From: Jens Axboe <jens.axboe@oracle.com>
Date: Fri, 14 Dec 2007 11:42:53 +0000 (+0100)
Subject: Overflow bugs in random map
X-Git-Tag: fio-1.17.3~15
X-Git-Url: https://git.kernel.dk/?p=fio.git;a=commitdiff_plain;h=509eab12448823a8eefbe925804b5308ee63bf5e

Overflow bugs in random map

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
---

diff --git a/filesetup.c b/filesetup.c
index 6c241516..a3bafca1 100644
--- a/filesetup.c
+++ b/filesetup.c
@@ -403,7 +403,7 @@ int setup_files(struct thread_data *td)
 			 * zero, set it to the real file size.
 			 */
 			f->io_size = td->o.size / td->o.nr_files;
-			if (!f->io_size) {
+			if (!f->io_size || f->io_size > f->real_file_size) {
 				if (f->file_offset > f->real_file_size)
 					goto err_offset;
 				f->io_size = f->real_file_size - f->file_offset;
@@ -484,7 +484,7 @@ err_offset:
 
 int init_random_map(struct thread_data *td)
 {
-	int num_maps, blocks;
+	unsigned long long blocks, num_maps;
 	struct fio_file *f;
 	unsigned int i;
 
@@ -492,8 +492,8 @@ int init_random_map(struct thread_data *td)
 		return 0;
 
 	for_each_file(td, f, i) {
-		blocks = (f->real_file_size + td->o.rw_min_bs - 1) / td->o.rw_min_bs;
-		num_maps = (blocks + BLOCKS_PER_MAP-1)/ BLOCKS_PER_MAP;
+		blocks = (f->real_file_size + td->o.rw_min_bs - 1) / (unsigned long long) td->o.rw_min_bs;
+		num_maps = (blocks + BLOCKS_PER_MAP-1)/ (unsigned long long) BLOCKS_PER_MAP;
 		f->file_map = malloc(num_maps * sizeof(long));
 		if (!f->file_map) {
 			log_err("fio: failed allocating random map. If running a large number of jobs, try the 'norandommap' option\n");
diff --git a/fio.h b/fio.h
index ca6e2904..b7b25b21 100644
--- a/fio.h
+++ b/fio.h
@@ -681,7 +681,7 @@ static inline void fio_ro_check(struct thread_data *td, struct io_u *io_u)
 }
 
 #define BLOCKS_PER_MAP		(8 * sizeof(long))
-#define TO_MAP_BLOCK(td, f, b)	((b) - ((f)->file_offset / (td)->o.rw_min_bs))
+#define TO_MAP_BLOCK(td, f, b)	((b) - ((f)->file_offset / (unsigned long long) (td)->o.rw_min_bs))
 #define RAND_MAP_IDX(td, f, b)	(TO_MAP_BLOCK(td, f, b) / BLOCKS_PER_MAP)
 #define RAND_MAP_BIT(td, f, b)	(TO_MAP_BLOCK(td, f, b) & (BLOCKS_PER_MAP - 1))