Skip to content

Commit 5a4510c

Browse files
Gax-cMikulas Patocka
authored andcommitted
dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
This was found by a static analyzer. There may be a potential integer overflow issue in unstripe_ctr(). uc->unstripe_offset and uc->unstripe_width are defined as "sector_t"(uint64_t), while uc->unstripe, uc->chunk_size and uc->stripes are all defined as "uint32_t". The result of the calculation will be limited to "uint32_t" without correct casting. So, we recommend adding an extra cast to prevent potential integer overflow. Fixes: 18a5bf2 ("dm: add unstriped target") Signed-off-by: Zichen Xie <[email protected]> Signed-off-by: Mikulas Patocka <[email protected]> Cc: [email protected]
1 parent fed13a5 commit 5a4510c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/md/dm-unstripe.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,8 @@ static int unstripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
8585
}
8686
uc->physical_start = start;
8787

88-
uc->unstripe_offset = uc->unstripe * uc->chunk_size;
89-
uc->unstripe_width = (uc->stripes - 1) * uc->chunk_size;
88+
uc->unstripe_offset = (sector_t)uc->unstripe * uc->chunk_size;
89+
uc->unstripe_width = (sector_t)(uc->stripes - 1) * uc->chunk_size;
9090
uc->chunk_shift = is_power_of_2(uc->chunk_size) ? fls(uc->chunk_size) - 1 : 0;
9191

9292
tmp_len = ti->len;

0 commit comments

Comments
 (0)