From e7c015219501b8250df1620048103417de5e89a2 Mon Sep 17 00:00:00 2001 From: John Garry Date: Fri, 26 Sep 2025 15:25:29 +0800 Subject: [PATCH] block: avoid possible overflow for chunk_sectors check in blk_stack_limits() stable inclusion from stable-v6.6.103 commit 3b9d69f0e68aa6b0acd9791c45d445154a8c66e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXSWT CVE: CVE-2025-39795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3b9d69f0e68aa6b0acd9791c45d445154a8c66e9 ------------------ [ Upstream commit 448dfecc7ff807822ecd47a5c052acedca7d09e8 ] In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors. Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: John Garry Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250729091448.1691334-2-john.g.garry@oracle.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Signed-off-by: Zheng Qixing --- block/blk-settings.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-settings.c b/block/blk-settings.c index 7019b8e204d9..021994f6d2d8 100644 --- a/block/blk-settings.c +++ b/block/blk-settings.c @@ -634,7 +634,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, } /* chunk_sectors a multiple of the physical block size? */ - if ((t->chunk_sectors << 9) & (t->physical_block_size - 1)) { + if (t->chunk_sectors % (t->physical_block_size >> SECTOR_SHIFT)) { t->chunk_sectors = 0; t->misaligned = 1; ret = -1; -- Gitee