This is a note to let you know that I've just added the patch titled
dm-stripe: fix a possible integer overflow
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
dm-stripe-fix-a-possible-integer-overflow.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
commit d42a776bd6f8527f17229a60714fb411d98f764f
Author: Mikulas Patocka <[email protected]>
Date: Mon Aug 11 13:17:32 2025 +0200
dm-stripe: fix a possible integer overflow
[ Upstream commit 1071d560afb4c245c2076494226df47db5a35708 ]
There's a possible integer overflow in stripe_io_hints if we have too
large chunk size. Test if the overflow happened, and if it did, don't set
limits->io_min and limits->io_opt;
Signed-off-by: Mikulas Patocka <[email protected]>
Reviewed-by: John Garry <[email protected]>
Suggested-by: Dongsheng Yang <[email protected]>
Cc: [email protected]
Signed-off-by: Sasha Levin <[email protected]>
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index aad50e9fe9958..11d8ff3c45635 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -456,11 +456,15 @@ static void stripe_io_hints(struct dm_target *ti,
struct queue_limits *limits)
{
struct stripe_c *sc = ti->private;
- unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT;
+ unsigned int io_min, io_opt;
limits->chunk_sectors = sc->chunk_size;
- limits->io_min = chunk_size;
- limits->io_opt = chunk_size * sc->stripes;
+
+ if (!check_shl_overflow(sc->chunk_size, SECTOR_SHIFT, &io_min) &&
+ !check_mul_overflow(io_min, sc->stripes, &io_opt)) {
+ limits->io_min = io_min;
+ limits->io_opt = io_opt;
+ }
}
static struct target_type stripe_target = {
