From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DC04C7618A for ; Mon, 20 Mar 2023 11:06:18 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 183F96B0074; Mon, 20 Mar 2023 07:06:18 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1339D6B0075; Mon, 20 Mar 2023 07:06:18 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 020976B0078; Mon, 20 Mar 2023 07:06:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id E95916B0074 for ; Mon, 20 Mar 2023 07:06:17 -0400 (EDT) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id AC6DA1C5F28 for ; Mon, 20 Mar 2023 11:06:17 +0000 (UTC) X-FDA: 80588997594.17.7809537 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf30.hostedemail.com (Postfix) with ESMTP id 2DEDB80011 for ; Mon, 20 Mar 2023 11:06:14 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf30.hostedemail.com: domain of mawupeng1@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=mawupeng1@huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1679310375; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TM5E/qg8Zzk0FCwBKYL2WKB1OYfZY5Me+vjvGDZLRRo=; b=qbvjN9Lfxy8OiZV4U6IaYi94z8sc7tSaUUuA0S2OFEaEvVgp0swKtzWmd/5DXBDHMTqKhv ofdCOylWTnF4l47WGTpqb3eWc/i7aCCCCF2ghByv11nwftPNvqLcuicv31eibLOb4I1Mni Lu/MWJFL5TdPNeb9t1O0xUTzJ8jGElM= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=none; dmarc=pass (policy=quarantine) header.from=huawei.com; spf=pass (imf30.hostedemail.com: domain of mawupeng1@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=mawupeng1@huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1679310375; a=rsa-sha256; cv=none; b=RsOcrIqPQvGk3eCs1g69Z3V+4MyvMuzZQ5Og0+samQqBVhY5LwA7JwXUQ6iKoYu6V0CF75 XJiyA5kTqiXJQDtKFPJcT/CzXVIo3zLQt7menm5KoLlEOyJl/LZJVdV/9ykDCJHk+Ja1Ok fClYEScq+eOxM1W9TO/RO+vvgPZf/KU= Received: from dggpemm500014.china.huawei.com (unknown [172.30.72.57]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4PgBff1STZznXpm; Mon, 20 Mar 2023 19:03:06 +0800 (CST) Received: from [10.174.178.120] (10.174.178.120) by dggpemm500014.china.huawei.com (7.185.36.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21; Mon, 20 Mar 2023 19:06:10 +0800 Message-ID: Date: Mon, 20 Mar 2023 19:06:10 +0800 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.9.0 CC: , , , , , Subject: Re: [PATCH v4 0/4] Add overflow checks for several syscalls Content-Language: en-US To: References: <20230320024739.224850-1-mawupeng1@huawei.com> From: mawupeng In-Reply-To: <20230320024739.224850-1-mawupeng1@huawei.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.174.178.120] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To dggpemm500014.china.huawei.com (7.185.36.153) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 2DEDB80011 X-Rspam-User: X-Stat-Signature: 4bk4rp8j393zocuqfdwbijbs5j9jukba X-HE-Tag: 1679310374-40703 X-HE-Meta: U2FsdGVkX18M2SmX4RK/WHA7NCr/onzrrLlIe6FnFMGa2WGm1ZjTpcN7VFmIN/JB1OOBpCJ0ZKe4qxTJuCwlaWokHrFlFrQ4NV1FpQx5eG5QOnmp+Ce2URHEWyO13QCb+gQMNr7RtsIsGIe7V0R0yXvOgUvu7Q/kWxC4vuoWqpUk1RTX3+POKhT2J33EVb83Sc5+kabSoxifCCOQcqqXXS5AtkDQbKOEsmecfwCSq1U0GoSE1ewgEEOK4MxwUD20BadDX9zKfxrIXGERphXx1V9RvHHBmFV5OTuLLC7kFKvcWbs9p90M79WXdshSiDWFrH851rcafPRetmkZHmzlRwXgEctKdy2VdXpUqmfOmDmiCmNEn2qu0d5XJUEPwnGsM8jjb8Jsv5C/zcu0n7KbI8qGeUlCcmH4ag/MfcRMcZuUQF4TfISUVOjc+LTsSzZkmQBsZAxIH8DntLb73Bn9POMgBq+kGZV8W/jktL6mpP/JxP2k67uIa6XVNtRUjiPaazsSeQNrF9Y2X2mDGdjAwm+PS3ovR5xAdWoYwkCLB7d/5R2sMHTnRrjNmKhaQ+Dq+bFk1vPXrBsqM95kYAOiD36ROJoVhg0eO09QHz9wafV/Ib2NQpCX/xyUPYFVg2iw2MPceCMx4FDAKD7tpR+XDHtWPvahHe/3jv3z5gm26mXII+hZU3RFdqBwS29QzDSYXqASDt4nnnHbL0B9I+7Zf+OvCAc/l7bXXwGvHLxdDhiFfOeXDipXggu2XZPxgFMS5Y0kw5Pw/lJCQRk2DyXK6AKmkvTCEBe+S5jRyafqlXCA6GVqGrJ5WwhUWaO1QnkG0xLC21oOlgUBjUn/F21UjIW7oV4N8dH1qnbNf3kJBv1KyOwqGrXPUfhnrjK8oism0hzwcFtraBeR/DG8Yl7L5tCYcAy4M15ZxyC8/KofsYh3mnt2ChKbiW0hW84ljSnsJLoX+PFOmSQb9sWGn+x c9YskX45 NblhrHa5OxQw0WplPEhQCePeB2urLG0EJyThumJfKP13mbt5ReZ56z1RsXQtlXzAfA06Id8EOe912UOg4qnhNlUHbn3npufjC2Q3pu1+PrHjO1m9lnj8kikwBYV2uxYpFux8S5JsLdSQ9bPTUIgXcyxxATQHBP181CQPBV02tLx3STXWSIw3X2y7IL9l4QmInYC8KVNpxnXnIHWLb/EvWwTzqEXPZKyzc3BT2t25wLVffE1528j+jgr24Z5FfDGB9kxuIv7QD9gyvUvLzOaCsCrEraxp5mNLwNm72 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Sorry for wasting your time. I send the wrong version of this patchset, this is the older version. I will send the right one later. On 2023/3/20 10:47, Wupeng Ma wrote: > From: Ma Wupeng > > While testing mlock, we have a problem if the len of mlock is ULONG_MAX. > The return value of mlock is zero. But nothing will be locked since the > len in do_mlock overflows to zero due to the following code in mlock: > > len = PAGE_ALIGN(len + (offset_in_page(start))); > > The same problem happens in munlock. > > Add new check and return -EINVAL to fix this overflowing scenarios since > they are absolutely wrong. > > Similar logic is used to fix problems with multiple syscalls. > > Here is the testcases: > > #include > #define _GNU_SOURCE > #include > #include > #include > #include > #include > #include > #include > > extern int errno; > int main(void) > { > int fd; > int ret; > void *addr; > int size = getpagesize(); > > fd = open("/tmp/testfile", O_RDWR | O_CREAT); > if (fd < 0) { > printf("open file error! errno: %d\n", errno); > return -1; > } > printf("open success\n"); > addr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); > if (addr == MAP_FAILED) { > printf("open file error! errno: %d\n", errno); > close(fd); > return -1; > } > printf("mmap success\n"); > memset(addr, 0, size); > > printf("==== mlock ====\n"); > ret = mlock(addr, ULONG_MAX); > if (ret == -1 && errno == EINVAL) > printf("mlock test passed\n"); > else > printf("mlock test failed, ret: %d, errno: %d\n", ret, errno); > > printf("==== set_mempolicy_home_node ====\n"); > ret = syscall(450, addr, ULONG_MAX, 0, 0); > if (ret == -1 && errno == EINVAL) > printf("set_mempolicy_home_node test passed\n"); > else > printf("set_mempolicy_home_node test failed, ret: %d, errno: %d\n", ret, errno); > > printf("==== mbind ====\n"); > unsigned long nodemask = 1Ul << 0; > long max_node = 8 * sizeof(nodemask); > ret = mbind(addr, ULONG_MAX, MPOL_BIND, &nodemask, max_node, MPOL_MF_MOVE_ALL); > if (ret == -1 && errno == EINVAL) > printf("mbind test passed\n"); > else > printf("mbind test failed, ret: %d, errno: %d\n", ret, errno); > > printf("==== msync ====\n"); > ret = msync(addr, ULONG_MAX, MS_ASYNC); > if (ret == -1 && errno == ENOMEM) > printf("mbind test passed\n"); > else > printf("mbind test failed, ret: %d, errno: %d\n", ret, errno); > > munmap(mmap, size); > > return 0; > } > > Changelog since v3[3]: > - rebase to the latest master > - add simple testcases > > Changelog since v2[2]: > - modified the way of checking overflows based on Andrew's comments > > Changelog since v1[1]: > - only check overflow rather than access_ok to keep backward-compatibility > > [1]: https://lore.kernel.org/lkml/20221228141701.c64add46c4b09aa17f605baf@linux-foundation.org/T/ > [2]: https://lore.kernel.org/linux-mm/20230116115813.2956935-5-mawupeng1@huawei.com/T/ > [3]: https://lore.kernel.org/linux-mm/de4149c7-0e6e-2035-3fb8-2f9da9633704@huawei.com/T/ > > Ma Wupeng (4): > mm/mlock: return EINVAL if len overflows for mlock/munlock > mm/mempolicy: return EINVAL for if len overflows for > set_mempolicy_home_node > mm/mempolicy: return EINVAL if len overflows for mbind > mm/msync: return ENOMEM if len overflows for msync > > mm/mempolicy.c | 6 ++++-- > mm/mlock.c | 8 ++++++++ > mm/msync.c | 3 ++- > 3 files changed, 14 insertions(+), 3 deletions(-) >