0070-zfs-Fix-possible-integer-overflows.patch 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. From 302c12ff5714bc455949117c1c9548ccb324d55b Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Tue, 8 Dec 2020 22:17:04 +0000
  4. Subject: [PATCH] zfs: Fix possible integer overflows
  5. In all cases the problem is that the value being acted upon by
  6. a left-shift is a 32-bit number which is then being used in the
  7. context of a 64-bit number.
  8. To avoid overflow we ensure that the number being shifted is 64-bit
  9. before the shift is done.
  10. Fixes: CID 73684, CID 73695, CID 73764
  11. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  12. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  13. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  14. ---
  15. grub-core/fs/zfs/zfs.c | 8 ++++----
  16. 1 file changed, 4 insertions(+), 4 deletions(-)
  17. diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
  18. index 9087a72..b078ccc 100644
  19. --- a/grub-core/fs/zfs/zfs.c
  20. +++ b/grub-core/fs/zfs/zfs.c
  21. @@ -564,7 +564,7 @@ find_bestub (uberblock_phys_t * ub_array,
  22. ubptr = (uberblock_phys_t *) ((grub_properly_aligned_t *) ub_array
  23. + ((i << ub_shift)
  24. / sizeof (grub_properly_aligned_t)));
  25. - err = uberblock_verify (ubptr, offset, 1 << ub_shift);
  26. + err = uberblock_verify (ubptr, offset, (grub_size_t) 1 << ub_shift);
  27. if (err)
  28. {
  29. grub_errno = GRUB_ERR_NONE;
  30. @@ -1543,7 +1543,7 @@ read_device (grub_uint64_t offset, struct grub_zfs_device_desc *desc,
  31. high = grub_divmod64 ((offset >> desc->ashift) + c,
  32. desc->n_children, &devn);
  33. - csize = bsize << desc->ashift;
  34. + csize = (grub_size_t) bsize << desc->ashift;
  35. if (csize > len)
  36. csize = len;
  37. @@ -1635,8 +1635,8 @@ read_device (grub_uint64_t offset, struct grub_zfs_device_desc *desc,
  38. while (len > 0)
  39. {
  40. - grub_size_t csize;
  41. - csize = ((s / (desc->n_children - desc->nparity))
  42. + grub_size_t csize = s;
  43. + csize = ((csize / (desc->n_children - desc->nparity))
  44. << desc->ashift);
  45. if (csize > len)
  46. csize = len;
  47. --
  48. 2.14.2