Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp2076069ybp; Thu, 10 Oct 2019 01:45:24 -0700 (PDT) X-Google-Smtp-Source: APXvYqzDfnWrwufc4mP/AGwKswdRyNoF3VXTVcV9m0XERO4KtLPaVUDWNeuSlgqPc20uK9roXr9R X-Received: by 2002:a17:906:6a4a:: with SMTP id n10mr6953489ejs.23.1570697124267; Thu, 10 Oct 2019 01:45:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570697124; cv=none; d=google.com; s=arc-20160816; b=XrpTGFPpwt0KCcJ2m/N3b7YDncdpxz2kn/Y7hdl6xoYTucE1a/eBb2gJkK055ltES1 i+ZvEiJHPCnvg8lPGXHQQ0ahoC9/4Bk1NnwUxyzxf7ssL93yDZnVuPsqHy9e7q2w6goJ 7TaNhVwiNmlkhoER94uiTCgPEkqe6mCxBCpV5vFEJzX0FGvL1KZRV7kZgt4HcjGDiSJg pSjs+TdmKxdtSH0+J8ySWXA1IC0p0nkVNjIs58OSPPFxdJVL0/1OLiAOWr6nASbg7fxZ cGMGveQUH2E8PJTl3qb2OLOgUi+7RecQWfgS8I+OMbxRQKrTmeHI1r2YWZmo1cVMJQNl whsg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+/SUI92s9UYN8a8FGbPGeed+nD9nug7fBB/mcHPuheg=; b=xdhBdLerIY6FR+Vhcho0uEsIbm8bErKa/J0O57LAtSUnhvOVLNyCX9ffO28JbYPQnD o5ZSJn2bDdR5x5oE5vOCSw8BHxiyDwZipTjcB8/QIiQU3bI4Eg2mAeBYHzMM/qOdXKmD +nsg8wjD4sBPkaMP8pZuuyDXAWlQsEzQG/1pusfZi2P5hvgkG1VzyCNdAv8o+9woPrc2 N/2uWE6Mr5GOHfi2p724uY6prO5Iwh5bkFmNZR7XXCXOc2uSqt3lgD1pmgI9+Sp6zBtX U2hDOZiDaHE6qcTOmO/Z19Z/7aplgFoUpzaR7S+Mp7wYhecZJO6HxGYwx+wqDuvWbjre WwXQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=EVpcru8b; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v6si2699220edw.51.2019.10.10.01.45.00; Thu, 10 Oct 2019 01:45:24 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=EVpcru8b; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388770AbfJJIns (ORCPT + 99 others); Thu, 10 Oct 2019 04:43:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:48684 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388145AbfJJInr (ORCPT ); Thu, 10 Oct 2019 04:43:47 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EFE8421929; Thu, 10 Oct 2019 08:43:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570697026; bh=Unj/6prc7e9Uu2o7AWgxamwyvugM5e+gPlPFrolWZUE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EVpcru8biNymXdONDVXacT0Oi79JFkgmS4ocAQSihR2oktNPrXhVL5gKI+tZzyZMl zfRpKackGt40LpkC8eSqbgzrm1jvXEPIv6AGPb2WthOBNhFxsTIoPWb5VvsCPmVDY4 eJUO/Kxmz0xQZtirUY3pXWYoIsHyg18OPVMgRj2k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Sandeen , Linus Torvalds Subject: [PATCH 5.3 141/148] vfs: Fix EOVERFLOW testing in put_compat_statfs64 Date: Thu, 10 Oct 2019 10:36:42 +0200 Message-Id: <20191010083620.865774230@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191010083609.660878383@linuxfoundation.org> References: <20191010083609.660878383@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Sandeen commit cc3a7bfe62b947b423fcb2cfe89fcba92bf48fa3 upstream. Today, put_compat_statfs64() disallows nearly any field value over 2^32 if f_bsize is only 32 bits, but that makes no sense. compat_statfs64 is there for the explicit purpose of providing 64-bit fields for f_files, f_ffree, etc. And f_bsize is always only 32 bits. As a result, 32-bit userspace gets -EOVERFLOW for i.e. large file counts even with -D_FILE_OFFSET_BITS=64 set. In reality, only f_bsize and f_frsize can legitimately overflow (fields like f_type and f_namelen should never be large), so test only those fields. This bug was discussed at length some time ago, and this is the proposal Al suggested at https://lkml.org/lkml/2018/8/6/640. It seemed to get dropped amid the discussion of other related changes, but this part seems obviously correct on its own, so I've picked it up and sent it, for expediency. Fixes: 64d2ab32efe3 ("vfs: fix put_compat_statfs64() does not handle errors") Signed-off-by: Eric Sandeen Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/statfs.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) --- a/fs/statfs.c +++ b/fs/statfs.c @@ -318,19 +318,10 @@ COMPAT_SYSCALL_DEFINE2(fstatfs, unsigned static int put_compat_statfs64(struct compat_statfs64 __user *ubuf, struct kstatfs *kbuf) { struct compat_statfs64 buf; - if (sizeof(ubuf->f_bsize) == 4) { - if ((kbuf->f_type | kbuf->f_bsize | kbuf->f_namelen | - kbuf->f_frsize | kbuf->f_flags) & 0xffffffff00000000ULL) - return -EOVERFLOW; - /* f_files and f_ffree may be -1; it's okay - * to stuff that into 32 bits */ - if (kbuf->f_files != 0xffffffffffffffffULL - && (kbuf->f_files & 0xffffffff00000000ULL)) - return -EOVERFLOW; - if (kbuf->f_ffree != 0xffffffffffffffffULL - && (kbuf->f_ffree & 0xffffffff00000000ULL)) - return -EOVERFLOW; - } + + if ((kbuf->f_bsize | kbuf->f_frsize) & 0xffffffff00000000ULL) + return -EOVERFLOW; + memset(&buf, 0, sizeof(struct compat_statfs64)); buf.f_type = kbuf->f_type; buf.f_bsize = kbuf->f_bsize;