From nobody Sun Nov 01 20:25:37 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jHmYY4mqdz6xsKy for ; Sun, 01 Nov 2026 20:25:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jHmYY4B95z4NVQ for ; Sun, 01 Nov 2026 20:25:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793564737; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MLlayKK0Oeq6JEV9Bs9Hniopxcu/ODw0oTcR1orwqTg=; b=sKJ8jIh2rBOFj7gaplaQCbNWR8nuz44u01oIB14ZL65WA+81cJ24teqvGy0zaAnkrJ/4r4 /HNYRKd4gM7KCIV9WABr8GtClJ2IUIZr60XhzsuS0O5qIrwVHvm0jJL2SZa2yZ8fREgNaL EMVAJC4b/XTPFXgLK2wZeIKiZCbt1Ky/VPrFJKZwSTLmVgz9kPpDXYnNi/kdzMJrdADVpa x7RygYx/DmkN9keDb+Bp8DDXrhv5jZRMR18z+Ruv53kkDKIJXu9LtP1I69H5eqJ/ND0ytb 8RFtQqvBThXczFF49L2r7f+KF8+M5XHX7CUBHCZiOFkWe7y8vC7mzOMjlI1SBg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793564737; b=PAA4S2Lf2X3XPRTp4gu5z0TgvuzQoziNElfrAQtjyAAMb5tuz1FaRsrPC6I0NPXQdU3kNl +7MTM5KkzlOuzkIxWDWTYoONjQsKorzAEOQio/4yWaMYr8PJvi4+X5lciQBPc7g5WZ+Sfk Jo2mtBQjDt5hEqj0QQT7NWEImIZHMQVFO+RKsK/kUSmh4wQkIvYEcx6jcDKuXZKn/RQVbO 83nsCt9xZf3VYRqEeaMOX+Igs/Lkppsg6uC3rY4sgk5Qtl9p9QPPh26kx1uH/Cw/TDTrqX 1CHontGVr/GmiWVB7k4BN68IpPFtXYaLY00z/9ZIiqmI5bP7uhoDJtwpNElsdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793564737; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=MLlayKK0Oeq6JEV9Bs9Hniopxcu/ODw0oTcR1orwqTg=; b=v+wxWIG4xs5+Tx/Eun++ovHKAPEffG01KsggEGo1XHCpKvKSg+vEu9SZKYXwwvxV4yD9vY gSud3bFbWl1DCkMPBY3qxaMfNDya0nsl61P5vhTDCeYQeC8Gdw0WYt88tzGEYbE4MbvOeu zAHbqfAY2GQMI3ya/+hLghdolkHSq+zmfsEoWllzKCbW5nNBr9qNP6EcPw1WTVjRx4F6eL B+EgW94RLaf1+2G2zkRaNAXVU/zIXHe93118Yd1AvCKwIGTNcszC+nn7kRvyngjTFJAQei JDe+pH8syFwgY0qGNln5a8luu32q+gV2Uju5dI/yyHrxduc+LfsfCm2QCCh08Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jHmYY3rFkz1CsL for ; Sun, 01 Nov 2026 20:25:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 36d4f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 01 Nov 2026 20:25:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Dag-Erling=?utf-8?Q? Sm=C3=B8rg?=rav Subject: git: b487aca48535 - main - vfs: Avoid integer overflow when faulting List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: des X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b487aca48535e5f04e4913447fcbe33f1bf56c68 Auto-Submitted: auto-generated Date: Sun, 01 Nov 2026 20:25:37 +0000 Message-Id: <6ae7a041.36d4f.35569c3f@gitrepo.freebsd.org> The branch main has been updated by des: URL: https://cgit.FreeBSD.org/src/commit/?id=b487aca48535e5f04e4913447fcbe33f1bf56c68 commit b487aca48535e5f04e4913447fcbe33f1bf56c68 Author: Dag-Erling Smørgrav AuthorDate: 2026-11-01 20:09:50 +0000 Commit: Dag-Erling Smørgrav CommitDate: 2026-11-01 20:09:50 +0000 vfs: Avoid integer overflow when faulting In vn_io_fault1(), the read / write length can easily exceed INT_MAX. Passing it directly to uiomove(), which expects an int, results in a negative uio_resid, which to the caller looks like we read more than was requested. PR: 298159 MFC after: 1 week Reviewed by: olce, kib Differential Revision: https://reviews.freebsd.org/D59412 --- sys/kern/vfs_vnops.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index 96b1c5696251..0bb8bfffec85 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -1531,7 +1531,7 @@ vn_io_fault1(struct vnode *vp, struct uio *uio, struct vn_io_fault_args *args, vm_page_t *prev_td_ma; vm_prot_t prot; vm_offset_t addr, end; - size_t len, resid; + size_t len; ssize_t adv; int error, cnt, saveheld, prev_td_ma_cnt; @@ -1553,7 +1553,6 @@ vn_io_fault1(struct vnode *vp, struct uio *uio, struct vn_io_fault_args *args, * point using UIO_NOCOPY below. */ uio_clone = cloneuio(uio); - resid = uio->uio_resid; short_uio.uio_segflg = UIO_USERSPACE; short_uio.uio_rw = uio->uio_rw; @@ -1563,9 +1562,15 @@ vn_io_fault1(struct vnode *vp, struct uio *uio, struct vn_io_fault_args *args, if (error != EFAULT) goto out; + /* + * Advance clone to the redo point. + */ atomic_add_long(&vn_io_faults_cnt, 1); uio_clone->uio_segflg = UIO_NOCOPY; - uiomove(NULL, resid - uio->uio_resid, uio_clone); + while (uio_clone->uio_resid > uio->uio_resid) { + len = MIN(uio_clone->uio_resid - uio->uio_resid, INT_MAX); + uiomove(NULL, len, uio_clone); + } uio_clone->uio_segflg = uio->uio_segflg; saveheld = curthread_pflags_set(TDP_UIOHELD); @@ -1629,6 +1634,7 @@ vn_io_fault1(struct vnode *vp, struct uio *uio, struct vn_io_fault_args *args, curthread_pflags_restore(saveheld); out: freeuio(uio_clone); + MPASS(uio->uio_resid >= 0); return (error); }