Commit 1071d560 authored by Mikulas Patocka's avatar Mikulas Patocka
Browse files

dm-stripe: fix a possible integer overflow 



There's a possible integer overflow in stripe_io_hints if we have too
large chunk size. Test if the overflow happened, and if it did, don't set
limits->io_min and limits->io_opt;

Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
Reviewed-by: default avatarJohn Garry <john.g.garry@oracle.com>
Suggested-by: default avatarDongsheng Yang <dongsheng.yang@linux.dev>
Cc: stable@vger.kernel.org
parent 8f5ae30d

drivers/md/dm-stripe.c

+7 −3
Original line number Diff line number Diff line
@@ -456,11 +456,15 @@ static void stripe_io_hints(struct dm_target *ti, 
			    struct queue_limits *limits)

{

	struct stripe_c *sc = ti->private;

	unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT;

	unsigned int io_min, io_opt;



	limits->chunk_sectors = sc->chunk_size;

	limits->io_min = chunk_size;

	limits->io_opt = chunk_size * sc->stripes;



	if (!check_shl_overflow(sc->chunk_size, SECTOR_SHIFT, &io_min) &&

	    !check_mul_overflow(io_min, sc->stripes, &io_opt)) {

		limits->io_min = io_min;

		limits->io_opt = io_opt;

	}

}



static struct target_type stripe_target = {