From: Qu Wenruo Date: Sat, 31 Oct 2020 01:07:50 +0000 (+0800) Subject: fs: btrfs: volumes: prevent overflow for multiplying X-Git-Tag: v2021.10~358^2~3 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3b72612ad191cad29aad3982221ff3355bec798d;p=platform%2Fkernel%2Fu-boot.git fs: btrfs: volumes: prevent overflow for multiplying In __btrfs_map_block() we do a int * int and assign it to u64. This is not safe as the result (int * int) is still evaluated as (int) thus it can overflow. Convert one of the multiplier to u64 to prevent such problem. In real world, this should not cause problem as we have device number limit thus it won't go beyond 4G for a single stripe. But it's harder to teach coverity about all these hidden limits, so just fix the possible overflow. Reported-by: Coverity CID 312957 Reported-by: Coverity CID 312948 Signed-off-by: Qu Wenruo --- diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index fcf52d4..4aaaeab 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -1030,7 +1030,7 @@ again: */ stripe_nr = stripe_nr / map->stripe_len; - stripe_offset = stripe_nr * map->stripe_len; + stripe_offset = stripe_nr * (u64)map->stripe_len; BUG_ON(offset < stripe_offset); /* stripe_offset is the offset of this block in its stripe*/ @@ -1103,7 +1103,7 @@ again: rot = stripe_nr % map->num_stripes; /* Fill in the logical address of each stripe */ - tmp = stripe_nr * nr_data_stripes(map); + tmp = (u64)stripe_nr * nr_data_stripes(map); for (i = 0; i < nr_data_stripes(map); i++) raid_map[(i+rot) % map->num_stripes] =