Re: [PATCH] mm/fadvise: validate offset in generic_fadvise

["David Hildenbrand (Red Hat)" <david@kernel.org>]

On 12/22/25 15:18, klourencodev@gmail.com wrote:
> From: Kevin Lourenco <klourencodev@gmail.com>
> 
> When converted to (u64) for page calculations, a negative offset
> can produce extremely large page indices. This may lead to issues in certain advice modes (excessive readahead or
> cache invalidation)
> 
> offsets are normally non-negative, but the API does not guarantee this. Since 'len' is already
> validated, checking 'offset' here is reasonable to prevent potential system instability.

Hi,

we tend to break lines as 72 chars in the patch description. I assume 
Andrew will fix that up or already did it :)

> 
> Signed-off-by: Kevin Lourenco <k.lourenco@criteo.com>
> ---
>   mm/fadvise.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/fadvise.c b/mm/fadvise.c
> index 67028e30aa91..b63fe21416ff 100644
> --- a/mm/fadvise.c
> +++ b/mm/fadvise.c
> @@ -43,7 +43,7 @@ int generic_fadvise(struct file *file, loff_t offset, loff_t len, int advice)
>   		return -ESPIPE;
>   
>   	mapping = file->f_mapping;
> -	if (!mapping || len < 0)
> +	if (!mapping || len < 0 || offset < 0)
>   		return -EINVAL;
>   
>   	bdi = inode_to_bdi(mapping->host);

The man page of fadvise64()/posix_madvise() is a bit unclear. It doesn't 
really specify what's supposed to happen on negative size or offset.

Staring at test cases in LTP, we seem to have:

* Check the value that posix_fadvise returns for wrong ADVISE value
* Check the value that posix_fadvise returns for wrong file descriptor
* Check the value that posix_fadvise returns for wrong ADVISE value
* Check the value that posix_fadvise returns for pipe descriptor

And we primarily only seem to test what's documented in the man page to 
fail.

Which raises the questions:
(1) Could we accidentally break some users out there?
(2) Should we update the man page to document what is supposed to happen
     with negative size or offset.

-- 
Cheers

David