linux-kernel - Re: [PATCH v3] hugetlbfs: Fix integer overflow check in hugetlbfs_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <202307241509.546e3574-oliver.sang@intel.com>
Date:   Mon, 24 Jul 2023 16:11:01 +0800
From:   kernel test robot <oliver.sang@...el.com>
To:     Linke Li <lilinke99@...mail.com>
CC:     <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-mm@...ck.org>,
        <mike.kravetz@...cle.com>, <muchun.song@...ux.dev>,
        <nathan@...nel.org>, <ndesaulniers@...gle.com>, <trix@...hat.com>,
        <linux-kernel@...r.kernel.org>, <llvm@...ts.linux.dev>,
        <dan.carpenter@...aro.org>, Linke Li <lilinke99@...il.com>,
        <oliver.sang@...el.com>
Subject: Re: [PATCH v3] hugetlbfs: Fix integer overflow check in
 hugetlbfs_file_mmap()



Hello,

kernel test robot noticed "WARNING:at_mm/hugetlb.c:#hugetlb_reserve_pages" on:

commit: c5ffbcff59bdefdc2f54a0d12955da6e3fe79e21 ("[PATCH v3] hugetlbfs: Fix integer overflow check in hugetlbfs_file_mmap()")
url: https://github.com/intel-lab-lkp/linux/commits/Linke-Li/hugetlbfs-Fix-integer-overflow-check-in-hugetlbfs_file_mmap/20230720-225128
base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git bfa3037d828050896ae52f6467b6ca2489ae6fb1
patch link: https://lore.kernel.org/all/tencent_C2D6865561F23A8141BB145149ACC682B408@qq.com/
patch subject: [PATCH v3] hugetlbfs: Fix integer overflow check in hugetlbfs_file_mmap()

in testcase: trinity
version: trinity-i386-abe9de86-1_20230429
with following parameters:

	runtime: 300s
	group: group-04
	nr_groups: 5

test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/


compiler: clang-15
test machine: qemu-system-i386 -enable-kvm -cpu SandyBridge -smp 2 -m 4G

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@...el.com>
| Closes: https://lore.kernel.org/oe-lkp/202307241509.546e3574-oliver.sang@intel.com



[   39.198826][ T3397] ------------[ cut here ]------------
[   39.199142][ T3397] hugetlb_reserve_pages called with a negative range
[   39.199541][ T3397] WARNING: CPU: 0 PID: 3397 at mm/hugetlb.c:6852 hugetlb_reserve_pages+0x39/0x410
[   39.200009][ T3397] Modules linked in:
[   39.200211][ T3397] CPU: 0 PID: 3397 Comm: trinity-main Not tainted 6.5.0-rc2-00053-gc5ffbcff59bd #1
[   39.200711][ T3397] EIP: hugetlb_reserve_pages+0x39/0x410
[   39.200992][ T3397] Code: 80 cc 03 00 00 8b 58 34 8b 40 38 c7 45 e4 00 00 00 00 89 cf 29 d7 7d 24 68 28 48 ca 82 68 43 ec bd 82 e8 3a 9a e2 ff 83 c4
08 <0f> 0b 31 db 89 d8 83 c4 18 5e 5f 5b 5d 31 c9 31 d2 c3 89 55 e0 89
[   39.201989][ T3397] EAX: 00000000 EBX: 83cdb4a8 ECX: 00000000 EDX: 00000000
[   39.202347][ T3397] ESI: ec0002d8 EDI: ffffffff EBP: ec7d9dc8 ESP: ec7d9da4
[   39.202749][ T3397] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010292
[   39.203139][ T3397] CR0: 80050033 CR2: 01100000 CR3: 6b83c000 CR4: 00040690
[   39.203534][ T3397] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[   39.203893][ T3397] DR6: fffe0ff0 DR7: 00000400
[   39.204132][ T3397] Call Trace:
[   39.204302][ T3397]  ? show_regs+0x4d/0x60
[   39.204553][ T3397]  ? hugetlb_reserve_pages+0x39/0x410
[   39.204827][ T3397]  ? __warn+0xa2/0x180
[   39.205036][ T3397]  ? hugetlb_reserve_pages+0x39/0x410
[   39.205308][ T3397]  ? hugetlb_reserve_pages+0x39/0x410
[   39.205613][ T3397]  ? report_bug+0x96/0x120
[   39.205845][ T3397]  ? vprintk_emit+0x6b/0x120
[   39.206082][ T3397]  ? exc_overflow+0x40/0x40
[   39.206315][ T3397]  ? handle_bug+0x29/0x50
[   39.206569][ T3397]  ? exc_invalid_op+0x17/0x40
[   39.206816][ T3397]  ? handle_exception+0x115/0x115
[   39.207075][ T3397]  ? exc_overflow+0x40/0x40
[   39.207307][ T3397]  ? hugetlb_reserve_pages+0x39/0x410
[   39.207612][ T3397]  ? exc_overflow+0x40/0x40
[   39.207852][ T3397]  ? hugetlb_reserve_pages+0x39/0x410
[   39.208126][ T3397]  ? hugetlbfs_file_mmap+0xb3/0x1b0
[   39.208392][ T3397]  hugetlbfs_file_mmap+0x116/0x1b0
[   39.208689][ T3397]  mmap_region+0x4c1/0x930
[   39.208918][ T3397]  ? vm_unmapped_area+0x1be/0x2b0
[   39.209183][ T3397]  do_mmap+0x352/0x4f0
[   39.209396][ T3397]  vm_mmap_pgoff+0x80/0x100
[   39.209659][ T3397]  ksys_mmap_pgoff+0x1aa/0x290
[   39.209907][ T3397]  __ia32_sys_mmap_pgoff+0x1c/0x30
[   39.210168][ T3397]  __do_fast_syscall_32+0x90/0xe0
[   39.210425][ T3397]  ? lockdep_hardirqs_on+0x85/0x110
[   39.210720][ T3397]  do_fast_syscall_32+0x28/0x60
[   39.210973][ T3397]  do_SYSENTER_32+0x12/0x20
[   39.211204][ T3397]  entry_SYSENTER_32+0xa6/0x10c
[   39.211452][ T3397] EIP: 0x77fb6539
[   39.211668][ T3397] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00
[   39.212668][ T3397] EAX: ffffffda EBX: 00000000 ECX: 00001000 EDX: 00000001
[   39.213024][ T3397] ESI: 00050022 EDI: 00000023 EBP: 00000000 ESP: 7ff736bc
[   39.213379][ T3397] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000246
[   39.213794][ T3397] irq event stamp: 2287591
[   39.214020][ T3397] hardirqs last  enabled at (2287599): [<8108610a>] __up_console_sem+0x5a/0x70
[   39.214468][ T3397] hardirqs last disabled at (2287606): [<810860f1>] __up_console_sem+0x41/0x70
[   39.214944][ T3397] softirqs last  enabled at (2287262): [<81007a66>] do_softirq_own_stack+0x26/0x30
[   39.215410][ T3397] softirqs last disabled at (2287253): [<81007a66>] do_softirq_own_stack+0x26/0x30
[   39.215891][ T3397] ---[ end trace 0000000000000000 ]---



To reproduce:

        # build kernel
	cd linux
	cp config-6.5.0-rc2-00053-gc5ffbcff59bd .config
	make HOSTCC=clang-15 CC=clang-15 ARCH=i386 olddefconfig prepare modules_prepare bzImage modules
	make HOSTCC=clang-15 CC=clang-15 ARCH=i386 INSTALL_MOD_PATH=<mod-install-dir> modules_install
	cd <mod-install-dir>
	find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz


        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email

        # if come across any failure that blocks the test,
        # please remove ~/.lkp and /lkp dir to run from a clean state.



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki



View attachment "config-6.5.0-rc2-00053-gc5ffbcff59bd" of type "text/plain" (149362 bytes)

View attachment "job-script" of type "text/plain" (4981 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (22884 bytes)

View attachment "trinity" of type "text/plain" (10216 bytes)