In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md: do overflow check for sb->bblog_shift in super_1_load()<\/p>\n
In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-
\ndisk superblock. It is used for badblocks API badblocks_set() by the
\nfollowing sequence,<\/p>\n
1930 rdev->badblocks.shift = sb->bblog_shift;
\n 1931 for (i = 0 ; i < (sectors <> 10;
\n 1935 sector <bblog_shift;
\n 1936 count <bblog_shift;
\n 1937 if (bb + 1 == 0)
\n 1938 break;
\n 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1))
\n 1940 return -EINVAL;
\n 1941 }<\/p>\n
bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for
\nan invalid bb->bblog_shit, it is possible to make sector be overflowed
\nby the following calculation,
\n 1935 sector <bblog_shift;
\nThen in turn when call badblocks_set() at line 1939 with the invalid
\nrdev->badblocks.shift set at line 1930, may result an overflow inside
\n_badblocks_clear() in block\/badblocks.c.<\/p>\n
Although there are many places to call badblocks APIs, the non-zero
\nshift value is only used in super_1_load(), other places always use 0 as
\nthe shift value. Therefore it is unnecessary to do a general shift value
\noverflow check inside badblock API, and just check here as the caller.<\/p>\n
This may avoid unnecessary check, make the badblocks API code more simple
\nand elegant.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md: do overflow check for sb->bblog_shift in super_1_load()<\/p>\n
In super_1_load(), sb->bblog_shift is an __u8 type value loaded from o<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21479","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}