linux-kernel - Re: [PATCH] fs: fix overflow check in rw_verify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAFnufp2YtYGioCtFyTpNufh2Kc3=8HRrpfTdsF9pZ6O0aCkSdA@mail.gmail.com>
Date: Sat, 20 Dec 2025 13:45:35 +0100
From: Matteo Croce <technoboy85@...il.com>
To: linux-fsdevel@...r.kernel.org, Christian Brauner <brauner@...nel.org>, 
	Alexander Viro <viro@...iv.linux.org.uk>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fs: fix overflow check in rw_verify_area()

Il giorno ven 19 dic 2025 alle ore 13:53 Matteo Croce
<technoboy85@...il.com> ha scritto:
>
> The overflow check in rw_verify_area() can itself overflow when
> pos + count > LLONG_MAX, causing the sum to wrap to a negative value
> and incorrectly return -EINVAL.
>
> This can be reproduced easily by creating a 20 MB file and reading it
> via splice() and a size of 0x7FFFFFFFFF000000. The syscall fails
> when the file pos reaches 16 MB.
>
> splice(3, NULL, 6, NULL, 9223372036837998592, 0) = 262144
> splice(3, NULL, 6, NULL, 9223372036837998592, 0) = 262144
> splice(3, NULL, 6, NULL, 9223372036837998592, 0) = -1 EINVAL (Invalid argument)
>
> This can probably be triggered in other ways given that coreutils often
> uses SSIZE_MAX as size argument[1][2]
>
> [1] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/src/cat.c?h=v9.9#n505
> [2] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/src/copy-file-data.c?h=v9.9#n130
> ---

I've found a simple shell reproducer, it might be worth adding it to
the commit message if the patch is considered for apply:

$ truncate -s $((2**63 - 1)) hugefile
$ dd if=hugefile bs=1M skip=$((2**43 - 2))
dd: error reading 'hugefile': Invalid argument
1+0 records in
1+0 records out
1048576 bytes (1,0 MB, 1,0 MiB) copied, 0,103536 s, 10,1 MB/s

Thanks,
-- 
Matteo Croce

perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay