[Devel] [PATCH hci-8.1] dm-ploop: fix u32 overflow of the delta BAT byte size

[Devel] [PATCH hci-8.1] dm-ploop: fix u32 overflow of the delta BAT byte size

[Alexander Ivanov]

The byte size of header and BAT, (PLOOP_MAP_OFFSET + m_Size) *
sizeof(map_index_t), is computed in u32 in several places. It wraps for
m_Size >= 2^30 - PLOOP_MAP_OFFSET, which a delta with small clusters
may legally have.

Compute the size in u64 and use ploop_nr_bat_clusters() for the number
of BAT clusters everywhere.

Reject a header or a resize whose hb_nr exceeds PLOOP_MAX_HB_NR,
which also keeps DIV_ROUND_UP(hb_nr, 8) and the bitmap size in bits
from wrapping.

https://virtuozzo.atlassian.net/browse/VSTOR-148171
Feature: dm-ploop: ploop target driver
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-ploop-bat.c | 23 ++++++++++++-----------
 drivers/md/dm-ploop-cmd.c | 19 +++++++++----------
 drivers/md/dm-ploop.h     |  6 ++++--
 3 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
index a7849de8aaa6..5ddb8ffdff07 100644
--- a/drivers/md/dm-ploop-bat.c
+++ b/drivers/md/dm-ploop-bat.c
@@ -189,7 +189,6 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page)
 	struct ploop_pvd_header *m_hdr = NULL;
 	u32 bat_clusters, offset_clusters;
 	struct dm_target *ti = ploop->ti;
-	unsigned long size;
 	int ret;
 
 	m_hdr = kmap(page);
@@ -213,8 +212,11 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page)
 	ploop->nr_bat_entries = le32_to_cpu(m_hdr->m_Size);
 
 	/* Header and BAT-occupied clusters at start of file */
-	size = (PLOOP_MAP_OFFSET + ploop->nr_bat_entries) * sizeof(map_index_t);
-	bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
+	bat_clusters = ploop_nr_bat_clusters(ploop, ploop->nr_bat_entries);
+	if ((u64)bat_clusters + ploop->nr_bat_entries > PLOOP_MAX_HB_NR) {
+		PL_ERR("Too large BAT");
+		goto out;
+	}
 
 	/* Clusters from start of file to first data block */
 	offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(m_hdr->m_FirstBlockOffset));
@@ -242,7 +244,7 @@ static int ploop_delta_check_header(struct ploop *ploop,
 				    struct rb_root *md_root,
 				    u32 *delta_nr_be_ret)
 {
-	u32 bytes, delta_nr_be, offset_clusters, bat_clusters;
+	u32 delta_nr_be, offset_clusters, bat_clusters;
 	struct md_page *md0 = ploop_md_first_entry(md_root);
 	struct ploop_pvd_header *d_hdr;
 	int ret = -EPROTO;
@@ -257,8 +259,7 @@ static int ploop_delta_check_header(struct ploop *ploop,
 
 	delta_nr_be = le32_to_cpu(d_hdr->m_Size);
 	offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(d_hdr->m_FirstBlockOffset));
-	bytes = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t);
-	bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop));
+	bat_clusters = ploop_nr_bat_clusters(ploop, delta_nr_be);
 
 	if (delta_nr_be > ploop->nr_bat_entries ||
 	    bat_clusters != offset_clusters)
@@ -274,13 +275,12 @@ ALLOW_ERROR_INJECTION(ploop_delta_check_header, ERRNO);
 static int ploop_convert_bat_entries(struct ploop *ploop, struct rb_root *md_root,
 			       u32 nr_be, u32 nr_pages, loff_t file_size)
 {
-	u32 i, end, bytes, bat_clusters, page_id, *bat_entries, max_file_clu;
+	u32 i, end, bat_clusters, page_id, *bat_entries, max_file_clu;
 	struct rb_node *node;
 	struct md_page *md;
 	int ret = 0;
 
-	bytes = (PLOOP_MAP_OFFSET + nr_be) * sizeof(map_index_t);
-	bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop));
+	bat_clusters = ploop_nr_bat_clusters(ploop, nr_be);
 	max_file_clu = file_size / CLU_SIZE(ploop) - 1;
 
 	page_id = 0;
@@ -311,12 +311,13 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
 			      struct rb_root *md_root, u32 *delta_nr_be_ret)
 {
 	struct bio_vec bvec_on_stack, *bvec = &bvec_on_stack;
-	u32 i, size, delta_nr_be, nr_segs;
+	u32 i, delta_nr_be, nr_segs;
 	loff_t pos, file_size;
 	struct iov_iter iter;
 	struct rb_node *node;
 	struct md_page *md;
 	ssize_t len;
+	u64 size;
 	int ret;
 
 	ret = -ENOMEM;
@@ -339,7 +340,7 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
 	if (ret)
 		goto out;
 
-	size = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t);
+	size = ((u64)delta_nr_be + PLOOP_MAP_OFFSET) * sizeof(map_index_t);
 	size = ALIGN(size, PAGE_SIZE); /* file may be open as direct */
 	nr_segs = size / PAGE_SIZE;
 
diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c
index 5fa78e6cff9a..ab17520c2d56 100644
--- a/drivers/md/dm-ploop-cmd.c
+++ b/drivers/md/dm-ploop-cmd.c
@@ -386,7 +386,7 @@ ALLOW_ERROR_INJECTION(ploop_grow_relocate_cluster, ERRNO);
 static int ploop_grow_update_header(struct ploop *ploop,
 				    struct ploop_cmd *cmd)
 {
-	unsigned int size, first_block_off;
+	unsigned int first_block_off;
 	struct ploop_pvd_header *hdr;
 	struct ploop_index_wb *piwb;
 	u32 nr_be, offset, clus;
@@ -413,9 +413,7 @@ static int ploop_grow_update_header(struct ploop *ploop,
 	}
 	piwb = md->piwb;
 
-	size = (PLOOP_MAP_OFFSET + cmd->resize.nr_bat_entries);
-	size *= sizeof(map_index_t);
-	clus = DIV_ROUND_UP(size, CLU_SIZE(ploop));
+	clus = ploop_nr_bat_clusters(ploop, cmd->resize.nr_bat_entries);
 	first_block_off = CLU_TO_SEC(ploop, clus);
 
 	hdr = kmap_local_page(piwb->bat_page);
@@ -597,6 +595,11 @@ static int ploop_resize(struct ploop *ploop, sector_t new_sectors)
 	}
 
 	nr_bat_entries = SEC_TO_CLU(ploop, new_sectors);
+	nr_bat_clusters = ploop_nr_bat_clusters(ploop, nr_bat_entries);
+	if ((u64)nr_bat_clusters + nr_bat_entries > PLOOP_MAX_HB_NR) {
+		DMWARN("resize: too large size is requested");
+		return -EINVAL;
+	}
 
 	/* Memory for new md pages */
 	ret = ploop_prealloc_md_pages(&cmd.resize.md_pages_root,
@@ -604,8 +607,6 @@ static int ploop_resize(struct ploop *ploop, sector_t new_sectors)
 	if (ret)
 		return ret;
 
-	size = (PLOOP_MAP_OFFSET + nr_bat_entries) * sizeof(map_index_t);
-	nr_bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
 	hb_nr = nr_bat_clusters + nr_bat_entries;
 	size = round_up(DIV_ROUND_UP(hb_nr, 8), sizeof(unsigned long));
 
@@ -1010,11 +1011,9 @@ static int process_flip_upper_deltas(struct ploop *ploop)
 	u8 level = ploop_top_level(ploop) - 1;
 	struct rb_node *node;
 	struct md_page *md;
-	u64 size;
 
-	size = (PLOOP_MAP_OFFSET + READ_ONCE(ploop->nr_bat_entries))
-		* sizeof(map_index_t);
-        bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
+	bat_clusters = ploop_nr_bat_clusters(ploop,
+					     READ_ONCE(ploop->nr_bat_entries));
 	hb_nr = ploop->hb_nr;
 
 	/*
diff --git a/drivers/md/dm-ploop.h b/drivers/md/dm-ploop.h
index 23662943d56a..5041fc8f1e13 100644
--- a/drivers/md/dm-ploop.h
+++ b/drivers/md/dm-ploop.h
@@ -12,6 +12,8 @@
 #include <linux/bio.h>
 
 #define PLOOP_MAP_OFFSET 16
+/* Keeps DIV_ROUND_UP(hb_nr, 8) and clu + PLOOP_MAP_OFFSET within u32 */
+#define PLOOP_MAX_HB_NR round_down(U32_MAX - PLOOP_MAP_OFFSET, 8)
 typedef u32 map_index_t;
 #define BAT_ENTRIES_PER_PAGE (PAGE_SIZE / sizeof(map_index_t))
 
@@ -410,9 +412,9 @@ static inline unsigned int ploop_nr_pages_in_cluster(struct ploop *ploop)
 static inline unsigned int ploop_nr_bat_clusters(struct ploop *ploop,
 						 u32 nr_bat_entries)
 {
-	unsigned long size, bat_clusters;
+	u64 size, bat_clusters;
 
-	size = (PLOOP_MAP_OFFSET + nr_bat_entries) * sizeof(map_index_t);
+	size = ((u64)nr_bat_entries + PLOOP_MAP_OFFSET) * sizeof(map_index_t);
 	bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
 
 	return bat_clusters;
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] dm-ploop: fix u32 overflow of the delta BAT byte size

[no-reply]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] dm-ploop: ploop_bat_clu_to_page_nr() still multiplies in 32 bits, wraps on 32-bit builds
--

commit 4d982aa9720b349cfdf860a1b465d9c33f3db9ff
Author: Alexander Ivanov <alexander.ivanov@virtuozzo.com>

dm-ploop: fix u32 overflow of the delta BAT byte size

This patch computes the header and BAT byte size in u64 via
ploop_nr_bat_clusters() and in ploop_read_delta_metadata(). It also
rejects headers and resizes whose hb_nr exceeds PLOOP_MAX_HB_NR.

> diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
> --- a/drivers/md/dm-ploop-bat.c
> +++ b/drivers/md/dm-ploop-bat.c

[ ... ]

> @@ -339,7 +340,7 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
>  	if (ret)
>  		goto out;
>  
> -	size = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t);
> +	size = ((u64)delta_nr_be + PLOOP_MAP_OFFSET) * sizeof(map_index_t);
>  	size = ALIGN(size, PAGE_SIZE); /* file may be open as direct */
>  	nr_segs = size / PAGE_SIZE;
>  

[Severity: Medium]
Is the u64 conversion complete? ploop_bat_clu_to_page_nr() in
dm-ploop.h still has the same wrap this patch fixes elsewhere:

static inline u32 ploop_bat_clu_to_page_nr(u32 clu)
{
	u64 byte;

	byte = (clu + PLOOP_MAP_OFFSET) * sizeof(map_index_t);
	return byte >> PAGE_SHIFT;
}

Here clu is u32 and PLOOP_MAP_OFFSET is int, so (clu + 16) is a 32-bit
value. It is multiplied by sizeof(map_index_t), a size_t. On a 32-bit
build size_t is 32 bits, so the product wraps for clu >= 2^30 - 16
before it is widened to u64 for byte. On 64-bit this does not wrap.

The sizes this patch now accepts reach that range. ploop_setup_metadata()
and ploop_resize() only reject sizes above PLOOP_MAX_HB_NR, which is
about 2^32 - 32. The commit message also describes m_Size >= 2^30 -
PLOOP_MAP_OFFSET as legal.

For such a size, the page count used by ploop_prealloc_md_pages() would
come from the wrapped helper:

ploop_prealloc_md_pages()
    new_nr_pages = ploop_bat_clu_to_page_nr(new_nr_bat_entries - 1) + 1;

nr_segs in ploop_read_delta_metadata() is now computed from the u64
size. Could nr_segs then exceed the number of md pages that were
preallocated?

If so, the rb_root_for_each_md_page() loop would fill only part of the
bvec array. The remaining bvecs, allocated with kvmalloc(), would be
passed uninitialised to vfs_iter_read().

init_be_iter() also takes last_page from the same helper:

init_be_iter()
    u32 rem, last_page = ploop_bat_clu_to_page_nr(nr_be - 1);

Could that give a wrong end index for large nr_be? Callers such as
ploop_md_page_find() users could also fail to find a page, and the
BUG_ON(!md) in the lookup path at the start of ploop_bat_clu_to_page_nr()
callers would then be reachable.

Would it make sense to widen the operand in ploop_bat_clu_to_page_nr()
the same way, for example ((u64)clu + PLOOP_MAP_OFFSET) *
sizeof(map_index_t)? Alternatively, 32-bit builds could be limited to
sizes the helper can represent.

The delta header comes from an image file and resize is command-driven,
so the large m_Size can be supplied externally.

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261009142316.801288-1-alexander.ivanov@virtuozzo.com?part=1

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] dm-ploop: fix u32 overflow of the delta BAT byte size

[Andrey Zhadchenko]

Reviewed-by: Andrey Zhadchenko <andrey.zhadchenko@virtuozzo.com>

On 10/9/26 16:23, Alexander Ivanov wrote:
> The byte size of header and BAT, (PLOOP_MAP_OFFSET + m_Size) *
> sizeof(map_index_t), is computed in u32 in several places. It wraps for
> m_Size >= 2^30 - PLOOP_MAP_OFFSET, which a delta with small clusters
> may legally have.
> 
> Compute the size in u64 and use ploop_nr_bat_clusters() for the number
> of BAT clusters everywhere.
> 
> Reject a header or a resize whose hb_nr exceeds PLOOP_MAX_HB_NR,
> which also keeps DIV_ROUND_UP(hb_nr, 8) and the bitmap size in bits
> from wrapping.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-148171
> Feature: dm-ploop: ploop target driver
> Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
> ---
>   drivers/md/dm-ploop-bat.c | 23 ++++++++++++-----------
>   drivers/md/dm-ploop-cmd.c | 19 +++++++++----------
>   drivers/md/dm-ploop.h     |  6 ++++--
>   3 files changed, 25 insertions(+), 23 deletions(-)
> 
> diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c
> index a7849de8aaa6..5ddb8ffdff07 100644
> --- a/drivers/md/dm-ploop-bat.c
> +++ b/drivers/md/dm-ploop-bat.c
> @@ -189,7 +189,6 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page)
>   	struct ploop_pvd_header *m_hdr = NULL;
>   	u32 bat_clusters, offset_clusters;
>   	struct dm_target *ti = ploop->ti;
> -	unsigned long size;
>   	int ret;
>   
>   	m_hdr = kmap(page);
> @@ -213,8 +212,11 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page)
>   	ploop->nr_bat_entries = le32_to_cpu(m_hdr->m_Size);
>   
>   	/* Header and BAT-occupied clusters at start of file */
> -	size = (PLOOP_MAP_OFFSET + ploop->nr_bat_entries) * sizeof(map_index_t);
> -	bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
> +	bat_clusters = ploop_nr_bat_clusters(ploop, ploop->nr_bat_entries);
> +	if ((u64)bat_clusters + ploop->nr_bat_entries > PLOOP_MAX_HB_NR) {
> +		PL_ERR("Too large BAT");
> +		goto out;
> +	}
>   
>   	/* Clusters from start of file to first data block */
>   	offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(m_hdr->m_FirstBlockOffset));
> @@ -242,7 +244,7 @@ static int ploop_delta_check_header(struct ploop *ploop,
>   				    struct rb_root *md_root,
>   				    u32 *delta_nr_be_ret)
>   {
> -	u32 bytes, delta_nr_be, offset_clusters, bat_clusters;
> +	u32 delta_nr_be, offset_clusters, bat_clusters;
>   	struct md_page *md0 = ploop_md_first_entry(md_root);
>   	struct ploop_pvd_header *d_hdr;
>   	int ret = -EPROTO;
> @@ -257,8 +259,7 @@ static int ploop_delta_check_header(struct ploop *ploop,
>   
>   	delta_nr_be = le32_to_cpu(d_hdr->m_Size);
>   	offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(d_hdr->m_FirstBlockOffset));
> -	bytes = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t);
> -	bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop));
> +	bat_clusters = ploop_nr_bat_clusters(ploop, delta_nr_be);
>   
>   	if (delta_nr_be > ploop->nr_bat_entries ||
>   	    bat_clusters != offset_clusters)
> @@ -274,13 +275,12 @@ ALLOW_ERROR_INJECTION(ploop_delta_check_header, ERRNO);
>   static int ploop_convert_bat_entries(struct ploop *ploop, struct rb_root *md_root,
>   			       u32 nr_be, u32 nr_pages, loff_t file_size)
>   {
> -	u32 i, end, bytes, bat_clusters, page_id, *bat_entries, max_file_clu;
> +	u32 i, end, bat_clusters, page_id, *bat_entries, max_file_clu;
>   	struct rb_node *node;
>   	struct md_page *md;
>   	int ret = 0;
>   
> -	bytes = (PLOOP_MAP_OFFSET + nr_be) * sizeof(map_index_t);
> -	bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop));
> +	bat_clusters = ploop_nr_bat_clusters(ploop, nr_be);
>   	max_file_clu = file_size / CLU_SIZE(ploop) - 1;
>   
>   	page_id = 0;
> @@ -311,12 +311,13 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
>   			      struct rb_root *md_root, u32 *delta_nr_be_ret)
>   {
>   	struct bio_vec bvec_on_stack, *bvec = &bvec_on_stack;
> -	u32 i, size, delta_nr_be, nr_segs;
> +	u32 i, delta_nr_be, nr_segs;
>   	loff_t pos, file_size;
>   	struct iov_iter iter;
>   	struct rb_node *node;
>   	struct md_page *md;
>   	ssize_t len;
> +	u64 size;
>   	int ret;
>   
>   	ret = -ENOMEM;
> @@ -339,7 +340,7 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file,
>   	if (ret)
>   		goto out;
>   
> -	size = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t);
> +	size = ((u64)delta_nr_be + PLOOP_MAP_OFFSET) * sizeof(map_index_t);
>   	size = ALIGN(size, PAGE_SIZE); /* file may be open as direct */
>   	nr_segs = size / PAGE_SIZE;
>   
> diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c
> index 5fa78e6cff9a..ab17520c2d56 100644
> --- a/drivers/md/dm-ploop-cmd.c
> +++ b/drivers/md/dm-ploop-cmd.c
> @@ -386,7 +386,7 @@ ALLOW_ERROR_INJECTION(ploop_grow_relocate_cluster, ERRNO);
>   static int ploop_grow_update_header(struct ploop *ploop,
>   				    struct ploop_cmd *cmd)
>   {
> -	unsigned int size, first_block_off;
> +	unsigned int first_block_off;
>   	struct ploop_pvd_header *hdr;
>   	struct ploop_index_wb *piwb;
>   	u32 nr_be, offset, clus;
> @@ -413,9 +413,7 @@ static int ploop_grow_update_header(struct ploop *ploop,
>   	}
>   	piwb = md->piwb;
>   
> -	size = (PLOOP_MAP_OFFSET + cmd->resize.nr_bat_entries);
> -	size *= sizeof(map_index_t);
> -	clus = DIV_ROUND_UP(size, CLU_SIZE(ploop));
> +	clus = ploop_nr_bat_clusters(ploop, cmd->resize.nr_bat_entries);
>   	first_block_off = CLU_TO_SEC(ploop, clus);
>   
>   	hdr = kmap_local_page(piwb->bat_page);
> @@ -597,6 +595,11 @@ static int ploop_resize(struct ploop *ploop, sector_t new_sectors)
>   	}
>   
>   	nr_bat_entries = SEC_TO_CLU(ploop, new_sectors);
> +	nr_bat_clusters = ploop_nr_bat_clusters(ploop, nr_bat_entries);
> +	if ((u64)nr_bat_clusters + nr_bat_entries > PLOOP_MAX_HB_NR) {
> +		DMWARN("resize: too large size is requested");
> +		return -EINVAL;
> +	}
>   
>   	/* Memory for new md pages */
>   	ret = ploop_prealloc_md_pages(&cmd.resize.md_pages_root,
> @@ -604,8 +607,6 @@ static int ploop_resize(struct ploop *ploop, sector_t new_sectors)
>   	if (ret)
>   		return ret;
>   
> -	size = (PLOOP_MAP_OFFSET + nr_bat_entries) * sizeof(map_index_t);
> -	nr_bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
>   	hb_nr = nr_bat_clusters + nr_bat_entries;
>   	size = round_up(DIV_ROUND_UP(hb_nr, 8), sizeof(unsigned long));
>   
> @@ -1010,11 +1011,9 @@ static int process_flip_upper_deltas(struct ploop *ploop)
>   	u8 level = ploop_top_level(ploop) - 1;
>   	struct rb_node *node;
>   	struct md_page *md;
> -	u64 size;
>   
> -	size = (PLOOP_MAP_OFFSET + READ_ONCE(ploop->nr_bat_entries))
> -		* sizeof(map_index_t);
> -        bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
> +	bat_clusters = ploop_nr_bat_clusters(ploop,
> +					     READ_ONCE(ploop->nr_bat_entries));
>   	hb_nr = ploop->hb_nr;
>   
>   	/*
> diff --git a/drivers/md/dm-ploop.h b/drivers/md/dm-ploop.h
> index 23662943d56a..5041fc8f1e13 100644
> --- a/drivers/md/dm-ploop.h
> +++ b/drivers/md/dm-ploop.h
> @@ -12,6 +12,8 @@
>   #include <linux/bio.h>
>   
>   #define PLOOP_MAP_OFFSET 16
> +/* Keeps DIV_ROUND_UP(hb_nr, 8) and clu + PLOOP_MAP_OFFSET within u32 */
> +#define PLOOP_MAX_HB_NR round_down(U32_MAX - PLOOP_MAP_OFFSET, 8)
>   typedef u32 map_index_t;
>   #define BAT_ENTRIES_PER_PAGE (PAGE_SIZE / sizeof(map_index_t))
>   
> @@ -410,9 +412,9 @@ static inline unsigned int ploop_nr_pages_in_cluster(struct ploop *ploop)
>   static inline unsigned int ploop_nr_bat_clusters(struct ploop *ploop,
>   						 u32 nr_bat_entries)
>   {
> -	unsigned long size, bat_clusters;
> +	u64 size, bat_clusters;
>   
> -	size = (PLOOP_MAP_OFFSET + nr_bat_entries) * sizeof(map_index_t);
> +	size = ((u64)nr_bat_entries + PLOOP_MAP_OFFSET) * sizeof(map_index_t);
>   	bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop));
>   
>   	return bat_clusters;

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] dm-ploop: fix u32 overflow of the delta BAT byte size

[Konstantin Khorenko]

  Applied with two small changes on commit, no need to resend.

  1. Added

  Fixes: 6ddad5a4d226 ("dm-ploop: Add ploop target driver")

  2. Changed the message of the new check in ploop_resize(). After the
  patch the function prints the same text from two different checks:

          } else if (SEC_TO_CLU(ploop, new_sectors) >= U32_MAX - 2) {
                  DMWARN("resize: too large size is requested");
                  return -EINVAL;
          ...
          nr_bat_entries = SEC_TO_CLU(ploop, new_sectors);
          nr_bat_clusters = ploop_nr_bat_clusters(ploop, nr_bat_entries);
          if ((u64)nr_bat_clusters + nr_bat_entries > PLOOP_MAX_HB_NR) {
                  DMWARN("resize: too large size is requested");
                  return -EINVAL;
          }

  Both checks are needed: the first one runs on sector_t and guards the
  u32 truncation of nr_bat_entries, the second one bounds hb_nr. But with
  the same text the log does not tell which one fired, and the first check
  looks redundant next to the second one. So the new check now says what
  does not fit, matching "Too large BAT" in ploop_setup_metadata():

                  DMWARN("resize: too large BAT");

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] dm-ploop: fix u32 overflow of the delta BAT byte size

[Konstantin Khorenko]

On Fri, 09 Oct 2026 16:23:16 +0200, Alexander Ivanov wrote:
> dm-ploop: fix u32 overflow of the delta BAT byte size

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.12.vz10, thanks!

[1/1] dm-ploop: fix u32 overflow of the delta BAT byte size
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/367e786f0989

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel