block: avoid possible overflow for chunk_sectors check in blk_stack_limits()

johnpgarry · gregkh · commit 5e276e6ff9aa · 2025-08-20T18:36:26.000+02:00
[ Upstream commit 448dfec ] In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors. Reviewed-by: Hannes Reinecke <hare@suse.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: John Garry <john.g.garry@oracle.com> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://lore.kernel.org/r/20250729091448.1691334-2-john.g.garry@oracle.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/block/blk-settings.c b/block/blk-settings.c
@@ -797,7 +797,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
 	}
 
 	/* chunk_sectors a multiple of the physical block size? */
-	if ((t->chunk_sectors << 9) & (t->physical_block_size - 1)) {
+	if (t->chunk_sectors % (t->physical_block_size >> SECTOR_SHIFT)) {
 		t->chunk_sectors = 0;
 		t->flags |= BLK_FLAG_MISALIGNED;
 		ret = -1;

Original file line number	Diff line number	Diff line change
`@@ -797,7 +797,7 @@ int blk_stack_limits(struct queue_limits t, struct queue_limits b,`
`797`	`797`	`}`
`798`	`798`
`799`	`799`	`/* chunk_sectors a multiple of the physical block size? */`
`800`		`- if ((t->chunk_sectors << 9) & (t->physical_block_size - 1)) {`
	`800`	`+ if (t->chunk_sectors % (t->physical_block_size >> SECTOR_SHIFT)) {`
`801`	`801`	`t->chunk_sectors = 0;`
`802`	`802`	`t->flags \|= BLK_FLAG_MISALIGNED;`
`803`	`803`	`ret = -1;`