[PATCH v7 0/2] badblocks: fix rounding bug and validate input range
Ramesh Adhikari <[email protected]>
| Newsgroups | org.kernel.vger.linux-block,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
Two related fixes to block/badblocks.c: Patch 1/2 fixes the actual reported bug: round_up()/round_down() don't modify their argument in place, they return the rounded value, and the callers in _badblocks_set()/_badblocks_clear()/badblocks_check() were discarding that return value. Depending on caller alignment this could leave sectors unrounded or, in the reported case, stall the CPU with a non-advancing cursor when reached via the nvdimm ioctl path. It also fixes a 32-bit build breakage reported by kernel test robot, since the old rounddown()/roundup() macros pull in 64-bit division helpers not linked on 32-bit builds. Unchanged since v6. Patch 2/2 hardens the same three functions against the input-range and shift edge cases the round_up/round_down fix exposed: s + sectors overflow, and rounding itself wrapping past ULLONG_MAX. Revised in v7 per Coly's review of v6 — see the changelog in that patch for details. The remaining open item, bounding bb->shift where it's populated from the on-disk MD superblock in drivers/md/md.c, is being sent separately since it's a different file and a different root cause (missing input validation, not a rounding bug). Ramesh Adhikari (2): badblocks: fix in-place round_up/round_down usage bug badblocks: validate sector range and shift before rounding block/badblocks.c | 40 ++++++++++++++++++++++++++++++++------- include/linux/badblocks.h | 6 +++++- 2 files changed, 38 insertions(+), 8 deletions(-) -- 2.43.0