block: fix integer overflow in __blkdev_sectors_to_bio_pages()

Mikulas Patocka · axboe · commit 09c2c359be54 · 2017-09-11T09:46:49.000-06:00
Fix possible integer overflow in __blkdev_sectors_to_bio_pages if sector_t is 32-bit. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Fixes: 615d22a ("block: Fix __blkdev_issue_zeroout loop") Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
diff --git a/block/blk-lib.c b/block/blk-lib.c
@@ -269,9 +269,9 @@ static int __blkdev_issue_write_zeroes(struct block_device *bdev,
  */
 static unsigned int __blkdev_sectors_to_bio_pages(sector_t nr_sects)
 {
-	sector_t bytes = (nr_sects << 9) + PAGE_SIZE - 1;
+	sector_t pages = DIV_ROUND_UP_SECTOR_T(nr_sects, PAGE_SIZE / 512);
 
-	return min(bytes >> PAGE_SHIFT, (sector_t)BIO_MAX_PAGES);
+	return min(pages, (sector_t)BIO_MAX_PAGES);
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -269,9 +269,9 @@ static int __blkdev_issue_write_zeroes(struct block_device *bdev,`
`269`	`269`	`*/`
`270`	`270`	`static unsigned int __blkdev_sectors_to_bio_pages(sector_t nr_sects)`
`271`	`271`	`{`
`272`		`- sector_t bytes = (nr_sects << 9) + PAGE_SIZE - 1;`
	`272`	`+ sector_t pages = DIV_ROUND_UP_SECTOR_T(nr_sects, PAGE_SIZE / 512);`
`273`	`273`
`274`		`- return min(bytes >> PAGE_SHIFT, (sector_t)BIO_MAX_PAGES);`
	`274`	`+ return min(pages, (sector_t)BIO_MAX_PAGES);`
`275`	`275`	`}`
`276`	`276`
`277`	`277`	`/**`