From nobody Sun Oct 5 19:25:04 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1525814932205772.2522872850864; Tue, 8 May 2018 14:28:52 -0700 (PDT) Received: from localhost ([::1]:53386 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fGAA7-0003Un-Nt for importer@patchew.org; Tue, 08 May 2018 17:28:43 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33382) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fGA92-0002Wd-Tl for qemu-devel@nongnu.org; Tue, 08 May 2018 17:27:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fGA92-0002j8-3D for qemu-devel@nongnu.org; Tue, 08 May 2018 17:27:36 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:35636 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fGA8x-0002gX-0g; Tue, 08 May 2018 17:27:31 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B6F08402290A; Tue, 8 May 2018 21:27:26 +0000 (UTC) Received: from red.redhat.com (ovpn-122-205.rdu2.redhat.com [10.10.122.205]) by smtp.corp.redhat.com (Postfix) with ESMTP id DE84DC1FA9; Tue, 8 May 2018 21:27:21 +0000 (UTC) From: Eric Blake To: qemu-devel@nongnu.org Date: Tue, 8 May 2018 16:27:18 -0500 Message-Id: <20180508212718.1482663-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Tue, 08 May 2018 21:27:26 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Tue, 08 May 2018 21:27:26 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'eblake@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH] iscsi: Avoid potential for get_status overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , "open list:iSCSI" , Peter Lieven , qemu-stable@nongnu.org, Max Reitz , Ronnie Sahlberg , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Detected by Coverity: Multiplying two 32-bit int and assigning the result to a 64-bit number is a risk of overflow. Prior to the conversion to byte-based interfaces, the block layer took care of ensuring that a status request never exceeded 2G in the driver; but after that conversion, the block layer expects drivers to deal with any size request (the driver can always truncate the request size back down, as long as it makes progress). So, in the off-chance that someone makes a large request, we are at the mercy of whether iscsi_get_lba_status_task() will cap things to at most INT_MAX / iscsilun->block_size when it populates lbasd->num_blocks; since I could not easily audit that, it's better to be safe than sorry by just forcing a 64-bit multiply. Fixes: 92809c36 CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- block/iscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/iscsi.c b/block/iscsi.c index 35423ded03b..a6311b9a320 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -732,7 +732,7 @@ retry: goto out_unlock; } - *pnum =3D lbasd->num_blocks * iscsilun->block_size; + *pnum =3D (int64_t) lbasd->num_blocks * iscsilun->block_size; if (lbasd->provisioning =3D=3D SCSI_PROVISIONING_TYPE_DEALLOCATED || lbasd->provisioning =3D=3D SCSI_PROVISIONING_TYPE_ANCHORED) { --=20 2.14.3