linux-kernel - [PATCH] fs/sync: fix the signed integer overflow warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 5 Dec 2017 21:46:10 +0800
From:   Ding Tianhong <dingtianhong@...wei.com>
To:     Al Viro <viro@...IV.linux.org.uk>, <linux-fsdevel@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, LinuxArm <linuxarm@...wei.com>
Subject: [PATCH] fs/sync: fix the signed integer overflow warning

The syzkaller report the warning when enable the UBSAN:

UBSAN: Undefined behaviour in fs/sync.c:290:10
signed integer overflow:
-1 + -9223372036854775808 cannot be represented in type 'long long int'
CPU: 0 PID: 3149 Comm: syz-executor3 Not tainted 4.xx #2
Hardware name: linux,dummy-virt (DT)
Call trace:
[<ffffffc00008f4d0>] dump_backtrace+0x0/0x2a0
[<ffffffc00008f790>] show_stack+0x20/0x30
[<ffffffc000ec3b5c>] dump_stack+0x11c/0x16c
[<ffffffc000ec3e80>] ubsan_epilogue+0x18/0x70
[<ffffffc000ec4ca0>] handle_overflow+0x14c/0x188
[<ffffffc000ec4d10>] __ubsan_handle_add_overflow+0x34/0x44
[<ffffffc00038c9f0>] SyS_sync_file_range+0x118/0x210

===========================================================================

The problem is that the input parameter is a wrong value, resulting in
an overflow of the 'endbyte', also it will not cause any serious problem
and return out in the next step.

This patch only fix the warning and no change the logic.

Signed-off-by: Ding Tianhong <dingtianhong@...wei.com>
---
 fs/sync.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/sync.c b/fs/sync.c
index 6e0a2cb..0f77586 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -293,10 +293,11 @@ static int do_fsync(unsigned int fd, int datasync)
 	if (flags & ~VALID_FLAGS)
 		goto out;

-	endbyte = offset + nbytes;
-
 	if ((s64)offset < 0)
 		goto out;
+
+	endbyte = offset + nbytes;
+
 	if ((s64)endbyte < 0)
 		goto out;
 	if (endbyte < offset)
-- 
1.8.3.1