lkml.org 
[lkml]   [2018]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.16 38/68] lib: fix stall in __bitmap_parselist()
    Date
    4.16-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Yury Norov <ynorov@caviumnetworks.com>

    commit 8351760ff5b2042039554b4948ddabaac644a976 upstream.

    syzbot is catching stalls at __bitmap_parselist()
    (https://syzkaller.appspot.com/bug?id=ad7e0351fbc90535558514a71cd3edc11681997a).
    The trigger is

    unsigned long v = 0;
    bitmap_parselist("7:,", &v, BITS_PER_LONG);

    which results in hitting infinite loop at

    while (a <= b) {
    off = min(b - a + 1, used_size);
    bitmap_set(maskp, a, off);
    a += group_size;
    }

    due to used_size == group_size == 0.

    Link: http://lkml.kernel.org/r/20180404162647.15763-1-ynorov@caviumnetworks.com
    Fixes: 0a5ce0831d04382a ("lib/bitmap.c: make bitmap_parselist() thread-safe and much faster")
    Signed-off-by: Yury Norov <ynorov@caviumnetworks.com>
    Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Reported-by: syzbot <syzbot+6887cbb011c8054e8a3d@syzkaller.appspotmail.com>
    Cc: Noam Camus <noamca@mellanox.com>
    Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
    Cc: Matthew Wilcox <mawilcox@microsoft.com>
    Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    lib/bitmap.c | 2 +-
    lib/test_bitmap.c | 4 ++++
    2 files changed, 5 insertions(+), 1 deletion(-)

    --- a/lib/bitmap.c
    +++ b/lib/bitmap.c
    @@ -607,7 +607,7 @@ static int __bitmap_parselist(const char
    /* if no digit is after '-', it's wrong*/
    if (at_start && in_range)
    return -EINVAL;
    - if (!(a <= b) || !(used_size <= group_size))
    + if (!(a <= b) || group_size == 0 || !(used_size <= group_size))
    return -EINVAL;
    if (b >= nmaskbits)
    return -ERANGE;
    --- a/lib/test_bitmap.c
    +++ b/lib/test_bitmap.c
    @@ -255,6 +255,10 @@ static const struct test_bitmap_parselis
    {-EINVAL, "-1", NULL, 8, 0},
    {-EINVAL, "-0", NULL, 8, 0},
    {-EINVAL, "10-1", NULL, 8, 0},
    + {-EINVAL, "0-31:", NULL, 8, 0},
    + {-EINVAL, "0-31:0", NULL, 8, 0},
    + {-EINVAL, "0-31:0/0", NULL, 8, 0},
    + {-EINVAL, "0-31:1/0", NULL, 8, 0},
    {-EINVAL, "0-31:10/1", NULL, 8, 0},
    };


    \
     
     \ /
      Last update: 2018-04-17 19:06    [W:3.385 / U:0.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site