linux-kernel - Re: [PATCH 01/15] ftruncate: pass a signed offset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 21 Jun 2024 09:47:19 +0200
From: Christian Brauner <brauner@...nel.org>
To: Arnd Bergmann <arnd@...nel.org>
Cc: linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Arnd Bergmann <arnd@...db.de>, Thomas Bogendoerfer <tsbogend@...ha.franken.de>, 
	linux-mips@...r.kernel.org, Helge Deller <deller@....de>, linux-parisc@...r.kernel.org, 
	"David S. Miller" <davem@...emloft.net>, Andreas Larsson <andreas@...sler.com>, 
	sparclinux@...r.kernel.org, Michael Ellerman <mpe@...erman.id.au>, 
	Nicholas Piggin <npiggin@...il.com>, Christophe Leroy <christophe.leroy@...roup.eu>, 
	"Naveen N . Rao" <naveen.n.rao@...ux.ibm.com>, linuxppc-dev@...ts.ozlabs.org, Brian Cain <bcain@...cinc.com>, 
	linux-hexagon@...r.kernel.org, Guo Ren <guoren@...nel.org>, linux-csky@...r.kernel.org, 
	Heiko Carstens <hca@...ux.ibm.com>, linux-s390@...r.kernel.org, Rich Felker <dalias@...c.org>, 
	John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>, linux-sh@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>, 
	Alexander Viro <viro@...iv.linux.org.uk>, linux-fsdevel@...r.kernel.org, libc-alpha@...rceware.org, 
	musl@...ts.openwall.com, ltp@...ts.linux.it, stable@...r.kernel.org
Subject: Re: [PATCH 01/15] ftruncate: pass a signed offset

On Thu, Jun 20, 2024 at 06:23:02PM GMT, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
> 
> The old ftruncate() syscall, using the 32-bit off_t misses a sign
> extension when called in compat mode on 64-bit architectures.  As a
> result, passing a negative length accidentally succeeds in truncating
> to file size between 2GiB and 4GiB.
> 
> Changing the type of the compat syscall to the signed compat_off_t
> changes the behavior so it instead returns -EINVAL.
> 
> The native entry point, the truncate() syscall and the corresponding
> loff_t based variants are all correct already and do not suffer
> from this mistake.
> 
> Fixes: 3f6d078d4acc ("fix compat truncate/ftruncate")
> Cc: stable@...r.kernel.org
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---

Looks good to me,
Reviewed-by: Christian Brauner <brauner@...nel.org>