From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id A0B1980726 for ; Tue, 13 Oct 2026 07:56:52 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69D7teqH009999; Tue, 13 Oct 2026 10:55:41 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69D7teqH009999 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="IMBIrDhs" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69D7tRTH009940 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 13 Oct 2026 10:55:27 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69D7tRTH009940 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48c437ae7dbso1505805f8f.1 for ; Tue, 13 Oct 2026 00:55:27 -0700 (PDT) X-Gm-Message-State: AFq9FYJlVwyy00uNJfyYqBVKMZ57oFRCmfI4s5mQkTdV5+7lK/u3icjb AY6qwFh05ET0osmVRuSsyjge/6AgV04BrryS5KLTxvnM+LHt4HvjZCXLHTPY92KBIWJaUxAxUGq eV4sZ5+10EeOZqSkjbePgKPyOBdCbJ9HjNJqvv7+Tz/1qFvo+JEydPA== X-Gm-Gg: AYBFou2neP2DJJMlj1EEv0D7gc/Gp1aPQy5FSF3g82JuXDcfUA5m//YB7d+6NbkMRTA tqpwdW9NGnTShcDpVjRU2DcmbvqrYlr3V5OHyUKQ1UCQfZ96xtKvGx2f/gSponfquPutfgJhemj fP7/6lzYi/GwyDPh/7Dmnv8wTNTxu8rTEZQ+kbKOCbKQOZUqUWYjUGnGCZs34Dcla8G4PYbYLRo DuQl7FQzRzKNfBAAkhojIGqc6H0UDk56mG4SGZuxynjUo5TSfcZ2/m5AudRJn1ed1Cz/hs4GmZV zaYcKOLYCTY4j9MU5fUuiUeRjzXd7F33ChaUoFPMoXl+zLLnKd7Mc1eL8ss+ghU6xo9jP1OrfKa 49Cf7T6cRgGjVL6QT+ucEeC5XVrk= X-Received: by 2002:a05:6000:188a:b0:48c:72fc:3644 with SMTP id ffacd0b85a97d-48dbacf555bmr26392059f8f.22.1791878127103; Tue, 13 Oct 2026 00:55:27 -0700 (PDT) X-Received: by 2002:a05:6000:188a:b0:48c:72fc:3644 with SMTP id ffacd0b85a97d-48dbacf555bmr26391961f8f.22.1791878126098; Tue, 13 Oct 2026 00:55:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791878126; cv=none; d=google.com; s=arc-20260327; b=AC4YlYAt4otnRba/VRr0DMHROO7hdw+XOWR8OVZuO1tGxzq0OYKYgTNNsPON0M3C3j MT6IPR7fqU4PftFw2XJ7npx759sI9MWhpJvFTEuyiuszE6DiscW/Hkz6aGpAvwYiLiWk 1Ai8EH4YvAOr+amHwSuXx2Vc07+m+ptQNcNSV/yCtxy6Gtp/ESL3hKW4dA/oHpelIlKR 7KrINKSLnuyGEsvPvEOYYbAiEkFqBVy6CTTKKteIxmG9iF4u7k0Pf6eWm6LcMXbeCifY 0WmAWAFoB3ZZD2gKagjj3482u4hvNKijGlztf4hdxMq/CAw8G/Jg5eoZ3xs5JHqz7S+g PJ5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=zj3tjgklPs4o3v7SncaqSgxoqsdQg3l5Dni3+M2z9Vs=; fh=M+TyAUhAp4+t7uzAVeqNdLHW5eNz2FQXSv4TjrRhpCk=; b=fKh7w115o3ERMi9zaQ+Bq+3w9xLSwIt+DhJQmZKZ8+ianCHUPgFJQguoiLHpferb7r w6WqAQJHmoC2+MBRaxnxNQ4UOHgrlerrp7V/eaB6SdqksFc573tD2Uhta3tpaTIe6eeC 31GKYafyU55cvqFbJrxnINBAVgb2Yl/4BxSqvcaHqwyWQIe4+Luvg8yEnE6URoTXnlrA WfAqIZpegIPwPxmqty9ebw2YHQGDK+f/qPzMPKfKJvmayeisHS2hp8G9C66HDQvRs8Hr mHjD5Nb59aOmhkEug8wX4hnQxAG+g9f6mkfZRMetY4WhfJgS2X0xDh72jhRMckqyAaDI 7+8w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=IMBIrDhs; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48de0c0c209si4206149f8f.405.2026.10.13.00.55.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 00:55:26 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=IMBIrDhs; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=zj3tjgklPs4o3v7SncaqSgxoqsdQg3l5Dni3+M2z9Vs=; b=IMBIrDhszaHx TErDVTPWvCv6bGtLurxM+lBLJWhXyHV3m8UCmnxDei5LDFkoVesBd6BL2/Lth0vWEMVIaLEUy6iDH hLnQ6xE+WvF8IjcqBXXly/0F3lefN+KC1IH950b7KmrhBgW8xLx2HZcFLLDhRL6DvNGalC5wFpliC 1R8zr7reeMEO0QAH0IphiIbP6ennBxjjKRMUPYPRv36XBoOrdguqnHlEKFE4CuwOpGU73yoJpi5Si ivtyPKwsG2Z55jQ2rD/JVddBBpRsBiSUXI9JTU5zF4WidhGkdubXC5ClAn2Y9cb2m276K+zpbVOGE LXBIJu3UPG1BdH5UXUizyQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xGXIg-004zlI-1L; Tue, 13 Oct 2026 09:55:16 +0200 From: Alexander Ivanov To: den@openvz.org Date: Tue, 13 Oct 2026 09:55:03 +0200 Message-ID: <20261013075513.90618-2-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261013075513.90618-1-alexander.ivanov@virtuozzo.com> References: <20261013075513.90618-1-alexander.ivanov@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v5 01/11] dm-ploop: fix u32 overflow of the delta BAT byte size X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The byte size of header and BAT, (PLOOP_MAP_OFFSET + m_Size) * sizeof(map_index_t), is computed in u32 in several places. It wraps for m_Size >= 2^30 - PLOOP_MAP_OFFSET, which a delta with small clusters may legally have. Compute the size in u64 and use ploop_nr_bat_clusters() for the number of BAT clusters everywhere. Reject a header or a resize whose hb_nr exceeds PLOOP_MAX_HB_NR, which also keeps DIV_ROUND_UP(hb_nr, 8) and the bitmap size in bits from wrapping. https://virtuozzo.atlassian.net/browse/VSTOR-148171 Feature: dm-ploop: ploop target driver Signed-off-by: Alexander Ivanov --- drivers/md/dm-ploop-bat.c | 23 ++++++++++++----------- drivers/md/dm-ploop-cmd.c | 19 +++++++++---------- drivers/md/dm-ploop.h | 6 ++++-- 3 files changed, 25 insertions(+), 23 deletions(-) diff --git a/drivers/md/dm-ploop-bat.c b/drivers/md/dm-ploop-bat.c index a7849de8aaa6..5ddb8ffdff07 100644 --- a/drivers/md/dm-ploop-bat.c +++ b/drivers/md/dm-ploop-bat.c @@ -189,7 +189,6 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page) struct ploop_pvd_header *m_hdr = NULL; u32 bat_clusters, offset_clusters; struct dm_target *ti = ploop->ti; - unsigned long size; int ret; m_hdr = kmap(page); @@ -213,8 +212,11 @@ int ploop_setup_metadata(struct ploop *ploop, struct page *page) ploop->nr_bat_entries = le32_to_cpu(m_hdr->m_Size); /* Header and BAT-occupied clusters at start of file */ - size = (PLOOP_MAP_OFFSET + ploop->nr_bat_entries) * sizeof(map_index_t); - bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop)); + bat_clusters = ploop_nr_bat_clusters(ploop, ploop->nr_bat_entries); + if ((u64)bat_clusters + ploop->nr_bat_entries > PLOOP_MAX_HB_NR) { + PL_ERR("Too large BAT"); + goto out; + } /* Clusters from start of file to first data block */ offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(m_hdr->m_FirstBlockOffset)); @@ -242,7 +244,7 @@ static int ploop_delta_check_header(struct ploop *ploop, struct rb_root *md_root, u32 *delta_nr_be_ret) { - u32 bytes, delta_nr_be, offset_clusters, bat_clusters; + u32 delta_nr_be, offset_clusters, bat_clusters; struct md_page *md0 = ploop_md_first_entry(md_root); struct ploop_pvd_header *d_hdr; int ret = -EPROTO; @@ -257,8 +259,7 @@ static int ploop_delta_check_header(struct ploop *ploop, delta_nr_be = le32_to_cpu(d_hdr->m_Size); offset_clusters = SEC_TO_CLU(ploop, le32_to_cpu(d_hdr->m_FirstBlockOffset)); - bytes = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t); - bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop)); + bat_clusters = ploop_nr_bat_clusters(ploop, delta_nr_be); if (delta_nr_be > ploop->nr_bat_entries || bat_clusters != offset_clusters) @@ -274,13 +275,12 @@ ALLOW_ERROR_INJECTION(ploop_delta_check_header, ERRNO); static int ploop_convert_bat_entries(struct ploop *ploop, struct rb_root *md_root, u32 nr_be, u32 nr_pages, loff_t file_size) { - u32 i, end, bytes, bat_clusters, page_id, *bat_entries, max_file_clu; + u32 i, end, bat_clusters, page_id, *bat_entries, max_file_clu; struct rb_node *node; struct md_page *md; int ret = 0; - bytes = (PLOOP_MAP_OFFSET + nr_be) * sizeof(map_index_t); - bat_clusters = DIV_ROUND_UP(bytes, CLU_SIZE(ploop)); + bat_clusters = ploop_nr_bat_clusters(ploop, nr_be); max_file_clu = file_size / CLU_SIZE(ploop) - 1; page_id = 0; @@ -311,12 +311,13 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file, struct rb_root *md_root, u32 *delta_nr_be_ret) { struct bio_vec bvec_on_stack, *bvec = &bvec_on_stack; - u32 i, size, delta_nr_be, nr_segs; + u32 i, delta_nr_be, nr_segs; loff_t pos, file_size; struct iov_iter iter; struct rb_node *node; struct md_page *md; ssize_t len; + u64 size; int ret; ret = -ENOMEM; @@ -339,7 +340,7 @@ int ploop_read_delta_metadata(struct ploop *ploop, struct file *file, if (ret) goto out; - size = (PLOOP_MAP_OFFSET + delta_nr_be) * sizeof(map_index_t); + size = ((u64)delta_nr_be + PLOOP_MAP_OFFSET) * sizeof(map_index_t); size = ALIGN(size, PAGE_SIZE); /* file may be open as direct */ nr_segs = size / PAGE_SIZE; diff --git a/drivers/md/dm-ploop-cmd.c b/drivers/md/dm-ploop-cmd.c index 5fa78e6cff9a..ab17520c2d56 100644 --- a/drivers/md/dm-ploop-cmd.c +++ b/drivers/md/dm-ploop-cmd.c @@ -386,7 +386,7 @@ ALLOW_ERROR_INJECTION(ploop_grow_relocate_cluster, ERRNO); static int ploop_grow_update_header(struct ploop *ploop, struct ploop_cmd *cmd) { - unsigned int size, first_block_off; + unsigned int first_block_off; struct ploop_pvd_header *hdr; struct ploop_index_wb *piwb; u32 nr_be, offset, clus; @@ -413,9 +413,7 @@ static int ploop_grow_update_header(struct ploop *ploop, } piwb = md->piwb; - size = (PLOOP_MAP_OFFSET + cmd->resize.nr_bat_entries); - size *= sizeof(map_index_t); - clus = DIV_ROUND_UP(size, CLU_SIZE(ploop)); + clus = ploop_nr_bat_clusters(ploop, cmd->resize.nr_bat_entries); first_block_off = CLU_TO_SEC(ploop, clus); hdr = kmap_local_page(piwb->bat_page); @@ -597,6 +595,11 @@ static int ploop_resize(struct ploop *ploop, sector_t new_sectors) } nr_bat_entries = SEC_TO_CLU(ploop, new_sectors); + nr_bat_clusters = ploop_nr_bat_clusters(ploop, nr_bat_entries); + if ((u64)nr_bat_clusters + nr_bat_entries > PLOOP_MAX_HB_NR) { + DMWARN("resize: too large size is requested"); + return -EINVAL; + } /* Memory for new md pages */ ret = ploop_prealloc_md_pages(&cmd.resize.md_pages_root, @@ -604,8 +607,6 @@ static int ploop_resize(struct ploop *ploop, sector_t new_sectors) if (ret) return ret; - size = (PLOOP_MAP_OFFSET + nr_bat_entries) * sizeof(map_index_t); - nr_bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop)); hb_nr = nr_bat_clusters + nr_bat_entries; size = round_up(DIV_ROUND_UP(hb_nr, 8), sizeof(unsigned long)); @@ -1010,11 +1011,9 @@ static int process_flip_upper_deltas(struct ploop *ploop) u8 level = ploop_top_level(ploop) - 1; struct rb_node *node; struct md_page *md; - u64 size; - size = (PLOOP_MAP_OFFSET + READ_ONCE(ploop->nr_bat_entries)) - * sizeof(map_index_t); - bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop)); + bat_clusters = ploop_nr_bat_clusters(ploop, + READ_ONCE(ploop->nr_bat_entries)); hb_nr = ploop->hb_nr; /* diff --git a/drivers/md/dm-ploop.h b/drivers/md/dm-ploop.h index 23662943d56a..5041fc8f1e13 100644 --- a/drivers/md/dm-ploop.h +++ b/drivers/md/dm-ploop.h @@ -12,6 +12,8 @@ #include #define PLOOP_MAP_OFFSET 16 +/* Keeps DIV_ROUND_UP(hb_nr, 8) and clu + PLOOP_MAP_OFFSET within u32 */ +#define PLOOP_MAX_HB_NR round_down(U32_MAX - PLOOP_MAP_OFFSET, 8) typedef u32 map_index_t; #define BAT_ENTRIES_PER_PAGE (PAGE_SIZE / sizeof(map_index_t)) @@ -410,9 +412,9 @@ static inline unsigned int ploop_nr_pages_in_cluster(struct ploop *ploop) static inline unsigned int ploop_nr_bat_clusters(struct ploop *ploop, u32 nr_bat_entries) { - unsigned long size, bat_clusters; + u64 size, bat_clusters; - size = (PLOOP_MAP_OFFSET + nr_bat_entries) * sizeof(map_index_t); + size = ((u64)nr_bat_entries + PLOOP_MAP_OFFSET) * sizeof(map_index_t); bat_clusters = DIV_ROUND_UP(size, CLU_SIZE(ploop)); return bat_clusters; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel