lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 027/410] hugetlbfs: fix offset overflow in hugetlbfs mmap
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mike Kravetz <mike.kravetz@oracle.com>

    commit 045c7a3f53d9403b62d396b6d051c4be5044cdb4 upstream.

    If mmap() maps a file, it can be passed an offset into the file at which
    the mapping is to start. Offset could be a negative value when
    represented as a loff_t. The offset plus length will be used to update
    the file size (i_size) which is also a loff_t.

    Validate the value of offset and offset + length to make sure they do
    not overflow and appear as negative.

    Found by syzcaller with commit ff8c0c53c475 ("mm/hugetlb.c: don't call
    region_abort if region_chg fails") applied. Prior to this commit, the
    overflow would still occur but we would luckily return ENOMEM.

    To reproduce:

    mmap(0, 0x2000, 0, 0x40021, 0xffffffffffffffffULL, 0x8000000000000000ULL);

    Resulted in,

    kernel BUG at mm/hugetlb.c:742!
    Call Trace:
    hugetlbfs_evict_inode+0x80/0xa0
    evict+0x24a/0x620
    iput+0x48f/0x8c0
    dentry_unlink_inode+0x31f/0x4d0
    __dentry_kill+0x292/0x5e0
    dput+0x730/0x830
    __fput+0x438/0x720
    ____fput+0x1a/0x20
    task_work_run+0xfe/0x180
    exit_to_usermode_loop+0x133/0x150
    syscall_return_slowpath+0x184/0x1c0
    entry_SYSCALL_64_fastpath+0xab/0xad

    Fixes: ff8c0c53c475 ("mm/hugetlb.c: don't call region_abort if region_chg fails")
    Link: http://lkml.kernel.org/r/1491951118-30678-1-git-send-email-mike.kravetz@oracle.com
    Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
    Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
    Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/hugetlbfs/inode.c | 15 ++++++++++++---
    1 file changed, 12 insertions(+), 3 deletions(-)

    --- a/fs/hugetlbfs/inode.c
    +++ b/fs/hugetlbfs/inode.c
    @@ -115,17 +115,26 @@ static int hugetlbfs_file_mmap(struct fi
    vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
    vma->vm_ops = &hugetlb_vm_ops;

    + /*
    + * Offset passed to mmap (before page shift) could have been
    + * negative when represented as a (l)off_t.
    + */
    + if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0)
    + return -EINVAL;
    +
    if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
    return -EINVAL;

    vma_len = (loff_t)(vma->vm_end - vma->vm_start);
    + len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
    + /* check for overflow */
    + if (len < vma_len)
    + return -EINVAL;

    mutex_lock(&inode->i_mutex);
    file_accessed(file);

    ret = -ENOMEM;
    - len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
    -
    if (hugetlb_reserve_pages(inode,
    vma->vm_pgoff >> huge_page_order(h),
    len >> huge_page_shift(h), vma,
    @@ -135,7 +144,7 @@ static int hugetlbfs_file_mmap(struct fi
    ret = 0;
    hugetlb_prefault_arch_hook(vma->vm_mm);
    if (vma->vm_flags & VM_WRITE && inode->i_size < len)
    - inode->i_size = len;
    + i_size_write(inode, len);
    out:
    mutex_unlock(&inode->i_mutex);

    \
     
     \ /
      Last update: 2018-06-07 18:09    [W:4.214 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site