Re: [PATCH] MIPS: vpe: fix integer overflow in vpe_write()

[Linus Torvalds <torvalds@linux-foundation.org>]

[ This was in my spambox, it may have been marked as spam for others too ]

On Thu, Jul 14, 2022 at 7:17 AM Ning Qiang <sohu0106@126.com> wrote:
>
> In the vpe_write function of arch/mips/kernel/vpe.c,parameter "size_t
> count" is pass by userland, if "count" is very large, it will bypass
> the check of "if ((count + v->len) > v->plen)".(such as
> count=0xffffffffffffffff).

We reject oversized IO requests to read/write, and clamp them at
MAX_RW_COUNT (which is basically INT_MAX rounded down to a page size).

Exactly to avoid issues like this.

So you shouldn't be able to pass in those kinds of counts, and it
won't be able to overflow the arithmetic unless 'v->len' can grow
boundlessly, which I don't think it can.

So I suspect this is not actually possible, but if you have a
test-case that shows me wrong, that woudl be interesing.

That said: that 'vpe_write()' thing is *odd*. Why is it using that
'v->len' thing, instead of using the passed-in offset?

So there is certainly somewhat strange code in there, and it would
probably be good to take a look at it. But being a very special MIPS
driver, I'm not sure how many people care...

               Linus