From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42B00C77B7D for ; Fri, 5 May 2023 08:44:51 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BA7D46B0075; Fri, 5 May 2023 04:44:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B31246B0078; Fri, 5 May 2023 04:44:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9F8706B007B; Fri, 5 May 2023 04:44:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) by kanga.kvack.org (Postfix) with ESMTP id 61D1F6B0075 for ; Fri, 5 May 2023 04:44:50 -0400 (EDT) Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-30644c18072so978307f8f.2 for ; Fri, 05 May 2023 01:44:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1683276289; x=1685868289; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=d7thzI5CUgHEdqerTrLl093tb24QcK7pQyDy8u9tgwU=; b=d+iqErpSIGcp5gqPzPfLpV9Wtu5BeNi86t8EMvwdvADEbZZp1LCnvKELGFrYF8fNOE ndqsXepNFnhQ3hxJtS3R3WjgXbNHYnebB3lg44IMsvxWjLFZOmgGGHDQxg0WTvMD7yd9 NzIJnkZtNtLMH1M/YUQGaySXuCMXMx5rYqfWu3bzObR0hhAxr7WF4rVPprtregTSwwQp 8PySROBoKwu43ZWOKLgXIRxRAtT7aGocx87dg02RI/D1UknidbrZzZRgIbuOFGh+Z3+M WdHegEslTsF2t0KeVvKjwDlRMs/zKZXKNUQ3gjSq57FzvVXDY6HvstTkXB47xtdtAyAw xHRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683276289; x=1685868289; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=d7thzI5CUgHEdqerTrLl093tb24QcK7pQyDy8u9tgwU=; b=Iwa8PWQbTyjk8C0FkNwAh1FkX00UvoJ58J75xFX508+ckx1qXzAGY8XYYcSFXkjElq B44nowVfOfXvlZ+sFZJdd/jm20JbXnlleoMhiXD20kjfVnNrS0eGUamRB2xPFaI6lW8U oi/YJ54oN6RNdqv8893UfPqcGj6dMazK29jmKlMnD4dEV8VIq0uVPzxIdPwRkg3hNoHx MKApGJ2g0nivu6yzYFwiL7+HagoeEEwOPZua1hNWayH02DgSfyrUWqG4kgXSz37jGXAP mPQweAHGGxZ8rc3nGHa/niy9ZCmS2P47iEv7j1LfqTNf+K91a2JCPpT+gkovhxtVbOqi bsGA== X-Gm-Message-State: AC+VfDzFnnk/awWPRjdSuWVKHYvWtVwiit6v1H1QZNWbv7nOpleS9RTS AKdC0uDpEYf3AZmnln6BQ3sFsg== X-Google-Smtp-Source: ACHHUZ4ZgJjDImejtz4NuONVB5GrLlTHrbYe5QhHZqWE6GsDMTPTtrhk2CGpkz7UGNUsZV8gDr5gwQ== X-Received: by 2002:a5d:6ac2:0:b0:306:28f4:963c with SMTP id u2-20020a5d6ac2000000b0030628f4963cmr837695wrw.23.1683276289592; Fri, 05 May 2023 01:44:49 -0700 (PDT) Received: from localhost ([102.36.222.112]) by smtp.gmail.com with ESMTPSA id b13-20020a05600010cd00b00306299be5a2sm1675227wrx.72.2023.05.05.01.44.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 05 May 2023 01:44:47 -0700 (PDT) Date: Fri, 5 May 2023 11:44:41 +0300 From: Dan Carpenter To: nphamcs@gmail.com Cc: linux-mm@kvack.org Subject: [bug report] cachestat: implement cachestat syscall Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hello Nhat Pham, The patch 5c289a59b1d0: "cachestat: implement cachestat syscall" from May 2, 2023, leads to the following Smatch static checker warning: mm/filemap.c:4282 __do_sys_cachestat() warn: potential integer overflow from user (local copy) 'csr.off + csr.len' mm/filemap.c 4250 SYSCALL_DEFINE4(cachestat, unsigned int, fd, 4251 struct cachestat_range __user *, cstat_range, 4252 struct cachestat __user *, cstat, unsigned int, flags) 4253 { 4254 struct fd f = fdget(fd); 4255 struct address_space *mapping; 4256 struct cachestat_range csr; 4257 struct cachestat cs; 4258 pgoff_t first_index, last_index; 4259 4260 if (!f.file) 4261 return -EBADF; 4262 4263 if (copy_from_user(&csr, cstat_range, csr comes from the user. 4264 sizeof(struct cachestat_range))) { 4265 fdput(f); 4266 return -EFAULT; 4267 } 4268 4269 /* hugetlbfs is not supported */ 4270 if (is_file_hugepages(f.file)) { 4271 fdput(f); 4272 return -EOPNOTSUPP; 4273 } 4274 4275 if (flags != 0) { 4276 fdput(f); 4277 return -EINVAL; 4278 } 4279 4280 first_index = csr.off >> PAGE_SHIFT; 4281 last_index = 4282 csr.len == 0 ? ULONG_MAX : (csr.off + csr.len - 1) >> PAGE_SHIFT; ^^^^^^^^^^^^^^^^^^^^^^ This can integer overflow. Do we need some checking to ensure that first_index < last_index? 4283 memset(&cs, 0, sizeof(struct cachestat)); 4284 mapping = f.file->f_mapping; 4285 filemap_cachestat(mapping, first_index, last_index, &cs); 4286 fdput(f); 4287 4288 if (copy_to_user(cstat, &cs, sizeof(struct cachestat))) 4289 return -EFAULT; 4290 4291 return 0; 4292 } regards, dan carpenter