[PATCH] zonefs: check multiplication overflow in zonefs_fname_to_fno()

[Guangshuo Li]

The change referenced by the Fixes tag added overflow checking for the
addition used while converting a zone file name to a zone number.

However, the digit value and decimal shift are still computed with
unchecked signed long multiplications. For sufficiently long numeric
names, shift or digit can overflow before check_add_overflow() sees the
value, leaving the parser with an already corrupted intermediate result.

Check the digit and shift multiplications as well. Only advance the shift
when another digit remains, so valid boundary values are not rejected due
to an unused final shift update.

Fixes: 3a8389d42bdf ("zonefs: handle integer overflow in zonefs_fname_to_fno")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 fs/zonefs/super.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index ff43d6d1ea30..106cf304348b 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -615,10 +615,12 @@ static long zonefs_fname_to_fno(const struct qstr *fname)
 		c = *rname;
 		if (!isdigit(c))
 			return -ENOENT;
-		digit = (c - '0') * shift;
+		if (check_mul_overflow((long)(c - '0'), shift, &digit))
+			return -ENOENT;
 		if (check_add_overflow(fno, digit, &fno))
 			return -ENOENT;
-		shift *= 10;
+		if (i + 1 < len && check_mul_overflow(shift, 10L, &shift))
+			return -ENOENT;
 	}
 
 	return fno;
-- 
2.43.0