diff mbox series

[v4,03/16] block: fix theoretical overflow in bdrv_init_padding()

Message ID 20201211183934.169161-4-vsementsov@virtuozzo.com (mailing list archive)
State New, archived
Headers show
Series 64bit block-layer: part I | expand

Commit Message

Vladimir Sementsov-Ogievskiy Dec. 11, 2020, 6:39 p.m. UTC
Calculation of sum may theoretically overflow, so use 64bit type and
add some good assertions.

Use int64_t constantly.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
---
 block/io.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Eric Blake Jan. 21, 2021, 10:42 p.m. UTC | #1
On 12/11/20 12:39 PM, Vladimir Sementsov-Ogievskiy wrote:
> Calculation of sum may theoretically overflow, so use 64bit type and
> add some good assertions.
> 
> Use int64_t constantly.
> 
> Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
> ---
>  block/io.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/block/io.c b/block/io.c
> index 21e8a50725..d9bc67f1b0 100644
> --- a/block/io.c
> +++ b/block/io.c
> @@ -1537,8 +1537,12 @@ static bool bdrv_init_padding(BlockDriverState *bs,
>                                int64_t offset, int64_t bytes,
>                                BdrvRequestPadding *pad)
>  {
> -    uint64_t align = bs->bl.request_alignment;
> -    size_t sum;
> +    int64_t align = bs->bl.request_alignment;
> +    int64_t sum;
> +
> +    bdrv_check_request(offset, bytes, &error_abort);
> +    assert(align <= INT_MAX); /* documented in block/block_int.h */
> +    assert(align * 2 <= SIZE_MAX); /* so we can allocate the buffer */

Would look better as assert(align <= SIZE_MAX / 2); but not technically
wrong as written because the earlier line proved align is less than 32
bits so align*2 can't overflow 63 bits.

Reviewed-by: Eric Blake <eblake@redhat.com>
diff mbox series

Patch

diff --git a/block/io.c b/block/io.c
index 21e8a50725..d9bc67f1b0 100644
--- a/block/io.c
+++ b/block/io.c
@@ -1537,8 +1537,12 @@  static bool bdrv_init_padding(BlockDriverState *bs,
                               int64_t offset, int64_t bytes,
                               BdrvRequestPadding *pad)
 {
-    uint64_t align = bs->bl.request_alignment;
-    size_t sum;
+    int64_t align = bs->bl.request_alignment;
+    int64_t sum;
+
+    bdrv_check_request(offset, bytes, &error_abort);
+    assert(align <= INT_MAX); /* documented in block/block_int.h */
+    assert(align * 2 <= SIZE_MAX); /* so we can allocate the buffer */
 
     memset(pad, 0, sizeof(*pad));