| Message ID | 20250422093206.1228087-1-d.kandybka@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | ceph: fix possible integer overflow in ceph_zero_objects() | expand |
On Tue, 2025-04-22 at 12:32 +0300, Dmitry Kandybka wrote: > In 'ceph_zero_objects', promote 'object_size' to 'u64' to avoid possible > integer overflow. > Compile tested only. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Dmitry Kandybka <d.kandybka@gmail.com> > --- > fs/ceph/file.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/ceph/file.c b/fs/ceph/file.c > index 851d70200c6b..a7254cab44cc 100644 > --- a/fs/ceph/file.c > +++ b/fs/ceph/file.c > @@ -2616,7 +2616,7 @@ static int ceph_zero_objects(struct inode *inode, loff_t offset, loff_t length) > s32 stripe_unit = ci->i_layout.stripe_unit; > s32 stripe_count = ci->i_layout.stripe_count; > s32 object_size = ci->i_layout.object_size; Frankly speaking, I don't quite follow why we are using signed type here (s32). As object size as stripe count should be positive value always. > - u64 object_set_size = object_size * stripe_count; > + u64 object_set_size = (u64) object_size * stripe_count; > u64 nearly, t; > > /* round offset up to next period boundary */ Looks good. Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com> Thanks, Slava.
diff --git a/fs/ceph/file.c b/fs/ceph/file.c index 851d70200c6b..a7254cab44cc 100644 --- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -2616,7 +2616,7 @@ static int ceph_zero_objects(struct inode *inode, loff_t offset, loff_t length) s32 stripe_unit = ci->i_layout.stripe_unit; s32 stripe_count = ci->i_layout.stripe_count; s32 object_size = ci->i_layout.object_size; - u64 object_set_size = object_size * stripe_count; + u64 object_set_size = (u64) object_size * stripe_count; u64 nearly, t; /* round offset up to next period boundary */
In 'ceph_zero_objects', promote 'object_size' to 'u64' to avoid possible integer overflow. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Kandybka <d.kandybka@gmail.com> --- fs/ceph/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)