From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x227OyZEDVA9oZoUxK+v0qe2rO+inxTzna9Kh8QVBDp8RfOqRCi3RZuJx5OzLTeaDfsaw/7dz ARC-Seal: i=1; a=rsa-sha256; t=1517256602; cv=none; d=google.com; s=arc-20160816; b=Ec5LLAMk+BK0e+1lwZTbV3Ih7hLTOdRNn9Z4KYcNxuuCzSw2PX1CiUfLn47ZtTINjg ++bvGq7npFGn+EhSVZQ60TcPhMCbQMyHBcFVA7nGVMAN0oXHkSUCBo7g6y9bT1EpNaHN DF8D1hkZHk/xvVbfkqtZNolnGWdlvbA86zOIRu/ZYD5DmUGecynXUxnoQPaRU3lpgsqa A2JR5x55G/eh8Ae2tbdqEKUrQNS6qH9cKrLgE67LJHGYe49WmqpaxYedvPjhxOl+K5KN lXcBfxzQK4h1I/JcDELCPcn4grrfaWn27wCi/wCB3rtn+kCXJGloTyQxRMxPOh2XDQDX ngcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=eTwif75R2CA4B/B9ZyWpp6nbFbOAE3rjykHkh2iMobA=; b=okmn1JiMqqVhAckJbtiNtqW3Lq4PDnGzYOnrzF2mVSRuRXk7xhsafMUZ/S72bUIoSR b4zP/oZz/svGIaO9fJeeFN96eloSe0bF0/VFRsHC2M/a4N8hqhofzACcGz7O68O5LfB2 BajIvrqLE4d4mUUh1E0ntx+yf3fIc/hXVm4wlESxKnkCwiMgEuQ7Oik94lMJpUk3x81j prXhvyUso/FCM+8PTbqr8k7lk9fx4lTMdoYtgZ4hjG0KWdgnN8NOul6C8kbNOldZEKwk 4UVZS/5Jc22ZC7fBbVrGdc6cP6J7AZPfhm7bapmniTN9JCYKo9+yDAQn0jH7p90J9Ugn zFsQ== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby , Jeff Layton , "J. Bruce Fields" , Alexander Viro , linux-fsdevel@vger.kernel.org, Jeff Layton Subject: [PATCH 4.9 24/66] fs/fcntl: f_setown, avoid undefined behaviour Date: Mon, 29 Jan 2018 13:56:48 +0100 Message-Id: <20180129123841.089658906@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123839.842860149@linuxfoundation.org> References: <20180129123839.842860149@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958737677690078?= X-GMAIL-MSGID: =?utf-8?q?1590958859051518504?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jiri Slaby commit fc3dc67471461c0efcb1ed22fb7595121d65fad9 upstream. fcntl(0, F_SETOWN, 0x80000000) triggers: UBSAN: Undefined behaviour in fs/fcntl.c:118:7 negation of -2147483648 cannot be represented in type 'int': CPU: 1 PID: 18261 Comm: syz-executor Not tainted 4.8.1-0-syzkaller #1 ... Call Trace: ... [] ? f_setown+0x1d8/0x200 [] ? SyS_fcntl+0x999/0xf30 [] ? entry_SYSCALL_64_fastpath+0x23/0xc1 Fix that by checking the arg parameter properly (against INT_MAX) before "who = -who". And return immediatelly with -EINVAL in case it is wrong. Note that according to POSIX we can return EINVAL: http://pubs.opengroup.org/onlinepubs/9699919799/functions/fcntl.html [EINVAL] The cmd argument is F_SETOWN and the value of the argument is not valid as a process or process group identifier. [v2] returns an error, v1 used to fail silently [v3] implement proper check for the bad value INT_MIN Signed-off-by: Jiri Slaby Cc: Jeff Layton Cc: "J. Bruce Fields" Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Jeff Layton Signed-off-by: Greg Kroah-Hartman --- fs/fcntl.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -114,6 +114,10 @@ void f_setown(struct file *filp, unsigne int who = arg; type = PIDTYPE_PID; if (who < 0) { + /* avoid overflow below */ + if (who == INT_MIN) + return; + type = PIDTYPE_PGID; who = -who; }