• Jiri Slaby's avatar
    fs/fcntl: f_setown, avoid undefined behaviour · 7b50205c
    Jiri Slaby authored
    commit fc3dc674 upstream.
    fcntl(0, F_SETOWN, 0x80000000) triggers:
    UBSAN: Undefined behaviour in fs/fcntl.c:118:7
    negation of -2147483648 cannot be represented in type 'int':
    CPU: 1 PID: 18261 Comm: syz-executor Not tainted 4.8.1-0-syzkaller #1
    Call Trace:
     [<ffffffffad8f0868>] ? f_setown+0x1d8/0x200
     [<ffffffffad8f19a9>] ? SyS_fcntl+0x999/0xf30
     [<ffffffffaed1fb00>] ? entry_SYSCALL_64_fastpath+0x23/0xc1
    Fix that by checking the arg parameter properly (against INT_MAX) before
    "who = -who". And return immediatelly with -EINVAL in case it is wrong.
    Note that according to POSIX we can return EINVAL:
            The cmd argument is F_SETOWN and the value of the argument
            is not valid as a process or process group identifier.
    [v2] returns an error, v1 used to fail silently
    [v3] implement proper check for the bad value INT_MIN
    Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
    Cc: Jeff Layton <jlayton@poochiereds.net>
    Cc: "J. Bruce Fields" <bfields@fieldses.org>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Cc: linux-fsdevel@vger.kernel.org
    Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
fcntl.c 16.6 KB