• Y
    proc: fix ubsan warning in mem_lseek · 1bb26e86
    yangerkun 提交于
    hulk inclusion
    category: bugfix
    bugzilla: 47438
    CVE: NA
    ---------------------------
    
    UBSAN has reported a overflow with mem_lseek. And it's fine with
    mem_open set file mode with FMODE_UNSIGNED_OFFSET(memory_lseek).
    However, another file use mem_lseek do lseek can have not
    FMODE_UNSIGNED_OFFSET(proc_kpagecount_operations/proc_pagemap_operations),
    fix it by checking overflow and FMODE_UNSIGNED_OFFSET.
    Reviewed-by: Nzhangyi (F) <yi.zhang@huawei.com>
    
    ==================================================================
    UBSAN: Undefined behaviour in ../fs/proc/base.c:941:15
    signed integer overflow:
    4611686018427387904 + 4611686018427387904 cannot be represented in type 'long long int'
    CPU: 4 PID: 4762 Comm: syz-executor.1 Not tainted 4.4.189 #3
    Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
    Call trace:
    [<ffffff90080a5f28>] dump_backtrace+0x0/0x590 arch/arm64/kernel/traps.c:91
    [<ffffff90080a64f0>] show_stack+0x38/0x60 arch/arm64/kernel/traps.c:234
    [<ffffff9008986a34>] __dump_stack lib/dump_stack.c:15 [inline]
    [<ffffff9008986a34>] dump_stack+0x128/0x184 lib/dump_stack.c:51
    [<ffffff9008a2d120>] ubsan_epilogue+0x34/0x9c lib/ubsan.c:166
    [<ffffff9008a2d8b8>] handle_overflow+0x228/0x280 lib/ubsan.c:197
    [<ffffff9008a2da2c>] __ubsan_handle_add_overflow+0x4c/0x68 lib/ubsan.c:204
    [<ffffff900862b9f4>] mem_lseek+0x12c/0x130 fs/proc/base.c:941
    [<ffffff90084ef78c>] vfs_llseek fs/read_write.c:260 [inline]
    [<ffffff90084ef78c>] SYSC_lseek fs/read_write.c:285 [inline]
    [<ffffff90084ef78c>] SyS_lseek+0x164/0x1f0 fs/read_write.c:276
    [<ffffff9008093c80>] el0_svc_naked+0x30/0x34
    ==================================================================
    Signed-off-by: Nyangerkun <yangerkun@huawei.com>
    Reviewed-by: Nzhangyi (F) <yi.zhang@huawei.com>
    Signed-off-by: Nzhangyi (F) <yi.zhang@huawei.com>
    (cherry picked from commit a422358aa04c53a08b215b8dcd6814d916ef5cf1)
    
    Conflicts:
    	fs/read_write.c
    Signed-off-by: NLi Ming <limingming.li@huawei.com>
    Reviewed-by: Nzhangyi (F) <yi.zhang@huawei.com>
    Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
    1bb26e86
read_write.c 39.1 KB