From nobody Mon Dec 15 21:29:37 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C6D5C4332F for ; Thu, 9 Nov 2023 02:33:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231665AbjKICc3 (ORCPT ); Wed, 8 Nov 2023 21:32:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33256 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229557AbjKICc1 (ORCPT ); Wed, 8 Nov 2023 21:32:27 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DBF0210E; Wed, 8 Nov 2023 18:32:25 -0800 (PST) Received: from dggpemm500020.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4SQm8Y1vPYzPpBr; Thu, 9 Nov 2023 10:28:13 +0800 (CST) Received: from localhost.localdomain (10.175.104.67) by dggpemm500020.china.huawei.com (7.185.36.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Thu, 9 Nov 2023 10:32:16 +0800 From: WoZ1zh1 To: , , , , , , , CC: , , , Subject: [PATCH -next V2] proc: support file->f_pos checking in mem_lseek Date: Thu, 9 Nov 2023 18:26:58 +0800 Message-ID: <20231109102658.2075547-1-wozizhi@huawei.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.104.67] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpemm500020.china.huawei.com (7.185.36.49) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In mem_lseek, file->f_pos may overflow. And it's not a problem that mem_open set file mode with FMODE_UNSIGNED_OFFSET(memory_lseek). However, another file use mem_lseek do lseek can have not FMODE_UNSIGNED_OFFSET (kpageflags_proc_ops/proc_pagemap_operations...), so in order to prevent file->f_pos updated to an abnormal number, fix it by checking overflow and FMODE_UNSIGNED_OFFSET. Signed-off-by: WoZ1zh1 --- fs/proc/base.c | 30 ++++++++++++++++++++++-------- fs/read_write.c | 5 ----- include/linux/fs.h | 5 ++++- 3 files changed, 26 insertions(+), 14 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index dd31e3b6bf77..0fd986e861d9 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -903,18 +903,32 @@ static ssize_t mem_write(struct file *file, const cha= r __user *buf, =20 loff_t mem_lseek(struct file *file, loff_t offset, int orig) { + loff_t ret =3D 0; + + spin_lock(&file->f_lock); switch (orig) { - case 0: - file->f_pos =3D offset; - break; - case 1: - file->f_pos +=3D offset; + case SEEK_CUR: + offset +=3D file->f_pos; + case SEEK_SET: + /* to avoid userland mistaking f_pos=3D-9 as -EBADF=3D-9 */ + if ((unsigned long long)offset >=3D -MAX_ERRNO) + ret =3D -EOVERFLOW; break; default: - return -EINVAL; + ret =3D -EINVAL; } - force_successful_syscall_return(); - return file->f_pos; + if (!ret) { + if (offset < 0 && !(unsigned_offsets(file))) { + ret =3D -EINVAL; + } else { + file->f_pos =3D offset; + ret =3D file->f_pos; + force_successful_syscall_return(); + } + } + + spin_unlock(&file->f_lock); + return ret; } =20 static int mem_release(struct inode *inode, struct file *file) diff --git a/fs/read_write.c b/fs/read_write.c index 4771701c896b..2f456d5a1df5 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -34,11 +34,6 @@ const struct file_operations generic_ro_fops =3D { =20 EXPORT_SYMBOL(generic_ro_fops); =20 -static inline bool unsigned_offsets(struct file *file) -{ - return file->f_mode & FMODE_UNSIGNED_OFFSET; -} - /** * vfs_setpos - update the file offset for lseek * @file: file structure in question diff --git a/include/linux/fs.h b/include/linux/fs.h index 98b7a7a8c42e..dde0756d2350 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2994,7 +2994,10 @@ extern ssize_t iter_file_splice_write(struct pipe_in= ode_info *, extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *o= ut, loff_t *opos, size_t len, unsigned int flags); =20 - +static inline bool unsigned_offsets(struct file *file) +{ + return file->f_mode & FMODE_UNSIGNED_OFFSET; +} extern void file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping= ); extern loff_t noop_llseek(struct file *file, loff_t offset, int whence); --=20 2.39.2