From patchwork Sat Sep 29 23:56:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 10621027 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E42ED180E for ; Sat, 29 Sep 2018 23:56:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D3FC029D01 for ; Sat, 29 Sep 2018 23:56:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C643529D06; Sat, 29 Sep 2018 23:56:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0A2B129D03 for ; Sat, 29 Sep 2018 23:56:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726686AbeI3G04 (ORCPT ); Sun, 30 Sep 2018 02:26:56 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:37049 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726009AbeI3G0z (ORCPT ); Sun, 30 Sep 2018 02:26:55 -0400 Received: by mail-pf1-f194.google.com with SMTP id x26-v6so6689175pfn.4; Sat, 29 Sep 2018 16:56:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=MVKuyCPY4VQT5fh6srGFZjipcp+9/X7ArZpjlW6EE3c=; b=pkHjyfaoU/HeMvJO+HpIAOZdFVyihslfr9gmPbPfOkarpyvhd2CdfZ4ujfcHVoUXAh xn+P3/YIfg6DEb8IIXM4ODtutCqISG96y+r6amQAQSQgi4VIv/I6nrHcB3eAYr7e4dLN 5ccnAQyabkVhVZdk0Gf94QzBUgmCT8GFGf0SL7n8RIB5Z/bxC/rTwuYaeK+zirbk8LWL BN8zegJFeLY/xYeSm5mpxNhf1tmrnXC6G96xYB00TdJgBwaBlApfwmYfNbTJSKGdhZSi PjQH6kFQu92DocxYQpH5F7tVF9gU5tSwZvgyita7vMyF6tFe0kFxGxgWh3m4F0rTZfAJ VKkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=MVKuyCPY4VQT5fh6srGFZjipcp+9/X7ArZpjlW6EE3c=; b=pjhnNugs2qxUUx5k9rom220udZ40Guxw7Sqz4HlYwCyIPuty10LS1K8sllpw6mOrmk SuGW5WwEiQCUhPH708klJ0ppl/F7cE8T9qvlbLMbAFCJqQ7pMc+b6mBCCQiNV6bwmf0y 19j2moDYV2kUCFXuG2ZIgB0WK5tLGntllIPjVlmMMtq+sZMxtvfZ2dVqqZWnPe9CBWsF HFFlhaGmFD28TEpJQbli9xMhfqN3fcVddH0gY62VC7zyqTgTCFCJJR2OaWMrB8EN5Neq otrUvloCA6BegWe/owhfEZ9SDLIJJU3VSWU9ZIaG0+XdrRQbZDMysui+vV7x1yEILWGk VhNA== X-Gm-Message-State: ABuFfohbufk9N+639f1p0ITufPcfvApFE3w7Pw9meY0NQc0YQd8s2Ga3 ZIeltdGVpyXCAGEdrmJXaTI= X-Google-Smtp-Source: ACcGV60rSW0g3ftIEpYfsRCX0Vs9pPmpBIzUvNBzJciLBnfyxNLMnbKoIQdVt2Y2VSxJJY8wATLB6g== X-Received: by 2002:a62:adc:: with SMTP id 89-v6mr2740918pfk.56.1538265387652; Sat, 29 Sep 2018 16:56:27 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-154-41-72-adsl.sparkbb.co.nz. [222.154.41.72]) by smtp.gmail.com with ESMTPSA id t85-v6sm15061141pfi.73.2018.09.29.16.56.26 (version=TLS1 cipher=AES128-SHA bits=128/128); Sat, 29 Sep 2018 16:56:27 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id 5F10F360082; Sun, 30 Sep 2018 12:56:23 +1300 (NZDT) From: Michael Schmitz To: linux-block@vger.kernel.org, axboe@kernel.dk Cc: linux-m68k@vger.kernel.org, geert@linux-m68k.org, Michael Schmitz Subject: [PATCH v4 1/2] block: fix signed int overflow in Amiga partition support Date: Sun, 30 Sep 2018 12:56:17 +1300 Message-Id: <1538265378-20544-2-git-send-email-schmitzmic@gmail.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1538265378-20544-1-git-send-email-schmitzmic@gmail.com> References: <1538265378-20544-1-git-send-email-schmitzmic@gmail.com> Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use sector_t as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch differs from Joanne's patch only in its use of sector_t instead of unsigned int. No checking for overflows is done (see patch 2 of this series for that). Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Reported-by: Martin Steigerwald Message-ID: <201206192146.09327.Martin@lichtvoll.de> Signed-off-by: Michael Schmitz Tested-by: Martin Steigerwald --- Changes from v3: - split off change of sector address type as quick fix. - cast to sector_t in sector address calculations. - move overflow checking to separate patch for more thorough review. --- block/partitions/amiga.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c index 5609366..902ddeb 100644 --- a/block/partitions/amiga.c +++ b/block/partitions/amiga.c @@ -32,7 +32,8 @@ int amiga_partition(struct parsed_partitions *state) unsigned char *data; struct RigidDiskBlock *rdb; struct PartitionBlock *pb; - int start_sect, nr_sects, blk, part, res = 0; + sector_t start_sect, nr_sects; + int blk, part, res = 0; int blksize = 1; /* Multiplier for disk block size */ int slot = 1; char b[BDEVNAME_SIZE]; @@ -100,17 +101,17 @@ int amiga_partition(struct parsed_partitions *state) /* Tell Kernel about it */ - nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 - - be32_to_cpu(pb->pb_Environment[9])) * + nr_sects = (sector_t) ((be32_to_cpu(pb->pb_Environment[10]) + + 1 - be32_to_cpu(pb->pb_Environment[9])) * be32_to_cpu(pb->pb_Environment[3]) * be32_to_cpu(pb->pb_Environment[5]) * - blksize; + blksize); if (!nr_sects) continue; - start_sect = be32_to_cpu(pb->pb_Environment[9]) * + start_sect = (sector_t) (be32_to_cpu(pb->pb_Environment[9]) * be32_to_cpu(pb->pb_Environment[3]) * be32_to_cpu(pb->pb_Environment[5]) * - blksize; + blksize); put_partition(state,slot++,start_sect,nr_sects); { /* Be even more informative to aid mounting */ From patchwork Sat Sep 29 23:56:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 10621029 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C7085913 for ; Sat, 29 Sep 2018 23:56:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B9D7129D01 for ; Sat, 29 Sep 2018 23:56:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ADE2729D03; Sat, 29 Sep 2018 23:56:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2B16229D05 for ; Sat, 29 Sep 2018 23:56:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726009AbeI3G04 (ORCPT ); Sun, 30 Sep 2018 02:26:56 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:46776 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726673AbeI3G04 (ORCPT ); Sun, 30 Sep 2018 02:26:56 -0400 Received: by mail-pf1-f194.google.com with SMTP id r64-v6so275187pfb.13; Sat, 29 Sep 2018 16:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=CRfTet/YciIHDBxQmJcZxXFvbu7pGmtRHC93H+tKkeo=; b=b8/8ENjCXRITMIp+PhO7PMoNFvEqHrXCebo97mg5DiBPYnOmmYWFFXXIc4Mx9dA388 tEjs+xG0dxPChpem+v2g2n5Wt+vMaoRJM+cR2IIyPjUfFm6N6eezbItt4BpL/5pThYV2 lUheK/QbVzvGNwePE84g4dWJ4uMUqyjZYjWCexOnbfIoRaSbq1H2ffg7dYr5lKp2bC5N Y4b7i06Wdqim1e4+6HH5eHEQoKhfg1rxxgyWA4lZs/SKjjPDG4F2we9UhiSpIqFWwg9d gM0Y8So8K0NZ5nuAZvDWah9EZzCZO2kXMxIamF0/1R6bZJ7oK2XEryKuMTr0qIsJQFfU da7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=CRfTet/YciIHDBxQmJcZxXFvbu7pGmtRHC93H+tKkeo=; b=Axra6nuO+xM2lrsF2yiUHIK0SXXRk3rCZdyjKWtYXCx2ZjfJcec5Ehz6Z7qw/S2vFJ WEpYV7mySwmk6PC9ALqqDkNDqZ4L//pxC5v6X26kEzhlC3xvoswCTpO/flopQ4dg7MVk iIdiEkdt09jSIYYvcV78Xs58yzy3YhTzc3SckxWK3xHuSQ8oSl8M/6WWJowo/zRJthqS bvO0OxZE+eQD2pyXwdwSEyYGL92pwwZicRoPdMLwv0C+W9AAGDgIBQkQn2T/Bpj+go1F SBOpRpa8+7IwUOIXpDCjx8QQM4dgAYJZjbSAgWb1gnwnWUmKlYTD+IPxMB6w8r0Qndxa 3CCQ== X-Gm-Message-State: ABuFfogmc8z10TyKaHxc6K8El5Aa/0dGUIB3ahorg92kDt/PbFWkgper dIzLWNHYXxqJzGKQZJLK8MI= X-Google-Smtp-Source: ACcGV62THXMOfoP9+BGxW46UHBoRM8VEt1NRwin6QovigkhlxcUuyPlP4lNQlREhx2ZawFYgQdU2GQ== X-Received: by 2002:a63:a309:: with SMTP id s9-v6mr4539405pge.106.1538265388132; Sat, 29 Sep 2018 16:56:28 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-154-41-72-adsl.sparkbb.co.nz. [222.154.41.72]) by smtp.gmail.com with ESMTPSA id 74-v6sm4064978pfx.182.2018.09.29.16.56.27 (version=TLS1 cipher=AES128-SHA bits=128/128); Sat, 29 Sep 2018 16:56:27 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id 13DF2360084; Sun, 30 Sep 2018 12:56:24 +1300 (NZDT) From: Michael Schmitz To: linux-block@vger.kernel.org, axboe@kernel.dk Cc: linux-m68k@vger.kernel.org, geert@linux-m68k.org, Michael Schmitz Subject: [PATCH v4 2/2] block: add overflow checks for Amiga partition support Date: Sun, 30 Sep 2018 12:56:18 +1300 Message-Id: <1538265378-20544-3-git-send-email-schmitzmic@gmail.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1538265378-20544-1-git-send-email-schmitzmic@gmail.com> References: <1538265378-20544-1-git-send-email-schmitzmic@gmail.com> Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. Bail out if sector addresses overflow 32 bits on kernels without LBD support. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted (now resubmitted as separate patch). This patch adds additional error checking and warning messages. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Reported-by: Martin Steigerwald Message-ID: <201206192146.09327.Martin@lichtvoll.de> Signed-off-by: Michael Schmitz --- Changes from RFC: - use u64 instead of sector_t, since that may be u32 without LBD support - check multiplication overflows each step - 3 u32 values may exceed u64! - warn against use on AmigaDOS if partition data overflow u32 sector count. - warn if partition CylBlocks larger than what's stored in the RDSK header. - bail out if we were to overflow sector_t (32 or 64 bit). Changes from v1: Kars de Jong: - use defines for magic offsets in DosEnvec struct Geert Uytterhoeven: - use u64 cast for multiplications of u32 numbers - use array3_size for overflow checks - change pr_err to pr_warn - discontinue use of pr_cont - reword log messages - drop redundant nr_sects overflow test - warn against 32 bit overflow for each affected partition - skip partitions that overflow sector_t size instead of aborting scan Changes from v2: - further trim 32 bit overflow test - correct duplicate types.h inclusion introduced in v2 Changes from v3: - split off sector address type fix for independent review - change blksize to unsigned - use check_mul_overflow() instead of array3_size() - rewrite checks to avoid 64 bit divisions in check_mul_overflow() --- block/partitions/amiga.c | 86 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 74 insertions(+), 12 deletions(-) diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c index 902ddeb..193e6c3 100644 --- a/block/partitions/amiga.c +++ b/block/partitions/amiga.c @@ -11,11 +11,19 @@ #define pr_fmt(fmt) fmt #include +#include +#include #include #include "check.h" #include "amiga.h" +/* magic offsets in partition DosEnvVec */ +#define NR_HD 3 +#define NR_SECT 5 +#define LO_CYL 9 +#define HI_CYL 10 + static __inline__ u32 checksum_block(__be32 *m, int size) { @@ -32,9 +40,12 @@ int amiga_partition(struct parsed_partitions *state) unsigned char *data; struct RigidDiskBlock *rdb; struct PartitionBlock *pb; - sector_t start_sect, nr_sects; + u64 start_sect, nr_sects; + sector_t end_sect; + u32 cylblk; /* rdb_CylBlocks = nr_heads*sect_per_track */ + u32 nr_hd, nr_sect, lo_cyl, hi_cyl; int blk, part, res = 0; - int blksize = 1; /* Multiplier for disk block size */ + unsigned int blksize = 1; /* Multiplier for disk block size */ int slot = 1; char b[BDEVNAME_SIZE]; @@ -99,19 +110,70 @@ int amiga_partition(struct parsed_partitions *state) if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 ) continue; - /* Tell Kernel about it */ + /* RDB gives us more than enough rope to hang ourselves with, + * many times over (2^128 bytes if all fields max out). + * Some careful checks are in order, so check for potential + * overflows. + * We are multiplying four 32 bit numbers to one sector_t! + */ + + nr_hd = be32_to_cpu(pb->pb_Environment[NR_HD]); + nr_sect = be32_to_cpu(pb->pb_Environment[NR_SECT]); + + /* CylBlocks is total number of blocks per cylinder */ + if (check_mul_overflow(nr_hd, nr_sect, &cylblk)) { + pr_err("Dev %s: heads*sects %u overflows u32, skipping partition!\n", + bdevname(state->bdev, b), cylblk); + continue; + } + + /* check for consistency with RDB defined CylBlocks */ + if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) { + pr_warn("Dev %s: cylblk %u > rdb_CylBlocks %u!\n", + bdevname(state->bdev, b), cylblk, + be32_to_cpu(rdb->rdb_CylBlocks)); + } + + /* RDB allows for variable logical block size - + * normalize to 512 byte blocks and check result. + */ + + if (check_mul_overflow(cylblk, blksize, &cylblk)) { + pr_err("Dev %s: partition %u bytes per cyl. overflows u32, skipping partition!\n", + bdevname(state->bdev, b), part); + continue; + } + + /* Calculate partition start and end. Limit of 32 bit on cylblk + * guarantees no overflow occurs if LBD support is enabled. + */ + + lo_cyl = be32_to_cpu(pb->pb_Environment[LO_CYL]); + start_sect = (u64) (lo_cyl * cylblk); + + hi_cyl = be32_to_cpu(pb->pb_Environment[HI_CYL]); + nr_sects = (u64) ((hi_cyl - lo_cyl + 1) * cylblk); - nr_sects = (sector_t) ((be32_to_cpu(pb->pb_Environment[10]) - + 1 - be32_to_cpu(pb->pb_Environment[9])) * - be32_to_cpu(pb->pb_Environment[3]) * - be32_to_cpu(pb->pb_Environment[5]) * - blksize); if (!nr_sects) continue; - start_sect = (sector_t) (be32_to_cpu(pb->pb_Environment[9]) * - be32_to_cpu(pb->pb_Environment[3]) * - be32_to_cpu(pb->pb_Environment[5]) * - blksize); + + /* Warn user if partition end overflows u32 (AmigaDOS limit) */ + + if ((start_sect + nr_sects) > UINT_MAX) { + pr_warn("Dev %s: partition %u (%llu-%llu) needs 64 bit device support!\n", + bdevname(state->bdev, b), part, + start_sect, start_sect + nr_sects); + } + + if (check_add_overflow(start_sect, nr_sects, &end_sect)) { + pr_err("Dev %s: partition %u (%llu-%llu) needs LBD device support, skipping partition!\n", + bdevname(state->bdev, b), part, + start_sect, (u64) end_sect); + continue; + } + + /* Tell Kernel about it */ + put_partition(state,slot++,start_sect,nr_sects); { /* Be even more informative to aid mounting */