From patchwork Fri Jun 16 22:36:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 13283348 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61627EB64DB for ; Fri, 16 Jun 2023 22:36:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229939AbjFPWgY (ORCPT ); Fri, 16 Jun 2023 18:36:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229705AbjFPWgX (ORCPT ); Fri, 16 Jun 2023 18:36:23 -0400 Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1444F30F8; Fri, 16 Jun 2023 15:36:23 -0700 (PDT) Received: by mail-pg1-x530.google.com with SMTP id 41be03b00d2f7-54fb23ff7d3so807230a12.0; Fri, 16 Jun 2023 15:36:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686954982; x=1689546982; h=references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=+6UCFNg4ScFWTGZ3Vx9Eu23SfSzKM8aQG3DQ2QqYdjs=; b=UllzPgL7zJOBCr9Fe3ZurXLozyCkT1OMePqOvsv+vInpAV4h6Q+OkcrochHVQjsW9/ /5/c9/mg68D8Wqc/4aHY7KWUhg9Ce7aqtJEG4TqwFp1nsBErdrczoIAjCCoZ1dDgtRK/ cS1g7JrLDLf3ROtAePbw9b+G1Xokvn8ADM5y347GHw0DA95lMNApAuZ2HS7tUVfeXvJ+ NqGEugbRaBOI/L58Hyr/ce7ecIKNa0CxIE+Dyr0NMMl3h0Apc9WHeo5HrC2eoWoZQ9f4 HSvRTleKU1v/6TxyXb2V8u48nY4fW9/Fv+wvAqBiP1vY2+mHUp/GSmQrUhts6061+G3W 27PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686954982; x=1689546982; h=references:in-reply-to:message-id:date:subject:cc:to:from :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=+6UCFNg4ScFWTGZ3Vx9Eu23SfSzKM8aQG3DQ2QqYdjs=; b=PnVnVGiY/CKL7V9C13pmsSspJDFO1AAbKbF406OGoClzd7+EmzHlEyDHid/tWT5s/o 8Zi4jMjDJoAk0hkVxF1AoDZNPzM3BNI+7QNCyvHSZSFFRUHzKy4SDvLqoAkHvp3piTOK aIRBQNdkcqBfMO5lQaVNiRwsyEbcAloFfdHMzvc8YDB4NnY55gtu/vxxDt0+tDbvEq+8 mu9kHlRArHGwyVKuoubd8W1Ssc+juyuqZCcPa1hsv9MMpFVtLK+QFECszUJirgjHDx4K c7Snows1nMkB7haxKxUSzctg/yMZcpgCJbe/O9V5h2vC1vkm/r2FggYvJsQOkCiYNN6/ O5WQ== X-Gm-Message-State: AC+VfDydbNEg9f4zXyuQxyhEmwiHh/1qFzEfX5RAFfo78gJEr/fUpKCY HYo7mEdQnpZPK7wi04D6RUc= X-Google-Smtp-Source: ACHHUZ6YFBQAcraTGjtnZuh+eb6ArsdKJ2Sq1aG8S6r33vyrxArWEwkFC9Hc7xKqJRQvySy1pgSFYA== X-Received: by 2002:a17:902:e742:b0:1b5:3d2e:47fc with SMTP id p2-20020a170902e74200b001b53d2e47fcmr1307930plf.36.1686954982458; Fri, 16 Jun 2023 15:36:22 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-152-217-2-adsl.sparkbb.co.nz. [222.152.217.2]) by smtp.gmail.com with ESMTPSA id 12-20020a170902c20c00b001ac2c3e54adsm10396847pll.118.2023.06.16.15.36.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jun 2023 15:36:21 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id B07C83603D9; Sat, 17 Jun 2023 10:36:18 +1200 (NZST) From: Michael Schmitz To: linux-block@vger.kernel.org, axboe@kernel.dk Cc: linux-m68k@vger.kernel.org, geert@linux-m68k.org, hch@lst.de, martin@lichtvoll.de, fthain@linux-m68k.org, Michael Schmitz , stable@vger.kernel.org Subject: [PATCH v12 1/3] block: fix signed int overflow in Amiga partition support Date: Sat, 17 Jun 2023 10:36:14 +1200 Message-Id: <20230616223616.6002-2-schmitzmic@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230616223616.6002-1-schmitzmic@gmail.com> References: <20230616223616.6002-1-schmitzmic@gmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use sector_t as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch differs from Joanne's patch only in its use of sector_t instead of unsigned int. No checking for overflows is done (see patch 3 of this series for that). Reported-by: Martin Steigerwald Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: # 5.2 Signed-off-by: Michael Schmitz Tested-by: Martin Steigerwald Reviewed-by: Geert Uytterhoeven Reviewed-by: Christoph Hellwig --- Changes from v3: - split off change of sector address type as quick fix. - cast to sector_t in sector address calculations. - move overflow checking to separate patch for more thorough review. Changes from v4: Andreas Schwab: - correct cast to sector_t in sector address calculations Changes from v7: Christoph Hellwig - correct style issues Changes from v9: - add Fixes: tags and stable backport prereq --- block/partitions/amiga.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c index 5c8624e26a54..85c5c79aae48 100644 --- a/block/partitions/amiga.c +++ b/block/partitions/amiga.c @@ -31,7 +31,8 @@ int amiga_partition(struct parsed_partitions *state) unsigned char *data; struct RigidDiskBlock *rdb; struct PartitionBlock *pb; - int start_sect, nr_sects, blk, part, res = 0; + sector_t start_sect, nr_sects; + int blk, part, res = 0; int blksize = 1; /* Multiplier for disk block size */ int slot = 1; @@ -96,14 +97,14 @@ int amiga_partition(struct parsed_partitions *state) /* Tell Kernel about it */ - nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 - - be32_to_cpu(pb->pb_Environment[9])) * + nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 - + be32_to_cpu(pb->pb_Environment[9])) * be32_to_cpu(pb->pb_Environment[3]) * be32_to_cpu(pb->pb_Environment[5]) * blksize; if (!nr_sects) continue; - start_sect = be32_to_cpu(pb->pb_Environment[9]) * + start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) * be32_to_cpu(pb->pb_Environment[3]) * be32_to_cpu(pb->pb_Environment[5]) * blksize; From patchwork Fri Jun 16 22:36:15 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 13283349 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2ECD5EB64D7 for ; Fri, 16 Jun 2023 22:36:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232422AbjFPWga (ORCPT ); Fri, 16 Jun 2023 18:36:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229705AbjFPWgZ (ORCPT ); Fri, 16 Jun 2023 18:36:25 -0400 Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C93F2D6B; Fri, 16 Jun 2023 15:36:24 -0700 (PDT) Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-1b53b8465daso4532795ad.0; Fri, 16 Jun 2023 15:36:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686954984; x=1689546984; h=references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=vWQWf1Vi/kzcg0apEc5j5giaZ7iGOcTQZNe9P1refP0=; b=GWVRCyoscwKJoBLRJwCvSv/ZfqYje7AkMQfaLuFUBgOm6Gv0el/rCXLFBWlCe3oY0V 1NYaJL08r9CfYvWCiLDu0CyFhA6bv50Wej+MT279xVwv/KMJJk9PCX8IB3qRr8JdKapC q+ujyDlyRHiyp495Xj86aU0HkpadePbW0fI7s4XO20ErLHBMnjiDh8AXPudXW5z2q0H2 V9CcC4V5yZ7+rmM/OlCcqiUR7/UC75t+qXmK8R3kJg7TCDrzAVxF+7UvTBHPdE2YgVIS Y+9QUqQp5ULqJ3i5mnqcCKJEYG4j2pw+Pw6E7WS6K+43kHO7ONH7n/zfd/sWlRVZURqy JpGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686954984; x=1689546984; h=references:in-reply-to:message-id:date:subject:cc:to:from :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=vWQWf1Vi/kzcg0apEc5j5giaZ7iGOcTQZNe9P1refP0=; b=HPPD8RDL80BjvDsYhrOvaKOIJvclVgdImSWvf0NCY9b+8QHNN7zPsiXzgOMkL+kaN5 lMcYu33e/aXdCKb3V5NiBmTgc/1ZXW1svl8vThVXfiN1kbnrFJyiVStLng0dYsO5bdlJ 03b5uHq7zevxYH4UFb1AVC03s4srP/FAE0o4hqXt607kRDyQ4QITC4kQ3fmfNoEJJyPc g3kyuXmOUOokV+x4prDsYhbpAeH2cXV7yWaWdF3IPDhPCNputCRwRc0UEgVfBbIFy/eJ /nW1lNKFkQbGa/3GbhrB8/dswu3iMyTxM7/T4mml6p/nR28pMutkUHpqKbM3yxDCH1JQ IBqg== X-Gm-Message-State: AC+VfDzYC1absF6njCdeJ2wBAdpWBXn+JmI31Sxa1Tc7jBR/tXWrLLO0 AA+Zv07qaCw186rz+VB1O/I= X-Google-Smtp-Source: ACHHUZ4PrWy6cnU0tGBrtpxrqitq2cxjKgSh19R9P4wYnhj3NvktuxAHHoOt90s/5yB5quO8JWk3Uw== X-Received: by 2002:a17:902:9891:b0:1b2:439f:aa6f with SMTP id s17-20020a170902989100b001b2439faa6fmr2547078plp.44.1686954983650; Fri, 16 Jun 2023 15:36:23 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-152-217-2-adsl.sparkbb.co.nz. [222.152.217.2]) by smtp.gmail.com with ESMTPSA id w17-20020a1709027b9100b001aae64e9b36sm6120764pll.114.2023.06.16.15.36.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jun 2023 15:36:22 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id 6D5D736045A; Sat, 17 Jun 2023 10:36:19 +1200 (NZST) From: Michael Schmitz To: linux-block@vger.kernel.org, axboe@kernel.dk Cc: linux-m68k@vger.kernel.org, geert@linux-m68k.org, hch@lst.de, martin@lichtvoll.de, fthain@linux-m68k.org, Michael Schmitz , stable@vger.kernel.org Subject: [PATCH v12 2/3] block: change annotation of rdb_CylBlocks in affs_hardblocks.h Date: Sat, 17 Jun 2023 10:36:15 +1200 Message-Id: <20230616223616.6002-3-schmitzmic@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230616223616.6002-1-schmitzmic@gmail.com> References: <20230616223616.6002-1-schmitzmic@gmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted (now resubmitted as patch 1 of this series). Patch 3 (this series) adds additional error checking and warning messages. One of the error checks now makes use of the previously unused rdb_CylBlocks field, which causes a 'sparse' warning (cast to restricted __be32). Annotate all 32 bit fields in affs_hardblocks.h as __be32, as the on-disk format of RDB and partition blocks is always big endian. Reported-by: Martin Steigerwald Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: # 5.2 Signed-off-by: Michael Schmitz Reviewed-by: Christoph Hellwig Reviewed-by: Geert Uytterhoeven --- Changes from v10: Christoph Hellwig: - change annotation of all __u32 fields to __be32 Changes from v11: Geert Uytterhoeven: - also change annotation of the two __s32 checksum fields --- include/uapi/linux/affs_hardblocks.h | 68 ++++++++++++++-------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/include/uapi/linux/affs_hardblocks.h b/include/uapi/linux/affs_hardblocks.h index 5e2fb8481252..a5aff2eb5f70 100644 --- a/include/uapi/linux/affs_hardblocks.h +++ b/include/uapi/linux/affs_hardblocks.h @@ -7,42 +7,42 @@ /* Just the needed definitions for the RDB of an Amiga HD. */ struct RigidDiskBlock { - __u32 rdb_ID; + __be32 rdb_ID; __be32 rdb_SummedLongs; - __s32 rdb_ChkSum; - __u32 rdb_HostID; + __be32 rdb_ChkSum; + __be32 rdb_HostID; __be32 rdb_BlockBytes; - __u32 rdb_Flags; - __u32 rdb_BadBlockList; + __be32 rdb_Flags; + __be32 rdb_BadBlockList; __be32 rdb_PartitionList; - __u32 rdb_FileSysHeaderList; - __u32 rdb_DriveInit; - __u32 rdb_Reserved1[6]; - __u32 rdb_Cylinders; - __u32 rdb_Sectors; - __u32 rdb_Heads; - __u32 rdb_Interleave; - __u32 rdb_Park; - __u32 rdb_Reserved2[3]; - __u32 rdb_WritePreComp; - __u32 rdb_ReducedWrite; - __u32 rdb_StepRate; - __u32 rdb_Reserved3[5]; - __u32 rdb_RDBBlocksLo; - __u32 rdb_RDBBlocksHi; - __u32 rdb_LoCylinder; - __u32 rdb_HiCylinder; - __u32 rdb_CylBlocks; - __u32 rdb_AutoParkSeconds; - __u32 rdb_HighRDSKBlock; - __u32 rdb_Reserved4; + __be32 rdb_FileSysHeaderList; + __be32 rdb_DriveInit; + __be32 rdb_Reserved1[6]; + __be32 rdb_Cylinders; + __be32 rdb_Sectors; + __be32 rdb_Heads; + __be32 rdb_Interleave; + __be32 rdb_Park; + __be32 rdb_Reserved2[3]; + __be32 rdb_WritePreComp; + __be32 rdb_ReducedWrite; + __be32 rdb_StepRate; + __be32 rdb_Reserved3[5]; + __be32 rdb_RDBBlocksLo; + __be32 rdb_RDBBlocksHi; + __be32 rdb_LoCylinder; + __be32 rdb_HiCylinder; + __be32 rdb_CylBlocks; + __be32 rdb_AutoParkSeconds; + __be32 rdb_HighRDSKBlock; + __be32 rdb_Reserved4; char rdb_DiskVendor[8]; char rdb_DiskProduct[16]; char rdb_DiskRevision[4]; char rdb_ControllerVendor[8]; char rdb_ControllerProduct[16]; char rdb_ControllerRevision[4]; - __u32 rdb_Reserved5[10]; + __be32 rdb_Reserved5[10]; }; #define IDNAME_RIGIDDISK 0x5244534B /* "RDSK" */ @@ -50,16 +50,16 @@ struct RigidDiskBlock { struct PartitionBlock { __be32 pb_ID; __be32 pb_SummedLongs; - __s32 pb_ChkSum; - __u32 pb_HostID; + __be32 pb_ChkSum; + __be32 pb_HostID; __be32 pb_Next; - __u32 pb_Flags; - __u32 pb_Reserved1[2]; - __u32 pb_DevFlags; + __be32 pb_Flags; + __be32 pb_Reserved1[2]; + __be32 pb_DevFlags; __u8 pb_DriveName[32]; - __u32 pb_Reserved2[15]; + __be32 pb_Reserved2[15]; __be32 pb_Environment[17]; - __u32 pb_EReserved[15]; + __be32 pb_EReserved[15]; }; #define IDNAME_PARTITION 0x50415254 /* "PART" */ From patchwork Fri Jun 16 22:36:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 13283350 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 712FDEB64DA for ; Fri, 16 Jun 2023 22:36:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231649AbjFPWgc (ORCPT ); Fri, 16 Jun 2023 18:36:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34346 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231912AbjFPWg0 (ORCPT ); Fri, 16 Jun 2023 18:36:26 -0400 Received: from mail-pf1-x42c.google.com (mail-pf1-x42c.google.com [IPv6:2607:f8b0:4864:20::42c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 63E1430FD; Fri, 16 Jun 2023 15:36:25 -0700 (PDT) Received: by mail-pf1-x42c.google.com with SMTP id d2e1a72fcca58-666683eb028so1138304b3a.0; Fri, 16 Jun 2023 15:36:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686954985; x=1689546985; h=references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to; bh=3LLDiVG+RQa/fzfc+Aret+vyoXqbU6usti8V8wN1jVg=; b=hYfPZ1GthrDXNW2Cq9FPRXbeIFvqiBknYw4+m6A/+d8AapL/B9dU/TO/aQtLGIlbM3 Loz1v5A6doepPWWIvFZUmOX0Sa2/vXAGwAC0wtzpvwRDVgW4hBmQ24aL+DWzmSmmjAfR 84VCmM8/kjcd6zTbdU+4A9xS8sgcIenTgargXnxmZo9qO7UEMokgROA245JyeSjbgPkM Yoxej384hseOx2s5tY6FzqnH5ss/9gc71xCfTIKPZzAqhC8skGGy07sb7NKgrOwKF3nv bpEcbzh5shZdXohtDm163lQsxJVFn6uNz4GHjuXOb/baRSYmv3VfSflYHi0SaD795ytW Gvxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686954985; x=1689546985; h=references:in-reply-to:message-id:date:subject:cc:to:from :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=3LLDiVG+RQa/fzfc+Aret+vyoXqbU6usti8V8wN1jVg=; b=Em81FfNeyQQLeMP2tLPsv/y3U8+ZfJKORwst/Hjekvtnh402oSQ8Hr9oAl5j4NHvaB TTpMwTcj7LUXnDRRmvoLEnZzJgVvwP5MgTe/gTM91T2lgQJK+qjAV+f1zNGVFP5pk7OM t9ZwUS2rl3jVKk6tjb9yCSrQjSqUFY/CAy/ITuILwnO6CzfZSdL6S1+rOtIiiOrcn/hr 12k+GuOSZj9BXxvYE1/DmnVSQhSJZi8FZNvA7zfneKjcUa1eGI2EnmPuPFnedpUd7jlQ hgmupAxXQeRUACBBNTfAoywxhTr+UPb5a4tqpXGEZbviPXqnan8WZrpvTzyt6ShbBzmA 5Uaw== X-Gm-Message-State: AC+VfDzp6HjCwy753cFnmg2TsAf8YtsvmdFk6HjVl4hmnV6z9p1svrSl ojIxGVF3fOnqd0xQmcBpnEY= X-Google-Smtp-Source: ACHHUZ4j/c3eaO1aMc52MGEKTC5l/E5Fiq0xI7Y3JeGPWD2RZkTcnh1ZGKYUaP4vDZvxkT0eGQXlSw== X-Received: by 2002:a05:6a00:1ace:b0:64f:daa9:d7af with SMTP id f14-20020a056a001ace00b0064fdaa9d7afmr3659307pfv.7.1686954984784; Fri, 16 Jun 2023 15:36:24 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-152-217-2-adsl.sparkbb.co.nz. [222.152.217.2]) by smtp.gmail.com with ESMTPSA id c4-20020a62e804000000b00666b012baedsm1822239pfi.158.2023.06.16.15.36.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Jun 2023 15:36:24 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id 3A89C36045B; Sat, 17 Jun 2023 10:36:20 +1200 (NZST) From: Michael Schmitz To: linux-block@vger.kernel.org, axboe@kernel.dk Cc: linux-m68k@vger.kernel.org, geert@linux-m68k.org, hch@lst.de, martin@lichtvoll.de, fthain@linux-m68k.org, Michael Schmitz , stable@vger.kernel.org Subject: [PATCH v12 3/3] block: add overflow checks for Amiga partition support Date: Sat, 17 Jun 2023 10:36:16 +1200 Message-Id: <20230616223616.6002-4-schmitzmic@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20230616223616.6002-1-schmitzmic@gmail.com> References: <20230616223616.6002-1-schmitzmic@gmail.com> Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. Bail out if sector addresses overflow 32 bits on kernels without LBD support. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted (now resubmitted as patch 1 in this series). This patch adds additional error checking and warning messages. Reported-by: Martin Steigerwald Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: # 5.2 Signed-off-by: Michael Schmitz Reviewed-by: Geert Uytterhoeven Reviewed-by: Christoph Hellwig --- Changes from RFC: - use u64 instead of sector_t, since that may be u32 without LBD support - check multiplication overflows each step - 3 u32 values may exceed u64! - warn against use on AmigaDOS if partition data overflow u32 sector count. - warn if partition CylBlocks larger than what's stored in the RDSK header. - bail out if we were to overflow sector_t (32 or 64 bit). Changes from v1: Kars de Jong: - use defines for magic offsets in DosEnvec struct Geert Uytterhoeven: - use u64 cast for multiplications of u32 numbers - use array3_size for overflow checks - change pr_err to pr_warn - discontinue use of pr_cont - reword log messages - drop redundant nr_sects overflow test - warn against 32 bit overflow for each affected partition - skip partitions that overflow sector_t size instead of aborting scan Changes from v2: - further trim 32 bit overflow test - correct duplicate types.h inclusion introduced in v2 Changes from v3: - split off sector address type fix for independent review - change blksize to unsigned - use check_mul_overflow() instead of array3_size() - rewrite checks to avoid 64 bit divisions in check_mul_overflow() Changes from v5: Geert Uytterhoeven: - correct ineffective u64 cast to avoid 32 bit mult. overflow - fix mult. overflow in partition block address calculation Changes from v6: Geert Uytterhoeven: - don't fail hard on partition block address overflow Changes from v7: - replace bdevname(state->bdev, b) by state->disk->disk_name - drop warn_no_part conditionals - remove remaining warn_no_part Changes from v8: Christoph Hellwig: - whitespace fix, drop unnecessary u64 casts kbuild warning: - sparse warning fix Changes from v9: - revert ineffective sparse warning fix, and rely on change to annotation of rdb_CylBlocks (patch 2 this series) instead. - add Fixes: tags and stable backport prereq --- block/partitions/amiga.c | 103 ++++++++++++++++++++++++++++++++------- 1 file changed, 85 insertions(+), 18 deletions(-) diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c index 85c5c79aae48..ed222b9c901b 100644 --- a/block/partitions/amiga.c +++ b/block/partitions/amiga.c @@ -11,10 +11,18 @@ #define pr_fmt(fmt) fmt #include +#include +#include #include #include "check.h" +/* magic offsets in partition DosEnvVec */ +#define NR_HD 3 +#define NR_SECT 5 +#define LO_CYL 9 +#define HI_CYL 10 + static __inline__ u32 checksum_block(__be32 *m, int size) { @@ -31,9 +39,12 @@ int amiga_partition(struct parsed_partitions *state) unsigned char *data; struct RigidDiskBlock *rdb; struct PartitionBlock *pb; - sector_t start_sect, nr_sects; - int blk, part, res = 0; - int blksize = 1; /* Multiplier for disk block size */ + u64 start_sect, nr_sects; + sector_t blk, end_sect; + u32 cylblk; /* rdb_CylBlocks = nr_heads*sect_per_track */ + u32 nr_hd, nr_sect, lo_cyl, hi_cyl; + int part, res = 0; + unsigned int blksize = 1; /* Multiplier for disk block size */ int slot = 1; for (blk = 0; ; blk++, put_dev_sector(sect)) { @@ -41,7 +52,7 @@ int amiga_partition(struct parsed_partitions *state) goto rdb_done; data = read_part_sector(state, blk, §); if (!data) { - pr_err("Dev %s: unable to read RDB block %d\n", + pr_err("Dev %s: unable to read RDB block %llu\n", state->disk->disk_name, blk); res = -1; goto rdb_done; @@ -58,12 +69,12 @@ int amiga_partition(struct parsed_partitions *state) *(__be32 *)(data+0xdc) = 0; if (checksum_block((__be32 *)data, be32_to_cpu(rdb->rdb_SummedLongs) & 0x7F)==0) { - pr_err("Trashed word at 0xd0 in block %d ignored in checksum calculation\n", + pr_err("Trashed word at 0xd0 in block %llu ignored in checksum calculation\n", blk); break; } - pr_err("Dev %s: RDB in block %d has bad checksum\n", + pr_err("Dev %s: RDB in block %llu has bad checksum\n", state->disk->disk_name, blk); } @@ -80,10 +91,15 @@ int amiga_partition(struct parsed_partitions *state) blk = be32_to_cpu(rdb->rdb_PartitionList); put_dev_sector(sect); for (part = 1; blk>0 && part<=16; part++, put_dev_sector(sect)) { - blk *= blksize; /* Read in terms partition table understands */ + /* Read in terms partition table understands */ + if (check_mul_overflow(blk, (sector_t) blksize, &blk)) { + pr_err("Dev %s: overflow calculating partition block %llu! Skipping partitions %u and beyond\n", + state->disk->disk_name, blk, part); + break; + } data = read_part_sector(state, blk, §); if (!data) { - pr_err("Dev %s: unable to read partition block %d\n", + pr_err("Dev %s: unable to read partition block %llu\n", state->disk->disk_name, blk); res = -1; goto rdb_done; @@ -95,19 +111,70 @@ int amiga_partition(struct parsed_partitions *state) if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 ) continue; - /* Tell Kernel about it */ + /* RDB gives us more than enough rope to hang ourselves with, + * many times over (2^128 bytes if all fields max out). + * Some careful checks are in order, so check for potential + * overflows. + * We are multiplying four 32 bit numbers to one sector_t! + */ + + nr_hd = be32_to_cpu(pb->pb_Environment[NR_HD]); + nr_sect = be32_to_cpu(pb->pb_Environment[NR_SECT]); + + /* CylBlocks is total number of blocks per cylinder */ + if (check_mul_overflow(nr_hd, nr_sect, &cylblk)) { + pr_err("Dev %s: heads*sects %u overflows u32, skipping partition!\n", + state->disk->disk_name, cylblk); + continue; + } + + /* check for consistency with RDB defined CylBlocks */ + if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) { + pr_warn("Dev %s: cylblk %u > rdb_CylBlocks %u!\n", + state->disk->disk_name, cylblk, + be32_to_cpu(rdb->rdb_CylBlocks)); + } + + /* RDB allows for variable logical block size - + * normalize to 512 byte blocks and check result. + */ + + if (check_mul_overflow(cylblk, blksize, &cylblk)) { + pr_err("Dev %s: partition %u bytes per cyl. overflows u32, skipping partition!\n", + state->disk->disk_name, part); + continue; + } + + /* Calculate partition start and end. Limit of 32 bit on cylblk + * guarantees no overflow occurs if LBD support is enabled. + */ + + lo_cyl = be32_to_cpu(pb->pb_Environment[LO_CYL]); + start_sect = ((u64) lo_cyl * cylblk); + + hi_cyl = be32_to_cpu(pb->pb_Environment[HI_CYL]); + nr_sects = (((u64) hi_cyl - lo_cyl + 1) * cylblk); - nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 - - be32_to_cpu(pb->pb_Environment[9])) * - be32_to_cpu(pb->pb_Environment[3]) * - be32_to_cpu(pb->pb_Environment[5]) * - blksize; if (!nr_sects) continue; - start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) * - be32_to_cpu(pb->pb_Environment[3]) * - be32_to_cpu(pb->pb_Environment[5]) * - blksize; + + /* Warn user if partition end overflows u32 (AmigaDOS limit) */ + + if ((start_sect + nr_sects) > UINT_MAX) { + pr_warn("Dev %s: partition %u (%llu-%llu) needs 64 bit device support!\n", + state->disk->disk_name, part, + start_sect, start_sect + nr_sects); + } + + if (check_add_overflow(start_sect, nr_sects, &end_sect)) { + pr_err("Dev %s: partition %u (%llu-%llu) needs LBD device support, skipping partition!\n", + state->disk->disk_name, part, + start_sect, end_sect); + continue; + } + + /* Tell Kernel about it */ + put_partition(state,slot++,start_sect,nr_sects); { /* Be even more informative to aid mounting */