From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Luo Meng <luomeng12@huawei.com>, Jeff Layton <jlayton@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 01/48] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock
Date: Tue, 22 Dec 2020 21:23:29 -0500 [thread overview]
Message-ID: <20201223022417.2794032-1-sashal@kernel.org> (raw)
From: Luo Meng <luomeng12@huawei.com>
[ Upstream commit 16238415eb9886328a89fe7a3cb0b88c7335fe16 ]
When the sum of fl->fl_start and l->l_len overflows,
UBSAN shows the following warning:
UBSAN: Undefined behaviour in fs/locks.c:482:29
signed integer overflow: 2 + 9223372036854775806
cannot be represented in type 'long long int'
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xe4/0x14e lib/dump_stack.c:118
ubsan_epilogue+0xe/0x81 lib/ubsan.c:161
handle_overflow+0x193/0x1e2 lib/ubsan.c:192
flock64_to_posix_lock fs/locks.c:482 [inline]
flock_to_posix_lock+0x595/0x690 fs/locks.c:515
fcntl_setlk+0xf3/0xa90 fs/locks.c:2262
do_fcntl+0x456/0xf60 fs/fcntl.c:387
__do_sys_fcntl fs/fcntl.c:483 [inline]
__se_sys_fcntl fs/fcntl.c:468 [inline]
__x64_sys_fcntl+0x12d/0x180 fs/fcntl.c:468
do_syscall_64+0xc8/0x5a0 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix it by parenthesizing 'l->l_len - 1'.
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/locks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/locks.c b/fs/locks.c
index 8252647c6084f..edae232dfc864 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -471,7 +471,7 @@ static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl,
if (l->l_len > 0) {
if (l->l_len - 1 > OFFSET_MAX - fl->fl_start)
return -EOVERFLOW;
- fl->fl_end = fl->fl_start + l->l_len - 1;
+ fl->fl_end = fl->fl_start + (l->l_len - 1);
} else if (l->l_len < 0) {
if (fl->fl_start + l->l_len < 0)
--
2.27.0
next reply other threads:[~2020-12-23 2:34 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 2:23 Sasha Levin [this message]
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 02/48] tomoyo: fix clang pointer arithmetic warning Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 03/48] crypto: omap-aes - fix the reference count leak of omap device Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 04/48] staging: wimax: depends on NET Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 05/48] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 06/48] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 07/48] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 08/48] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 09/48] locktorture: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 10/48] rcutorture: " Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 11/48] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 12/48] Bluetooth: hidp: use correct wait queue when removing ctrl_wait Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 13/48] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 14/48] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 15/48] jfs: Fix memleak in dbAdjCtl Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 16/48] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 17/48] media: cec-core: first mark device unregistered, then wake up fhs Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 18/48] media: isif: reset global state Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 19/48] media: dvbdev: Fix memleak in dvb_register_device Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 20/48] mmc: tmio: do not print real IOMEM pointer Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 21/48] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 22/48] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 23/48] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 24/48] scsi: atari_scsi: Fix race condition between .queuecommand and EH Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 25/48] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 26/48] ARM: dts: hisilicon: fix errors detected by usb yaml Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 27/48] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 28/48] ARM: dts: hisilicon: fix errors detected by spi-pl022.yaml Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 29/48] selftests/x86/fsgsbase: Fix GS == 1, 2, and 3 tests Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 30/48] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
2020-12-23 2:23 ` [PATCH AUTOSEL 4.9 31/48] iommu/tegra-smmu: Expand mutex protection range Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 32/48] crypto: qce - Fix SHA result buffer corruption issues Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 33/48] media: gp8psk: initialize stats at power control logic Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 34/48] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 35/48] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3 Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 36/48] MIPS: KASLR: Avoid endless loop in sync_icache if synci_step is zero Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 37/48] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 38/48] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 39/48] iwlwifi: trans: consider firmware dead after errors Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 40/48] iwlwifi: add an extra firmware state in the transport Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 41/48] nl80211: always accept scan request with the duration set Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 42/48] cfg80211: Save the regulatory domain when setting custom regulatory Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 43/48] mac80211: disallow band-switch during CSA Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 44/48] mac80211: Fix calculation of minimal channel width Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 45/48] mac80211: don't filter out beacons once we start CSA Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 46/48] mac80211: Update rate control on channel change Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 47/48] ALSA: hda/hdmi: packet buffer index must be set before reading value Sasha Levin
2020-12-23 2:24 ` [PATCH AUTOSEL 4.9 48/48] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223022417.2794032-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jlayton@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luomeng12@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome