* [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem()
@ 2023-07-25 17:03 Dan Carpenter
2023-07-26 4:10 ` Matthew Wilcox
2023-07-26 5:56 ` Baoquan He
0 siblings, 2 replies; 5+ messages in thread
From: Dan Carpenter @ 2023-07-25 17:03 UTC (permalink / raw)
To: Baoquan He, Matthew Wilcox
Cc: Vivek Goyal, Dave Young, kexec, linux-fsdevel, kernel-janitors
The bug is the error handling:
if (tmp < nr_bytes) {
"tmp" can hold negative error codes but because "nr_bytes" is type
size_t the negative error codes are treated as very high positive
values (success). Fix this by changing "nr_bytes" to type ssize_t. The
"nr_bytes" variable is used to store values between 1 and PAGE_SIZE and
they can fit in ssize_t without any issue.
Fixes: 5d8de293c224 ("vmcore: convert copy_oldmem_page() to take an iov_iter")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
fs/proc/vmcore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index cb80a7703d58..1fb213f379a5 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -132,7 +132,7 @@ ssize_t read_from_oldmem(struct iov_iter *iter, size_t count,
u64 *ppos, bool encrypted)
{
unsigned long pfn, offset;
- size_t nr_bytes;
+ ssize_t nr_bytes;
ssize_t read = 0, tmp;
int idx;
--
2.39.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem()
2023-07-25 17:03 [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem() Dan Carpenter
@ 2023-07-26 4:10 ` Matthew Wilcox
2023-07-26 5:56 ` Baoquan He
1 sibling, 0 replies; 5+ messages in thread
From: Matthew Wilcox @ 2023-07-26 4:10 UTC (permalink / raw)
To: Dan Carpenter
Cc: Baoquan He, Vivek Goyal, Dave Young, kexec, linux-fsdevel,
kernel-janitors
On Tue, Jul 25, 2023 at 08:03:16PM +0300, Dan Carpenter wrote:
> The bug is the error handling:
>
> if (tmp < nr_bytes) {
>
> "tmp" can hold negative error codes but because "nr_bytes" is type
> size_t the negative error codes are treated as very high positive
> values (success). Fix this by changing "nr_bytes" to type ssize_t. The
> "nr_bytes" variable is used to store values between 1 and PAGE_SIZE and
> they can fit in ssize_t without any issue.
>
> Fixes: 5d8de293c224 ("vmcore: convert copy_oldmem_page() to take an iov_iter")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem()
2023-07-25 17:03 [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem() Dan Carpenter
2023-07-26 4:10 ` Matthew Wilcox
@ 2023-07-26 5:56 ` Baoquan He
2023-07-26 6:03 ` Dan Carpenter
1 sibling, 1 reply; 5+ messages in thread
From: Baoquan He @ 2023-07-26 5:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Matthew Wilcox, Vivek Goyal, akpm, Dave Young, kexec,
linux-fsdevel, kernel-janitors
Hi Dan,
On 07/25/23 at 08:03pm, Dan Carpenter wrote:
> The bug is the error handling:
>
> if (tmp < nr_bytes) {
>
> "tmp" can hold negative error codes but because "nr_bytes" is type
> size_t the negative error codes are treated as very high positive
> values (success). Fix this by changing "nr_bytes" to type ssize_t. The
> "nr_bytes" variable is used to store values between 1 and PAGE_SIZE and
> they can fit in ssize_t without any issue.
>
> Fixes: 5d8de293c224 ("vmcore: convert copy_oldmem_page() to take an iov_iter")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> fs/proc/vmcore.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
> index cb80a7703d58..1fb213f379a5 100644
> --- a/fs/proc/vmcore.c
> +++ b/fs/proc/vmcore.c
> @@ -132,7 +132,7 @@ ssize_t read_from_oldmem(struct iov_iter *iter, size_t count,
> u64 *ppos, bool encrypted)
> {
> unsigned long pfn, offset;
> - size_t nr_bytes;
> + ssize_t nr_bytes;
> ssize_t read = 0, tmp;
> int idx;
Thanks for this fix. Just curious, this is found out by code exploring,
or any breaking?
Acked-by: Baoquan He <bhe@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem()
2023-07-26 5:56 ` Baoquan He
@ 2023-07-26 6:03 ` Dan Carpenter
2023-07-26 8:41 ` Baoquan He
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2023-07-26 6:03 UTC (permalink / raw)
To: Baoquan He
Cc: Matthew Wilcox, Vivek Goyal, akpm, Dave Young, kexec,
linux-fsdevel, kernel-janitors
On Wed, Jul 26, 2023 at 01:56:29PM +0800, Baoquan He wrote:
>
> Thanks for this fix. Just curious, this is found out by code exploring,
> or any breaking?
It's from static analysis, looking at when error codes are type promoted
to unsigned. I pushed the Smatch check for this yesterday.
https://github.com/error27/smatch/commit/a2e6ca07e2ef83a72c9ffa3508af1398a6ecc7ed
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem()
2023-07-26 6:03 ` Dan Carpenter
@ 2023-07-26 8:41 ` Baoquan He
0 siblings, 0 replies; 5+ messages in thread
From: Baoquan He @ 2023-07-26 8:41 UTC (permalink / raw)
To: Dan Carpenter
Cc: Matthew Wilcox, Vivek Goyal, akpm, Dave Young, kexec,
linux-fsdevel, kernel-janitors
On 07/26/23 at 09:03am, Dan Carpenter wrote:
> On Wed, Jul 26, 2023 at 01:56:29PM +0800, Baoquan He wrote:
> >
> > Thanks for this fix. Just curious, this is found out by code exploring,
> > or any breaking?
>
> It's from static analysis, looking at when error codes are type promoted
> to unsigned. I pushed the Smatch check for this yesterday.
I see, thanks for telling.
>
> https://github.com/error27/smatch/commit/a2e6ca07e2ef83a72c9ffa3508af1398a6ecc7ed
>
> regards,
> dan carpenter
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-07-26 8:49 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-25 17:03 [PATCH] proc/vmcore: fix signedness bug in read_from_oldmem() Dan Carpenter
2023-07-26 4:10 ` Matthew Wilcox
2023-07-26 5:56 ` Baoquan He
2023-07-26 6:03 ` Dan Carpenter
2023-07-26 8:41 ` Baoquan He
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).