[PATCH] libfs: fix simple_attr_write on 32bit machine

[PATCH] libfs: fix simple_attr_write on 32bit machine

[Akinobu Mita]

Assume that /sys/kernel/debug/dummy64 is debugfs file created by
debugfs_create_x64().

	# cd /sys/kernel/debug
	# echo 0x1234567812345678 > dummy64
	# cat dummy64
	0x0000000012345678

	# echo 0x80000000 > dummy64
	# cat dummy64
	0xffffffff80000000

The value more than INT_MAX cannot be written to the debugfs file
created by debugfs_create_u64 or debugfs_create_x64 on 32bit machine.
Because simple_attr_write() uses simple_strtol() for the conversion.

To fix this, use simple_strtoll() instead.

Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/libfs.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index c88eab5..275ca474 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -822,7 +822,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
 		goto out;
 
 	attr->set_buf[size] = '\0';
-	val = simple_strtol(attr->set_buf, NULL, 0);
+	val = simple_strtoll(attr->set_buf, NULL, 0);
 	ret = attr->set(attr->data, val);
 	if (ret == 0)
 		ret = len; /* on success, claim we got the whole input */
-- 
1.7.4.4

Re: [PATCH] libfs: fix simple_attr_write on 32bit machine

[Andrew Morton]

On Sat,  9 Jul 2011 14:00:26 +0900
Akinobu Mita <akinobu.mita@gmail.com> wrote:

> Assume that /sys/kernel/debug/dummy64 is debugfs file created by
> debugfs_create_x64().
> 
> 	# cd /sys/kernel/debug
> 	# echo 0x1234567812345678 > dummy64
> 	# cat dummy64
> 	0x0000000012345678
> 
> 	# echo 0x80000000 > dummy64
> 	# cat dummy64
> 	0xffffffff80000000
> 
> The value more than INT_MAX cannot be written to the debugfs file
> created by debugfs_create_u64 or debugfs_create_x64 on 32bit machine.
> Because simple_attr_write() uses simple_strtol() for the conversion.
> 
> To fix this, use simple_strtoll() instead.
> 
> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
> Cc: Greg Kroah-Hartman <gregkh@suse.de>
> ---
>  fs/libfs.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/libfs.c b/fs/libfs.c
> index c88eab5..275ca474 100644
> --- a/fs/libfs.c
> +++ b/fs/libfs.c
> @@ -822,7 +822,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
>  		goto out;
>  
>  	attr->set_buf[size] = '\0';
> -	val = simple_strtol(attr->set_buf, NULL, 0);
> +	val = simple_strtoll(attr->set_buf, NULL, 0);
>  	ret = attr->set(attr->data, val);
>  	if (ret == 0)
>  		ret = len; /* on success, claim we got the whole input */

It should strictly be simple_strtoull(), but I guess that doesn't
change anything.

And it should always have been strict_*(), now known as kstrto*().  But
that interface fix is non-back-compatible so it's too late to fix it.

Re: [PATCH] libfs: fix simple_attr_write on 32bit machine

[Greg KH]

On Sat, Jul 09, 2011 at 02:00:26PM +0900, Akinobu Mita wrote:
> Assume that /sys/kernel/debug/dummy64 is debugfs file created by
> debugfs_create_x64().
> 
> 	# cd /sys/kernel/debug
> 	# echo 0x1234567812345678 > dummy64
> 	# cat dummy64
> 	0x0000000012345678
> 
> 	# echo 0x80000000 > dummy64
> 	# cat dummy64
> 	0xffffffff80000000
> 
> The value more than INT_MAX cannot be written to the debugfs file
> created by debugfs_create_u64 or debugfs_create_x64 on 32bit machine.
> Because simple_attr_write() uses simple_strtol() for the conversion.
> 
> To fix this, use simple_strtoll() instead.
> 
> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
> Cc: Greg Kroah-Hartman <gregkh@suse.de>

Do we have any debugfs files that need this change in the tree now for
3.1 or newer?

thanks,

greg k-h

Re: [PATCH] libfs: fix simple_attr_write on 32bit machine

[Akinobu Mita]

2011/8/23 Greg KH <greg@kroah.com>:
> On Sat, Jul 09, 2011 at 02:00:26PM +0900, Akinobu Mita wrote:
>> Assume that /sys/kernel/debug/dummy64 is debugfs file created by
>> debugfs_create_x64().
>>
>>       # cd /sys/kernel/debug
>>       # echo 0x1234567812345678 > dummy64
>>       # cat dummy64
>>       0x0000000012345678
>>
>>       # echo 0x80000000 > dummy64
>>       # cat dummy64
>>       0xffffffff80000000
>>
>> The value more than INT_MAX cannot be written to the debugfs file
>> created by debugfs_create_u64 or debugfs_create_x64 on 32bit machine.
>> Because simple_attr_write() uses simple_strtol() for the conversion.
>>
>> To fix this, use simple_strtoll() instead.
>>
>> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
>> Cc: Greg Kroah-Hartman <gregkh@suse.de>
>
> Do we have any debugfs files that need this change in the tree now for
> 3.1 or newer?

This patch has already been merged into 3.0.  Some files are created
debugfs_create_[ux]64 with write permission and affected by this bug.

hwpoison/corrupt-filter-flags-mask
hwpoison/corrupt-filter-flags-value
hwpoison/corrupt-filter-memcg
apei/einj/param1
apei/einj/param2