Re: [PATCH] zonefs: check multiplication overflow in zonefs_fname_to_fno()

[Damien Le Moal]

On 7/8/26 19:46, Guangshuo Li wrote:
> The change referenced by the Fixes tag added overflow checking for the
> addition used while converting a zone file name to a zone number.
> 
> However, the digit value and decimal shift are still computed with
> unchecked signed long multiplications. For sufficiently long numeric
> names, shift or digit can overflow before check_add_overflow() sees the
> value, leaving the parser with an already corrupted intermediate result.
> 
> Check the digit and shift multiplications as well. Only advance the shift
> when another digit remains, so valid boundary values are not rejected due
> to an unused final shift update.
> 
> Fixes: 3a8389d42bdf ("zonefs: handle integer overflow in zonefs_fname_to_fno")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>

Please check your email setup. This one was in my Junk folder.

The patch looks OK to me.

> ---
>  fs/zonefs/super.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
> index ff43d6d1ea30..106cf304348b 100644
> --- a/fs/zonefs/super.c
> +++ b/fs/zonefs/super.c
> @@ -615,10 +615,12 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
>  		c = *rname;
>  		if (!isdigit(c))
>  			return -ENOENT;
> -		digit = (c - '0') * shift;
> +		if (check_mul_overflow((long)(c - '0'), shift, &digit))
> +			return -ENOENT;
>  		if (check_add_overflow(fno, digit, &fno))
>  			return -ENOENT;
> -		shift *= 10;
> +		if (i + 1 < len && check_mul_overflow(shift, 10L, &shift))
> +			return -ENOENT;
>  	}
>  
>  	return fno;


-- 
Damien Le Moal
Western Digital Research