linux-kernel - Re: [PATCH] fs: fix overflow check in rw_verify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFnufp1LcTCLtCrd=iLxD7DPaOouov=BW=Scj_yXJ+Pn96RKLQ@mail.gmail.com>
Date: Wed, 24 Dec 2025 00:28:08 +0100
From: Matteo Croce <technoboy85@...il.com>
To: linux-fsdevel@...r.kernel.org, Christian Brauner <brauner@...nel.org>, 
	Alexander Viro <viro@...iv.linux.org.uk>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fs: fix overflow check in rw_verify_area()

Il giorno sab 20 dic 2025 alle ore 13:45 Matteo Croce
<technoboy85@...il.com> ha scritto:
>
> Il giorno ven 19 dic 2025 alle ore 13:53 Matteo Croce
> <technoboy85@...il.com> ha scritto:
> >
> > The overflow check in rw_verify_area() can itself overflow when
> > pos + count > LLONG_MAX, causing the sum to wrap to a negative value
> > and incorrectly return -EINVAL.
> >
> > This can be reproduced easily by creating a 20 MB file and reading it
> > via splice() and a size of 0x7FFFFFFFFF000000. The syscall fails
> > when the file pos reaches 16 MB.
> >
> > splice(3, NULL, 6, NULL, 9223372036837998592, 0) = 262144
> > splice(3, NULL, 6, NULL, 9223372036837998592, 0) = 262144
> > splice(3, NULL, 6, NULL, 9223372036837998592, 0) = -1 EINVAL (Invalid argument)
> >
> > This can probably be triggered in other ways given that coreutils often
> > uses SSIZE_MAX as size argument[1][2]
> >
> > [1] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/src/cat.c?h=v9.9#n505
> > [2] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/src/copy-file-data.c?h=v9.9#n130
> > ---
>
> I've found a simple shell reproducer, it might be worth adding it to
> the commit message if the patch is considered for apply:
>
> $ truncate -s $((2**63 - 1)) hugefile
> $ dd if=hugefile bs=1M skip=$((2**43 - 2))
> dd: error reading 'hugefile': Invalid argument
> 1+0 records in
> 1+0 records out
> 1048576 bytes (1,0 MB, 1,0 MiB) copied, 0,103536 s, 10,1 MB/s
>
> Thanks,
> --
> Matteo Croce
>
> perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay

Following a discussion on the coreutils mailing list[1] I think that
this should be fixed differently.
I'll be back with a v2.

[1] https://lists.gnu.org/archive/html/coreutils/2025-12/msg00097.html

Regards,
-- 
Matteo Croce

perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay