[PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Julian Sun]

The overflow check in generic_copy_file_checks() and generic_remap_checks()
is now broken because the result of the addition is implicitly converted to
an unsigned type, which disrupts the comparison with signed numbers.
This caused the kernel to not return EOVERFLOW in copy_file_range()
call with len is set to 0xffffffffa003e45bul.

Use the check_add_overflow() macro to fix this issue.

Reported-and-tested-by: syzbot+296b1c84b9cbf306e5a0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=296b1c84b9cbf306e5a0
Fixes: 1383a7ed6749 ("vfs: check file ranges before cloning files")
Fixes: 96e6e8f4a68d ("vfs: add missing checks to copy_file_range")
Inspired-by: Dave Chinner <david@fromorbit.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Julian Sun <sunjunchao2870@gmail.com>
---
 fs/read_write.c  | 5 +++--
 fs/remap_range.c | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/read_write.c b/fs/read_write.c
index 070a7c33b9dd..5211246edc2e 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1509,7 +1509,7 @@ static int generic_copy_file_checks(struct file *file_in, loff_t pos_in,
 	struct inode *inode_in = file_inode(file_in);
 	struct inode *inode_out = file_inode(file_out);
 	uint64_t count = *req_count;
-	loff_t size_in;
+	loff_t size_in, tmp;
 	int ret;
 
 	ret = generic_file_rw_checks(file_in, file_out);
@@ -1544,7 +1544,8 @@ static int generic_copy_file_checks(struct file *file_in, loff_t pos_in,
 		return -ETXTBSY;
 
 	/* Ensure offsets don't wrap. */
-	if (pos_in + count < pos_in || pos_out + count < pos_out)
+	if (check_add_overflow(pos_in, count, &tmp) ||
+	    check_add_overflow(pos_out, count, &tmp))
 		return -EOVERFLOW;
 
 	/* Shorten the copy to EOF */
diff --git a/fs/remap_range.c b/fs/remap_range.c
index 28246dfc8485..6fdeb3c8cb70 100644
--- a/fs/remap_range.c
+++ b/fs/remap_range.c
@@ -36,7 +36,7 @@ static int generic_remap_checks(struct file *file_in, loff_t pos_in,
 	struct inode *inode_out = file_out->f_mapping->host;
 	uint64_t count = *req_count;
 	uint64_t bcount;
-	loff_t size_in, size_out;
+	loff_t size_in, size_out, tmp;
 	loff_t bs = inode_out->i_sb->s_blocksize;
 	int ret;
 
@@ -45,7 +45,8 @@ static int generic_remap_checks(struct file *file_in, loff_t pos_in,
 		return -EINVAL;
 
 	/* Ensure offsets don't wrap. */
-	if (pos_in + count < pos_in || pos_out + count < pos_out)
+	if (check_add_overflow(pos_in, count, &tmp) ||
+	    check_add_overflow(pos_out, count, &tmp))
 		return -EINVAL;
 
 	size_in = i_size_read(inode_in);
-- 
2.39.2

Re: [PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Darrick J. Wong]

On Fri, Sep 20, 2024 at 08:28:51PM +0800, Julian Sun wrote:
> The overflow check in generic_copy_file_checks() and generic_remap_checks()
> is now broken because the result of the addition is implicitly converted to
> an unsigned type, which disrupts the comparison with signed numbers.
> This caused the kernel to not return EOVERFLOW in copy_file_range()
> call with len is set to 0xffffffffa003e45bul.
> 
> Use the check_add_overflow() macro to fix this issue.
> 
> Reported-and-tested-by: syzbot+296b1c84b9cbf306e5a0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=296b1c84b9cbf306e5a0
> Fixes: 1383a7ed6749 ("vfs: check file ranges before cloning files")
> Fixes: 96e6e8f4a68d ("vfs: add missing checks to copy_file_range")
> Inspired-by: Dave Chinner <david@fromorbit.com>
> Reviewed-by: Jan Kara <jack@suse.cz>
> Signed-off-by: Julian Sun <sunjunchao2870@gmail.com>

Reviewed-by: Darrick J. Wong <djwong@kernel.org>

--D

> ---
>  fs/read_write.c  | 5 +++--
>  fs/remap_range.c | 5 +++--
>  2 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/read_write.c b/fs/read_write.c
> index 070a7c33b9dd..5211246edc2e 100644
> --- a/fs/read_write.c
> +++ b/fs/read_write.c
> @@ -1509,7 +1509,7 @@ static int generic_copy_file_checks(struct file *file_in, loff_t pos_in,
>  	struct inode *inode_in = file_inode(file_in);
>  	struct inode *inode_out = file_inode(file_out);
>  	uint64_t count = *req_count;
> -	loff_t size_in;
> +	loff_t size_in, tmp;
>  	int ret;
>  
>  	ret = generic_file_rw_checks(file_in, file_out);
> @@ -1544,7 +1544,8 @@ static int generic_copy_file_checks(struct file *file_in, loff_t pos_in,
>  		return -ETXTBSY;
>  
>  	/* Ensure offsets don't wrap. */
> -	if (pos_in + count < pos_in || pos_out + count < pos_out)
> +	if (check_add_overflow(pos_in, count, &tmp) ||
> +	    check_add_overflow(pos_out, count, &tmp))
>  		return -EOVERFLOW;
>  
>  	/* Shorten the copy to EOF */
> diff --git a/fs/remap_range.c b/fs/remap_range.c
> index 28246dfc8485..6fdeb3c8cb70 100644
> --- a/fs/remap_range.c
> +++ b/fs/remap_range.c
> @@ -36,7 +36,7 @@ static int generic_remap_checks(struct file *file_in, loff_t pos_in,
>  	struct inode *inode_out = file_out->f_mapping->host;
>  	uint64_t count = *req_count;
>  	uint64_t bcount;
> -	loff_t size_in, size_out;
> +	loff_t size_in, size_out, tmp;
>  	loff_t bs = inode_out->i_sb->s_blocksize;
>  	int ret;
>  
> @@ -45,7 +45,8 @@ static int generic_remap_checks(struct file *file_in, loff_t pos_in,
>  		return -EINVAL;
>  
>  	/* Ensure offsets don't wrap. */
> -	if (pos_in + count < pos_in || pos_out + count < pos_out)
> +	if (check_add_overflow(pos_in, count, &tmp) ||
> +	    check_add_overflow(pos_out, count, &tmp))
>  		return -EINVAL;
>  
>  	size_in = i_size_read(inode_in);
> -- 
> 2.39.2
> 
> 

Re: [PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Christian Brauner]

On Fri, 20 Sep 2024 20:28:51 +0800, Julian Sun wrote:
> The overflow check in generic_copy_file_checks() and generic_remap_checks()
> is now broken because the result of the addition is implicitly converted to
> an unsigned type, which disrupts the comparison with signed numbers.
> This caused the kernel to not return EOVERFLOW in copy_file_range()
> call with len is set to 0xffffffffa003e45bul.
> 
> Use the check_add_overflow() macro to fix this issue.
> 
> [...]

Applied to the vfs.misc.v6.13 branch of the vfs/vfs.git tree.
Patches in the vfs.misc.v6.13 branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.misc.v6.13

[2/3] vfs: Fix implicit conversion problem when testing overflow case
      https://git.kernel.org/vfs/vfs/c/8f3ab2511887

Re: [PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Christian Brauner]

Unrelated to the semantics but why do you use 2/3 numbering for a single
patch? This is really confusing.

Re: [PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Julian Sun]

Christian Brauner <brauner@kernel.org> 于2024年9月25日周三 16:37写道：
>
> Unrelated to the semantics but why do you use 2/3 numbering for a single
> patch? This is really confusing.

Sorry for the inconvenience. I used git send-email --to xxx --cc xxx
./*.patch to send my patch series. My intention was to send the three
patches together as a thread, but it clearly didn’t work out... I’ve
tried Google and ChatGPT but couldn’t find any information on how to
send a patch series as a single thread... The other two patches are
here[1][2], but they still need to be refined

[1]: https://lore.kernel.org/linux-fsdevel/20240920122621.215397-1-sunjunchao2870@gmail.com/
[2]:https://lore.kernel.org/linux-fsdevel/20240920123022.215863-1-sunjunchao2870@gmail.com/


Thanks,
-- 
Julian Sun <sunjunchao2870@gmail.com>

Re: [PATCH 2/3] vfs: Fix implicit conversion problem when testing overflow case

[Julian Sun]

Hi,

I noticed this patch hasn’t been merged into 6.13. Was it overlooked
or rejected?

Christian Brauner <brauner@kernel.org> 于2024年9月25日周三 16:37写道：
>
> On Fri, 20 Sep 2024 20:28:51 +0800, Julian Sun wrote:
> > The overflow check in generic_copy_file_checks() and generic_remap_checks()
> > is now broken because the result of the addition is implicitly converted to
> > an unsigned type, which disrupts the comparison with signed numbers.
> > This caused the kernel to not return EOVERFLOW in copy_file_range()
> > call with len is set to 0xffffffffa003e45bul.
> >
> > Use the check_add_overflow() macro to fix this issue.
> >
> > [...]
>
> Applied to the vfs.misc.v6.13 branch of the vfs/vfs.git tree.
> Patches in the vfs.misc.v6.13 branch should appear in linux-next soon.
>
> Please report any outstanding bugs that were missed during review in a
> new review to the original patch series allowing us to drop it.
>
> It's encouraged to provide Acked-bys and Reviewed-bys even though the
> patch has now been applied. If possible patch trailers will be updated.
>
> Note that commit hashes shown below are subject to change due to rebase,
> trailer updates or similar. If in doubt, please check the listed branch.
>
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
> branch: vfs.misc.v6.13
>
> [2/3] vfs: Fix implicit conversion problem when testing overflow case
>       https://git.kernel.org/vfs/vfs/c/8f3ab2511887



-- 
Julian Sun <sunjunchao2870@gmail.com>