mtd: blktrans: fix multiplication overflow

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=2ce401d56b36a7492b26646b94d1fe9194880a1a
Commit:     2ce401d56b36a7492b26646b94d1fe9194880a1a
Parent:     7446076e818814d3237b20a96112b44bdb3f8576
Author:     Peng Fan <van.freenix at gmail.com>
AuthorDate: Fri Sep 11 21:41:47 2015 +0800
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Mon Sep 28 17:23:21 2015 -0700

    mtd: blktrans: fix multiplication overflow
    
    In drivers/mtd/mtd_blkdevs.c:
    406	set_capacity(gd, (new->size * tr->blksize) >> 9);
    The type of new->size is unsigned long and the type of tr->blksize is int,
    the result of 'new->size * tr->blksize' may exceed ULONG_MAX on 32bit
    machines.
    
    I use nand chip MT29F32G08CBADBWP which is 4GB and the parameters passed
    to kernel is 'mtdparts=gpmi-nand:-(user)', the whole nand chip will be
    treated as a 4GB mtd partition. new->size is 0x800000 and tr->blksize is
    0x200, 'new->size * tr->blksize' however is 0. This is what we do not want
    to see.
    
    Using type cast u64 to fix the multiplication overflow issue.
    
    Signed-off-by: Peng Fan <van.freenix at gmail.com>
    Cc: David Woodhouse <dwmw2 at infradead.org>
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
---
 drivers/mtd/mtd_blkdevs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 44dc965..cb47d79 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -399,7 +399,7 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
 		snprintf(gd->disk_name, sizeof(gd->disk_name),
 			 "%s%d", tr->name, new->devnum);
 
-	set_capacity(gd, (new->size * tr->blksize) >> 9);
+	set_capacity(gd, ((u64)new->size * tr->blksize) >> 9);
 
 	/* Create the request queue */
 	spin_lock_init(&new->queue_lock);