tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

block: fix signed int overflow in Amiga partition support

The Amiga partition parser module uses signed int for partition sector
address and count, which will overflow for disks larger than 1 TB.

Use sector_t as type for sector address and size to allow using disks
up to 2 TB without LBD support, and disks larger than 2 TB with LBD.

This bug was reported originally in 2012, and the fix was created by
the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been
discussed and reviewed on linux-m68k at that time but never officially
submitted. This patch differs from Joanne's patch only in its use of
sector_t instead of unsigned int. No checking for overflows is done
(see patch 3 of this series for that).

Reported-by: Martin Steigerwald <Martin@lichtvoll.de>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Message-ID: <201206192146.09327.Martin@lichtvoll.de>
Cc: <stable@vger.kernel.org> # 5.2
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Tested-by: Martin Steigerwald <Martin@lichtvoll.de>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230620201725.7020-2-schmitzmic@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Michael Schmitz and committed by
Jens Axboe fc3d092c 6d4e80db

+5 -4
+5 -4
block/partitions/amiga.c
··· 31 31 unsigned char *data; 32 32 struct RigidDiskBlock *rdb; 33 33 struct PartitionBlock *pb; 34 - int start_sect, nr_sects, blk, part, res = 0; 34 + sector_t start_sect, nr_sects; 35 + int blk, part, res = 0; 35 36 int blksize = 1; /* Multiplier for disk block size */ 36 37 int slot = 1; 37 38 ··· 97 96 98 97 /* Tell Kernel about it */ 99 98 100 - nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 - 101 - be32_to_cpu(pb->pb_Environment[9])) * 99 + nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 - 100 + be32_to_cpu(pb->pb_Environment[9])) * 102 101 be32_to_cpu(pb->pb_Environment[3]) * 103 102 be32_to_cpu(pb->pb_Environment[5]) * 104 103 blksize; 105 104 if (!nr_sects) 106 105 continue; 107 - start_sect = be32_to_cpu(pb->pb_Environment[9]) * 106 + start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) * 108 107 be32_to_cpu(pb->pb_Environment[3]) * 109 108 be32_to_cpu(pb->pb_Environment[5]) * 110 109 blksize;