From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226XDA1ROVLRPuf98a1Upc6VjEPaa0YNKNxmIjVg7K/BsxUD3NHqsX0FhCJvEFasilck3TvR ARC-Seal: i=1; a=rsa-sha256; t=1517256987; cv=none; d=google.com; s=arc-20160816; b=TzWkfgarKoWfItzB71CN9U/FSV6f6N9/zccQhR+PCK5M9GxFY4kIoceEV5YyP3vH1Z unQ6Is65oBxgRiEdz4cKfpi1ThD67Av6WPFziU70cVgtdQ/Wckw6jvhXVTK78iu4RnUX Uq1w5M9dMMWsxy1vcG+q6b+1GCT100qE9HnM/h1vK3giraTb1ucLgLsP+4CT1AusefJb Bij1Wq0+x6VhmBDuTBUzqMdmEoqXo6N4OAYSvVpgNK4oHvitrUBq6GheaQtSTT10ajhC XUGDQiDqLaLA3HQo7n0jcXNGTLUAIWWHX5ANdw/ltWRS4Et29z06T94n8VOlkpH72CDZ BQLg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=1QGDRTBkZvRRsFoYvnh8QKoKXpJWPaK4p2hFHRRNKW8=; b=VZhVdHRLIAZ82WxHm+Y6eQApqX/UBpxvYVcwmDhashJTgacztdWsby43XgIi252WSN glIo++q4RXeT47M5+0KpCD2zNMrqaGBS0tvJ5ciLTqmB9BrANtlGyX2XjDK0LM3J6LLA w+xeP3EBAasa/vOeeK2M7nGgmoOVRtKThlYB8Momp1fIqNpx+XyVQIezu1IerArnDVQW vWMJTH/EvV2MNrqPL8+lx0/yUGPgepR2N6OrtkucnOrwwJur1fUSrSNS5MC+dn9d060T COX2B2NRe14Jm6N95T61E04mwKRkGOXFIPo3KDJXT32SPF77RhuIMVEQxjCjgheUuk7B 5Y8A== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby , Jeff Layton , "J. Bruce Fields" , Alexander Viro , linux-fsdevel@vger.kernel.org, Jeff Layton Subject: [PATCH 3.18 34/52] fs/fcntl: f_setown, avoid undefined behaviour Date: Mon, 29 Jan 2018 13:56:52 +0100 Message-Id: <20180129123629.677671722@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123628.168904217@linuxfoundation.org> References: <20180129123628.168904217@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958737677690078?= X-GMAIL-MSGID: =?utf-8?q?1590959263346793139?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiri Slaby commit fc3dc67471461c0efcb1ed22fb7595121d65fad9 upstream. fcntl(0, F_SETOWN, 0x80000000) triggers: UBSAN: Undefined behaviour in fs/fcntl.c:118:7 negation of -2147483648 cannot be represented in type 'int': CPU: 1 PID: 18261 Comm: syz-executor Not tainted 4.8.1-0-syzkaller #1 ... Call Trace: ... [] ? f_setown+0x1d8/0x200 [] ? SyS_fcntl+0x999/0xf30 [] ? entry_SYSCALL_64_fastpath+0x23/0xc1 Fix that by checking the arg parameter properly (against INT_MAX) before "who = -who". And return immediatelly with -EINVAL in case it is wrong. Note that according to POSIX we can return EINVAL: http://pubs.opengroup.org/onlinepubs/9699919799/functions/fcntl.html [EINVAL] The cmd argument is F_SETOWN and the value of the argument is not valid as a process or process group identifier. [v2] returns an error, v1 used to fail silently [v3] implement proper check for the bad value INT_MIN Signed-off-by: Jiri Slaby Cc: Jeff Layton Cc: "J. Bruce Fields" Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Jeff Layton Signed-off-by: Greg Kroah-Hartman --- fs/fcntl.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -113,6 +113,10 @@ void f_setown(struct file *filp, unsigne int who = arg; type = PIDTYPE_PID; if (who < 0) { + /* avoid overflow below */ + if (who == INT_MIN) + return; + type = PIDTYPE_PGID; who = -who; }