[uml-devel] Integer overflows in new AIO ubd driver

[Gerd S. <in...@ge...>]

Hi,

I recently tried to benchmark the new AIO-based ubd driver (including
O_DIRECT), and ran into serious problems with filesystems > 4GB. I think
I found the problem; two overflows in ubd_kern.c (see patch).

My test system was 2.6.16 plus all patches from user-mode-linux.sf.net
minus no_cow_odirect. Symptoms were that ext3 complained that it was
tried to write blocks into the system zone, and switched the filesystem
to r/o.

I also experienced (hard) lockups when doing lots of I/O. But this seems
to be unrelated to this problem (but who knows).

Gerd

--- linux-2.6.16/arch/um/drivers/ubd_kern.c.orig        2006-03-26 16:57:11.000000000 +0200
+++ linux-2.6.16/arch/um/drivers/ubd_kern.c     2006-03-26 18:16:02.000000000 +0200
@@ -1228,7 +1228,7 @@ static void do_ubd_request(request_queue
                while(dev->start_sg < dev->end_sg){
                        struct scatterlist *sg = &dev->sg[dev->start_sg];

-                       prepare_request(req, &io_req, req->sector << 9,
+                       prepare_request(req, &io_req, (unsigned long long) req->sector << 9,
                                        sg->offset, sg->length, sg->page);

                        if(do_io(&io_req, req, dev) == -EAGAIN)
@@ -1573,7 +1573,7 @@ static int do_io(struct io_thread_req *r
                }

                off = req->offsets[bit] + req->offset +
-                       start * req->sectorsize;
+                       (unsigned long long) start * req->sectorsize;
                len = (end - start) * req->sectorsize;
                buf = &req->buffer[start * req->sectorsize];




-- 
------------------------------------------------------------
Gerd Stolpmann * Viktoriastr. 45 * 64293 Darmstadt * Germany 
ge...@ge...          http://www.gerd-stolpmann.de
Phone: +49-6151-153855                  Fax: +49-6151-997714
------------------------------------------------------------