From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752947AbbHUO5J (ORCPT ); Fri, 21 Aug 2015 10:57:09 -0400 Received: from mail-pd0-f172.google.com ([209.85.192.172]:34841 "EHLO mail-pd0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751863AbbHUO5I (ORCPT ); Fri, 21 Aug 2015 10:57:08 -0400 From: Peng Fan To: dwmw2@infradead.org, computersforpeace@gmail.com Cc: linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, van.freenix@gmail.com Subject: [PATCH] mtd: blktrans: fix integer overflow Date: Fri, 21 Aug 2015 22:57:31 +0800 Message-Id: <1440169051-13891-1-git-send-email-van.freenix@gmail.com> X-Mailer: git-send-email 1.8.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In drivers/mtd/mtd_blkdevs.c: 406 set_capacity(gd, (new->size * tr->blksize) >> 9); The type of new->size is unsigned long and the type of tr->blksize is int, the result of 'new->size * tr->blksize' may exceed ULONG_MAX on 32bit machines. I use nand chip MT29F32G08CBADBWP which is 4GB and the parameters passed to kernel is 'mtdparts=gpmi-nand:-(user)', the whole nand chip will be treated as a 4GB mtd partition. new->size is 0x800000 and tr->blksize is 0x200, 'new->size * tr->blksize' however is 0. This is what we do not want to see. Change the type of entry size of mtd_blktrans_dev to unsigned long long to fix the overflow issue. Signed-off-by: Peng Fan Cc: David Woodhouse Cc: Brian Norris --- include/linux/mtd/blktrans.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/mtd/blktrans.h b/include/linux/mtd/blktrans.h index e93837f..3853d74 100644 --- a/include/linux/mtd/blktrans.h +++ b/include/linux/mtd/blktrans.h @@ -38,7 +38,7 @@ struct mtd_blktrans_dev { struct mutex lock; int devnum; bool bg_stop; - unsigned long size; + unsigned long long size; int readonly; int open; struct kref ref; -- 1.8.4