Skip to content

Commit fc3d092

Browse files
Michael Schmitzaxboe
authored andcommitted
block: fix signed int overflow in Amiga partition support
The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use sector_t as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow <jdow@earthlink.net>. A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch differs from Joanne's patch only in its use of sector_t instead of unsigned int. No checking for overflows is done (see patch 3 of this series for that). Reported-by: Martin Steigerwald <Martin@lichtvoll.de> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: <stable@vger.kernel.org> # 5.2 Signed-off-by: Michael Schmitz <schmitzmic@gmail.com> Tested-by: Martin Steigerwald <Martin@lichtvoll.de> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/r/20230620201725.7020-2-schmitzmic@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent 6d4e80d commit fc3d092

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

block/partitions/amiga.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ int amiga_partition(struct parsed_partitions *state)
3131
unsigned char *data;
3232
struct RigidDiskBlock *rdb;
3333
struct PartitionBlock *pb;
34-
int start_sect, nr_sects, blk, part, res = 0;
34+
sector_t start_sect, nr_sects;
35+
int blk, part, res = 0;
3536
int blksize = 1; /* Multiplier for disk block size */
3637
int slot = 1;
3738

@@ -96,14 +97,14 @@ int amiga_partition(struct parsed_partitions *state)
9697

9798
/* Tell Kernel about it */
9899

99-
nr_sects = (be32_to_cpu(pb->pb_Environment[10]) + 1 -
100-
be32_to_cpu(pb->pb_Environment[9])) *
100+
nr_sects = ((sector_t)be32_to_cpu(pb->pb_Environment[10]) + 1 -
101+
be32_to_cpu(pb->pb_Environment[9])) *
101102
be32_to_cpu(pb->pb_Environment[3]) *
102103
be32_to_cpu(pb->pb_Environment[5]) *
103104
blksize;
104105
if (!nr_sects)
105106
continue;
106-
start_sect = be32_to_cpu(pb->pb_Environment[9]) *
107+
start_sect = (sector_t)be32_to_cpu(pb->pb_Environment[9]) *
107108
be32_to_cpu(pb->pb_Environment[3]) *
108109
be32_to_cpu(pb->pb_Environment[5]) *
109110
blksize;

0 commit comments

Comments
 (0)