On Mon 26-08-19 22:35:47, zhangyi (F) wrote:
> If user specify a large enough value of "commit=" option, it may trigger
> signed integer overflow which may lead to sbi->s_commit_interval becomes
> a large or small value, zero in particular.
>
> UBSAN: Undefined behaviour in ../fs/ext4/super.c:1592:31
> signed integer overflow:
> 536870912 * 1000 cannot be represented in type 'int'
> [...]
> Call trace:
> [...]
> [<ffffff9008a2d120>] ubsan_epilogue+0x34/0x9c lib/ubsan.c:166
> [<ffffff9008a2d8b8>] handle_overflow+0x228/0x280 lib/ubsan.c:197
> [<ffffff9008a2d95c>] __ubsan_handle_mul_overflow+0x4c/0x68 lib/ubsan.c:218
> [<ffffff90086d070c>] handle_mount_opt fs/ext4/super.c:1592 [inline]
> [<ffffff90086d070c>] parse_options+0x1724/0x1a40 fs/ext4/super.c:1773
> [<ffffff90086d51c4>] ext4_remount+0x2ec/0x14a0 fs/ext4/super.c:4834
> [...]
>
> Although it is not a big deal, still silence the UBSAN by limit the
> input value.
>
> Signed-off-by: zhangyi (F) <yi.zhang@xxxxxxxxxx>
Looks good to me. You can add:
Reviewed-by: Jan Kara <jack@xxxxxxx>
Honza
> ---
> fs/ext4/super.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index 4079605d437a..7310facffa9d 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -1874,6 +1874,13 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
> } else if (token == Opt_commit) {
> if (arg == 0)
> arg = JBD2_DEFAULT_MAX_COMMIT_AGE;
> + else if (arg > INT_MAX / HZ) {
> + ext4_msg(sb, KERN_ERR,
> + "Invalid commit interval %d, "
> + "must be smaller than %d",
> + arg, INT_MAX / HZ);
> + return -1;
> + }
> sbi->s_commit_interval = HZ * arg;
> } else if (token == Opt_debug_want_extra_isize) {
> sbi->s_want_extra_isize = arg;
> --
> 2.23.0.rc2.8.gff66981
>
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR
