linux-kernel - Shift overflow in acpi_gpe_apply_masked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 20 Oct 2017 19:30:31 +0100
From:   Tvrtko Ursulin <tursulin@...ulin.net>
To:     "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Len Brown <lenb@...nel.org>
Cc:     linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Shift overflow in acpi_gpe_apply_masked_gpes


Hi all,

Triggered with ubsan:

  UBSAN: Undefined behaviour in drivers/acpi/sysfs.c:845:33
  shift exponent 64 is too large for 64-bit type 'long long unsigned int'
  CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.14.0-rc5+ #532
  Hardware name: LENOVO 80MX/Lenovo E31-80, BIOS DCCN34WW(V2.03) 12/01/2015
  Call Trace:
   dump_stack+0xab/0xfe
   ? _atomic_dec_and_lock+0x112/0x112
   ? get_unsigned_val+0x48/0x91
   ubsan_epilogue+0x9/0x49
   __ubsan_handle_shift_out_of_bounds+0x1ea/0x241
   ? __ubsan_handle_load_invalid_value+0x136/0x136
   ? do_raw_spin_unlock+0xf5/0x1d0
   ? do_raw_spin_trylock+0x90/0x90
   ? __lock_is_held+0x71/0x150
   ? _raw_spin_unlock_irqrestore+0x32/0x50
   ? trace_hardirqs_on_caller+0x184/0x360
   ? acpi_gpe_apply_masked_gpes+0x95/0xfd
   acpi_gpe_apply_masked_gpes+0x95/0xfd
   ? acpi_gpe_set_masked_gpes+0xc1/0xc1
   ? acpi_get_table+0xff/0x114
   acpi_scan_init+0x1cf/0x3fe
   ? acpi_match_madt+0xa7/0xa7
   ? bus_register+0x386/0x450
   ? subsys_register.part.1+0x140/0x140
   acpi_init+0x41f/0x492
   ? acpi_sleep_proc_init+0x30/0x30
   ? console_unlock+0x524/0x7a0
   ? trace_hardirqs_on_caller+0x184/0x360
   ? scan_for_dmi_ipmi+0x22/0x202
   ? fb_console_init+0x14f/0x1e6
   ? acpi_sleep_proc_init+0x30/0x30
   do_one_initcall+0xa3/0x256
   ? parameq+0xe0/0xe0
   ? initcall_blacklisted+0x160/0x160
   ? down_write_nested+0x110/0x110
   ? kasan_unpoison_shadow+0x30/0x40
   kernel_init_freeable+0x3ee/0x47f
   ? rest_init+0xf0/0xf0
   kernel_init+0xf/0x140
   ? rest_init+0xf0/0xf0
   ret_from_fork+0x27/0x40

Code is:

#define ACPI_MASKABLE_GPE_MAX	0x80
...
void __init acpi_gpe_apply_masked_gpes(void)
{
	acpi_handle handle;
	acpi_status status;
	u8 gpe;

	for (gpe = 0;
	     gpe < min_t(u8, ACPI_MASKABLE_GPE_MAX, acpi_current_gpe_count);
	     gpe++) {
		if (acpi_masked_gpes & ((u64)1<<gpe)) {
...

Left shift on the last line is bound by ACPI_MASKABLE_GPE_MAX which is 0x80.

Regards,

Tvrtko