Integer overflow in target_core_device.c

From: ÐÐÑÐ ÐÐÑÐÐÐÐÑÐ
Date: Fri Apr 22 2016 - 03:18:14 EST


Linux kernel commit 8a9ebe717a133ba7bc90b06047f43cc6b8bcb8b3

attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9)

Since max_discard_sectors is 32-bit, there may be integer overflow,
making wrong max_unmap_lba_count.

For example, LVM Thin provisioning reports that it have 16 GB maximal
discard block.

Exactly the same bug in DRBD9, I have already reported.

--
Segmentation fault