Skip to content

Commit 7198bfc

Browse files
committed
Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()"
This reverts commit 6d35d04. Both Gabriel and Borislav report that this commit casues a regression with nbd: sysfs: cannot create duplicate filename '/dev/block/43:0' Revert it before 5.18-rc1 and we'll investigage this separately in due time. Link: https://lore.kernel.org/all/YkiJTnFOt9bTv6A2@zn.tnic/ Reported-by: Gabriel L. Somlo <somlo@cmu.edu> Reported-by: Borislav Petkov <bp@alien8.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent 2651ee5 commit 7198bfc

File tree

1 file changed

+12
-12
lines changed

1 file changed

+12
-12
lines changed

drivers/block/nbd.c

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1800,6 +1800,17 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)
18001800
refcount_set(&nbd->refs, 0);
18011801
INIT_LIST_HEAD(&nbd->list);
18021802
disk->major = NBD_MAJOR;
1803+
1804+
/* Too big first_minor can cause duplicate creation of
1805+
* sysfs files/links, since index << part_shift might overflow, or
1806+
* MKDEV() expect that the max bits of first_minor is 20.
1807+
*/
1808+
disk->first_minor = index << part_shift;
1809+
if (disk->first_minor < index || disk->first_minor > MINORMASK) {
1810+
err = -EINVAL;
1811+
goto out_free_work;
1812+
}
1813+
18031814
disk->minors = 1 << part_shift;
18041815
disk->fops = &nbd_fops;
18051816
disk->private_data = nbd;
@@ -1904,19 +1915,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
19041915
if (!netlink_capable(skb, CAP_SYS_ADMIN))
19051916
return -EPERM;
19061917

1907-
if (info->attrs[NBD_ATTR_INDEX]) {
1918+
if (info->attrs[NBD_ATTR_INDEX])
19081919
index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]);
1909-
1910-
/*
1911-
* Too big first_minor can cause duplicate creation of
1912-
* sysfs files/links, since index << part_shift might overflow, or
1913-
* MKDEV() expect that the max bits of first_minor is 20.
1914-
*/
1915-
if (index < 0 || index > MINORMASK >> part_shift) {
1916-
printk(KERN_ERR "nbd: illegal input index %d\n", index);
1917-
return -EINVAL;
1918-
}
1919-
}
19201920
if (!info->attrs[NBD_ATTR_SOCKETS]) {
19211921
printk(KERN_ERR "nbd: must specify at least one socket\n");
19221922
return -EINVAL;

0 commit comments

Comments
 (0)