fs/exec.c:745 transfer_args_to_stack() error: buffer overflow 'bprm->page' 32 <= 32

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Christian Brauner <[email protected]>
CC: "David Hildenbrand (Arm)" <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   62cc90241548d5570ee68e01aaba6506964e9811
commit: 16cc4f5c1c4b9e45eca7f7deefa5410a292db599 exec: fix unsigned loop counter wrap in transfer_args_to_stack()
date:   7 days ago
:::::: branch date: 13 hours ago
:::::: commit date: 7 days ago
config: arm-randconfig-r072-20260728 (https://download.01.org/0day-ci/archive/20260728/[email protected]/config)
compiler: arm-linux-gnueabi-gcc (GCC) 12.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 16cc4f5c1c4b ("exec: fix unsigned loop counter wrap in transfer_args_to_stack()")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
fs/exec.c:745 transfer_args_to_stack() error: buffer overflow 'bprm->page' 32 <= 32

vim +745 fs/exec.c

7e7ec6a934349ef Nicolas Pitre         2016-07-24  729  
7e7ec6a934349ef Nicolas Pitre         2016-07-24  730  /*
7e7ec6a934349ef Nicolas Pitre         2016-07-24  731   * Transfer the program arguments and environment from the holding pages
7e7ec6a934349ef Nicolas Pitre         2016-07-24  732   * onto the stack. The provided stack pointer is adjusted accordingly.
7e7ec6a934349ef Nicolas Pitre         2016-07-24  733   */
7e7ec6a934349ef Nicolas Pitre         2016-07-24  734  int transfer_args_to_stack(struct linux_binprm *bprm,
7e7ec6a934349ef Nicolas Pitre         2016-07-24  735  			   unsigned long *sp_location)
7e7ec6a934349ef Nicolas Pitre         2016-07-24  736  {
7e7ec6a934349ef Nicolas Pitre         2016-07-24  737  	unsigned long index, stop, sp;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  738  	int ret = 0;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  739  
7e7ec6a934349ef Nicolas Pitre         2016-07-24  740  	stop = bprm->p >> PAGE_SHIFT;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  741  	sp = *sp_location;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  742  
16cc4f5c1c4b9e4 Christian Brauner     2026-07-21  743  	for (index = MAX_ARG_PAGES; index-- > stop; ) {
7e7ec6a934349ef Nicolas Pitre         2016-07-24  744  		unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0;
3a608cfee97e99b Fabio M. De Francesco 2022-08-03 @745  		char *src = kmap_local_page(bprm->page[index]) + offset;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  746  		sp -= PAGE_SIZE - offset;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  747  		if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0)
7e7ec6a934349ef Nicolas Pitre         2016-07-24  748  			ret = -EFAULT;
3a608cfee97e99b Fabio M. De Francesco 2022-08-03  749  		kunmap_local(src);
7e7ec6a934349ef Nicolas Pitre         2016-07-24  750  		if (ret)
7e7ec6a934349ef Nicolas Pitre         2016-07-24  751  			goto out;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  752  	}
7e7ec6a934349ef Nicolas Pitre         2016-07-24  753  
2aea94ac14d1e0a Max Filippov          2024-03-20  754  	bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  755  	*sp_location = sp;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  756  
7e7ec6a934349ef Nicolas Pitre         2016-07-24  757  out:
7e7ec6a934349ef Nicolas Pitre         2016-07-24  758  	return ret;
7e7ec6a934349ef Nicolas Pitre         2016-07-24  759  }
7e7ec6a934349ef Nicolas Pitre         2016-07-24  760  EXPORT_SYMBOL(transfer_args_to_stack);
7e7ec6a934349ef Nicolas Pitre         2016-07-24  761  

:::::: The code at line 745 was first introduced by commit
:::::: 3a608cfee97e99b3fff9ffe62246a098042e725d exec: Replace kmap{,_atomic}() with kmap_local_page()

:::::: TO: Fabio M. De Francesco <[email protected]>
:::::: CC: Kees Cook <[email protected]>

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki