linux-kernel - Re: [PATCH v1] fsnotify: Pass correct offset to fsnotify_mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <76cd6212-c85f-4337-99cf-67824c3abee7@arm.com>
Date: Fri, 3 Oct 2025 17:36:23 +0100
From: Ryan Roberts <ryan.roberts@....com>
To: Kiryl Shutsemau <kirill@...temov.name>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
 David Hildenbrand <david@...hat.com>,
 Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
 "Liam R. Howlett" <Liam.Howlett@...cle.com>, Vlastimil Babka
 <vbabka@...e.cz>, Mike Rapoport <rppt@...nel.org>,
 Suren Baghdasaryan <surenb@...gle.com>, Michal Hocko <mhocko@...e.com>,
 Amir Goldstein <amir73il@...il.com>, linux-mm@...ck.org,
 linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v1] fsnotify: Pass correct offset to fsnotify_mmap_perm()

On 03/10/2025 17:00, Kiryl Shutsemau wrote:
> On Fri, Oct 03, 2025 at 04:52:36PM +0100, Ryan Roberts wrote:
>> fsnotify_mmap_perm() requires a byte offset for the file about to be
>> mmap'ed. But it is called from vm_mmap_pgoff(), which has a page offset.
>> Previously the conversion was done incorrectly so let's fix it, being
>> careful not to overflow on 32-bit platforms.
>>
>> Discovered during code review.
> 
> Heh. Just submitted fix for the same issue:
> 
> https://lore.kernel.org/all/20251003155804.1571242-1-kirill@shutemov.name/T/#u
> 

Ha... great minds...

I notice that for your version you're just doing "pgoff << PAGE_SHIFT" without
casting pgoff.

I'm not sure if that is safe?

pgoff is unsigned long (so 32 bits on 32 bit systems). loff_t is unsigned long
long (so always 64 bits). So is it possible that you shift off the end of 32
bits and lose those bits without a cast to loff_t first?

TBH my knowledge of the exact rules is shaky...