linux-kernel - Re: [PATCH] hugetlb: check for undefined shift on 32 bit architectures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 16 Feb 2023 03:08:21 +0100 (CET)
From:   Jesper Juhl <jesperjuhl76@...il.com>
To:     Mike Kravetz <mike.kravetz@...cle.com>
cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Muchun Song <songmuchun@...edance.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Sasha Levin <sashal@...nel.org>,
        Anders Roxell <anders.roxell@...aro.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Naresh Kamboju <naresh.kamboju@...aro.org>,
        stable@...r.kernel.org
Subject: Re: [PATCH] hugetlb: check for undefined shift on 32 bit
 architectures

On Wed, 15 Feb 2023, Mike Kravetz wrote:

> Users can specify the hugetlb page size in the mmap, shmget and
> memfd_create system calls.  This is done by using 6 bits within the
> flags argument to encode the base-2 logarithm of the desired page size.
> The routine hstate_sizelog() uses the log2 value to find the
> corresponding hugetlb hstate structure.  Converting the log2 value
> (page_size_log) to potential hugetlb page size is the simple statement:
>
> 	1UL << page_size_log
>
> Because only 6 bits are used for page_size_log, the left shift can not
> be greater than 63.  This is fine on 64 bit architectures where a long
> is 64 bits.  However, if a value greater than 31 is passed on a 32 bit
> architecture (where long is 32 bits) the shift will result in undefined
> behavior.  This was generally not an issue as the result of the
> undefined shift had to exactly match hugetlb page size to proceed.
>
> Recent improvements in runtime checking have resulted in this undefined
> behavior throwing errors such as reported below.
>
> Fix by comparing page_size_log to BITS_PER_LONG before doing shift.
>
> Reported-by: Naresh Kamboju <naresh.kamboju@...aro.org>
> Link: https://lore.kernel.org/lkml/CA+G9fYuei_Tr-vN9GS7SfFyU1y9hNysnf=PB7kT0=yv4MiPgVg@mail.gmail.com/
> Fixes: 42d7395feb56 ("mm: support more pagesizes for MAP_HUGETLB/SHM_HUGETLB")
> Cc: <stable@...r.kernel.org>
> Signed-off-by: Mike Kravetz <mike.kravetz@...cle.com>

Looks good to me.

Reviewed-by: Jesper Juhl <jesperjuhl76@...il.com>