Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755435Ab3JaTIg (ORCPT ); Thu, 31 Oct 2013 15:08:36 -0400 Received: from mail-oa0-f52.google.com ([209.85.219.52]:46375 "EHLO mail-oa0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755052Ab3JaTId (ORCPT ); Thu, 31 Oct 2013 15:08:33 -0400 MIME-Version: 1.0 In-Reply-To: <20131031190608.GH13318@ZenIV.linux.org.uk> References: <5271C5E5.6080606@asianux.com> <20131031190608.GH13318@ZenIV.linux.org.uk> Date: Thu, 31 Oct 2013 12:08:33 -0700 X-Google-Sender-Auth: Oeo6qjs8JbDmEGgG9bQCXVkQMMI Message-ID: Subject: Re: [PATCH] fs/befs/linuxvfs.c: need signed cast for variable 'block' From: Kees Cook To: Al Viro Cc: Chen Gang , "Eric W. Biederman" , Serge Hallyn , "linux-kernel@vger.kernel.org" , Greg KH Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1531 Lines: 38 On Thu, Oct 31, 2013 at 12:06 PM, Al Viro wrote: > On Thu, Oct 31, 2013 at 09:53:59AM -0700, Kees Cook wrote: > >> If block (type sector_t) is unsigned, we shouldn't cast it signed. >> This entire code path should be removed. What is BEFS's expected >> maximum block size? (Looks like even befs_blocknr_t is u64, so nothing >> seems trivially in danger of wrapping.) I would also note that all the >> format strings are wrong too (%ld instead of %lu). > > FWIW, this > res = befs_fblock2brun(sb, ds, block, &run); > if (res != BEFS_OK) { > befs_error(sb, > "<--- befs_get_block() for inode %lu, block " > "%ld ERROR", inode->i_ino, block); > return -EFBIG; > } > also looks wrong - ioctl(..., FIBMAP, ...) shouldn't be able to spew > printks on a valid fs and hitting it with block number greater than > file length will, AFAICS, trigger that. > > I agree that this code needs fixing, but just making gcc STFU about the > comparison would only serve to hide the problem. Anybody familiar with > befs or willing to learn it? Agreed. MAINTAINERS shows it as orphaned. Perhaps it should be moved into staging? -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/