From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 776A3C43331 for ; Fri, 6 Sep 2019 05:48:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 637052070C for ; Fri, 6 Sep 2019 05:48:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726179AbfIFFsj (ORCPT ); Fri, 6 Sep 2019 01:48:39 -0400 Received: from szxga04-in.huawei.com ([45.249.212.190]:6691 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726080AbfIFFsj (ORCPT ); Fri, 6 Sep 2019 01:48:39 -0400 Received: from DGGEMS412-HUB.china.huawei.com (unknown [172.30.72.59]) by Forcepoint Email with ESMTP id 2EEFAF6D4D508FC0452F; Fri, 6 Sep 2019 13:48:36 +0800 (CST) Received: from [127.0.0.1] (10.133.210.141) by DGGEMS412-HUB.china.huawei.com (10.3.19.212) with Microsoft SMTP Server id 14.3.439.0; Fri, 6 Sep 2019 13:48:26 +0800 Subject: Re: [PATCH V2] proc: fix ubsan warning in mem_lseek To: , CC: , , , References: <20190902065706.60754-1-yangerkun@huawei.com> From: yangerkun Message-ID: <7452f3d2-1fcf-2627-cbee-b9a920c17fcb@huawei.com> Date: Fri, 6 Sep 2019 13:48:25 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <20190902065706.60754-1-yangerkun@huawei.com> Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-Originating-IP: [10.133.210.141] X-CFilter-Loop: Reflected Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Ping. On 2019/9/2 14:57, yangerkun wrote: > UBSAN has reported a overflow with mem_lseek. And it's fine with > mem_open set file mode with FMODE_UNSIGNED_OFFSET(memory_lseek). > However, another file use mem_lseek do lseek can have not > FMODE_UNSIGNED_OFFSET(proc_kpagecount_operations/proc_pagemap_operations), > fix it by checking overflow and FMODE_UNSIGNED_OFFSET. > > ================================================================== > UBSAN: Undefined behaviour in ../fs/proc/base.c:941:15 > signed integer overflow: > 4611686018427387904 + 4611686018427387904 cannot be represented in type 'long long int' > CPU: 4 PID: 4762 Comm: syz-executor.1 Not tainted 4.4.189 #3 > Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 > Call trace: > [] dump_backtrace+0x0/0x590 arch/arm64/kernel/traps.c:91 > [] show_stack+0x38/0x60 arch/arm64/kernel/traps.c:234 > [] __dump_stack lib/dump_stack.c:15 [inline] > [] dump_stack+0x128/0x184 lib/dump_stack.c:51 > [] ubsan_epilogue+0x34/0x9c lib/ubsan.c:166 > [] handle_overflow+0x228/0x280 lib/ubsan.c:197 > [] __ubsan_handle_add_overflow+0x4c/0x68 lib/ubsan.c:204 > [] mem_lseek+0x12c/0x130 fs/proc/base.c:941 > [] vfs_llseek fs/read_write.c:260 [inline] > [] SYSC_lseek fs/read_write.c:285 [inline] > [] SyS_lseek+0x164/0x1f0 fs/read_write.c:276 > [] el0_svc_naked+0x30/0x34 > ================================================================== > > Signed-off-by: yangerkun > --- > fs/proc/base.c | 32 ++++++++++++++++++++++++-------- > fs/read_write.c | 5 ----- > include/linux/fs.h | 5 +++++ > 3 files changed, 29 insertions(+), 13 deletions(-) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index ebea950..a6c701b 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -882,18 +882,34 @@ static ssize_t mem_write(struct file *file, const char __user *buf, > > loff_t mem_lseek(struct file *file, loff_t offset, int orig) > { > + loff_t ret = 0; > + > + spin_lock(&file->f_lock); > switch (orig) { > - case 0: > - file->f_pos = offset; > - break; > - case 1: > - file->f_pos += offset; > + case SEEK_CUR: > + offset += file->f_pos; > + /* fall through */ > + case SEEK_SET: > + /* to avoid userland mistaking f_pos=-9 as -EBADF=-9 */ > + if ((unsigned long long)offset >= -MAX_ERRNO) > + ret = -EOVERFLOW; > break; > default: > - return -EINVAL; > + ret = -EINVAL; > + } > + > + if (!ret) { > + if (offset < 0 && !(unsigned_offsets(file))) { > + ret = -EINVAL; > + } else { > + file->f_pos = offset; > + ret = file->f_pos; > + force_successful_syscall_return(); > + } > } > - force_successful_syscall_return(); > - return file->f_pos; > + > + spin_unlock(&file->f_lock); > + return ret; > } > > static int mem_release(struct inode *inode, struct file *file) > diff --git a/fs/read_write.c b/fs/read_write.c > index 5bbf587..961966e 100644 > --- a/fs/read_write.c > +++ b/fs/read_write.c > @@ -34,11 +34,6 @@ const struct file_operations generic_ro_fops = { > > EXPORT_SYMBOL(generic_ro_fops); > > -static inline bool unsigned_offsets(struct file *file) > -{ > - return file->f_mode & FMODE_UNSIGNED_OFFSET; > -} > - > /** > * vfs_setpos - update the file offset for lseek > * @file: file structure in question > diff --git a/include/linux/fs.h b/include/linux/fs.h > index 997a530..e5edbc9 100644 > --- a/include/linux/fs.h > +++ b/include/linux/fs.h > @@ -3074,6 +3074,11 @@ extern void > file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping); > extern loff_t noop_llseek(struct file *file, loff_t offset, int whence); > extern loff_t no_llseek(struct file *file, loff_t offset, int whence); > +static inline bool unsigned_offsets(struct file *file) > +{ > + return file->f_mode & FMODE_UNSIGNED_OFFSET; > +} > + > extern loff_t vfs_setpos(struct file *file, loff_t offset, loff_t maxsize); > extern loff_t generic_file_llseek(struct file *file, loff_t offset, int whence); > extern loff_t generic_file_llseek_size(struct file *file, loff_t offset,