[LU-19059] overflow in lov_stripe_size()

• Type: Bug
• Resolution: Fixed
• Priority: Blocker
• Fix Version/s: Lustre 2.17.0
• Affects Version/s: Lustre 2.16.1
• Severity: 3
• Assignee: Vladimir Saveliev
• Reporter: Vladimir Saveliev

Description

u64 lov_stripe_size(struct lov_stripe_md *lsm, int index, u64 ost_size,
                    int stripeno)
{
        u32 ssize = lsm->lsm_entries[index]->lsme_stripe_size;
..
        if (stripe_size)
                lov_size = ost_size * swidth + stripeno * ssize + stripe_size;
        else
                lov_size = (ost_size - 1) * swidth + (stripeno + 1) * ssize;

 (stripeno + 1) * ssize operates on 2 32-bit integers and may overflow. For instance if stripeno == 31 and ssize == 128 * 1048576.

The causes miscalculation of file size.

Issue Links

• is related to: LU-6174 do_div() silently truncates divisor to uint32_t