From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:42432 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1732114AbeIVAcc (ORCPT ); Fri, 21 Sep 2018 20:32:32 -0400 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w8LIYiLZ115745 for ; Fri, 21 Sep 2018 14:42:22 -0400 Received: from e06smtp04.uk.ibm.com (e06smtp04.uk.ibm.com [195.75.94.100]) by mx0b-001b2d01.pphosted.com with ESMTP id 2mn2xpgcyv-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 21 Sep 2018 14:42:22 -0400 Received: from localhost by e06smtp04.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Sep 2018 19:42:20 +0100 Subject: Re: [PATCH] vfs: require i_size <= SIZE_MAX in kernel_read_file() From: Mimi Zohar To: Eric Biggers , linux-fsdevel@vger.kernel.org, Alexander Viro Cc: Mimi Zohar , Dmitry Kasatkin Date: Fri, 21 Sep 2018 14:42:15 -0400 In-Reply-To: <20180907191624.186623-1-ebiggers@kernel.org> References: <20180907191624.186623-1-ebiggers@kernel.org> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Message-Id: <1537555335.3830.344.camel@linux.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Fri, 2018-09-07 at 12:16 -0700, Eric Biggers wrote: > From: Eric Biggers > > On 32-bit systems, the buffer allocated by kernel_read_file() is too > small if the file size is > SIZE_MAX, due to truncation to size_t. > > Fortunately, since the 'count' argument to kernel_read() is also > truncated to size_t, only the allocated space is filled; then, -EIO is > returned since 'pos != i_size' after the read loop. > > But this is not obvious and seems incidental. We should be more > explicit about this case. So, fail early if i_size > SIZE_MAX. > > Signed-off-by: Eric Biggers Thanks! > --- > fs/exec.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/fs/exec.c b/fs/exec.c > index 1ebf6e5a521d..fc281b738a98 100644 > --- a/fs/exec.c > +++ b/fs/exec.c > @@ -908,14 +908,14 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, > goto out; > > i_size = i_size_read(file_inode(file)); > - if (max_size > 0 && i_size > max_size) { > - ret = -EFBIG; > - goto out; > - } > if (i_size <= 0) { > ret = -EINVAL; > goto out; > } > + if (i_size > SIZE_MAX || (max_size > 0 && i_size > max_size)) { > + ret = -EFBIG; > + goto out; > + } > > if (id != READING_FIRMWARE_PREALLOC_BUFFER) > *buf = vmalloc(i_size);