @@ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start, > { > struct block_device *part; > int ret; > + sector_t end; > + sector_t capacity = get_capacity(disk); Very minor nitpick, but I think this would read nicer as: + sector_t capacity = get_capacity(disk), end; struct block_device *part; int ret; Otherwise this looks good: Reviewed-by: Christoph Hellwig <hch@lst.de>
On Fri, Jun 16, 2023 at 11:05:57AM +0000, min15.li wrote: > In the function bdev_add_partition(),there is no check that the start > and end sectors exceed the size of the disk before calling add_partition. > When we call the block's ioctl interface directly to add a partition, > and the capacity of the disk is set to 0 by driver,the command will > continue to execute. > v1->v2: check for overflows of the start + length value and put > the capacity check at the beginning of the function. > > Signed-off-by: min15.li <min15.li@samsung.com> I doubt you sign documents as "min15.li", right? :) Please fix. You also forgot a "changes" list below the --- line saying what changed from the previous submission. thanks, greg k-h
diff --git a/block/partitions/core.c b/block/partitions/core.c index 49e0496ff23c..3546b43d5124 100644 --- a/block/partitions/core.c +++ b/block/partitions/core.c @@ -438,8 +438,20 @@ int bdev_add_partition(struct gendisk *disk, int partno, sector_t start, { struct block_device *part; int ret; + sector_t end; + sector_t capacity = get_capacity(disk); mutex_lock(&disk->open_mutex); + if (check_add_overflow(start, length, &end)) { + ret = -EINVAL; + goto out; + } + + if (start >= capacity || end > capacity) { + ret = -EINVAL; + goto out; + } + if (!disk_live(disk)) { ret = -ENXIO; goto out;
In the function bdev_add_partition(),there is no check that the start and end sectors exceed the size of the disk before calling add_partition. When we call the block's ioctl interface directly to add a partition, and the capacity of the disk is set to 0 by driver,the command will continue to execute. v1->v2: check for overflows of the start + length value and put the capacity check at the beginning of the function. Signed-off-by: min15.li <min15.li@samsung.com> --- block/partitions/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)