Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3e03989b authored by Roland Dreier's avatar Roland Dreier Committed by Nicholas Bellinger
Browse files

target: Avoid integer overflow in se_dev_align_max_sectors() 



The expression (max_sectors * block_size) might overflow a u32
(indeed, since iblock sets max_hw_sectors to UINT_MAX, it is
guaranteed to overflow and end up with a much-too-small result in many
common cases).  Fix this by doing an equivalent calculation that
doesn't require multiplication.

While we're touching this code, avoid splitting a printk format across
two lines and use pr_info(...) instead of printk(KERN_INFO ...).

Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 0d0f9dfb

drivers/target/target_core_device.c

+9 −9
Original line number Diff line number Diff line
@@ -850,20 +850,20 @@ int se_dev_check_shutdown(struct se_device *dev) 


static u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)

{

	u32 tmp, aligned_max_sectors;

	u32 aligned_max_sectors;

	u32 alignment;

	/*

	 * Limit max_sectors to a PAGE_SIZE aligned value for modern

	 * transport_allocate_data_tasks() operation.

	 */

	tmp = rounddown((max_sectors * block_size), PAGE_SIZE);

	aligned_max_sectors = (tmp / block_size);

	if (max_sectors != aligned_max_sectors) {

		printk(KERN_INFO "Rounding down aligned max_sectors from %u"

				" to %u\n", max_sectors, aligned_max_sectors);

		return aligned_max_sectors;

	}

	alignment = max(1ul, PAGE_SIZE / block_size);

	aligned_max_sectors = rounddown(max_sectors, alignment);



	return max_sectors;

	if (max_sectors != aligned_max_sectors)

		pr_info("Rounding down aligned max_sectors from %u to %u\n",

			max_sectors, aligned_max_sectors);



	return aligned_max_sectors;

}



void se_dev_set_default_attribs(