[PATCH] block: partitions: ldm: avoid overflow in VMDB size check

[PATCH] block: partitions: ldm: avoid overflow in VMDB size check

[zhangqiuhao]

ldm_validate_vmdb() can accept a VMDB whose declared VBLK extent
exceeds the TOCBLOCK configuration bitmap.

For example, these fields on a 4 MiB image pass the preceding PRIVHEAD
and TOCBLOCK bounds checks:

    disk capacity = 8192 sectors
    config_start  = 6144 sectors
    config_size   = 2048 sectors
    bitmap1_start =   17 sectors
    bitmap1_size  = 1024 sectors (524288 bytes)
    vblk_size     =  128 bytes
    last_vblk_seq = 0x02000008 (33554440)

The configuration area fits on the disk, and the bitmap ends at sector
1041 within the 2048-sector area. The VBLK extent is 128 * 33554440 =
4294968320 bytes (4 GiB + 1024 bytes), so the VMDB should be rejected.
Both multiplicands are u32, however, so the product wraps to 1024 before
it is promoted to u64 for the comparison. The check evaluates
1024 > 524288 as false and incorrectly accepts the VMDB.

Cast vblk_size to u64 before multiplying. The check then evaluates
4294968320 > 524288 as true and rejects the out-of-range extent.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: zhangqiuhao <zhangqiuhao@huawei.com>
---

Based on Jens Axboe's for-next at
70866cfa169d5ee149364267289e71d50f9a7ae9.

 block/partitions/ldm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index c0bdcae58..d5c133a33 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -458,7 +458,8 @@ static bool ldm_validate_vmdb(struct parsed_partitions *state,
 	 * The last_vblkd_seq can be before the end of the vmdb, just make sure
 	 * it is not out of bounds.
 	 */
-	if ((vm->vblk_size * vm->last_vblk_seq) > (toc->bitmap1_size << 9)) {
+	if (((u64)vm->vblk_size * vm->last_vblk_seq) >
+	    (toc->bitmap1_size << 9)) {
 		ldm_crit ("VMDB exceeds allowed size specified by TOCBLOCK.  "
 				"Database is corrupt.  Aborting.");
 		goto out;
-- 
2.33.0