From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: fs/ext4/ioctl.c:1576 ext4_ioctl_set_lufid() warn: impossible condition '(lufid_args.esl_name_len > 255) => (1-255 > 255)'
Date: Wed, 05 Aug 2026 07:21:45 +0800 [thread overview]
Message-ID: <202608050733.wWV0zqak-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Artem Blagodarenko <artem.blagodarenko@gmail.com>
CC: 0day robot <lkp@intel.com>
CC: Andreas Dilger <adilger@dilger.ca>
tree: https://github.com/intel-lab-lkp/linux/commits/Artem-Blagodarenko/ext4-validate-count-against-limit-in-ext4_dx_csum_verify-_set/20260804-043122
head: 9865af268fb3a85241b9a3ee14a37281da3a4885
commit: 9865af268fb3a85241b9a3ee14a37281da3a4885 ext4: Add EXT4_IOC_SET_LUFID ioctl for setting LUFID on directory entries
date: 27 hours ago
:::::: branch date: 27 hours ago
:::::: commit date: 27 hours ago
config: i386-randconfig-141 (https://download.01.org/0day-ci/archive/20260805/202608050733.wWV0zqak-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608050733.wWV0zqak-lkp@intel.com/
smatch warnings:
fs/ext4/ioctl.c:1576 ext4_ioctl_set_lufid() warn: impossible condition '(lufid_args.esl_name_len > 255) => (1-255 > 255)'
fs/ext4/namei.c:2465 add_dirent_to_buf() error: we previously assumed 'de' could be null (see line 2441)
vim +1576 fs/ext4/ioctl.c
04a91570ac6776 Theodore Ts'o 2025-09-16 1537
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1538 /*
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1539 * ext4_ioctl_set_lufid() - Set LUFID on a directory entry
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1540 * @filp: file pointer (parent directory)
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1541 * @arg: pointer to ext4_set_lufid structure with filename and LUFID data
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1542 *
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1543 * This ioctl allows setting LUFID data on an existing
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1544 * directory entry. It is called on the parent directory with a filename and
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1545 * LUFID data.
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1546 */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1547 static long ext4_ioctl_set_lufid(struct file *filp, unsigned long arg)
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1548 {
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1549 struct inode *dir = file_inode(filp);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1550 struct mnt_idmap *idmap = file_mnt_idmap(filp);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1551 struct ext4_set_lufid lufid_args;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1552 struct {
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1553 __u32 edp_magic;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1554 struct ext4_dirent_data_header df_header;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1555 char df_fid[255];
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1556 } edp;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1557 int err;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1558
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1559 /* Check if parent is a directory */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1560 if (!S_ISDIR(dir->i_mode))
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1561 return -ENOTDIR;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1562
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1563 /* This ioctl mutates directory entries; merely having the directory
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1564 * open (which only ever requires read access) is not enough.
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1565 * MAY_EXEC is required for entry lookup; MAY_WRITE for modification. */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1566 err = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1567 if (err)
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1568 return err;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1569
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1570 /* Copy arguments from user space */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1571 if (copy_from_user(&lufid_args, (struct ext4_set_lufid __user *)arg,
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1572 sizeof(lufid_args)))
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1573 return -EFAULT;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1574
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1575 /* Validate parameters. esl_name_len is NUL-excluded length (1-255). */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 @1576 if (lufid_args.esl_name_len == 0 || lufid_args.esl_name_len > EXT4_NAME_LEN)
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1577 return -EINVAL;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1578
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1579 /* ddh_length (esl_data_len + the header byte below) must itself fit
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1580 * in the __u8 ddh_length field without wrapping */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1581 if (lufid_args.esl_data_len == 0 ||
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1582 lufid_args.esl_data_len > 255 - sizeof(edp.df_header))
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1583 return -EINVAL;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1584
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1585 /* Ensure filename is NUL-terminated at exactly esl_name_len */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1586 if (lufid_args.esl_name[lufid_args.esl_name_len] != '\0')
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1587 return -EINVAL;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1588
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1589 /* '.' and '..' are not ordinary entries -- they must stay the first
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1590 * two entries in the directory's first block, so they can't go
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1591 * through the general delete+re-add path this ioctl uses */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1592 if (!strcmp(lufid_args.esl_name, ".") || !strcmp(lufid_args.esl_name, ".."))
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1593 return -EINVAL;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1594
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1595 /* Prepare the dentry param struct with LUFID data. ddh_length is
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1596 * documented (see struct ext4_dirent_data_header) as the length of
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1597 * the header plus the whole data blob -- include the header here so
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1598 * every dirdata reader/writer that takes ddh_length at face value
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1599 * (e.g. ext4_dirdata_set()'s memcpy) copies the full LUFID payload
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1600 * instead of silently dropping its last byte. */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1601 edp.edp_magic = EXT4_LUFID_MAGIC;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1602 edp.df_header.ddh_length = lufid_args.esl_data_len +
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1603 sizeof(edp.df_header);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1604 memcpy(edp.df_fid, lufid_args.esl_data, lufid_args.esl_data_len);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1605
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1606 /* Want write access */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1607 err = mnt_want_write_file(filp);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1608 if (err)
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1609 return err;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1610
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1611 /* Call the helper function to do the actual work */
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1612 err = ext4_dirdata_set_lufid(idmap, dir, lufid_args.esl_name,
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1613 lufid_args.esl_name_len,
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1614 (struct ext4_dentry_param *)&edp);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1615
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1616 mnt_drop_write_file(filp);
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1617 return err;
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1618 }
9865af268fb3a8 Artem Blagodarenko 2026-07-31 1619
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-08-04 23:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202608050733.wWV0zqak-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.