From: Steven Rostedt <[email protected]> Sashiko has complained about out of bounds issues if ctx->pos isn't what is expected in __eventfs_iterate()[1]. This would be an issue if the logic that calls __eventfs_iterate() didn't already prevent the code from going out of bounds.
The issue Sashiko brings up is if a user uses lseek64() to put in a position like 0x100000000 which will overflow the integer used to iterate the files. This should never be an issue because both tracefs and eventfs uses the default "maxbytes" for its superblock "s_maxbytes" field which is defined as: fs/super.c: s->s_maxbytes = MAX_NON_LFS; include/linux/fs.h:#define MAX_NON_LFS ((1UL<<31) - 1) Where MAX_NON_LFS turns into 0x7fffffff. Testing this with code to try to pass 0x100000000 to lseek64() to a eventfs directory returns -EINVAL. But relying on logic for the integrity of a function is not very robust. Add a WARN_ON_ONCE() in case the ctx->pos is out of the expected range. [1] https://sashiko.dev/#/patchset/20260810160708.3460a2fd%40gandalf.local.home Signed-off-by: Steven Rostedt <[email protected]> --- fs/tracefs/event_inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index be21b8510c14..ee5d03e403ec 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -696,6 +696,10 @@ static int __eventfs_iterate(struct file *file, struct dir_context *ctx, bool ro if (!(ti->flags & TRACEFS_EVENT_INODE)) return -EINVAL; + /* Logic should prevent ctx->pos from going out of range */ + if (WARN_ON_ONCE(ctx->pos < 2 || ctx->pos > 0x7fffffffULL)) + return -EINVAL; + c = ctx->pos - 2; guard(srcu)(&eventfs_srcu); -- 2.53.0
