[PATCH] brd: prevent overflow caused by too large rd_size parameter

From: Satoru Takeuchi
Date: Fri Sep 22 2017 - 00:10:11 EST


The max value of rd_size parameter is ULONG_MAX from the following commit.

Commit 366f4aea649a65c3735d91b4409d84c771811290 ("brd: Switch rd_size
to unsigned long")

However, this parameter * 1024 will be set as inode->i_size corresponding
to brd devices and it's a signed value. To prevent overflow, this parameter
should be equal to or smaller than the max value of sector_t >> 11, 10 bits
are for 1024 and 1 bit is for sign bit.

Signed-off-by: Satoru Takeuchi <satoru.takeuchi@xxxxxxxxx>
---
drivers/block/brd.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/block/brd.c b/drivers/block/brd.c
index 104b71c..2b00e7d 100644
--- a/drivers/block/brd.c
+++ b/drivers/block/brd.c
@@ -546,6 +546,14 @@ static int __init brd_init(void)
* dynamically.
*/

+ /*
+ * rd_size * 1024 will be set as its inode->i_size and it's a signed
+ * value. So rd_size should be equal to or smaller than the max value
+ * of sector_t >> 11, 10 bits are for 1024 and 1 bit is for sign bit.
+ */
+ if (rd_size >> (sizeof(sector_t) * 8 - 11))
+ return -EINVAL;
+
if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
return -EIO;

--
2.7.4