stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Eric Sandeen <sandeen@redhat.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Sasha Levin <sashal@kernel.org>,
	linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 23/26] vfs: Fix EOVERFLOW testing in put_compat_statfs64
Date: Wed,  9 Oct 2019 13:05:55 -0400	[thread overview]
Message-ID: <20191009170558.32517-23-sashal@kernel.org> (raw)
In-Reply-To: <20191009170558.32517-1-sashal@kernel.org>

From: Eric Sandeen <sandeen@redhat.com>

[ Upstream commit cc3a7bfe62b947b423fcb2cfe89fcba92bf48fa3 ]

Today, put_compat_statfs64() disallows nearly any field value over
2^32 if f_bsize is only 32 bits, but that makes no sense.
compat_statfs64 is there for the explicit purpose of providing 64-bit
fields for f_files, f_ffree, etc.  And f_bsize is always only 32 bits.

As a result, 32-bit userspace gets -EOVERFLOW for i.e.  large file
counts even with -D_FILE_OFFSET_BITS=64 set.

In reality, only f_bsize and f_frsize can legitimately overflow
(fields like f_type and f_namelen should never be large), so test
only those fields.

This bug was discussed at length some time ago, and this is the proposal
Al suggested at https://lkml.org/lkml/2018/8/6/640.  It seemed to get
dropped amid the discussion of other related changes, but this
part seems obviously correct on its own, so I've picked it up and
sent it, for expediency.

Fixes: 64d2ab32efe3 ("vfs: fix put_compat_statfs64() does not handle errors")
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/statfs.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/fs/statfs.c b/fs/statfs.c
index f0216629621d6..56f655f757ffb 100644
--- a/fs/statfs.c
+++ b/fs/statfs.c
@@ -304,19 +304,10 @@ COMPAT_SYSCALL_DEFINE2(fstatfs, unsigned int, fd, struct compat_statfs __user *,
 static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstatfs *kbuf)
 {
 	struct compat_statfs64 buf;
-	if (sizeof(ubuf->f_bsize) == 4) {
-		if ((kbuf->f_type | kbuf->f_bsize | kbuf->f_namelen |
-		     kbuf->f_frsize | kbuf->f_flags) & 0xffffffff00000000ULL)
-			return -EOVERFLOW;
-		/* f_files and f_ffree may be -1; it's okay
-		 * to stuff that into 32 bits */
-		if (kbuf->f_files != 0xffffffffffffffffULL
-		 && (kbuf->f_files & 0xffffffff00000000ULL))
-			return -EOVERFLOW;
-		if (kbuf->f_ffree != 0xffffffffffffffffULL
-		 && (kbuf->f_ffree & 0xffffffff00000000ULL))
-			return -EOVERFLOW;
-	}
+
+	if ((kbuf->f_bsize | kbuf->f_frsize) & 0xffffffff00000000ULL)
+		return -EOVERFLOW;
+
 	memset(&buf, 0, sizeof(struct compat_statfs64));
 	buf.f_type = kbuf->f_type;
 	buf.f_bsize = kbuf->f_bsize;
-- 
2.20.1


  parent reply	other threads:[~2019-10-09 17:29 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-09 17:05 [PATCH AUTOSEL 4.19 01/26] KVM: arm/arm64: vgic: Use the appropriate TRACE_INCLUDE_PATH Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 02/26] nvme-pci: Fix a race in controller removal Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 03/26] scsi: ufs: skip shutdown if hba is not powered Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 04/26] scsi: megaraid: disable device when probe failed after enabled device Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 05/26] scsi: qla2xxx: Fix unbound sleep in fcport delete path Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 06/26] ARM: OMAP2+: Fix missing reset done flag for am3 and am43 Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 07/26] ARM: OMAP2+: Fix warnings with broken omap2_set_init_voltage() Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 08/26] kvm: x86: Improve emulation of CPUID leaves 0BH and 1FH Sasha Levin
2019-10-09 20:58   ` Paolo Bonzini
2019-10-09 22:41     ` Sasha Levin
2019-10-09 22:49       ` Paolo Bonzini
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 09/26] kvm: x86: Use AMD CPUID semantics for AMD vCPUs Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 10/26] ieee802154: ca8210: prevent memory leak Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 11/26] ARM: dts: am4372: Set memory bandwidth limit for DISPC Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 12/26] net: dsa: qca8k: Use up to 7 ports for all operations Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 13/26] MIPS: dts: ar9331: fix interrupt-controller size Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 14/26] xen/efi: Set nonblocking callbacks Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 15/26] kvm: vmx: Limit guest PMCs to those supported on the host Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 16/26] nl80211: fix null pointer dereference Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 17/26] mac80211: fix txq " Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 18/26] netfilter: nft_connlimit: disable bh on garbage collection Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 19/26] net: dsa: rtl8366rb: add missing of_node_put after calling of_get_child_by_name Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 20/26] mips: Loongson: Fix the link time qualifier of 'serial_exit()' Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 21/26] net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write() Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 22/26] lib: textsearch: fix escapes in example code Sasha Levin
2019-10-09 17:05 ` Sasha Levin [this message]
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 24/26] r8152: Set macpassthru in reset_resume callback Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 25/26] namespace: fix namespace.pl script to support relative paths Sasha Levin
2019-10-09 17:05 ` [PATCH AUTOSEL 4.19 26/26] Make filldir[64]() verify the directory entry filename is valid Sasha Levin
2019-10-09 17:56   ` Linus Torvalds
2019-10-09 20:51     ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191009170558.32517-23-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sandeen@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).