linux-kernel - [PATCH v2] mm/gfp: cast GFP_ZONE_TABLE entries to long to avoid shift overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <tencent_DAB2E2BC61A449B6AC4FA9798C4D75BED705@qq.com>
Date: Fri, 12 Dec 2025 15:09:16 +0800
From: Yankai Xu <815559068@...com>
To: linux-kernel@...r.kernel.org
Cc: linux-mm@...ck.org,
	akpm@...ux-foundation.org,
	Yankai Xu <815559068@...com>
Subject: [PATCH v2] mm/gfp: cast GFP_ZONE_TABLE entries to long to avoid shift overflow

When a new zone is added to enum zone_type in mmzone.h, the existing
GFP_ZONE_TABLE macro causes a compile-time shift overflow:

  CC      arch/x86/kernel/asm-offsets.s
  In file included from ./include/linux/slab.h:16,
                   from ./include/linux/crypto.h:18,
                   from arch/x86/kernel/asm-offsets.c:9:
  ./include/linux/gfp.h: In function ‘gfp_zone’:
  ./include/linux/gfp.h:132:27: error: left shift count >= width of type [-Werror=shift-count-overflow]
    132 |         | (OPT_ZONE_DMA32 << (___GFP_MOVABLE | ___GFP_DMA32) * GFP_ZONES_SHIFT)\
        |                           ^~
  ./include/linux/gfp.h:157:14: note: in expansion of macro ‘GFP_ZONE_TABLE’
    157 |         z = (GFP_ZONE_TABLE >> (bit * GFP_ZONES_SHIFT)) &
        |

This can be reproduced by adding a new zone:

@@ -868,6 +868,7 @@ enum zone_type {
 #ifdef CONFIG_ZONE_DEVICE
        ZONE_DEVICE,
 #endif
+       ZONE_FOO,
        __MAX_NR_ZONES

 };

This happens because the left-hand side operands of the shifts inside GFP_ZONE_TABLE are enum zone_type, which is of type int. The shift is logically valid because it has been checked by 16 * GFP_ZONES_SHIFT > BITS_PER_LONG previously.

Fixed this by casting each value in GFP_ZONE_TABLE to type long.

Signed-off-by: Yankai Xu <815559068@...com>
---
v2:
  - Added compiler warning messages and reproduce steps
---
 include/linux/gfp.h | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index b155929af..e694f3103 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -122,14 +122,14 @@ static inline bool gfpflags_allow_spinning(const gfp_t gfp_flags)
 #endif

 #define GFP_ZONE_TABLE ( \
-	(ZONE_NORMAL << 0 * GFP_ZONES_SHIFT)				       \
-	| (OPT_ZONE_DMA << ___GFP_DMA * GFP_ZONES_SHIFT)		       \
-	| (OPT_ZONE_HIGHMEM << ___GFP_HIGHMEM * GFP_ZONES_SHIFT)	       \
-	| (OPT_ZONE_DMA32 << ___GFP_DMA32 * GFP_ZONES_SHIFT)		       \
-	| (ZONE_NORMAL << ___GFP_MOVABLE * GFP_ZONES_SHIFT)		       \
-	| (OPT_ZONE_DMA << (___GFP_MOVABLE | ___GFP_DMA) * GFP_ZONES_SHIFT)    \
-	| (ZONE_MOVABLE << (___GFP_MOVABLE | ___GFP_HIGHMEM) * GFP_ZONES_SHIFT)\
-	| (OPT_ZONE_DMA32 << (___GFP_MOVABLE | ___GFP_DMA32) * GFP_ZONES_SHIFT)\
+	((long)ZONE_NORMAL << 0 * GFP_ZONES_SHIFT)				     \
+	| ((long)OPT_ZONE_DMA << ___GFP_DMA * GFP_ZONES_SHIFT)			     \
+	| ((long)OPT_ZONE_HIGHMEM << ___GFP_HIGHMEM * GFP_ZONES_SHIFT)		     \
+	| ((long)OPT_ZONE_DMA32 << ___GFP_DMA32 * GFP_ZONES_SHIFT)		     \
+	| ((long)ZONE_NORMAL << ___GFP_MOVABLE * GFP_ZONES_SHIFT)		     \
+	| ((long)OPT_ZONE_DMA << (___GFP_MOVABLE | ___GFP_DMA) * GFP_ZONES_SHIFT)    \
+	| ((long)ZONE_MOVABLE << (___GFP_MOVABLE | ___GFP_HIGHMEM) * GFP_ZONES_SHIFT)\
+	| ((long)OPT_ZONE_DMA32 << (___GFP_MOVABLE | ___GFP_DMA32) * GFP_ZONES_SHIFT)\
 )

 /*
--
2.43.0