From patchwork Tue Jul 3 19:39:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 10505047 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6E3D66035E for ; Tue, 3 Jul 2018 19:39:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5676528BAD for ; Tue, 3 Jul 2018 19:39:28 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4AB5328BB8; Tue, 3 Jul 2018 19:39:28 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A523E28BAD for ; Tue, 3 Jul 2018 19:39:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751646AbeGCTj0 (ORCPT ); Tue, 3 Jul 2018 15:39:26 -0400 Received: from mail-pl0-f66.google.com ([209.85.160.66]:35617 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750716AbeGCTjZ (ORCPT ); Tue, 3 Jul 2018 15:39:25 -0400 Received: by mail-pl0-f66.google.com with SMTP id k1-v6so1509915plt.2; Tue, 03 Jul 2018 12:39:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=YQpzAu5nxyllUsF89bhKweYv9SEAsGYJtKUE1eCdDJk=; b=X7Q0O5q3qQ7Si6oCrgq7Sgu3nomLdeJq6cZGB34Gznog1ec4gIkV0iRtBkfhtbz8q2 nOtaBJJKZZRe+sX2DZkU7yOCS9ddrsLMXH8dk7cNhvd0ReptwzEthw1CShEufap5sEpg EyXnsR2jdVztWHfFvo3LVHbI3uuLuM9bR/PyU07sxWmhHTERgkwjm2iBZ5HUxfDRv2Nh eleNjUv6NUZGfTOp2bDhldMc1ygphgUZItP7XRffNwwPpVlFFmzYL67KD30aC4mk9uAT eB6yrzYGAp4J+oDnzDmIEosrES5ng0DK8Uyx54lH0d2OuJP1s8ySWx/XAmXcYZQgkTdB wxCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=YQpzAu5nxyllUsF89bhKweYv9SEAsGYJtKUE1eCdDJk=; b=SsnOdofHt7UCdn4O8AoeE9B5NCiJtxLybYl9SziGF6T8jDt9fmaPjMhtYOJqi0YRmG uwSUfcAUjAOP/NCr3YU3SUkNm6fj65FMB+eg5qCYxfmrTMbD6DW2Pc5e1XHx6KdLfFRY h6WP+lTnupn5T1Fyk3kfJUOR7+WtKHKvsnM6oHuZSlv7/z08saLeo1ksEDWkmXYzXJ8T FJhopADWsdQrr4+Fnsd/UNyvOGGwqjTk1F3nUY53DUsxZT2T0QbG2qXfT0Zpu86i0vaH 5S4FUV8mgWx3P2ZvXcF5DiSwr8BKO+OBTgEhGd44zrt3LHrHdwVV94ZrjTdfhetdzg3d QFnA== X-Gm-Message-State: APt69E1D2OPWEXLDCojajIrFWRJ+TNn3CYaLtJEWhxqSMNTlDFKImIpD G4jrA1lVN8SE1Jr4Ybeo3bE= X-Google-Smtp-Source: ADUXVKKq6lYIepg7fyl3ptsC7UyrGlYz4iJzL90ETrHHc8eoI1JSDzXr4NSA37J9FmW4zU/h2W7DMg== X-Received: by 2002:a17:902:8a95:: with SMTP id p21-v6mr31263708plo.91.1530646765078; Tue, 03 Jul 2018 12:39:25 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-154-41-72-adsl.sparkbb.co.nz. [222.154.41.72]) by smtp.gmail.com with ESMTPSA id x2-v6sm3399359pgq.33.2018.07.03.12.39.23 (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 03 Jul 2018 12:39:24 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id 3FE61360081; Wed, 4 Jul 2018 07:39:20 +1200 (NZST) From: Michael Schmitz To: linux-block@vger.kernel.org Cc: linux-m68k@vger.kernel.org, axboe@kernel.dk, geert@linux-m68k.org, jdow@earthlink.net, martin@lichtvoll.de, jongk@linux-m68k.org, Michael Schmitz Subject: [PATCH v3] block: fix Amiga partition support for disks >= 1 TB Date: Wed, 4 Jul 2018 07:39:18 +1200 Message-Id: <1530646758-30513-1-git-send-email-schmitzmic@gmail.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1530509350-25410-1-git-send-email-schmitzmic@gmail.com> References: <1530509350-25410-1-git-send-email-schmitzmic@gmail.com> Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. Bail out if sector addresses overflow 32 bits on kernels without LBD support. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch adds additional error checking and warning messages. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Reported-by: Martin Steigerwald Message-ID: <201206192146.09327.Martin@lichtvoll.de> Signed-off-by: Michael Schmitz Tested-by: Martin Steigerwald --- Changes from RFC: - use u64 instead of sector_t, since that may be u32 without LBD support - check multiplication overflows each step - 3 u32 values may exceed u64! - warn against use on AmigaDOS if partition data overflow u32 sector count. - warn if partition CylBlocks larger than what's stored in the RDSK header. - bail out if we were to overflow sector_t (32 or 64 bit). Changes from v1: Kars de Jong: - use defines for magic offsets in DosEnvec struct Geert Uytterhoeven: - use u64 cast for multiplications of u32 numbers - use array3_size for overflow checks - change pr_err to pr_warn - discontinue use of pr_cont - reword log messages - drop redundant nr_sects overflow test - warn against 32 bit overflow for each affected partition - skip partitions that overflow sector_t size instead of aborting scan Changes from v2: - further trim 32 bit overflow test - correct duplicate types.h inclusion introduced in v2 --- block/partitions/amiga.c | 89 ++++++++++++++++++++++++++++++++++++++++----- 1 files changed, 79 insertions(+), 10 deletions(-) diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c index 5609366..4e6e478 100644 --- a/block/partitions/amiga.c +++ b/block/partitions/amiga.c @@ -11,11 +11,19 @@ #define pr_fmt(fmt) fmt #include +#include +#include #include #include "check.h" #include "amiga.h" +/* magic offsets in partition DosEnvVec */ +#define NR_HD 3 +#define NR_SECT 5 +#define LO_CYL 9 +#define HI_CYL 10 + static __inline__ u32 checksum_block(__be32 *m, int size) { @@ -32,7 +40,9 @@ int amiga_partition(struct parsed_partitions *state) unsigned char *data; struct RigidDiskBlock *rdb; struct PartitionBlock *pb; - int start_sect, nr_sects, blk, part, res = 0; + u64 start_sect, nr_sects; + u64 cylblk; /* rdb_CylBlocks = nr_heads*sect_per_track */ + int blk, part, res = 0; int blksize = 1; /* Multiplier for disk block size */ int slot = 1; char b[BDEVNAME_SIZE]; @@ -98,19 +108,78 @@ int amiga_partition(struct parsed_partitions *state) if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 ) continue; + /* RDB gives us more than enough rope to hang ourselves with, + * many times over (2^128 bytes if all fields max out). + * Some careful checks are in order. + */ + + /* CylBlocks is total number of blocks per cylinder */ + cylblk = be32_to_cpu(pb->pb_Environment[NR_HD]) * + be32_to_cpu(pb->pb_Environment[NR_SECT]); + + /* check for consistency with RDB defined CylBlocks */ + if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) { + pr_warn("Dev %s: cylblk %llu > rdb_CylBlocks 0x%x!\n", + bdevname(state->bdev, b), cylblk, + be32_to_cpu(rdb->rdb_CylBlocks)); + } + + /* check for potential overflows - we are going to multiply + * three 32 bit numbers to one 64 bit result later! + * Condition 1: nr_heads * sects_per_track must fit u32! + * NB: This is a HARD limit for AmigaDOS. We just warn. + */ + + if (cylblk > UINT_MAX) { + pr_warn("Dev %s: heads*sects %llu > UINT_MAX!\n", + bdevname(state->bdev, b), cylblk); + } + + /* Condition 2: even if CylBlocks did not overflow, the end + * result must still fit u64! + */ + + if (array3_size(be32_to_cpu(pb->pb_Environment[LO_CYL]), + cylblk, blksize) == SIZE_MAX) { + pr_err("Dev %s: partition %u start overflows u64, skipping partition!\n", + bdevname(state->bdev, b), part); + continue; + } + + if (array3_size(be32_to_cpu(pb->pb_Environment[HI_CYL]), + cylblk, blksize) == SIZE_MAX) { + pr_err("Dev %s: partition %u end overflows u64, skipping partition!\n", + bdevname(state->bdev, b), part); + continue; + } + /* Tell Kernel about it */ - nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 - - be32_to_cpu(pb->pb_Environment[9])) * - be32_to_cpu(pb->pb_Environment[3]) * - be32_to_cpu(pb->pb_Environment[5]) * - blksize; + nr_sects = (u64)((be32_to_cpu(pb->pb_Environment[HI_CYL]) + 1 - + be32_to_cpu(pb->pb_Environment[LO_CYL])) * + be32_to_cpu(pb->pb_Environment[NR_HD]) * + be32_to_cpu(pb->pb_Environment[NR_SECT]) * + blksize); if (!nr_sects) continue; - start_sect = be32_to_cpu(pb->pb_Environment[9]) * - be32_to_cpu(pb->pb_Environment[3]) * - be32_to_cpu(pb->pb_Environment[5]) * - blksize; + start_sect = (u64)(be32_to_cpu(pb->pb_Environment[LO_CYL]) * + be32_to_cpu(pb->pb_Environment[NR_HD]) * + be32_to_cpu(pb->pb_Environment[NR_SECT]) * + blksize); + + /* Warn user if start_sect or nr_sects overflow u32 */ + if ((start_sect + nr_sects) > UINT_MAX) { + pr_warn("Dev %s: partition %u (%llu-%llu) needs 64 bit device support!\n", + bdevname(state->bdev, b), part, + start_sect, nr_sects); + /* Without LBD support, better bail out */ + if (!IS_ENABLED(CONFIG_LBDAF)) { + pr_err("Dev %s: no LBD support, skipping partition %u!", + bdevname(state->bdev, b), part); + continue; + } + } + put_partition(state,slot++,start_sect,nr_sects); { /* Be even more informative to aid mounting */