Commit 440327f4 authored by Li Nan's avatar Li Nan
Browse files

block: fix overflow in blk_ioctl_discard() 

mainline inclusion
from mainline-v6.9-rc3
commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9K0H6

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22d24a544b0d49bbcbd61c8c0eaf77d3c9297155



--------------------------------

There is no check for overflow of 'start + len' in blk_ioctl_discard().
Hung task occurs if submit an discard ioctl with the following param:
  start = 0x80000000000ff000, len = 0x8000000000fff000;
Add the overflow validation now.

Signed-off-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20240329012319.2034550-1-linan666@huaweicloud.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 8c0dfc8b

block/ioctl.c

+3 −2
Original line number Diff line number Diff line
@@ -89,7 +89,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, 
		unsigned long arg)

{

	uint64_t range[2];

	uint64_t start, len;

	uint64_t start, len, end;

	struct inode *inode = bdev->bd_inode;

	int err;
@@ -110,7 +110,8 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, 
	if (len & 511)

		return -EINVAL;



	if (start + len > bdev_nr_bytes(bdev))

	if (check_add_overflow(start, len, &end) ||

	    end > bdev_nr_bytes(bdev))

		return -EINVAL;



	filemap_invalidate_lock(inode->i_mapping);