From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Paulo Alcantara <pc@cjr.nz>,
Ronnie Sahlberg <lsahlber@redhat.com>,
Steve French <stfrench@microsoft.com>,
Sasha Levin <sashal@kernel.org>,
sfrench@samba.org, linux-cifs@vger.kernel.org,
samba-technical@lists.samba.org
Subject: [PATCH AUTOSEL 5.18 36/49] cifs: fix signed integer overflow when fl_end is OFFSET_MAX
Date: Wed, 1 Jun 2022 09:52:00 -0400 [thread overview]
Message-ID: <20220601135214.2002647-36-sashal@kernel.org> (raw)
In-Reply-To: <20220601135214.2002647-1-sashal@kernel.org>
From: Paulo Alcantara <pc@cjr.nz>
[ Upstream commit d80c69846ddfddf437167b31ab4cd0de12f61001 ]
This fixes the following when running xfstests generic/504:
[ 134.394698] CIFS: Attempting to mount \\win16.vm.test\Share
[ 134.420905] CIFS: VFS: generate_smb3signingkey: dumping generated
AES session keys
[ 134.420911] CIFS: VFS: Session Id 05 00 00 00 00 c4 00 00
[ 134.420914] CIFS: VFS: Cipher type 1
[ 134.420917] CIFS: VFS: Session Key ea 0b d9 22 2e af 01 69 30 1b
15 74 bf 87 41 11
[ 134.420920] CIFS: VFS: Signing Key 59 28 43 5c f0 b6 b1 6f f5 7b
65 f2 9f 9e 58 7d
[ 134.420923] CIFS: VFS: ServerIn Key eb aa 58 c8 95 01 9a f7 91 98
e4 fa bc d8 74 f1
[ 134.420926] CIFS: VFS: ServerOut Key 08 5b 21 e5 2e 4e 86 f6 05 c2
58 e0 af 53 83 e7
[ 134.771946]
================================================================================
[ 134.771953] UBSAN: signed-integer-overflow in fs/cifs/file.c:1706:19
[ 134.771957] 9223372036854775807 + 1 cannot be represented in type
'long long int'
[ 134.771960] CPU: 4 PID: 2773 Comm: flock Not tainted 5.11.22 #1
[ 134.771964] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[ 134.771966] Call Trace:
[ 134.771970] dump_stack+0x8d/0xb5
[ 134.771981] ubsan_epilogue+0x5/0x50
[ 134.771988] handle_overflow+0xa3/0xb0
[ 134.771997] ? lockdep_hardirqs_on_prepare+0xe8/0x1b0
[ 134.772006] cifs_setlk+0x63c/0x680 [cifs]
[ 134.772085] ? _get_xid+0x5f/0xa0 [cifs]
[ 134.772085] cifs_flock+0x131/0x400 [cifs]
[ 134.772085] __x64_sys_flock+0xfc/0x120
[ 134.772085] do_syscall_64+0x33/0x40
[ 134.772085] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 134.772085] RIP: 0033:0x7fea4f83b3fb
[ 134.772085] Code: ff 48 8b 15 8f 1a 0d 00 f7 d8 64 89 02 b8 ff ff
ff ff eb da e8 16 0b 02 00 66 0f 1f 44 00 00 f3 0f 1e fa b8 49 00 00
00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 5d 1a 0d 00 f7 d8 64 89
01 48
Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/cifsglob.h | 5 +++++
fs/cifs/cifssmb.c | 3 ++-
fs/cifs/file.c | 8 ++++----
3 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 8de977c359b1..91678cd01741 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1979,4 +1979,9 @@ static inline bool cifs_is_referral_server(struct cifs_tcon *tcon,
return is_tcon_dfs(tcon) || (ref && (ref->flags & DFSREF_REFERRAL_SERVER));
}
+static inline u64 cifs_flock_len(struct file_lock *fl)
+{
+ return fl->fl_end == OFFSET_MAX ? 0 : fl->fl_end - fl->fl_start + 1;
+}
+
#endif /* _CIFS_GLOB_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 47e927c4ff8d..a9dccd10e885 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -2558,7 +2558,8 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon,
pLockData->fl_start = le64_to_cpu(parm_data->start);
pLockData->fl_end = pLockData->fl_start +
- le64_to_cpu(parm_data->length) - 1;
+ (le64_to_cpu(parm_data->length) ?
+ le64_to_cpu(parm_data->length) - 1 : 0);
pLockData->fl_pid = -le32_to_cpu(parm_data->pid);
}
}
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index d511a78383c3..03f217fa490d 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1395,7 +1395,7 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile)
cifs_dbg(VFS, "Can't push all brlocks!\n");
break;
}
- length = 1 + flock->fl_end - flock->fl_start;
+ length = cifs_flock_len(flock);
if (flock->fl_type == F_RDLCK || flock->fl_type == F_SHLCK)
type = CIFS_RDLCK;
else
@@ -1511,7 +1511,7 @@ cifs_getlk(struct file *file, struct file_lock *flock, __u32 type,
bool wait_flag, bool posix_lck, unsigned int xid)
{
int rc = 0;
- __u64 length = 1 + flock->fl_end - flock->fl_start;
+ __u64 length = cifs_flock_len(flock);
struct cifsFileInfo *cfile = (struct cifsFileInfo *)file->private_data;
struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
struct TCP_Server_Info *server = tcon->ses->server;
@@ -1609,7 +1609,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
struct cifsLockInfo *li, *tmp;
- __u64 length = 1 + flock->fl_end - flock->fl_start;
+ __u64 length = cifs_flock_len(flock);
struct list_head tmp_llist;
INIT_LIST_HEAD(&tmp_llist);
@@ -1713,7 +1713,7 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type,
unsigned int xid)
{
int rc = 0;
- __u64 length = 1 + flock->fl_end - flock->fl_start;
+ __u64 length = cifs_flock_len(flock);
struct cifsFileInfo *cfile = (struct cifsFileInfo *)file->private_data;
struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
struct TCP_Server_Info *server = tcon->ses->server;
--
2.35.1
next prev parent reply other threads:[~2022-06-01 13:56 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-01 13:51 [PATCH AUTOSEL 5.18 01/49] IB/rdmavt: add missing locks in rvt_ruc_loopback Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 02/49] PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 03/49] ARM: dts: ox820: align interrupt controller node name with dtschema Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 04/49] ARM: dts: socfpga: " Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 05/49] ARM: dts: s5pv210: align DMA channels " Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 06/49] ASoC: amd: Add driver data to acp6x machine driver Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 07/49] arm64: dts: qcom: msm8994: Fix the cont_splash_mem address Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 08/49] arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 09/49] PM / devfreq: rk3399_dmc: Disable edev on remove() Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 10/49] crypto: ccree - use fine grained DMA mapping dir Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 11/49] crypto: qat - fix off-by-one error in PFVF debug print Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 12/49] soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 13/49] fs: jfs: fix possible NULL pointer dereference in dbFree() Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 14/49] arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's vddio-supply property Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 15/49] arm64: Expand ESR_ELx_WFx_ISS_TI to match its ARMv8.7 definition Sasha Levin
2022-06-01 15:26 ` Marc Zyngier
2022-06-05 13:38 ` Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 16/49] ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 17/49] ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 18/49] ARM: OMAP1: clock: Fix UART rate reporting algorithm Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 19/49] selftests/resctrl: Change the default limited time to 120 seconds Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 20/49] powerpc/fadump: Fix fadump to work with a different endian capture kernel Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 21/49] fat: add ratelimit to fat*_ent_bread() Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 22/49] pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 23/49] ARM: versatile: Add missing of_node_put in dcscb_init Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 24/49] ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 25/49] arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for bluetooth Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 26/49] arm64: dts: qcom: sc7280-qcard: " Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 27/49] ARM: hisi: Add missing of_node_put after of_find_compatible_node Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 28/49] cpufreq: Avoid unnecessary frequency updates due to mismatch Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 29/49] PCI: microchip: Add missing chained_irq_enter()/exit() calls Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 30/49] powerpc/rtas: Keep MSR[RI] set when calling RTAS Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 31/49] PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 32/49] PCI: cadence: Clear FLR in device capabilities register Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 33/49] KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 34/49] alpha: fix alloc_zeroed_user_highpage_movable() Sasha Levin
2022-06-01 13:51 ` [PATCH AUTOSEL 5.18 35/49] KVM: arm64: vgic: Do not ignore vgic_its_restore_cte failures Sasha Levin
2022-06-01 16:45 ` Marc Zyngier
2022-06-01 13:52 ` Sasha Levin [this message]
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 37/49] tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 38/49] cifs: return ENOENT for DFS lookup_cache_entry() Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 39/49] powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 40/49] powerpc/xics: fix refcount leak in icp_opal_init() Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 41/49] powerpc/powernv: fix missing of_node_put in uv_init() Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 42/49] macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 43/49] powerpc/iommu: Add missing of_node_put in iommu_init_early_dart Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 44/49] fanotify: fix incorrect fmode_t casts Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 45/49] smb3: check for null tcon Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 46/49] RDMA/hfi1: Prevent panic when SDMA is disabled Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 47/49] cifs: do not use tcpStatus after negotiate completes Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 48/49] Input: gpio-keys - cancel delayed work only in case of GPIO Sasha Levin
2022-06-01 13:52 ` [PATCH AUTOSEL 5.18 49/49] drm: fix EDID struct for old ARM OABI format Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220601135214.2002647-36-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lsahlber@redhat.com \
--cc=pc@cjr.nz \
--cc=samba-technical@lists.samba.org \
--cc=sfrench@samba.org \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).