From patchwork Mon Jul 2 05:29:10 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Schmitz X-Patchwork-Id: 10500453 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 142186035E for ; Mon, 2 Jul 2018 05:29:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E97352878E for ; Mon, 2 Jul 2018 05:29:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DD49028793; Mon, 2 Jul 2018 05:29:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4D07F287A4 for ; Mon, 2 Jul 2018 05:29:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752211AbeGBF3T (ORCPT ); Mon, 2 Jul 2018 01:29:19 -0400 Received: from mail-pf0-f194.google.com ([209.85.192.194]:32971 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751917AbeGBF3R (ORCPT ); Mon, 2 Jul 2018 01:29:17 -0400 Received: by mail-pf0-f194.google.com with SMTP id b17-v6so6937086pfi.0; Sun, 01 Jul 2018 22:29:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Hs4wW+iwKWz902x2Peu52FSbUfKFtSbapmulbKA+U0U=; b=oGsH7E5w53aezdY+IT2KBSTY2UQuAAar9yZCqvFALX/Qj3n5MPQB5PH0a6DKox82bh Vgk1SjI35mv4O/N5sro48bQvxUCXEdxc3V6ier45DGA24LJvUCGBmptl/XCjAw7vuyTA d3naPcU43a4/xNGw6PlPQW3WptmRgoij8gTnZRxKZO5XP7isi2l6xPsuWEOw/EQpGfOd YytTh2PecR8TD0uFoar5WVzDL7WtW+mofXbMnrbJ71IDxEWrRZHyEdYXxyPL+qDO1FWg wI74LZxbOteejoh+HIn3fkb9n9Rl9OHUI0HdSSvQVh1zYr0zLfsf/EjmeGc+FOFOItmJ c3ng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Hs4wW+iwKWz902x2Peu52FSbUfKFtSbapmulbKA+U0U=; b=Qs8wyKCXOSi8Rm2V0qGjkMpTnZcu0zVdSraqCFOCat9BXvA7oW/+GMtqkRWL6jFpWj VpZmsh28tfHceg1Qh2Uk0cTW7Kj6S/m0MZ7X203ElJS1w0rryVbkT8Jo+8RyK8Kc9nvU oZawZ+8n62Mu5neOkQvFflS3J2ARotm5aCaiMWTnEe1pXZJA+4H9pPsWuBBbjq2tdRh/ PYIJOw0kGJkKF5oc2m+qK6GnSZPoiSZSWGyHzv4JC7qUl/I3IbP0u6D+umuLkqqdQy9s 2YnPf1/NyCBxRBqh0DM6Dmclq2LcBL1FT7gRplrFSRQtMSGRx44335B2Sr92+Z97JCza cPyw== X-Gm-Message-State: APt69E0EJV1ZDpEv8OOnW5EHvI506Xm5QbZ2tdW5ybGbAmVAV8wQvxgp GUGZNVaMMVUrgO3nQslR0HU= X-Google-Smtp-Source: AAOMgpdUnxR/t5VheCEHTx9lg5DXPx141CdDhI47MQn+UFVr3pOUXaFEoGVoRFOjrqsejutVHqpycw== X-Received: by 2002:a65:5d05:: with SMTP id e5-v6mr14505723pgr.222.1530509357304; Sun, 01 Jul 2018 22:29:17 -0700 (PDT) Received: from xplor.waratah.dyndns.org (222-154-41-72-adsl.sparkbb.co.nz. [222.154.41.72]) by smtp.gmail.com with ESMTPSA id e17-v6sm21470932pgo.70.2018.07.01.22.29.16 (version=TLS1 cipher=AES128-SHA bits=128/128); Sun, 01 Jul 2018 22:29:16 -0700 (PDT) Received: by xplor.waratah.dyndns.org (Postfix, from userid 1000) id 849DC360081; Mon, 2 Jul 2018 17:29:12 +1200 (NZST) From: Michael Schmitz To: linux-block@vger.kernel.org Cc: linux-m68k@vger.kernel.org, axboe@kernel.dk, geert@linux-m68k.org, jdow@earthlink.net, martin@lichtvoll.de, Michael Schmitz Subject: [PATCH] block: fix Amiga partition support for disks >= 1 TB Date: Mon, 2 Jul 2018 17:29:10 +1200 Message-Id: <1530509350-25410-1-git-send-email-schmitzmic@gmail.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <20180627012421.80B8F24E094@nmr-admin> References: <20180627012421.80B8F24E094@nmr-admin> Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. Bail out if sector addresses overflow 32 bits on kernels without LBD support. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch adds additional error checking and warning messages. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Reported-by: Martin Steigerwald Message-ID: <201206192146.09327.Martin@lichtvoll.de> Signed-off-by: Michael Schmitz Tested-by: Martin Steigerwald Changes from RFC: - use u64 instead of sector_t, since that may be u32 without LBD support - check multiplication overflows each step - 3 u32 values may exceed u64! - warn against use on AmigaDOS if partition data overflow u32 sector count. - warn if partition CylBlocks larger than what's stored in the RDSK header. - bail out if we were to overflow sector_t (32 or 64 bit). --- block/partitions/amiga.c | 99 +++++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 98 insertions(+), 1 deletions(-) diff --git a/block/partitions/amiga.c b/block/partitions/amiga.c index 5609366..6184d83 100644 --- a/block/partitions/amiga.c +++ b/block/partitions/amiga.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) fmt #include +#include #include #include "check.h" @@ -32,7 +33,9 @@ int amiga_partition(struct parsed_partitions *state) unsigned char *data; struct RigidDiskBlock *rdb; struct PartitionBlock *pb; - int start_sect, nr_sects, blk, part, res = 0; + u64 start_sect, nr_sects; + u64 cylblk, cylblk_res; /* rdb_CylBlocks = nr_heads*sect_per_track */ + int blk, part, res = 0, blk_shift = 0, did_warn = 0; int blksize = 1; /* Multiplier for disk block size */ int slot = 1; char b[BDEVNAME_SIZE]; @@ -98,6 +101,79 @@ int amiga_partition(struct parsed_partitions *state) if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 ) continue; + /* RDB gives us more than enough rope to hang ourselves with, + * many times over (2^128 bytes if all fields max out). + * Some careful checks are in order. + */ + + /* CylBlocks is total number of blocks per cylinder */ + cylblk = be32_to_cpu(pb->pb_Environment[3]) * + be32_to_cpu(pb->pb_Environment[5]); + + /* check for consistency with RDB defined CylBlocks */ + if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) { + pr_err("Dev %s: cylblk 0x%lx > rdb_CylBlocks 0x%x!\n", + bdevname(state->bdev, b), + (unsigned long) cylblk, + be32_to_cpu(rdb->rdb_CylBlocks)); + } + + /* check for potential overflows - we are going to multiply + * three 32 bit numbers to one 64 bit result later! + * Condition 1: nr_heads * sects_per_track must fit u32! + * NB: This is a HARD limit for AmigaDOS. We don't care much. + */ + + if (cylblk > UINT_MAX) { + pr_err("Dev %s: hds*sects 0x%lx > UINT_MAX!\n", + bdevname(state->bdev, b), + (unsigned long) cylblk); + + /* lop off low 32 bits */ + cylblk_res = cylblk >> 32; + + /* check for further overflow in end result */ + if (be32_to_cpu(pb->pb_Environment[9]) * + cylblk_res * blksize > UINT_MAX) { + pr_err("Dev %s: start_sect overflows u64!\n", + bdevname(state->bdev, b)); + res = -1; + goto rdb_done; + } + + if (be32_to_cpu(pb->pb_Environment[10]) * + cylblk_res * blksize > UINT_MAX) { + pr_err("Dev %s: end_sect overflows u64!\n", + bdevname(state->bdev, b)); + res = -1; + goto rdb_done; + } + } + + /* Condition 2: even if CylBlocks did not overflow, the end + * result must still fit u64! + */ + + /* how many bits above 32 in cylblk * blksize ? */ + if (cylblk*blksize > (u64) UINT_MAX) + blk_shift = ilog2(cylblk*blksize) - 32; + + if (be32_to_cpu(pb->pb_Environment[9]) + > (u64) UINT_MAX>>blk_shift) { + pr_err("Dev %s: start_sect overflows u64!\n", + bdevname(state->bdev, b)); + res = -1; + goto rdb_done; + } + + if (be32_to_cpu(pb->pb_Environment[10]) + > (u64) UINT_MAX>>blk_shift) { + pr_err("Dev %s: end_sect overflows u64!\n", + bdevname(state->bdev, b)); + res = -1; + goto rdb_done; + } + /* Tell Kernel about it */ nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 - @@ -111,6 +187,27 @@ int amiga_partition(struct parsed_partitions *state) be32_to_cpu(pb->pb_Environment[3]) * be32_to_cpu(pb->pb_Environment[5]) * blksize; + + /* Warn user if start_sect or nr_sects overflow u32 */ + if ((nr_sects > UINT_MAX || start_sect > UINT_MAX || + (start_sect + nr_sects) > UINT_MAX) && !did_warn) { + pr_err("Dev %s: partition 32 bit overflow! ", + bdevname(state->bdev, b)); + pr_cont("start_sect 0x%llX, nr_sects 0x%llx\n", + start_sect, nr_sects); + pr_err("Dev %s: partition may need 64 bit ", + bdevname(state->bdev, b)); + pr_cont("device support on native AmigaOS!\n"); + /* Without LBD support, better bail out */ + if (!IS_ENABLED(CONFIG_LBDAF)) { + pr_err("Dev %s: no LBD support, aborting!", + bdevname(state->bdev, b)); + res = -1; + goto rdb_done; + } + did_warn++; + } + put_partition(state,slot++,start_sect,nr_sects); { /* Be even more informative to aid mounting */