fs/ext4/ioctl.c:1576 ext4_ioctl_set_lufid() warn: impossible condition '(lufid_args.esl_name_len > 255) => (1-255 > 255)'
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] TO: Artem Blagodarenko <[email protected]> CC: 0day robot <[email protected]> CC: Andreas Dilger <[email protected]> tree: https://github.com/intel-lab-lkp/linux/commits/Artem-Blagodarenko/ext4-validate-count-against-limit-in-ext4_dx_csum_verify-_set/20260804-043122 head: 9865af268fb3a85241b9a3ee14a37281da3a4885 commit: 9865af268fb3a85241b9a3ee14a37281da3a4885 ext4: Add EXT4_IOC_SET_LUFID ioctl for setting LUFID on directory entries date: 27 hours ago :::::: branch date: 27 hours ago :::::: commit date: 27 hours ago config: i386-randconfig-141 (https://download.01.org/0day-ci/archive/20260805/[email protected]/config) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 smatch: v0.5.0-9187-g5189e3fb If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ smatch warnings: fs/ext4/ioctl.c:1576 ext4_ioctl_set_lufid() warn: impossible condition '(lufid_args.esl_name_len > 255) => (1-255 > 255)' fs/ext4/namei.c:2465 add_dirent_to_buf() error: we previously assumed 'de' could be null (see line 2441) vim +1576 fs/ext4/ioctl.c 04a91570ac6776 Theodore Ts'o 2025-09-16 1537 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1538 /* 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1539 * ext4_ioctl_set_lufid() - Set LUFID on a directory entry 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1540 * @filp: file pointer (parent directory) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1541 * @arg: pointer to ext4_set_lufid structure with filename and LUFID data 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1542 * 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1543 * This ioctl allows setting LUFID data on an existing 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1544 * directory entry. It is called on the parent directory with a filename and 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1545 * LUFID data. 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1546 */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1547 static long ext4_ioctl_set_lufid(struct file *filp, unsigned long arg) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1548 { 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1549 struct inode *dir = file_inode(filp); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1550 struct mnt_idmap *idmap = file_mnt_idmap(filp); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1551 struct ext4_set_lufid lufid_args; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1552 struct { 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1553 __u32 edp_magic; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1554 struct ext4_dirent_data_header df_header; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1555 char df_fid[255]; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1556 } edp; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1557 int err; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1558 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1559 /* Check if parent is a directory */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1560 if (!S_ISDIR(dir->i_mode)) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1561 return -ENOTDIR; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1562 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1563 /* This ioctl mutates directory entries; merely having the directory 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1564 * open (which only ever requires read access) is not enough. 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1565 * MAY_EXEC is required for entry lookup; MAY_WRITE for modification. */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1566 err = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1567 if (err) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1568 return err; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1569 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1570 /* Copy arguments from user space */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1571 if (copy_from_user(&lufid_args, (struct ext4_set_lufid __user *)arg, 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1572 sizeof(lufid_args))) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1573 return -EFAULT; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1574 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1575 /* Validate parameters. esl_name_len is NUL-excluded length (1-255). */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 @1576 if (lufid_args.esl_name_len == 0 || lufid_args.esl_name_len > EXT4_NAME_LEN) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1577 return -EINVAL; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1578 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1579 /* ddh_length (esl_data_len + the header byte below) must itself fit 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1580 * in the __u8 ddh_length field without wrapping */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1581 if (lufid_args.esl_data_len == 0 || 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1582 lufid_args.esl_data_len > 255 - sizeof(edp.df_header)) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1583 return -EINVAL; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1584 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1585 /* Ensure filename is NUL-terminated at exactly esl_name_len */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1586 if (lufid_args.esl_name[lufid_args.esl_name_len] != '\0') 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1587 return -EINVAL; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1588 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1589 /* '.' and '..' are not ordinary entries -- they must stay the first 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1590 * two entries in the directory's first block, so they can't go 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1591 * through the general delete+re-add path this ioctl uses */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1592 if (!strcmp(lufid_args.esl_name, ".") || !strcmp(lufid_args.esl_name, "..")) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1593 return -EINVAL; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1594 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1595 /* Prepare the dentry param struct with LUFID data. ddh_length is 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1596 * documented (see struct ext4_dirent_data_header) as the length of 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1597 * the header plus the whole data blob -- include the header here so 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1598 * every dirdata reader/writer that takes ddh_length at face value 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1599 * (e.g. ext4_dirdata_set()'s memcpy) copies the full LUFID payload 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1600 * instead of silently dropping its last byte. */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1601 edp.edp_magic = EXT4_LUFID_MAGIC; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1602 edp.df_header.ddh_length = lufid_args.esl_data_len + 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1603 sizeof(edp.df_header); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1604 memcpy(edp.df_fid, lufid_args.esl_data, lufid_args.esl_data_len); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1605 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1606 /* Want write access */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1607 err = mnt_want_write_file(filp); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1608 if (err) 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1609 return err; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1610 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1611 /* Call the helper function to do the actual work */ 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1612 err = ext4_dirdata_set_lufid(idmap, dir, lufid_args.esl_name, 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1613 lufid_args.esl_name_len, 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1614 (struct ext4_dentry_param *)&edp); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1615 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1616 mnt_drop_write_file(filp); 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1617 return err; 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1618 } 9865af268fb3a8 Artem Blagodarenko 2026-07-31 1619 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki