When running static analysis tools to find where signed values could potentially wrap the family of d_path() functions turn out to trigger a lot of mess. In evaluating the code, all of these usages seem safe, but pointer math is involved so if a negative number is ever somehow passed into these functions, memory can be traversed backwards in ways not intended. Resolve all of the abuguity by just making "size" an unsigned value, which takes the guesswork out of everything involved. Reported-by: Jordy Zomer <jordy@pwning.systems> Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> Cc: "Ahmed S. Darwish" <a.darwish@xxxxxxxxxxxxx> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx> Cc: Eric Biggers <ebiggers@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/d_path.c | 14 +++++++------- include/linux/dcache.h | 12 ++++++------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/fs/d_path.c b/fs/d_path.c index 23a53f7b5c71..7876b741a47e 100644 --- a/fs/d_path.c +++ b/fs/d_path.c @@ -182,7 +182,7 @@ static int prepend_path(const struct path *path, */ char *__d_path(const struct path *path, const struct path *root, - char *buf, int buflen) + char *buf, unsigned int buflen) { DECLARE_BUFFER(b, buf, buflen); @@ -193,7 +193,7 @@ char *__d_path(const struct path *path, } char *d_absolute_path(const struct path *path, - char *buf, int buflen) + char *buf, unsigned int buflen) { struct path root = {}; DECLARE_BUFFER(b, buf, buflen); @@ -230,7 +230,7 @@ static void get_fs_root_rcu(struct fs_struct *fs, struct path *root) * * "buflen" should be positive. */ -char *d_path(const struct path *path, char *buf, int buflen) +char *d_path(const struct path *path, char *buf, unsigned int buflen) { DECLARE_BUFFER(b, buf, buflen); struct path root; @@ -266,7 +266,7 @@ EXPORT_SYMBOL(d_path); /* * Helper function for dentry_operations.d_dname() members */ -char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen, +char *dynamic_dname(struct dentry *dentry, char *buffer, unsigned int buflen, const char *fmt, ...) { va_list args; @@ -284,7 +284,7 @@ char *dynamic_dname(struct dentry *dentry, char *buffer, int buflen, return memcpy(buffer, temp, sz); } -char *simple_dname(struct dentry *dentry, char *buffer, int buflen) +char *simple_dname(struct dentry *dentry, char *buffer, unsigned int buflen) { DECLARE_BUFFER(b, buffer, buflen); /* these dentries are never renamed, so d_lock is not needed */ @@ -328,7 +328,7 @@ static char *__dentry_path(const struct dentry *d, struct prepend_buffer *p) return extract_string(&b); } -char *dentry_path_raw(const struct dentry *dentry, char *buf, int buflen) +char *dentry_path_raw(const struct dentry *dentry, char *buf, unsigned int buflen) { DECLARE_BUFFER(b, buf, buflen); @@ -337,7 +337,7 @@ char *dentry_path_raw(const struct dentry *dentry, char *buf, int buflen) } EXPORT_SYMBOL(dentry_path_raw); -char *dentry_path(const struct dentry *dentry, char *buf, int buflen) +char *dentry_path(const struct dentry *dentry, char *buf, unsigned int buflen) { DECLARE_BUFFER(b, buf, buflen); diff --git a/include/linux/dcache.h b/include/linux/dcache.h index 9e23d33bb6f1..1a9838dc66fe 100644 --- a/include/linux/dcache.h +++ b/include/linux/dcache.h @@ -296,13 +296,13 @@ static inline unsigned d_count(const struct dentry *dentry) * helper function for dentry_operations.d_dname() members */ extern __printf(4, 5) -char *dynamic_dname(struct dentry *, char *, int, const char *, ...); +char *dynamic_dname(struct dentry *, char *, unsigned int, const char *, ...); -extern char *__d_path(const struct path *, const struct path *, char *, int); -extern char *d_absolute_path(const struct path *, char *, int); -extern char *d_path(const struct path *, char *, int); -extern char *dentry_path_raw(const struct dentry *, char *, int); -extern char *dentry_path(const struct dentry *, char *, int); +char *__d_path(const struct path *, const struct path *, char *, unsigned int); +char *d_absolute_path(const struct path *, char *, unsigned int); +char *d_path(const struct path *, char *, unsigned int); +char *dentry_path_raw(const struct dentry *, char *, unsigned int); +char *dentry_path(const struct dentry *, char *, unsigned int); /* Allocation counts.. */ -- 2.32.0