Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752902AbdLENrU (ORCPT <rfc822;w@1wt.eu>);
        Tue, 5 Dec 2017 08:47:20 -0500
Received: from szxga05-in.huawei.com ([45.249.212.191]:11511 "EHLO
        szxga05-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751416AbdLENrT (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 5 Dec 2017 08:47:19 -0500
To: Al Viro <viro@ZenIV.linux.org.uk>, <linux-fsdevel@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, LinuxArm <linuxarm@huawei.com>
From: Ding Tianhong <dingtianhong@huawei.com>
Subject: [PATCH] fs/sync: fix the signed integer overflow warning
Message-ID: <4d9e1313-2b39-fe9a-6911-a925946e4353@huawei.com>
Date: Tue, 5 Dec 2017 21:46:10 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.177.23.32]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
        refid=str=0001.0A090204.5A26A33E.0009,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
        ip=0.0.0.0,
        so=2014-11-16 11:51:01,
        dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: baae386c799bfdcb7d8312c928bcb521
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1475
Lines: 49

The syzkaller report the warning when enable the UBSAN:

UBSAN: Undefined behaviour in fs/sync.c:290:10
signed integer overflow:
-1 + -9223372036854775808 cannot be represented in type 'long long int'
CPU: 0 PID: 3149 Comm: syz-executor3 Not tainted 4.xx #2
Hardware name: linux,dummy-virt (DT)
Call trace:
[<ffffffc00008f4d0>] dump_backtrace+0x0/0x2a0
[<ffffffc00008f790>] show_stack+0x20/0x30
[<ffffffc000ec3b5c>] dump_stack+0x11c/0x16c
[<ffffffc000ec3e80>] ubsan_epilogue+0x18/0x70
[<ffffffc000ec4ca0>] handle_overflow+0x14c/0x188
[<ffffffc000ec4d10>] __ubsan_handle_add_overflow+0x34/0x44
[<ffffffc00038c9f0>] SyS_sync_file_range+0x118/0x210

===========================================================================

The problem is that the input parameter is a wrong value, resulting in
an overflow of the 'endbyte', also it will not cause any serious problem
and return out in the next step.

This patch only fix the warning and no change the logic.

Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
---
 fs/sync.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/sync.c b/fs/sync.c
index 6e0a2cb..0f77586 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -293,10 +293,11 @@ static int do_fsync(unsigned int fd, int datasync)
 	if (flags & ~VALID_FLAGS)
 		goto out;

-	endbyte = offset + nbytes;
-
 	if ((s64)offset < 0)
 		goto out;
+
+	endbyte = offset + nbytes;
+
 	if ((s64)endbyte < 0)
 		goto out;
 	if (endbyte < offset)
-- 
1.8.3.1