* [PATCH] loop: fix setting arbitrarily large block size
@ 2021-06-22 16:10 Shreyansh Chouhan
2021-06-23 5:09 ` [RESEND PATCH] " Shreyansh Chouhan
0 siblings, 1 reply; 6+ messages in thread
From: Shreyansh Chouhan @ 2021-06-22 16:10 UTC (permalink / raw)
To: axboe
Cc: Shreyansh Chouhan, linux-block, linux-kernel,
syzbot+cf89d662483d6a1a0790
loop_validate_block_size took an unsigned short argument. Passing an
argument with size greater than the size of unsigned short would cause
an overflow and could potentially render the upper bound check on the
block size useless, allowing to set an arbitrarily large block size.
Reproted-by: syzbot+cf89d662483d6a1a0790@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
---
drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 9a758cf66507..635baff0dd66 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
* @bsize: size to validate
*/
static int
-loop_validate_block_size(unsigned short bsize)
+loop_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [RESEND PATCH] loop: fix setting arbitrarily large block size
2021-06-22 16:10 [PATCH] loop: fix setting arbitrarily large block size Shreyansh Chouhan
@ 2021-06-23 5:09 ` Shreyansh Chouhan
2021-06-24 6:14 ` Christoph Hellwig
2021-06-26 8:24 ` [PATCH v2] " Shreyansh Chouhan
0 siblings, 2 replies; 6+ messages in thread
From: Shreyansh Chouhan @ 2021-06-23 5:09 UTC (permalink / raw)
To: axboe
Cc: Shreyansh Chouhan, linux-block, linux-kernel,
syzbot+cf89d662483d6a1a0790
REASON FOR RESEND: Fixed spelling of the Reported-by tag.
loop_validate_block_size took an unsigned short argument. Passing an
argument with size greater than the size of unsigned short would cause
an overflow and could potentially render the upper bound check on the
block size useless, allowing to set an arbitrarily large block size.
Reported-by: syzbot+cf89d662483d6a1a0790@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
---
drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 9a758cf66507..635baff0dd66 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
* @bsize: size to validate
*/
static int
-loop_validate_block_size(unsigned short bsize)
+loop_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [RESEND PATCH] loop: fix setting arbitrarily large block size
2021-06-23 5:09 ` [RESEND PATCH] " Shreyansh Chouhan
@ 2021-06-24 6:14 ` Christoph Hellwig
2021-06-26 8:24 ` [PATCH v2] " Shreyansh Chouhan
1 sibling, 0 replies; 6+ messages in thread
From: Christoph Hellwig @ 2021-06-24 6:14 UTC (permalink / raw)
To: Shreyansh Chouhan
Cc: axboe, linux-block, linux-kernel, syzbot+cf89d662483d6a1a0790
On Wed, Jun 23, 2021 at 10:39:33AM +0530, Shreyansh Chouhan wrote:
> REASON FOR RESEND: Fixed spelling of the Reported-by tag.
That goes under a "---" deliminator.
Except for that:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] loop: fix setting arbitrarily large block size
2021-06-23 5:09 ` [RESEND PATCH] " Shreyansh Chouhan
2021-06-24 6:14 ` Christoph Hellwig
@ 2021-06-26 8:24 ` Shreyansh Chouhan
2021-06-28 5:34 ` Christoph Hellwig
2021-07-20 7:25 ` Shreyansh Chouhan
1 sibling, 2 replies; 6+ messages in thread
From: Shreyansh Chouhan @ 2021-06-26 8:24 UTC (permalink / raw)
To: axboe, hch
Cc: Shreyansh Chouhan, linux-block, linux-kernel,
syzbot+cf89d662483d6a1a0790
loop_validate_block_size took an unsigned short argument. Passing an
argument with size greater than the size of unsigned short would cause
an overflow and could potentially render the upper bound check on the
block size useless, allowing to set an arbitrarily large block size.
Reported-by: syzbot+cf89d662483d6a1a0790@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
---
Changes from v1: Fixed the spelling of reported-by tag. Fixed the
commit message.
drivers/block/loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 9a758cf66507..635baff0dd66 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
* @bsize: size to validate
*/
static int
-loop_validate_block_size(unsigned short bsize)
+loop_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2] loop: fix setting arbitrarily large block size
2021-06-26 8:24 ` [PATCH v2] " Shreyansh Chouhan
@ 2021-06-28 5:34 ` Christoph Hellwig
2021-07-20 7:25 ` Shreyansh Chouhan
1 sibling, 0 replies; 6+ messages in thread
From: Christoph Hellwig @ 2021-06-28 5:34 UTC (permalink / raw)
To: Shreyansh Chouhan
Cc: axboe, hch, linux-block, linux-kernel, syzbot+cf89d662483d6a1a0790
Looks good,
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] loop: fix setting arbitrarily large block size
2021-06-26 8:24 ` [PATCH v2] " Shreyansh Chouhan
2021-06-28 5:34 ` Christoph Hellwig
@ 2021-07-20 7:25 ` Shreyansh Chouhan
1 sibling, 0 replies; 6+ messages in thread
From: Shreyansh Chouhan @ 2021-07-20 7:25 UTC (permalink / raw)
To: axboe, hch; +Cc: linux-block, linux-kernel, syzbot+cf89d662483d6a1a0790
Hi,
Pinging for review since there has been no activity on this
patch for some time.
Thank you,
Shreyansh Chouhan
On Sat, Jun 26, 2021 at 01:54:06PM +0530, Shreyansh Chouhan wrote:
>
> loop_validate_block_size took an unsigned short argument. Passing an
> argument with size greater than the size of unsigned short would cause
> an overflow and could potentially render the upper bound check on the
> block size useless, allowing to set an arbitrarily large block size.
>
> Reported-by: syzbot+cf89d662483d6a1a0790@syzkaller.appspotmail.com
> Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
> ---
>
> Changes from v1: Fixed the spelling of reported-by tag. Fixed the
> commit message.
>
> drivers/block/loop.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/block/loop.c b/drivers/block/loop.c
> index 9a758cf66507..635baff0dd66 100644
> --- a/drivers/block/loop.c
> +++ b/drivers/block/loop.c
> @@ -236,7 +236,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
> * @bsize: size to validate
> */
> static int
> -loop_validate_block_size(unsigned short bsize)
> +loop_validate_block_size(unsigned long bsize)
> {
> if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
> return -EINVAL;
> --
> 2.31.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-07-20 7:26 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-22 16:10 [PATCH] loop: fix setting arbitrarily large block size Shreyansh Chouhan
2021-06-23 5:09 ` [RESEND PATCH] " Shreyansh Chouhan
2021-06-24 6:14 ` Christoph Hellwig
2021-06-26 8:24 ` [PATCH v2] " Shreyansh Chouhan
2021-06-28 5:34 ` Christoph Hellwig
2021-07-20 7:25 ` Shreyansh Chouhan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).