Skip to content

Commit b6f3f28

Browse files
Michael Schmitzaxboe
Michael Schmitz
authored and
axboe
committed
block: add overflow checks for Amiga partition support
The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. Bail out if sector addresses overflow 32 bits on kernels without LBD support. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted (now resubmitted as patch 1 in this series). This patch adds additional error checking and warning messages. Reported-by: Martin Steigerwald <Martin@lichtvoll.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: <stable@vger.kernel.org> # 5.2 Signed-off-by: Michael Schmitz <schmitzmic@gmail.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Reviewed-by: Christoph Hellwig <hch@infradead.org> Link: https://lore.kernel.org/r/20230620201725.7020-4-schmitzmic@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent 95a5543 commit b6f3f28

File tree

1 file changed

+85
-18
lines changed

1 file changed

+85
-18
lines changed

‎block/partitions/amiga.c

Lines changed: 85 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,18 @@
1111
#define pr_fmt(fmt) fmt
1212

1313
#include <linux/types.h>
14+
#include <linux/mm_types.h>
15+
#include <linux/overflow.h>
1416
#include <linux/affs_hardblocks.h>
1517

1618
#include "check.h"
1719

20+
/* magic offsets in partition DosEnvVec */
21+
#define NR_HD 3
22+
#define NR_SECT 5
23+
#define LO_CYL 9
24+
#define HI_CYL 10
25+
1826
static __inline__ u32
1927
checksum_block(__be32 *m, int size)
2028
{
@@ -31,17 +39,20 @@ int amiga_partition(struct parsed_partitions *state)
3139
unsigned char *data;
3240
struct RigidDiskBlock *rdb;
3341
struct PartitionBlock *pb;
34-
sector_t start_sect, nr_sects;
35-
int blk, part, res = 0;
36-
int blksize = 1; /* Multiplier for disk block size */
42+
u64 start_sect, nr_sects;
43+
sector_t blk, end_sect;
44+
u32 cylblk; /* rdb_CylBlocks = nr_heads*sect_per_track */
45+
u32 nr_hd, nr_sect, lo_cyl, hi_cyl;
46+
int part, res = 0;
47+
unsigned int blksize = 1; /* Multiplier for disk block size */
3748
int slot = 1;
3849

3950
for (blk = 0; ; blk++, put_dev_sector(sect)) {
4051
if (blk == RDB_ALLOCATION_LIMIT)
4152
goto rdb_done;
4253
data = read_part_sector(state, blk, &sect);
4354
if (!data) {
44-
pr_err("Dev %s: unable to read RDB block %d\n",
55+
pr_err("Dev %s: unable to read RDB block %llu\n",
4556
state->disk->disk_name, blk);
4657
res = -1;
4758
goto rdb_done;
@@ -58,12 +69,12 @@ int amiga_partition(struct parsed_partitions *state)
5869
*(__be32 *)(data+0xdc) = 0;
5970
if (checksum_block((__be32 *)data,
6071
be32_to_cpu(rdb->rdb_SummedLongs) & 0x7F)==0) {
61-
pr_err("Trashed word at 0xd0 in block %d ignored in checksum calculation\n",
72+
pr_err("Trashed word at 0xd0 in block %llu ignored in checksum calculation\n",
6273
blk);
6374
break;
6475
}
6576

66-
pr_err("Dev %s: RDB in block %d has bad checksum\n",
77+
pr_err("Dev %s: RDB in block %llu has bad checksum\n",
6778
state->disk->disk_name, blk);
6879
}
6980

@@ -80,10 +91,15 @@ int amiga_partition(struct parsed_partitions *state)
8091
blk = be32_to_cpu(rdb->rdb_PartitionList);
8192
put_dev_sector(sect);
8293
for (part = 1; blk>0 && part<=16; part++, put_dev_sector(sect)) {
83-
blk *= blksize; /* Read in terms partition table understands */
94+
/* Read in terms partition table understands */
95+
if (check_mul_overflow(blk, (sector_t) blksize, &blk)) {
96+
pr_err("Dev %s: overflow calculating partition block %llu! Skipping partitions %u and beyond\n",
97+
state->disk->disk_name, blk, part);
98+
break;
99+
}
84100
data = read_part_sector(state, blk, &sect);
85101
if (!data) {
86-
pr_err("Dev %s: unable to read partition block %d\n",
102+
pr_err("Dev %s: unable to read partition block %llu\n",
87103
state->disk->disk_name, blk);
88104
res = -1;
89105
goto rdb_done;
@@ -95,19 +111,70 @@ int amiga_partition(struct parsed_partitions *state)
95111
if (checksum_block((__be32 *)pb, be32_to_cpu(pb->pb_SummedLongs) & 0x7F) != 0 )
96112
continue;
97113

98-
/* Tell Kernel about it */
114+
/* RDB gives us more than enough rope to hang ourselves with,
115+
* many times over (2^128 bytes if all fields max out).
116+
* Some careful checks are in order, so check for potential
117+
* overflows.
118+
* We are multiplying four 32 bit numbers to one sector_t!
119+
*/
120+
121+
nr_hd = be32_to_cpu(pb->pb_Environment[NR_HD]);
122+
nr_sect = be32_to_cpu(pb->pb_Environment[NR_SECT]);
123+
124+
/* CylBlocks is total number of blocks per cylinder */
125+
if (check_mul_overflow(nr_hd, nr_sect, &cylblk)) {
126+
pr_err("Dev %s: heads*sects %u overflows u32, skipping partition!\n",
127+
state->disk->disk_name, cylblk);
128+
continue;
129+
}
130+
131+
/* check for consistency with RDB defined CylBlocks */
132+
if (cylblk > be32_to_cpu(rdb->rdb_CylBlocks)) {
133+
pr_warn("Dev %s: cylblk %u > rdb_CylBlocks %u!\n",
134+
state->disk->disk_name, cylblk,
135+
be32_to_cpu(rdb->rdb_CylBlocks));
136+
}
137+
138+
/* RDB allows for variable logical block size -
139+
* normalize to 512 byte blocks and check result.
140+
*/
141+
142+
if (check_mul_overflow(cylblk, blksize, &cylblk)) {
143+
pr_err("Dev %s: partition %u bytes per cyl. overflows u32, skipping partition!\n",
144+
state->disk->disk_name, part);
145+
continue;
146+
}
147+
148+
/* Calculate partition start and end. Limit of 32 bit on cylblk
149+
* guarantees no overflow occurs if LBD support is enabled.
150+
*/
151+
152+
lo_cyl = be32_to_cpu(pb->pb_Environment[LO_CYL]);
153+
start_sect = ((u64) lo_cyl * cylblk);
154+
155+
hi_cyl = be32_to_cpu(pb->pb_Environment[HI_CYL]);
156+
nr_sects = (((u64) hi_cyl - lo_cyl + 1) * cylblk);
99157

100-
nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 -
101-
be32_to_cpu(pb->pb_Environment[9])) *
102-
be32_to_cpu(pb->pb_Environment[3]) *
103-
be32_to_cpu(pb->pb_Environment[5]) *
104-
blksize;
105158
if (!nr_sects)
106159
continue;
107-
start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) *
108-
be32_to_cpu(pb->pb_Environment[3]) *
109-
be32_to_cpu(pb->pb_Environment[5]) *
110-
blksize;
160+
161+
/* Warn user if partition end overflows u32 (AmigaDOS limit) */
162+
163+
if ((start_sect + nr_sects) > UINT_MAX) {
164+
pr_warn("Dev %s: partition %u (%llu-%llu) needs 64 bit device support!\n",
165+
state->disk->disk_name, part,
166+
start_sect, start_sect + nr_sects);
167+
}
168+
169+
if (check_add_overflow(start_sect, nr_sects, &end_sect)) {
170+
pr_err("Dev %s: partition %u (%llu-%llu) needs LBD device support, skipping partition!\n",
171+
state->disk->disk_name, part,
172+
start_sect, end_sect);
173+
continue;
174+
}
175+
176+
/* Tell Kernel about it */
177+
111178
put_partition(state,slot++,start_sect,nr_sects);
112179
{
113180
/* Be even more informative to aid mounting */

0 commit comments

Comments
 (0)