linux-kernel - Re: [PATCH v1] fsnotify: Pass correct offset to fsnotify_mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <uqijoyhj6m33aslecgbovhujpjgql2zllw4ahfpm5jfqkcsjut@yemuevv2pjrm>
Date: Fri, 3 Oct 2025 17:54:03 +0100
From: Kiryl Shutsemau <kirill@...temov.name>
To: Ryan Roberts <ryan.roberts@....com>
Cc: Andrew Morton <akpm@...ux-foundation.org>, 
	David Hildenbrand <david@...hat.com>, Lorenzo Stoakes <lorenzo.stoakes@...cle.com>, 
	"Liam R. Howlett" <Liam.Howlett@...cle.com>, Vlastimil Babka <vbabka@...e.cz>, 
	Mike Rapoport <rppt@...nel.org>, Suren Baghdasaryan <surenb@...gle.com>, 
	Michal Hocko <mhocko@...e.com>, Amir Goldstein <amir73il@...il.com>, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v1] fsnotify: Pass correct offset to fsnotify_mmap_perm()

On Fri, Oct 03, 2025 at 05:36:23PM +0100, Ryan Roberts wrote:
> On 03/10/2025 17:00, Kiryl Shutsemau wrote:
> > On Fri, Oct 03, 2025 at 04:52:36PM +0100, Ryan Roberts wrote:
> >> fsnotify_mmap_perm() requires a byte offset for the file about to be
> >> mmap'ed. But it is called from vm_mmap_pgoff(), which has a page offset.
> >> Previously the conversion was done incorrectly so let's fix it, being
> >> careful not to overflow on 32-bit platforms.
> >>
> >> Discovered during code review.
> > 
> > Heh. Just submitted fix for the same issue:
> > 
> > https://lore.kernel.org/all/20251003155804.1571242-1-kirill@shutemov.name/T/#u
> > 
> 
> Ha... great minds...
> 
> I notice that for your version you're just doing "pgoff << PAGE_SHIFT" without
> casting pgoff.
> 
> I'm not sure if that is safe?
> 
> pgoff is unsigned long (so 32 bits on 32 bit systems). loff_t is unsigned long
> long (so always 64 bits). So is it possible that you shift off the end of 32
> bits and lose those bits without a cast to loff_t first?
> 
> TBH my knowledge of the exact rules is shaky...

I think you are right. Missing cast in my patch might be problematic on
32-bit machines.

Reviewed-by: Kiryl Shutsemau <kas@...nel.org>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov