Re: [PATCH] fs: fix overflow check in rw_verify_area()

[Matteo Croce]

Il giorno ven 19 dic 2025 alle ore 13:53 Matteo Croce
<technoboy85@xxxxxxxxx> ha scritto:
>
> The overflow check in rw_verify_area() can itself overflow when
> pos + count > LLONG_MAX, causing the sum to wrap to a negative value
> and incorrectly return -EINVAL.
>
> This can be reproduced easily by creating a 20 MB file and reading it
> via splice() and a size of 0x7FFFFFFFFF000000. The syscall fails
> when the file pos reaches 16 MB.
>
> splice(3, NULL, 6, NULL, 9223372036837998592, 0) = 262144
> splice(3, NULL, 6, NULL, 9223372036837998592, 0) = 262144
> splice(3, NULL, 6, NULL, 9223372036837998592, 0) = -1 EINVAL (Invalid argument)
>
> This can probably be triggered in other ways given that coreutils often
> uses SSIZE_MAX as size argument[1][2]
>
> [1] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/src/cat.c?h=v9.9#n505
> [2] https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/src/copy-file-data.c?h=v9.9#n130
> ---

I've found a simple shell reproducer, it might be worth adding it to
the commit message if the patch is considered for apply:

$ truncate -s $((2**63 - 1)) hugefile
$ dd if=hugefile bs=1M skip=$((2**43 - 2))
dd: error reading 'hugefile': Invalid argument
1+0 records in
1+0 records out
1048576 bytes (1,0 MB, 1,0 MiB) copied, 0,103536 s, 10,1 MB/s

Thanks,
-- 
Matteo Croce

perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay