[PATCH] dm-stripe: fix a possible integer overflow

[Mikulas Patocka]

There's a possible integer overflow in stripe_io_hints if we have too
large chunk size. Test if the overflow happened, and if it did, don't set
limits->io_min and limits->io_opt;

Signed-off-by: Mikulas Patocka <mpato...@redhat.com>
Cc: sta...@vger.kernel.org

---
 drivers/md/dm-stripe.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

Index: linux-2.6/drivers/md/dm-stripe.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-stripe.c       2025-07-06 15:02:23.000000000 
+0200
+++ linux-2.6/drivers/md/dm-stripe.c    2025-07-07 12:32:49.000000000 +0200
@@ -456,10 +456,14 @@ static void stripe_io_hints(struct dm_ta
                            struct queue_limits *limits)
 {
        struct stripe_c *sc = ti->private;
-       unsigned int chunk_size = sc->chunk_size << SECTOR_SHIFT;
+       unsigned int io_min = sc->chunk_size << SECTOR_SHIFT;
+       unsigned int io_opt = io_min * sc->stripes;
 
-       limits->io_min = chunk_size;
-       limits->io_opt = chunk_size * sc->stripes;
+       if (io_min >> SECTOR_SHIFT == sc->chunk_size &&
+           io_opt / sc->stripes == io_min) {
+               limits->io_min = io_min;
+               limits->io_opt = io_opt;
+       }
 }
 
 static struct target_type stripe_target = {