Re: [PATCH] scsi_debug: Fix 32-bit overflow in do_device_access

[Douglas Gilbert]

On 11-01-31 09:47 PM, Darrick J. Wong wrote:
> If I create a scsi_debug device that is larger than 4GB, the multiplication of
> (block * scsi_debug_sector_size) can produce a 64-bit value.  Unfortunately,
> the compiler sees two 32-bit quantities and performs a 32-bit multiplication,
> thus truncating the bits above 2^32.  This causes the wrong memory location to
> be read or written.  Change block and rest to be unsigned long long.

Not sure why 'rest' also needs to be 64 bit.
The third argument of this call:
   ret = func(scmd, fake_storep, rest * scsi_debug_sector_size);
later in do_device_access() is declared int.

> Signed-off-by: Darrick J. Wong<djwong@xxxxxxxxxx>
Acked-by: Douglas Gilbert <dgilbert@xxxxxxxxxxxx>

> ---
>
>   drivers/scsi/scsi_debug.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
> index 7b31093..a6b2d72 100644
> --- a/drivers/scsi/scsi_debug.c
> +++ b/drivers/scsi/scsi_debug.c
> @@ -1671,7 +1671,7 @@ static int do_device_access(struct scsi_cmnd *scmd,
>   			    unsigned long long lba, unsigned int num, int write)
>   {
>   	int ret;
> -	unsigned int block, rest = 0;
> +	unsigned long long block, rest = 0;
>   	int (*func)(struct scsi_cmnd *, unsigned char *, int);
>
>   	func = write ? fetch_to_dev_buffer : fill_from_dev_buffer;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/