From nobody Thu Dec 18 03:20:29 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8600AC4332F for ; Fri, 10 Nov 2023 18:29:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345514AbjKJS3g (ORCPT ); Fri, 10 Nov 2023 13:29:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346571AbjKJS1A (ORCPT ); Fri, 10 Nov 2023 13:27:00 -0500 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D2E6C83FB; Thu, 9 Nov 2023 23:24:56 -0800 (PST) Received: from dggpemm500020.china.huawei.com (unknown [172.30.72.54]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4SRVb85pfpzMmdt; Fri, 10 Nov 2023 15:20:20 +0800 (CST) Received: from localhost.localdomain (10.175.104.67) by dggpemm500020.china.huawei.com (7.185.36.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Fri, 10 Nov 2023 15:24:50 +0800 From: Zizhi Wo To: , , , , , , , CC: , , , Subject: [PATCH next V3] proc: support file->f_pos checking in mem_lseek Date: Fri, 10 Nov 2023 23:19:28 +0800 Message-ID: <20231110151928.2667204-1-wozizhi@huawei.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.104.67] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To dggpemm500020.china.huawei.com (7.185.36.49) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: WoZ1zh1 In mem_lseek, file->f_pos may overflow. And it's not a problem that mem_open set file mode with FMODE_UNSIGNED_OFFSET(memory_lseek). However, another file use mem_lseek do lseek can have not FMODE_UNSIGNED_OFFSET (kpageflags_proc_ops/proc_pagemap_operations...), so in order to prevent file->f_pos updated to an abnormal number, fix it by checking overflow and FMODE_UNSIGNED_OFFSET. Signed-off-by: WoZ1zh1 --- fs/proc/base.c | 31 +++++++++++++++++++++++-------- fs/read_write.c | 5 ----- include/linux/fs.h | 5 ++++- 3 files changed, 27 insertions(+), 14 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index dd31e3b6bf77..20f5fcf6b73e 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -903,18 +903,33 @@ static ssize_t mem_write(struct file *file, const cha= r __user *buf, =20 loff_t mem_lseek(struct file *file, loff_t offset, int orig) { + loff_t ret =3D 0; + + spin_lock(&file->f_lock); switch (orig) { - case 0: - file->f_pos =3D offset; - break; - case 1: - file->f_pos +=3D offset; + case SEEK_CUR: + offset +=3D file->f_pos; + fallthrough; + case SEEK_SET: + /* to avoid userland mistaking f_pos=3D-9 as -EBADF=3D-9 */ + if ((unsigned long long)offset >=3D -MAX_ERRNO) + ret =3D -EOVERFLOW; break; default: - return -EINVAL; + ret =3D -EINVAL; } - force_successful_syscall_return(); - return file->f_pos; + if (!ret) { + if (offset < 0 && !(unsigned_offsets(file))) { + ret =3D -EINVAL; + } else { + file->f_pos =3D offset; + ret =3D file->f_pos; + force_successful_syscall_return(); + } + } + + spin_unlock(&file->f_lock); + return ret; } =20 static int mem_release(struct inode *inode, struct file *file) diff --git a/fs/read_write.c b/fs/read_write.c index 4771701c896b..2f456d5a1df5 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -34,11 +34,6 @@ const struct file_operations generic_ro_fops =3D { =20 EXPORT_SYMBOL(generic_ro_fops); =20 -static inline bool unsigned_offsets(struct file *file) -{ - return file->f_mode & FMODE_UNSIGNED_OFFSET; -} - /** * vfs_setpos - update the file offset for lseek * @file: file structure in question diff --git a/include/linux/fs.h b/include/linux/fs.h index 98b7a7a8c42e..dde0756d2350 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2994,7 +2994,10 @@ extern ssize_t iter_file_splice_write(struct pipe_in= ode_info *, extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *o= ut, loff_t *opos, size_t len, unsigned int flags); =20 - +static inline bool unsigned_offsets(struct file *file) +{ + return file->f_mode & FMODE_UNSIGNED_OFFSET; +} extern void file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping= ); extern loff_t noop_llseek(struct file *file, loff_t offset, int whence); --=20 2.39.2