From: Steve French <smfrench@gmail.com>
To: linux-mm <linux-mm@kvack.org>
Cc: linux-fsdevel <linux-fsdevel@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: signed integer overflow bug in truncate_pagecache
Date: Wed, 11 Aug 2021 20:08:30 -0500 [thread overview]
Message-ID: <CAH2r5mv_YRkGCs_qhmUje_qvUkPJpurdYw1W88VQ17CzKVhhGQ@mail.gmail.com> (raw)
Running a debug build of the kernel while running regression tests for
cifs.ko on 5.11, I noticed this message logged which looks like it is
still a probably valid bug in truncate_pagecache in mm/truncate.c in
current kernel as well
loff_t holebegin = round_up(newsize, PAGE_SIZE);
This was what was in dmesg:
[23907.325526] UBSAN: signed-integer-overflow in mm/truncate.c:833:9
[23907.325532] 9223372036854775807 + 1 cannot be represented in type
'long long int'
[23907.325536] CPU: 2 PID: 13007 Comm: xfs_io Not tainted 5.11.22 #1
[23907.325540] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[23907.325543] Call Trace:
[23907.325548] dump_stack+0x8d/0xb5
[23907.325560] ubsan_epilogue+0x5/0x50
[23907.325568] handle_overflow+0xa3/0xb0
[23907.325581] truncate_pagecache+0x8a/0x90
[23907.325587] cifs_set_file_size+0xdb/0x2c0 [cifs]
[23907.325749] cifs_setattr+0xc93/0x1260 [cifs]
[23907.325799] notify_change+0x35b/0x4a0
[23907.325811] ? do_truncate+0x5e/0x90
[23907.325817] do_truncate+0x5e/0x90
[23907.325828] do_sys_ftruncate+0x143/0x280
[23907.325837] do_syscall_64+0x33/0x40
[23907.325842] entry_SYSCALL_64_after_hwframe+0x44/0xa9
--
Thanks,
Steve
reply other threads:[~2021-08-12 1:08 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAH2r5mv_YRkGCs_qhmUje_qvUkPJpurdYw1W88VQ17CzKVhhGQ@mail.gmail.com \
--to=smfrench@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox