* [PATCH] mm: shmem: avoid overflowing in shmem_fallocate
@ 2014-12-04 0:24 ` Sasha Levin
0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2014-12-04 0:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Sasha Levin, Hugh Dickins, linux-mm
"offset + len" has the potential of overflowing. Validate this user input
first to avoid undefined behaviour.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
mm/shmem.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/shmem.c b/mm/shmem.c
index 185836b..5a0e344 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2098,6 +2098,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
}
/* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
+ error = -EOVERFLOW;
+ if ((u64)len + offset < (u64)len)
+ goto out;
error = inode_newsize_ok(inode, offset + len);
if (error)
goto out;
--
1.7.10.4
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH] mm: shmem: avoid overflowing in shmem_fallocate
@ 2014-12-04 0:24 ` Sasha Levin
0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2014-12-04 0:24 UTC (permalink / raw)
To: linux-kernel; +Cc: Sasha Levin, Hugh Dickins, linux-mm
"offset + len" has the potential of overflowing. Validate this user input
first to avoid undefined behaviour.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
mm/shmem.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/mm/shmem.c b/mm/shmem.c
index 185836b..5a0e344 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2098,6 +2098,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
}
/* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
+ error = -EOVERFLOW;
+ if ((u64)len + offset < (u64)len)
+ goto out;
error = inode_newsize_ok(inode, offset + len);
if (error)
goto out;
--
1.7.10.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] mm: shmem: avoid overflowing in shmem_fallocate
2014-12-04 0:24 ` Sasha Levin
@ 2014-12-04 1:51 ` Naoya Horiguchi
-1 siblings, 0 replies; 6+ messages in thread
From: Naoya Horiguchi @ 2014-12-04 1:51 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel@vger.kernel.org, Hugh Dickins, linux-mm@kvack.org
On Wed, Dec 03, 2014 at 07:24:07PM -0500, Sasha Levin wrote:
> "offset + len" has the potential of overflowing. Validate this user input
> first to avoid undefined behaviour.
>
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
> ---
> mm/shmem.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/mm/shmem.c b/mm/shmem.c
> index 185836b..5a0e344 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -2098,6 +2098,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
> }
>
> /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
> + error = -EOVERFLOW;
> + if ((u64)len + offset < (u64)len)
> + goto out;
Hi Sasha,
It seems to me that we already do some overflow check in common path,
do_fallocate():
/* Check for wrap through zero too */
if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
return -EFBIG;
Do we really need another check?
And this patch changes the return value of fallocate(2), so you need
update man document.
BTW, when I'm reading your patch, I noticed that returning -EOVERFLOW
(rather than -EFBIG) looks better when ((offset + len) < 0) in
do_fallocate() is true.
Thanks,
Naoya Horiguchi
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] mm: shmem: avoid overflowing in shmem_fallocate
@ 2014-12-04 1:51 ` Naoya Horiguchi
0 siblings, 0 replies; 6+ messages in thread
From: Naoya Horiguchi @ 2014-12-04 1:51 UTC (permalink / raw)
To: Sasha Levin
Cc: linux-kernel@vger.kernel.org, Hugh Dickins, linux-mm@kvack.org
On Wed, Dec 03, 2014 at 07:24:07PM -0500, Sasha Levin wrote:
> "offset + len" has the potential of overflowing. Validate this user input
> first to avoid undefined behaviour.
>
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
> ---
> mm/shmem.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/mm/shmem.c b/mm/shmem.c
> index 185836b..5a0e344 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -2098,6 +2098,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
> }
>
> /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
> + error = -EOVERFLOW;
> + if ((u64)len + offset < (u64)len)
> + goto out;
Hi Sasha,
It seems to me that we already do some overflow check in common path,
do_fallocate():
/* Check for wrap through zero too */
if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
return -EFBIG;
Do we really need another check?
And this patch changes the return value of fallocate(2), so you need
update man document.
BTW, when I'm reading your patch, I noticed that returning -EOVERFLOW
(rather than -EFBIG) looks better when ((offset + len) < 0) in
do_fallocate() is true.
Thanks,
Naoya Horiguchi
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] mm: shmem: avoid overflowing in shmem_fallocate
2014-12-04 1:51 ` Naoya Horiguchi
@ 2014-12-04 2:33 ` Sasha Levin
-1 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2014-12-04 2:33 UTC (permalink / raw)
To: Naoya Horiguchi
Cc: linux-kernel@vger.kernel.org, Hugh Dickins, linux-mm@kvack.org
On 12/03/2014 08:51 PM, Naoya Horiguchi wrote:
> On Wed, Dec 03, 2014 at 07:24:07PM -0500, Sasha Levin wrote:
>> > "offset + len" has the potential of overflowing. Validate this user input
>> > first to avoid undefined behaviour.
>> >
>> > Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
>> > ---
>> > mm/shmem.c | 3 +++
>> > 1 file changed, 3 insertions(+)
>> >
>> > diff --git a/mm/shmem.c b/mm/shmem.c
>> > index 185836b..5a0e344 100644
>> > --- a/mm/shmem.c
>> > +++ b/mm/shmem.c
>> > @@ -2098,6 +2098,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>> > }
>> >
>> > /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
>> > + error = -EOVERFLOW;
>> > + if ((u64)len + offset < (u64)len)
>> > + goto out;
> Hi Sasha,
>
> It seems to me that we already do some overflow check in common path,
> do_fallocate():
>
> /* Check for wrap through zero too */
> if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
> return -EFBIG;
>
> Do we really need another check?
It looks like we actually need to fix this snippet you pasted rather than shmem_fallocate().
We can't check for ((offset + len) < 0) since both offset and length are signed integers. I'll
send a patch to deal with that rather that this shmem specific one. Thanks!
Thanks,
Sasha
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] mm: shmem: avoid overflowing in shmem_fallocate
@ 2014-12-04 2:33 ` Sasha Levin
0 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2014-12-04 2:33 UTC (permalink / raw)
To: Naoya Horiguchi
Cc: linux-kernel@vger.kernel.org, Hugh Dickins, linux-mm@kvack.org
On 12/03/2014 08:51 PM, Naoya Horiguchi wrote:
> On Wed, Dec 03, 2014 at 07:24:07PM -0500, Sasha Levin wrote:
>> > "offset + len" has the potential of overflowing. Validate this user input
>> > first to avoid undefined behaviour.
>> >
>> > Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
>> > ---
>> > mm/shmem.c | 3 +++
>> > 1 file changed, 3 insertions(+)
>> >
>> > diff --git a/mm/shmem.c b/mm/shmem.c
>> > index 185836b..5a0e344 100644
>> > --- a/mm/shmem.c
>> > +++ b/mm/shmem.c
>> > @@ -2098,6 +2098,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
>> > }
>> >
>> > /* We need to check rlimit even when FALLOC_FL_KEEP_SIZE */
>> > + error = -EOVERFLOW;
>> > + if ((u64)len + offset < (u64)len)
>> > + goto out;
> Hi Sasha,
>
> It seems to me that we already do some overflow check in common path,
> do_fallocate():
>
> /* Check for wrap through zero too */
> if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
> return -EFBIG;
>
> Do we really need another check?
It looks like we actually need to fix this snippet you pasted rather than shmem_fallocate().
We can't check for ((offset + len) < 0) since both offset and length are signed integers. I'll
send a patch to deal with that rather that this shmem specific one. Thanks!
Thanks,
Sasha
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-12-04 2:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-04 0:24 [PATCH] mm: shmem: avoid overflowing in shmem_fallocate Sasha Levin
2014-12-04 0:24 ` Sasha Levin
2014-12-04 1:51 ` Naoya Horiguchi
2014-12-04 1:51 ` Naoya Horiguchi
2014-12-04 2:33 ` Sasha Levin
2014-12-04 2:33 ` Sasha Levin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.