Commit 62497afb authored by Li Nan's avatar Li Nan
Browse files

block: fix overflow in blk_ioctl_discard() 

mainline inclusion
from mainline-v6.9-rc3
commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155
category: bugfix
bugzilla: 189755, https://gitee.com/openeuler/kernel/issues/I9K0H3

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22d24a544b0d49bbcbd61c8c0eaf77d3c9297155



--------------------------------

There is no check for overflow of 'start + len' in blk_ioctl_discard().
Hung task occurs if submit an discard ioctl with the following param:
  start = 0x80000000000ff000, len = 0x8000000000fff000;
Add the overflow validation now.

Signed-off-by: default avatarLi Nan <linan122@huawei.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20240329012319.2034550-1-linan666@huaweicloud.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>

Conflict:
	block/ioctl.c
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parent 6c4027e2

block/ioctl.c

+3 −2
Original line number Diff line number Diff line
@@ -122,7 +122,7 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode, 
		unsigned long arg, unsigned long flags)

{

	uint64_t range[2];

	uint64_t start, len;

	uint64_t start, len, end;

	struct request_queue *q = bdev_get_queue(bdev);

	int err;
@@ -143,7 +143,8 @@ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode, 
	if (len & 511)

		return -EINVAL;



	if (start + len > i_size_read(bdev->bd_inode))

	if (check_add_overflow(start, len, &end) ||

	    end > i_size_read(bdev->bd_inode))

		return -EINVAL;



	err = truncate_bdev_range(bdev, mode, start, start + len - 1);