From nobody Sun Oct 5 21:12:25 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1530582090843811.5157688602679; Mon, 2 Jul 2018 18:41:30 -0700 (PDT) Received: from localhost ([::1]:37251 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1faAJu-0007ay-4v for importer@patchew.org; Mon, 02 Jul 2018 21:41:30 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35455) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1faAGH-0004l5-JG for qemu-devel@nongnu.org; Mon, 02 Jul 2018 21:37:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1faAGG-0005B9-EI for qemu-devel@nongnu.org; Mon, 02 Jul 2018 21:37:45 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:40628 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1faAGA-00056X-1H; Mon, 02 Jul 2018 21:37:38 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8891E40267A1; Tue, 3 Jul 2018 01:37:37 +0000 (UTC) Received: from red.redhat.com (ovpn-122-121.rdu2.redhat.com [10.10.122.121]) by smtp.corp.redhat.com (Postfix) with ESMTP id AA99A2026D76; Tue, 3 Jul 2018 01:37:36 +0000 (UTC) From: Eric Blake To: qemu-devel@nongnu.org Date: Mon, 2 Jul 2018 20:37:26 -0500 Message-Id: <20180703013730.55375-3-eblake@redhat.com> In-Reply-To: <20180703013730.55375-1-eblake@redhat.com> References: <20180703013730.55375-1-eblake@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Tue, 03 Jul 2018 01:37:37 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Tue, 03 Jul 2018 01:37:37 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'eblake@redhat.com' RCPT:'' Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PULL 2/6] iscsi: Avoid potential for get_status overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , "open list:iSCSI" , Peter Lieven , qemu-stable@nongnu.org, Max Reitz , Ronnie Sahlberg , Paolo Bonzini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Detected by Coverity: Multiplying two 32-bit int and assigning the result to a 64-bit number is a risk of overflow. Prior to the conversion to byte-based interfaces, the block layer took care of ensuring that a status request never exceeded 2G in the driver; but after that conversion, the block layer expects drivers to deal with any size request (the driver can always truncate the request size back down, as long as it makes progress). So, in the off-chance that someone makes a large request, we are at the mercy of whether iscsi_get_lba_status_task() will cap things to at most INT_MAX / iscsilun->block_size when it populates lbasd->num_blocks; since I could not easily audit that, it's better to be safe than sorry by just forcing a 64-bit multiply. Fixes: 92809c36 CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake Message-Id: <20180508212718.1482663-1-eblake@redhat.com> Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- block/iscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/iscsi.c b/block/iscsi.c index 9beb06d4986..ead2bd5aa7f 100644 --- a/block/iscsi.c +++ b/block/iscsi.c @@ -734,7 +734,7 @@ retry: goto out_unlock; } - *pnum =3D lbasd->num_blocks * iscsilun->block_size; + *pnum =3D (int64_t) lbasd->num_blocks * iscsilun->block_size; if (lbasd->provisioning =3D=3D SCSI_PROVISIONING_TYPE_DEALLOCATED || lbasd->provisioning =3D=3D SCSI_PROVISIONING_TYPE_ANCHORED) { --=20 2.14.4