From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Luo Meng <luomeng12@huawei.com>, Jeff Layton <jlayton@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 01/66] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock
Date: Tue, 22 Dec 2020 21:21:47 -0500 [thread overview]
Message-ID: <20201223022253.2793452-1-sashal@kernel.org> (raw)
From: Luo Meng <luomeng12@huawei.com>
[ Upstream commit 16238415eb9886328a89fe7a3cb0b88c7335fe16 ]
When the sum of fl->fl_start and l->l_len overflows,
UBSAN shows the following warning:
UBSAN: Undefined behaviour in fs/locks.c:482:29
signed integer overflow: 2 + 9223372036854775806
cannot be represented in type 'long long int'
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe4/0x14e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x81 lib/ubsan.c:161
handle_overflow+0x193/0x1e2 lib/ubsan.c:192
flock64_to_posix_lock fs/locks.c:482 [inline]
flock_to_posix_lock+0x595/0x690 fs/locks.c:515
fcntl_setlk+0xf3/0xa90 fs/locks.c:2262
do_fcntl+0x456/0xf60 fs/fcntl.c:387
__do_sys_fcntl fs/fcntl.c:483 [inline]
__se_sys_fcntl fs/fcntl.c:468 [inline]
__x64_sys_fcntl+0x12d/0x180 fs/fcntl.c:468
do_syscall_64+0xc8/0x5a0 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix it by parenthesizing 'l->l_len - 1'.
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/locks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/locks.c b/fs/locks.c
index 1a40e277eb5e1..11bb382a23c2e 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -488,7 +488,7 @@ static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl,
if (l->l_len > 0) {
if (l->l_len - 1 > OFFSET_MAX - fl->fl_start)
return -EOVERFLOW;
- fl->fl_end = fl->fl_start + l->l_len - 1;
+ fl->fl_end = fl->fl_start + (l->l_len - 1);
} else if (l->l_len < 0) {
if (fl->fl_start + l->l_len < 0)
--
2.27.0
next reply other threads:[~2020-12-23 2:23 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 2:21 Sasha Levin [this message]
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 02/66] tomoyo: fix clang pointer arithmetic warning Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 03/66] crypto: omap-aes - fix the reference count leak of omap device Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 04/66] staging: wimax: depends on NET Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 05/66] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 06/66] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 07/66] staging: ks7010: fix missing destroy_workqueue() on error in ks7010_sdio_probe Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 08/66] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 09/66] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 10/66] mips: cm: add missing iounmap() on error in mips_cm_probe() Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 11/66] locktorture: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 12/66] rcutorture: " Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.14 13/66] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 14/66] drm/ast: Fixed 1920x1080 sync. polarity issue Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 15/66] s390/trng: set quality to 1024 Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 16/66] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 17/66] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 18/66] mwifiex: pcie: skip cancel_work_sync() on reset failure path Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 19/66] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 20/66] jfs: Fix memleak in dbAdjCtl Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 21/66] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 22/66] media: cec-core: first mark device unregistered, then wake up fhs Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 23/66] media: isif: reset global state Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 24/66] s390/dasd: Fix operational path inconsistency Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 25/66] media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister() Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 26/66] media: dvbdev: Fix memleak in dvb_register_device Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 27/66] mmc: tmio: do not print real IOMEM pointer Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 28/66] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 29/66] MIPS: kvm: Use vm_get_page_prot to get protection bits Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 30/66] scsi: ufs: Atomic update for clkgating_enable Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 31/66] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 32/66] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 33/66] scsi: atari_scsi: Fix race condition between .queuecommand and EH Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 34/66] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 35/66] ARM: dts: hisilicon: fix errors detected by usb yaml Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 36/66] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 37/66] ARM: dts: hisilicon: fix errors detected by spi-pl022.yaml Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 38/66] selftests/x86/fsgsbase: Fix GS == 1, 2, and 3 tests Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 39/66] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 40/66] hv_netvsc: Validate number of allocated sub-channels Sasha Levin
2020-12-23 2:47 ` Michael Kelley
2020-12-23 8:59 ` Andrea Parri
2020-12-23 14:14 ` Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 41/66] iommu/tegra-smmu: Expand mutex protection range Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 42/66] arm64: tegra: Fix GIC400 missing GICH/GICV register regions Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 43/66] crypto: qce - Fix SHA result buffer corruption issues Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 44/66] media: gp8psk: initialize stats at power control logic Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 45/66] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 46/66] x86/pci: Fix the function type for check_reserved_t Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 47/66] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3 Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 48/66] bridge: switchdev: Notify about VLAN protocol changes Sasha Levin
2020-12-23 15:31 ` Vladimir Oltean
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 49/66] MIPS: KASLR: Avoid endless loop in sync_icache if synci_step is zero Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 50/66] cpufreq: sti-cpufreq: fix mem leak in sti_cpufreq_set_opp_info() Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 51/66] cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 52/66] clocksource/drivers/sh_cmt: Fix potential deadlock when calling runtime PM Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 53/66] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 54/66] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 55/66] iwlwifi: trans: consider firmware dead after errors Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 56/66] iwlwifi: add an extra firmware state in the transport Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 57/66] USB: typec: tcpm: Fix PR_SWAP error handling Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 58/66] USB: typec: tcpm: Add a 30ms room for tPSSourceOn in PR_SWAP Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 59/66] nl80211: always accept scan request with the duration set Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 60/66] cfg80211: Save the regulatory domain when setting custom regulatory Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 61/66] mac80211: disallow band-switch during CSA Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 62/66] mac80211: Fix calculation of minimal channel width Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 63/66] mac80211: don't filter out beacons once we start CSA Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 64/66] mac80211: Update rate control on channel change Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 65/66] ALSA: hda/hdmi: packet buffer index must be set before reading value Sasha Levin
2020-12-23 2:22 ` [PATCH AUTOSEL 4.14 66/66] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223022253.2793452-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jlayton@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luomeng12@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox