Overflow bugs in random map

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

diff --git a/filesetup.c b/filesetup.c
index 6c241516ff9424f526e587b9acd620b817c9cdfb..a3bafca1ec10ef587f455170eb9e04ae9a570af7 100644 (file)
--- a/filesetup.c
+++ b/filesetup.c
@@ -403,7 +403,7 @@ int setup_files(struct thread_data *td)
                         * zero, set it to the real file size.
                         */
                        f->io_size = td->o.size / td->o.nr_files;
-                       if (!f->io_size) {
+                       if (!f->io_size || f->io_size > f->real_file_size) {
                                if (f->file_offset > f->real_file_size)
                                        goto err_offset;
                                f->io_size = f->real_file_size - f->file_offset;
@@ -484,7 +484,7 @@ err_offset:
 
 int init_random_map(struct thread_data *td)
 {
-       int num_maps, blocks;
+       unsigned long long blocks, num_maps;
        struct fio_file *f;
        unsigned int i;
 
@@ -492,8 +492,8 @@ int init_random_map(struct thread_data *td)
                return 0;
 
        for_each_file(td, f, i) {
-               blocks = (f->real_file_size + td->o.rw_min_bs - 1) / td->o.rw_min_bs;
-               num_maps = (blocks + BLOCKS_PER_MAP-1)/ BLOCKS_PER_MAP;
+               blocks = (f->real_file_size + td->o.rw_min_bs - 1) / (unsigned long long) td->o.rw_min_bs;
+               num_maps = (blocks + BLOCKS_PER_MAP-1)/ (unsigned long long) BLOCKS_PER_MAP;
                f->file_map = malloc(num_maps * sizeof(long));
                if (!f->file_map) {
                        log_err("fio: failed allocating random map. If running a large number of jobs, try the 'norandommap' option\n");

diff --git a/fio.h b/fio.h
index ca6e2904782000d678d0a7d5482c784e13ab1573..b7b25b21f37c8b81dc6e152d15955a74297f7980 100644 (file)
--- a/fio.h
+++ b/fio.h
@@ -681,7 +681,7 @@ static inline void fio_ro_check(struct thread_data *td, struct io_u *io_u)
 }
 
 #define BLOCKS_PER_MAP         (8 * sizeof(long))
-#define TO_MAP_BLOCK(td, f, b) ((b) - ((f)->file_offset / (td)->o.rw_min_bs))
+#define TO_MAP_BLOCK(td, f, b) ((b) - ((f)->file_offset / (unsigned long long) (td)->o.rw_min_bs))
 #define RAND_MAP_IDX(td, f, b) (TO_MAP_BLOCK(td, f, b) / BLOCKS_PER_MAP)
 #define RAND_MAP_BIT(td, f, b) (TO_MAP_BLOCK(td, f, b) & (BLOCKS_PER_MAP - 1))