Re: [PATCH] fat: calculate data area start without overflow

[OGAWA Hirofumi]

hengyul@xxxxxxxxxx writes:

> From: Hengyu Liang <hengyul@xxxxxxxxxx>
>
> On 32-bit architectures, sbi->fat_length, sbi->dir_start and
> sbi->data_start are unsigned long. The number of FATs is an 8-bit BPB
> field, while the FAT32 length is a 32-bit BPB field. Therefore, the
> calculation
>
>     sbi->fat_start + sbi->fats * sbi->fat_length
>
> can wrap before data_start is checked against total_sectors.

[...]
> -	sbi->dir_start = sbi->fat_start + sbi->fats * sbi->fat_length;
>  	sbi->dir_entries = bpb.fat_dir_entries;
>  	if (sbi->dir_entries & (sbi->dir_per_block - 1)) {
>  		if (!silent)
> @@ -1763,19 +1764,23 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc,
>  
>  	rootdir_sectors = sbi->dir_entries
>  		* sizeof(struct msdos_dir_entry) / sb->s_blocksize;
> -	sbi->data_start = sbi->dir_start + rootdir_sectors;
> +	dir_start = sbi->fat_start +
> +		mul_u32_u32(sbi->fats, sbi->fat_length);
> +	data_start = dir_start + rootdir_sectors;

Maybe, since u32 overflow is always bigger than total_sectors, so we
should use check_*_overflow() instead, and detect early?

Thanks.
-- 
OGAWA Hirofumi <hirofumi@xxxxxxxxxxxxxxxxxx>