linux-kernel - Re: fs/proc/task_mmu.c:598:48: error: cast to pointer from integer of different size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEf4BzaxM=dNhtTRn44jaEqrdcufUv3HmEfFc2d2mV=Y5e2xbQ@mail.gmail.com>
Date: Mon, 1 Jul 2024 10:40:57 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Arnd Bergmann <arnd@...db.de>
Cc: Naresh Kamboju <naresh.kamboju@...aro.org>, open list <linux-kernel@...r.kernel.org>, 
	linux-fsdevel@...r.kernel.org, lkft-triage@...ts.linaro.org, 
	Jan Kara <jack@...e.cz>, Christian Brauner <brauner@...nel.org>, Hugh Dickins <hughd@...gle.com>, 
	Andrii Nakryiko <andrii@...nel.org>, Alexander Viro <viro@...iv.linux.org.uk>, 
	Dan Carpenter <dan.carpenter@...aro.org>, Anders Roxell <anders.roxell@...aro.org>
Subject: Re: fs/proc/task_mmu.c:598:48: error: cast to pointer from integer of
 different size

On Mon, Jul 1, 2024 at 4:58 AM Arnd Bergmann <arnd@...db.de> wrote:
>
> On Mon, Jul 1, 2024, at 12:19, Naresh Kamboju wrote:
> > fs/proc/task_mmu.c: In function 'do_procmap_query':
> > fs/proc/task_mmu.c:598:48: error: cast to pointer from integer of
> > different size [-Werror=int-to-pointer-cast]
> >   598 |         if (karg.vma_name_size && copy_to_user((void __user
> > *)karg.vma_name_addr,
> >       |                                                ^
> > fs/proc/task_mmu.c:605:48: error: cast to pointer from integer of
> > different size [-Werror=int-to-pointer-cast]
> >   605 |         if (karg.build_id_size && copy_to_user((void __user
> > *)karg.build_id_addr,
> >       |                                                ^
> > cc1: all warnings being treated as errors
> >
>
> There is already a fix in linux-next:
>
> @@ -595,14 +595,14 @@ static int do_procmap_query(struct proc_maps_private *priv, void __user *uarg)
>         query_vma_teardown(mm, vma);
>         mmput(mm);
>
> -       if (karg.vma_name_size && copy_to_user((void __user *)karg.vma_name_addr,
> +       if (karg.vma_name_size && copy_to_user((void __user *)(uintptr_t)karg.vma_name_addr,
>                                                name, karg.vma_name_size)) {
>                 kfree(name_buf);
>                 return -EFAULT;
>         }
>
>
> This could be expressed slightly nicer using u64_to_user_ptr(),
> but functionally that is the same.

oh, of course we have a helper for that. I will update my patch, I
don't think Andrew has applied it to mm-unstable just yet, thanks for
suggestion!

>
> I also see a slight issue in the use of .compat_ioctl:
>
>  const struct file_operations proc_pid_maps_operations = {
>         .open           = pid_maps_open,
>         .read           = seq_read,
>         .llseek         = seq_lseek,
>         .release        = proc_map_release,
> +       .unlocked_ioctl = procfs_procmap_ioctl,
> +       .compat_ioctl   = procfs_procmap_ioctl,
>  };
>
>
> Since the argument is always a pointer, this should be
>
>        .compat_ioctl = compat_ptr_ioctl,

Another thing I didn't know about, I'll send a patch to switch to this, thanks!

>
> In practice this is only relevant on 32-bit s390
> tasks to sanitize the pointer value.
>
>      Arnd