NetBSD Problem Report #60097

From www@netbsd.org  Tue Mar 17 07:55:43 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R12" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 118911A9278
	for <gnats-bugs@gnats.NetBSD.org>; Tue, 17 Mar 2026 07:55:43 +0000 (UTC)
Message-Id: <20260317075541.BAF261A9279@mollari.NetBSD.org>
Date: Tue, 17 Mar 2026 07:55:41 +0000 (UTC)
From: imuwoto@gmail.com
Reply-To: imuwoto@gmail.com
To: gnats-bugs@NetBSD.org
Subject: seemingly unsafe usage of round_page(off_t)
X-Send-Pr-Version: www-1.0
X-From4GNATS: "imuwoto@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60097
>Category:       kern
>Synopsis:       seemingly unsafe usage of round_page(off_t)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Mar 17 08:00:00 +0000 2026
>Originator:     YAMAMOTO Takashi
>Release:        -current
>Organization:
>Environment:
>Description:
the kernel often uses round_pages() macro on off_t/voff_t
to pass VOP_PUTPAGES and similar functions.

because off_t/voff_t is signed, "+ PAGE_MASK" in round_page()
can overflow, which is an UD, and typical compilers returns a negative
value, which is not safe to pass to VOP_PUTPAGES and similar apis.

similar roundup macros like ffs_blkroundup may have similar issues.

>How-To-Repeat:

>Fix:
for VOP_PUTPAGES arguments, i was thinking about something like the following:

+/*
+ * macros to round/trunc off_t/voff_t for VOP_PUTPAGES and similar
+ * functions.
+ *
+ * note that, because off_t/voff_t is signed, "+ PAGE_MASK" in round_page()
+ * can overflow, which is an UD, and typical compilers returns a negative
+ * value, which is not safe to pass to VOP_PUTPAGES and similar apis.
+ * off_round_page() detects such a case and returns 0, which means
+ * "up to the end of the object" for VOP_PUTPAGES and similar apis.
+ * off_trunc_page() is just for a symmetry.
+ */
+#define        off_round_page(x)       ((x) <= INT64_MAX - PAGE_MASK ? ((x) + PAGE_MASK) & ~PAGE_MASK : 0)
+#define        off_trunc_page(x)       (((x) & ~PAGE_MASK))

but i guess the problem is not only about VOP_PUTPAGES.

iirc, ffs's max file size is far smaller than INT64_MAX.
maybe we can reject user requests which exceeds the value
before entering file systems.
eg. by checking cached value of _PC_FILESIZEBITS.

Home	PR Database Search